Introduction to the practice of statistics, (3rd edition), by David S. Moore and George P. McCabe. Pp. 825 (with appendices and CD-ROM). £27.95. 1999. ISBN 0 7167 3502 4 (W. H. Freeman).

An increasing number of wireless applications rely on GPS signals for localization, navigation, and time synchronization. However, civilian GPS signals are known to be susceptible to spoofing attacks which make GPS receivers in range believe that they reside at locations different than their real physical locations. In this paper, we investigate the requirements for successful GPS spoofing attacks on individuals and groups of victims with civilian or military GPS receivers. In particular, we are interested in identifying from which locations and with which precision the attacker needs to generate its signals in order to successfully spoof the receivers. We will show, for example, that any number of receivers can easily be spoofed to one arbitrary location; however, the attacker is restricted to only few transmission locations when spoofing a group of receivers while preserving their constellation. In addition, we investigate the practical aspects of a satellite-lock takeover, in which a victim receives spoofed signals after first being locked on to legitimate GPS signals. Using a civilian GPS signal generator, we perform a set of experiments and find the minimal precision of the attacker's spoofing signals required for covert satellite-lock takeover.

/pdf/on-the-requirements-for-successful-gps-spoofing-attacks-zqco3kdke2.pdf

On the requirements for successful GPS spoofing attacks

Global navigation satellite signals can be spoofed by false signals, but special receivers can provide defenses against such attacks. The development of good spoofing defenses requires an understanding of the possible attack modes of a spoofer and the properties of those modes that can be exploited for defense purposes. Sets of attack methods and defense methods are described in detail. An attack/defense matrix is developed that documents which defense techniques are effective against the various attack techniques. Recommendations are generated to improve the offerings of commercial off-the-shelf receivers from the current situation, a complete lack of spoofing defenses, to a situation in which various levels of defense are present, some that add significant security for relatively little additional cost and others that add more security at costs that start to become appreciable.

GNSS Spoofing and Detection

Article deposited according to Hindawi Publishing Corporation policy for the International Journal of Navigation and Observation: http://www.hindawi.com/journals/ijno/guidelines/, August 22, 2012.

/pdf/gps-vulnerability-to-spoofing-threats-and-a-review-of-16e256lzgo.pdf

GPS Vulnerability to Spoofing Threats and a Review of Antispoofing Techniques

Many operations in power grids, such as fault detection and event location estimation, depend on precise timing information. In this paper, a novel Time Synchronization Attack (TSA) is proposed to attack the timing information in smart grid. Since many applications in smart grid utilize synchronous measurements and most of the measurement devices are equipped with global positioning system (GPS) for precise timing, it is highly probable to attack the measurement system by spoofing the GPS. The effectiveness of TSA is demonstrated for three applications of phasor measurement unit (PMU) in smart grid, namely transmission line fault detection, voltage stability monitoring and event locationing. The validity of TSA is demonstrated by numerical simulations.

Time Synchronization Attack in Smart Grid: Impact and Analysis

Due to the large amount of different new applications based on GNSS systems, the issue of interference monitoring is becoming an increasing concern in the satellite navigation community. Threats for GNSS can be classified as unintentional interference, jamming and spoofing. Among them, spoofing is more deceitful because the target receiver might not be able to detect the attack and consequently generate misleading position solutions. Different kind of spoofing attacks can be implemented depending on their complexity. The paper analyzes what is known as intermediate spoofing attack, by means of a spoofer device developed at the Navigation Signal Analysis and Simulation (NavSAS) laboratory. The work focuses on the spoofing detection, performed by implementing proper signal quality monitoring techniques at code and carrier tracking level.

Detection of spoofed GPS signals at code and carrier tracking level

A key aspect to be considered in the design of new generations of global navigation satellite system (GNSS) signals and receivers is a proper partition between system and receiver contribution to the robustness against spoofing attacks. This article maps the current threats and vulnerabilities of GNSS receivers and presents a survey of recent defenses, focusing on cryptographic solutions suitable to authenticate civil signals. Future perspectives and trends are analyzed, with particular emphasis on spreading code authentication techniques, considered as a key innovation for the next generation of civil GNSS signals. An assessment of the robustness and feasibility of the various presented solutions is also provided, analyzing in particular the impact on both current and future receivers.

Signal Structure-Based Authentication for Civil GNSSs: Recent Solutions and Perspectives

The definition of new families of curves named interference error envelope (IEE) and interference running average (IRA) is presented. Such tools are able to assess the impact of RF interference on different GNSS receivers, taking into account the features of the in-band interference source. In fact the actual impact on the final performance is strictly related to the specific receiver architectures. Continuous wave (CW) and wide band (WB) interference signals are considered in order to assess by means of IEE and IRA the robustness of new modulations based on the multiplexed binary offset carrier (MBOC) scheme for several receiver configurations, by varying the discriminator spacing, type, and the front-end filter bandwidth. Interference robustness is evaluated and compared with those of the well-known binary phase shift keying (BPSK) and binary offset carrier BOC(1,1) modulations. Simulation and theoretical results are validated by means of laboratory tests, proving the reliability of IEE curves for interference impact assessment.

Method for Assessing the Interference Impact on GNSS Receivers

The mitigation of radio frequency interference (RFI) has a fundamental role in global navigation satellite system (GNSS) applications, especially when a high level of availability is required. Several electromagnetic sources, in fact, might degrade the performance of the global positioning system (GPS) and Galileo receivers, and their effects can be either in-band (i.e., secondary harmonics generated by transmitters of other communication systems due to non-linearity distortions) or out-of-band (i.e., strong signals that occupy frequency bandwidths very close to GNSS bands). We investigated the effects of real out-of-band signals on GNSS receivers and analyzed the impact on the overall receiver chain in order to evaluate the impact of the interference source. In particular, the analysis focuses on the spectrum at the front-end output, on the automatic gain control (AGC) behavior, as well as on the digital processing stages (signal acquisition and tracking) at the analog digital converter (ADC) output. This study refers to several experiments and data collections performed in interfered areas of downtown Torino (Italy). The obtained results underline how digital/analog TV transmissions represent a potential interference source for GNSS applications and might be critical for the safety of life services.

Investigation on the effect of strong out-of-band signals on global navigation satellite systems receivers

The number of applications based on Global Navigation Satellite System (GNSS) technology is constantly increasing; consequently, the requirements related to signal quality are becoming more and more important. This paper exploits results of the decision theory, aiming at investigating the performance of the goodness of fit test when applied to interference detection in GNSS receivers. It proposes two versions of a signal quality monitoring algorithm: one working exclusively precorrelation, the other providing postcorrelation information as well.

Beatrice Motella

Papers

Detection of spoofed GPS signals at code and carrier tracking level

Signal Structure-Based Authentication for Civil GNSSs: Recent Solutions and Perspectives

Method for Assessing the Interference Impact on GNSS Receivers

Investigation on the effect of strong out-of-band signals on global navigation satellite systems receivers

Methods of goodness of fit for GNSS interference detection