kth.sePublikationer
Ändra sökning
RefereraExporteraLänk till posten
Permanent länk

Direktlänk
Referera
Referensformat
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Annat format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annat språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf
GNSS receiver tracking performance analysis under distance-decreasing attacks
KTH, Skolan för elektro- och systemteknik (EES), Kommunikationsnät.
KTH, Skolan för elektro- och systemteknik (EES), Kommunikationsnät.ORCID-id: 0000-0002-3267-5374
2015 (Engelska)Ingår i: Proceedings of 2015 International Conference on Localization and GNSS, IEEE , 2015Konferensbidrag, Publicerat paper (Refereegranskat)
Resurstyp
Text
Abstract [en]

Numerous works have investigated the vulnerability of Global Navigation Satellite Systems (GNSS) against attacks. Upcoming systems make provisions for cryptographic civilian signal protection. However, this alone does not fully protect GNSS-based localization. In this paper, we show that attacks at the physical layer, without modification of navigation messages, can be severely effective. We analyze the influence of the, so called distance decreasing attacks, and we investigate their feasibility and we find that they can be practical and effective. Finally, we consider signal quality monitoring, but it can not readily serve as a countermeasure.

Ort, förlag, år, upplaga, sidor
IEEE , 2015.
Nyckelord [en]
Distance decreasing attacks, GNSS, Tracking
Nationell ämneskategori
Signalbehandling
Identifikatorer
URN: urn:nbn:se:kth:diva-187134DOI: 10.1109/ICL-GNSS.2015.7217163ISI: 000380461600030Scopus ID: 2-s2.0-84959559446OAI: oai:DiVA.org:kth-187134DiVA, id: diva2:929441
Konferens
International Conference on Localization and GNSS, ICL-GNSS 2015; Gothenburg; Sweden
Anmärkning

QC 20160518

Tillgänglig från: 2016-05-18 Skapad: 2016-05-17 Senast uppdaterad: 2024-03-18Bibliografiskt granskad
Ingår i avhandling
1. Secure GNSS-based Positioning and Timing: Distance-Decreasing attacks, fault detection and exclusion, and attack detection with the help of opportunistic signals
Öppna denna publikation i ny flik eller fönster >>Secure GNSS-based Positioning and Timing: Distance-Decreasing attacks, fault detection and exclusion, and attack detection with the help of opportunistic signals
2021 (Engelska)Doktorsavhandling, sammanläggning (Övrigt vetenskapligt)
Abstract [en]

With trillions of devices connected in large scale systems in a wired or wireless manner, positioning and synchronization become vital. Global Navigation Satellite System (GNSS) is the first choice to provide global coverage for positioning and synchronization services. From small mobile devices to aircraft, from intelligent transportation systems to cellular networks, and from cargo tracking to smart grids, GNSS plays an important role, thus, requiring high reliability and security protection.       

However, as GNSS signals propagate from satellites to receivers at distance of around 20 000 km, the signal power arriving at the receivers is very low, making the signals easily jammed or overpowered. Another vulnerability stems from that civilian GNSS signals and their specifications are publicly open, so that anyone can craft own signals to spoof GNSS receivers: an adversary forges own GNSS signals and broadcasts them to the victim receiver, to mislead the victim into believing that it is at an adversary desired location or follows a false trajectory, or adjusts its clock to a time dictated by the adversary. Another type of attack is replaying GNSS signals: an adversary transmits a pre-recorded GNSS signal stream to the victim receiver, so that the receiver calculates an erroneous position and time. Recent incidents reported in press show that the GNSS functionalities in a certain area, e.g., Black Sea, have been affected by cyberattacks composed of the above-mentioned attack types.        

This thesis, thus, studies GNSS vulnerabilities and proposes detection and mitigation methods for GNSS attacks, notably spoofing and replay attacks. We analyze the effectiveness of one important and powerful replay attack, the so-called Distance-decreasing (DD) attacks that were previously investigated for wireless communication systems, on GNSS signals. DD attacks are physical layer attacks, targeting time-of-flight ranging protocols, to shorten the perceived as measured distance between the transmitter and receiver. The attacker first transmits an adversary-chosen data bit to the victim receiver before the signal arrives at the attacker; upon receipt of the GNSS signal, the attacker estimates the data bit based on the early fraction of the bit period, and then switches to transmitting the estimate to the victim receiver. Consequently, the DD signal arrives at the victim receiver earlier than the genuine GNSS signals would have, which in effect shortens the pseudorange measurement between the sender (satellite) and the victim receiver, consequently, affecting the calculated position and time of the receiver. We study how the DD attacks affect the bit error rate (BER) of the received signals at the victim, and analyze its effectiveness, that is, the ability to shorten pseudorange measurements, on different GNSS signals. Several approaches are considered for the attacker to mount a DD attack with high probability of success (without being detected) against a victim receiver, for cryptographically unprotected and protected signals. We analyze the tracking output of the DD signals at the victim receiver and propose a Goodness of Fit (GoF) test and a Generalized Likelihood Ratio Test (GLRT) to detect the attacks. The evaluation of the two tests shows that they are effective, with the result being perhaps more interesting when considering DD attacks against Galileo signals that can be cryptographically protected.       

Moreover, this thesis investigates the feasibility of validating the authenticity of the GNSS signals with the help of opportunistic signals, which is information readily available in modern communication environments, e.g., 3G, 4G and WiFi. We analyze the time synchronization accuracy of different technologies, e.g., Network Time Protocol (NTP), WiFi and local oscillator, as the basis for detecting a discrepancy with the GNSS-obtained time. Two detection approaches are proposed and one testbench is designed for the evaluation. A synthesized spoofing attack is used to verify the effectiveness of the approaches.       

Beyond attack detection, we develop algorithms to detect and exclude faulty signals, namely the Clustering-based Solution Separation Algorithm (CSSA) and the Fast Multiple Fault Detection and Exclusion (FM-FDE). They both utilize the redundant available satellites, more than the minimum a GNSS receiver needs for position and time offset calculation. CSSA adopts data clustering to group subsets of positions calculated with different subsets of available satellites. Basically, these positions, calculated with subsets not containing any faulty satellites, should be close to each other, i.e., in a dense area; otherwise they should be scattered. FM-FDE is a more efficient algorithm that uses distances between positions, calculated with fixed-size subsets, as test statistics to detect and exclude faulty satellite signals. As the results show, FM-FDE runs faster than CSSA and other solution-separation fault detection and exclusion algorithms while remaining equally effective.

Ort, förlag, år, upplaga, sidor
KTH Royal Institute of Technology, 2021. s. 71
Serie
TRITA-EECS-AVL ; 2021:19
Nationell ämneskategori
Kommunikationssystem Datorsystem Annan elektroteknik och elektronik Signalbehandling Geoteknik
Forskningsämne
Elektro- och systemteknik
Identifikatorer
urn:nbn:se:kth:diva-291548 (URN)978-91-7873-811-3 (ISBN)
Disputation
2021-04-01, https://kth-se.zoom.us/webinar/register/WN_IFbfmOPTSVCODSCFxTnMDA, Online, Stockholm, 09:00 (Engelska)
Opponent
Handledare
Anmärkning

QC 20210316

Tillgänglig från: 2021-03-16 Skapad: 2021-03-15 Senast uppdaterad: 2022-06-25Bibliografiskt granskad

Open Access i DiVA

Fulltext saknas i DiVA

Övriga länkar

Förlagets fulltextScopus

Person

Zhang, KeweiPapadimitratos, Panagiotis

Sök vidare i DiVA

Av författaren/redaktören
Zhang, KeweiPapadimitratos, Panagiotis
Av organisationen
Kommunikationsnät
Signalbehandling

Sök vidare utanför DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetricpoäng

doi
urn-nbn
Totalt: 71 träffar
RefereraExporteraLänk till posten
Permanent länk

Direktlänk
Referera
Referensformat
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Annat format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annat språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf