Endre søk
RefereraExporteraLink to record
Permanent link

Direct link
Referera
Referensformat
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Annet format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annet språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf
Distributed and Mobile Message Level Relaying/Replaying of GNSS Signals
KTH, Skolan för elektroteknik och datavetenskap (EECS), Datavetenskap, Programvaruteknik och datorsystem, SCS.ORCID-id: 0000-0001-8919-0098
KTH, Skolan för elektroteknik och datavetenskap (EECS), Datavetenskap, Nätverk och systemteknik.ORCID-id: 0000-0002-3267-5374
2022 (engelsk)Inngår i: The International Technical Meeting of the The Institute of Navigation, Institute of Navigation , 2022Konferansepaper, Publicerat paper (Fagfellevurdert)
Abstract [en]

With the introduction of Navigation Message Authentication (NMA), future Global Navigation Satellite Systems (GNSSs) prevent spoofing by simulation, i.e., the generation of forged satellite signals based on publicly known information. However, authentication does not prevent record-and-replay attacks, commonly termed as meaconing. Meaconing attacks are less powerful in terms of adversarial control over the victim receiver location and time, but by acting at the signal level, they are not thwarted by NMA. This makes replaying/relaying attacks a significant threat for current and future GNSS. While there are numerous investigations on meaconing attacks, the vast majority does not rely on actual implementation and experimental evaluation in real-world settings. In this work, we contribute to the improvement of the experimental understanding of meaconing attacks. We design and implement a system capable of real-time, distributed, and mobile meaconing, built with off-the-shelf hardware. We extend from basic distributed meaconing attacks, with signals from different locations relayed over the Internet and replayed within range of the victim receiver(s). This basic attack form has high bandwidth requirements and thus depends on the quality of service of the available network to work. To overcome this limitation, we propose to replay on message level, i.e., to demodulate and re-generate signals before and after the transmission respectively (including the authentication part of the payload). The resultant reduced bandwidth enables the attacker to operate in mobile scenarios, as well as to replay signals from multiple GNSS constellations and/or bands simultaneously. Additionally, the attacker can delay individually selected satellite signals to potentially influence the victim position and time solution in a more fine-grained manner. Our versatile test-bench, enabling different types of replaying/relaying attacks, facilitates testing realistic scenarios towards new and improved replaying/relaying-focused countermeasures in GNSS receivers.

sted, utgiver, år, opplag, sider
Institute of Navigation , 2022.
HSV kategori
Identifikatorer
URN: urn:nbn:se:kth:diva-323284DOI: 10.33012/2022.18227Scopus ID: 2-s2.0-85147930155OAI: oai:DiVA.org:kth-323284DiVA, id: diva2:1730313
Konferanse
International technical Meeting of the Institute of Navigation
Merknad

QC 20250317

Tilgjengelig fra: 2023-01-24 Laget: 2023-01-24 Sist oppdatert: 2025-03-17bibliografisk kontrollert
Inngår i avhandling
1. Data verification for GNSS systems and protection of GNSS services
Åpne denne publikasjonen i ny fane eller vindu >>Data verification for GNSS systems and protection of GNSS services
2025 (engelsk)Doktoravhandling, med artikler (Annet vitenskapelig)
Abstract [en]

 Global Navigation Satellite Systems (GNSS) provide ubiquitous precise localization and synchronization for a wide gamut of applications, spanning from location-based service to core industrial functionalities in communications and large infrastructure. Civilian use of GNSS relies on publicly available signals and infrastructure designed to operate at a high level of interoperability. Nevertheless, such systems proved to be vulnerable to voluntary and involuntary interference aiming to deny, modify, and falsify the GNSS-provided solution. This poses a significant threat to the robustness of satellite-based timing and localization. A decreasing entry threshold from the knowledge and tools accessibility perspective makes mounting such attacks feasible and effective even against low-value targets. In this work, this issue is targeted, with a practical approach, from three directions, by cross-checking the navigation solution with alternative providers of time, by localizing the interference source and characterizing it, and by relying on specific receiver dynamics to eliminate falsified signals. We discuss protection mechanisms targeting the consumer market based on available infrastructure or on sensing supported by sensors embedded in the GNSS-enabled platform itself. These efforts collectively aim to improve the robustness of consumer GNSS solutions, without modifying the GNSS receiver or the signal structure, to provide secure and reliable navigation and timing in an increasingly adversarial environment.

Abstract [sv]

Globala system för satellitnavigering (eng. global navigation satellite systems, GNSS) tillhandahåller allestädes närvarande precis platsbestämning och synkronisering för ett brett spann av tillämpningar, från platsbaserade tjänster till industriella kärnfunktioner i kommunikation och stora infrastrukturer. Civil användning av GNSS förlitar sig på allmänt tillgängliga signaler och infrastruktur som är designad att användas på en hög nivå av interoperabilitet. Dessa system har visat sig sårbara för störningar som söker att neka, modifiera och falsifiera GNSS-lösningar. Detta utgör ett allvarligt hot mot tillförlitligheten av satellitbaserad tids- och platsbestämning. En sänkning av tröskeln för tillgängligheten av kunskap och verktyg gör det möjligt och effektivt att inleda sådana attacker, även mot lågvärdesmål. I detta verk angrips problemet praktiskt via tre tillvägagångssätt: genom dubbelkontroll av navigationslösningen med alternativa internettidsleverantörer, genom lokalisering av störningskällan och karaktärisera den, och genom att förlita sig på specifik mottagardynamik för att eliminera falsifierade signaler. Vi diskuterar skyddsmekanismer ämnade för konsumentmarknaden baserat på tillgänglig infrastruktur eller m.h.a. mätningar från inbyggda sensorer i GNSS-plattformen i sig. Dessa ansträngningar söker att gemensamt förbättra tillförlitligheten hos konsument GNSS-lösningar, utan att modifiera GNSS-mottagaren eller signalstrukturen, för att erbjuda säker ochpålitlig navigation och tid i en alltmer fientlig miljö

sted, utgiver, år, opplag, sider
Stockholm: KTH Royal Institute of Technology, 2025. s. xxvi, 62
Serie
TRITA-EECS-AVL ; 2025:36
HSV kategori
Forskningsprogram
Informations- och kommunikationsteknik
Identifikatorer
urn:nbn:se:kth:diva-361272 (URN)978-91-8106-231-1 (ISBN)
Disputas
2025-04-15, https://kth-se.zoom.us/j/62121217840, Sal C, Kistagången 16, Stockholm, 14:00 (engelsk)
Opponent
Veileder
Merknad

QC 20250317

Tilgjengelig fra: 2025-03-17 Laget: 2025-03-17 Sist oppdatert: 2025-10-30bibliografisk kontrollert

Open Access i DiVA

Fulltekst mangler i DiVA

Andre lenker

Forlagets fulltekstScopus

Person

Lenhart, MalteSpanghero, MarcoPapadimitratos, Panos

Søk i DiVA

Av forfatter/redaktør
Lenhart, MalteSpanghero, MarcoPapadimitratos, Panos
Av organisasjonen

Søk utenfor DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetric

doi
urn-nbn
Totalt: 125 treff
RefereraExporteraLink to record
Permanent link

Direct link
Referera
Referensformat
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Annet format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annet språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf