kth.sePublications KTH
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Distributed and Mobile Message Level Relaying/Replaying of GNSS Signals
KTH, School of Electrical Engineering and Computer Science (EECS), Computer Science, Software and Computer systems, SCS.ORCID iD: 0000-0001-8919-0098
KTH, School of Electrical Engineering and Computer Science (EECS), Computer Science, Network and Systems Engineering.ORCID iD: 0000-0002-3267-5374
2022 (English)In: The International Technical Meeting of the The Institute of Navigation, Institute of Navigation , 2022Conference paper, Published paper (Refereed)
Abstract [en]

With the introduction of Navigation Message Authentication (NMA), future Global Navigation Satellite Systems (GNSSs) prevent spoofing by simulation, i.e., the generation of forged satellite signals based on publicly known information. However, authentication does not prevent record-and-replay attacks, commonly termed as meaconing. Meaconing attacks are less powerful in terms of adversarial control over the victim receiver location and time, but by acting at the signal level, they are not thwarted by NMA. This makes replaying/relaying attacks a significant threat for current and future GNSS. While there are numerous investigations on meaconing attacks, the vast majority does not rely on actual implementation and experimental evaluation in real-world settings. In this work, we contribute to the improvement of the experimental understanding of meaconing attacks. We design and implement a system capable of real-time, distributed, and mobile meaconing, built with off-the-shelf hardware. We extend from basic distributed meaconing attacks, with signals from different locations relayed over the Internet and replayed within range of the victim receiver(s). This basic attack form has high bandwidth requirements and thus depends on the quality of service of the available network to work. To overcome this limitation, we propose to replay on message level, i.e., to demodulate and re-generate signals before and after the transmission respectively (including the authentication part of the payload). The resultant reduced bandwidth enables the attacker to operate in mobile scenarios, as well as to replay signals from multiple GNSS constellations and/or bands simultaneously. Additionally, the attacker can delay individually selected satellite signals to potentially influence the victim position and time solution in a more fine-grained manner. Our versatile test-bench, enabling different types of replaying/relaying attacks, facilitates testing realistic scenarios towards new and improved replaying/relaying-focused countermeasures in GNSS receivers.

Place, publisher, year, edition, pages
Institute of Navigation , 2022.
National Category
Electrical Engineering, Electronic Engineering, Information Engineering
Identifiers
URN: urn:nbn:se:kth:diva-323284DOI: 10.33012/2022.18227Scopus ID: 2-s2.0-85147930155OAI: oai:DiVA.org:kth-323284DiVA, id: diva2:1730313
Conference
International technical Meeting of the Institute of Navigation
Note

QC 20250317

Available from: 2023-01-24 Created: 2023-01-24 Last updated: 2025-03-17Bibliographically approved
In thesis
1. Data verification for GNSS systems and protection of GNSS services
Open this publication in new window or tab >>Data verification for GNSS systems and protection of GNSS services
2025 (English)Doctoral thesis, comprehensive summary (Other academic)
Abstract [en]

 Global Navigation Satellite Systems (GNSS) provide ubiquitous precise localization and synchronization for a wide gamut of applications, spanning from location-based service to core industrial functionalities in communications and large infrastructure. Civilian use of GNSS relies on publicly available signals and infrastructure designed to operate at a high level of interoperability. Nevertheless, such systems proved to be vulnerable to voluntary and involuntary interference aiming to deny, modify, and falsify the GNSS-provided solution. This poses a significant threat to the robustness of satellite-based timing and localization. A decreasing entry threshold from the knowledge and tools accessibility perspective makes mounting such attacks feasible and effective even against low-value targets. In this work, this issue is targeted, with a practical approach, from three directions, by cross-checking the navigation solution with alternative providers of time, by localizing the interference source and characterizing it, and by relying on specific receiver dynamics to eliminate falsified signals. We discuss protection mechanisms targeting the consumer market based on available infrastructure or on sensing supported by sensors embedded in the GNSS-enabled platform itself. These efforts collectively aim to improve the robustness of consumer GNSS solutions, without modifying the GNSS receiver or the signal structure, to provide secure and reliable navigation and timing in an increasingly adversarial environment.

Abstract [sv]

Globala system för satellitnavigering (eng. global navigation satellite systems, GNSS) tillhandahåller allestädes närvarande precis platsbestämning och synkronisering för ett brett spann av tillämpningar, från platsbaserade tjänster till industriella kärnfunktioner i kommunikation och stora infrastrukturer. Civil användning av GNSS förlitar sig på allmänt tillgängliga signaler och infrastruktur som är designad att användas på en hög nivå av interoperabilitet. Dessa system har visat sig sårbara för störningar som söker att neka, modifiera och falsifiera GNSS-lösningar. Detta utgör ett allvarligt hot mot tillförlitligheten av satellitbaserad tids- och platsbestämning. En sänkning av tröskeln för tillgängligheten av kunskap och verktyg gör det möjligt och effektivt att inleda sådana attacker, även mot lågvärdesmål. I detta verk angrips problemet praktiskt via tre tillvägagångssätt: genom dubbelkontroll av navigationslösningen med alternativa internettidsleverantörer, genom lokalisering av störningskällan och karaktärisera den, och genom att förlita sig på specifik mottagardynamik för att eliminera falsifierade signaler. Vi diskuterar skyddsmekanismer ämnade för konsumentmarknaden baserat på tillgänglig infrastruktur eller m.h.a. mätningar från inbyggda sensorer i GNSS-plattformen i sig. Dessa ansträngningar söker att gemensamt förbättra tillförlitligheten hos konsument GNSS-lösningar, utan att modifiera GNSS-mottagaren eller signalstrukturen, för att erbjuda säker ochpålitlig navigation och tid i en alltmer fientlig miljö

Place, publisher, year, edition, pages
Stockholm: KTH Royal Institute of Technology, 2025. p. xxvi, 62
Series
TRITA-EECS-AVL ; 2025:36
National Category
Other Electrical Engineering, Electronic Engineering, Information Engineering
Research subject
Information and Communication Technology
Identifiers
urn:nbn:se:kth:diva-361272 (URN)978-91-8106-231-1 (ISBN)
Public defence
2025-04-15, https://kth-se.zoom.us/j/62121217840, Sal C, Kistagången 16, Stockholm, 14:00 (English)
Opponent
Supervisors
Note

QC 20250317

Available from: 2025-03-17 Created: 2025-03-17 Last updated: 2025-10-30Bibliographically approved

Open Access in DiVA

No full text in DiVA

Other links

Publisher's full textScopus

Authority records

Lenhart, MalteSpanghero, MarcoPapadimitratos, Panos

Search in DiVA

By author/editor
Lenhart, MalteSpanghero, MarcoPapadimitratos, Panos
By organisation
KTHSoftware and Computer systems, SCSNetwork and Systems Engineering
Electrical Engineering, Electronic Engineering, Information Engineering

Search outside of DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetric score

doi
urn-nbn
Total: 114 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf