GNSS Spoofing Detection: Guard against automated ground vehicle attacks

DATA COLLECTION

Data was gathered on the University of Texas (UT) Radionavigation Laboratory (RNL) Sensorium, an integrated platform for automated and connected vehicle perception research. It is equipped with multiple radars, IMUs, GNSS receivers and a lidar, as shown in Figure 1.

Figure 1: The UT RNL has developed a multi-modal ground-vehicle-mounted integrated perception platform call the Sensorium. It houses three different types of IMU, two triple-frequency GNSS antennas, three radar sensors and two cameras.

With the Sensorium, the RNL produced a public benchmark dataset collected in the dense urban center of the city of Austin called TEX-CUP for evaluating multi-sensor GNSS-based urban positioning algorithms. The data captured includes a diverse set of multipath environments (open-sky, shallow urban and deep urban). The TEX-CUP dataset provides raw wideband intermediate frequency (IF) GNSS data with tightly synchronized raw measurements from multiple IMUs and a stereoscopic camera unit, as well as truth positioning data. This allows researchers to develop algorithms using any subset of the sensor measurements and compare their results with the true position.

For our analysis, only the raw GNSS IF samples from the primary antenna and inertial data were considered. Two-bit-quantized IF samples were captured at the Sensorium and at the reference station through the RadioLynx, a low-cost L1+L2 GNSS front end with a 5 MHz bandwidth at each frequency, and were processed with the RNL’s GRID software-defined radio (SDR). The system’s performance was separately evaluated using inertial data from each of the Sensorium’s two MEMS inertial sensors.

The first, a LORD MicroStrain 3DM-GX5-25, is an industrial-grade sensor. The second, a Bosch BMX055, is a surface-mount consumer-grade sensor.TEX-CUP provides ground truth data for the vehicle position and orientation. The post-processed solution is accurate to better than 10 centimeters throughout the dataset. The effectiveness of the developed spoofing detection method is evaluated with the dataset subsets.

SPOOFING METHODOLOGY

The total signal at the victim receiver antenna is the sum of the authentic signal, the spoofed signal and the received noise. Under a challenging spoofing attack, the spoofed signal contains a perfect null of the authentic signal and the received noise, which is entirely naturally generated — that is, not introduced by the spoofer.

Physical-Layer Spoofing. To artificially simulate a spoofing attack over-the-air, cable injection and digital signal injection spoofing were considered. Over-the-air attacks are possible, but are not authorized in urban areas. A cable injection attack would be permissible for a live experiment in an urban area, and digital signal combining, is a powerful after-the-fact spoofing technique. But in both cases it is challenging to explore a worst-case spoofing attack in which the authentic signals are entirely nulled by an antipodal spoofing signal.

Experience with ds7 and ds8 from the Texas Spoofing Test Battery revealed that such antipodal spoofing is difficult to maintain under even static laboratory conditions. The remnant authentic signal from an unsophisticated and imperfect spoofing attack sullies the test statistic, making detection too easy and leading to an overly optimistic performance assessment. In short, physical-layer spoofing is challenging to conduct in such a way as to present a convincing worst-case spoofing attack to our detector.

Observation-Domain Spoofing. It is important to evaluate spoofing detection techniques on a worst-case spoofing attack, with the idea being that if the proposed detection strategy is effective on the worst-case scenario, it is even more effective on weaker attacks. Accordingly, we adopt observation-domain spoofing. The spoofing in the observation domain is advantageous because the authentic signal is inherently nulled, presenting a subtle attack.

The first method of implementing observation-domain spoofing is position offset spoofing. With position offset spoofing, a position offset is added to the authentic measured position to generate a spoofed position. This is accomplished by altering the pseudorange and carrier-phase measurements from each satellite so that they correspond to the spoofed position with the desired additive position offset.

The second method of implementing observation-domain spoofing is timestamp spoofing. With timestamp spoofing, the measurements at a particular time are reassigned to have an alternate measurement timestamp. The authentic observables from time t+δt(t) are fed to the estimator as if they had occurred at time t. The timestamp-shifted observables are adjusted to account for the transmitting spacecraft’s orbital motion and clock evolution over the interval from t to t+δt(t).

In position offset spoofing, all vehicle motion reflected in the authentic carrier-phase observation is also present in the spoofed observation. This includes all high-frequency motion due to the road irregularities and other minor movements. A detection technique designed to detect small-amplitude, high-frequency discrepancies in carrier-phase measurements via the WFARC would not actually see such discrepancies unless the change in carrier phase due to the position offset also included simulated high-frequency content.

By contrast, timestamp spoofing borrows spoofed carrier-phase and pseudorange measurements from a different time instant, ensuring that high-frequency variations in these quantities will be different from those predicted by the a priori state based on IMU propagation. This is more representative of an actual spoofing attack scenario in which the attacker cannot predict the high-frequency vehicle motion. Moreover, by reducing the timestamp shift δt(t), one can realize ever-subtler attacks that are increasingly hard to detect, allowing exploration of worst-case-for-detectability spoofing.

Thus, timestamp spoofing is representative of a case in which a well-financed attacker is able to place a single-satellite-full-single-ensemble spoofer capable of full authentic-signal nulling along the line-of-sight from the target vehicle to each overhead GNSS satellite.