GNSS Sequence Extraction and Reuse for Navigation

Merwe, J. Rossouw van der; Bartl, Sascha; O’Driscoll, Cillian; Rügamer, Alexander; Förster, Frank; Berglez, Philipp; Popugaev, Alexander; Felber, Wolfgang

doi:10.33012/2020.17591

Cited by 13 publications

(3 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For civilian-GNSS signals, the pseudorandom spreading codes are publicly known, allowing the possibility of acquiring each satellite's signals individually. If codes are not publicly available, signals originating from the different satellites can be separated using spatial methods like high gain antennas or antenna arrays [16,33,48].…”

Section: Key Components Of the Attackmentioning

confidence: 99%

Cryptography Is Not Enough: Relay Attacks on Authenticated GNSS Signals

Motallebighomi¹,

Sathaye²,

Singh³

et al. 2022

Preprint

View full text Add to dashboard Cite

Civilian-GNSS is vulnerable to signal spoofing attacks, and countermeasures based on cryptographic authentication are being proposed to protect against these attacks. Both Galileo and GPS are currently testing broadcast authentication techniques based on the delayed key disclosure to validate the integrity of navigation messages. These authentication mechanisms have proven secure against record now and replay later attacks, as navigation messages become invalid after keys are released. This work analyzes the security guarantees of cryptographically protected GNSS signals and shows the possibility of spoofing a receiver to an arbitrary location without breaking any cryptographic operation. In contrast to prior work, we demonstrate the ability of an attacker to receive signals close to the victim receiver and generate spoofing signals for a different target location without modifying the navigation message contents. Our strategy exploits the essential common reception and transmission time method used to estimate pseudorange in GNSS receivers, thereby rendering any cryptographic authentication useless. We evaluate our attack on a commercial receiver (ublox M9N) and a software-defined GNSS receiver (GNSS-SDR) using a combination of open-source tools, commercial GNSS signal generators, and software-defined radio hardware platforms. Our results show that it is possible to spoof a victim receiver to locations around 4000 km away from the true location without requiring any high-speed communication networks or modifying the message contents. Through this work, we further highlight the fundamental limitations in securing a broadcast signaling-based localization system even if all communications are cryptographically protected.

show abstract

Section: Key Components Of the Attackmentioning

confidence: 99%

Cryptography Is Not Enough: Relay Attacks on Authenticated GNSS Signals

Motallebighomi¹,

Sathaye²,

Singh³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…For this reason, research institutions in Germany and Austria have carried out monitoring projects on GPS Mcode signals. These projects focus on receiving GPS signals and separating the M codes from the composite signals to achieve the blind estimation of GPS M-code sequences [6]. Research teams from Austria and Ireland have developed a blind sequence generator for this purpose, using a 1.8-meter antenna to extract the code sequences of GPS M-code signals on the ground for tracking and measurement.…”

Section: Introductionmentioning

confidence: 99%

Blind Estimation of GPS M-Code Signals under Noncooperative Conditions

Rui

Ouyang

Zeng

et al. 2022

Wireless Communications and Mobile Computing

View full text Add to dashboard Cite

In the process of Global Positioning System (GPS) modernization, M-code signals with better immunity to interference have been proposed and used in place of P(Y) signals as new authorization signals. A typical positioning, navigation, and timing (PNT) service is based on the local interrelation operation between the reference signal and the received signal. To obtain a PNT, the receiver should generate replicas of the pseudorandom code for acquisition and tracking. However, due to the use of an encryption algorithm, the receiver cannot use the M-code signal under noncooperative conditions. This paper presents an algorithm for estimating M-code sequences without prior knowledge. This algorithm adopts a waveform matching technique and a time domain filtering method to extract M-code from the in-phase channel and quadrature channel of the GPS L1 band. A high-gain antenna is used to receive GPS signals to keep the signal from being drowned out by noise. The experimental results show the feasibility of the method. Therefore, it is helpful for studying and evaluating the performance achieved without prior knowledge of the GPS signals.

show abstract

“…Antenna arrays are normally used as a countermeasure to jamming or spoofing (Ward, 1994), but antenna arrays have also been used for SQM, as described by Gunawardena et al (2019). Additionally, dish antennas can obviously be used to retrieve unknown pseudorandom noise (PRN) code sequences, which has been discussed in detail by van der Merwe, Bartl, et al (2020). Another use of BSP is to distinguish genuine signals from spoofing signals, possibly making use of artificial intelligence methods (van der Merwe, Nikolikj, et al, 2020).…”

mentioning

confidence: 99%