Protecting GNSS-based Services using Time Offset Validation

Abstract

Global navigation satellite systems (GNSS) provide pervasive accurate positioning and timing services for a large gamut of applications, from Time based One-Time Passwords (TOPT), to power grid and cellular systems. However, there can be security concerns for the applications due to the vulnerability of GNSS. It is important to observe that GNSS receivers are components of platforms, in principle having rich connectivity to different network infrastructures. Of particular interest is the access to a variety of timing sources, as those can be used to validate GNSS-provided location and time. Therefore, we consider off-the-shelf platforms and how to detect if the GNSS receiver is attacked or not, by cross-checking the GNSS time and time from other available sources. First, we survey different technologies to analyze their availability, accuracy and trustworthiness for time synchronization. Then, we propose a validation approach for absolute and relative time. Moreover, we design a framework and experimental setup for the evaluation of the results. Attacks can be detected based on WiFi supplied time when the adversary shifts the GNSS provided time, more than 23.942 µs; with Network Time Protocol (NTP) supplied time when the adversary-induced shift is more than 2.046 ms. Consequently, the proposal significantly limits the capability of an adversary to manipulate the victim GNSS receiver.

High-precision Hardware Oscillators Ensemble for GNSS Attack Detection

“…Beyond the aforementioned early works on time-based detection for GNSS attacks, we discuss next the most closely related recent works, including notably approaches that rely on local time references or an ensemble of clocks. Nonetheless, we do not discuss timebased detection approaches that rely on network-obtained time information [11,12], which are a powerful tool, but are dependant on the quality of the connection, and the level of sophistication of the attacker able to tamper with (access to) the remote time server.…”

“…Specifically for time-based detection of GNSS attacks, the socalled Time Test can be leveraged [10]. In this case, various secure network time providers (NTS, PTP) can be leveraged [11,12] to compare the time solution provided by the GNSS receiver with a trusted time reference. However, a diversified attacker can manipulate GNSS signals to induce a false PVT solution while preventing the receiver from connecting to the network altogether or, selectively, to network time providers.…”

Authenticated time for detecting GNSS attacks

“…Such a capability can be valuable as it could be readily deployed to safeguard GNSS-based position (and timing). The recent results in [23] exploit the co-existence of multiple time sources to cross-validate time information obtained from the GNSS receiver, demonstrating how a combination of different time sources can be used to detect deviations in GNSS time and detect GNSS attacks that caused such time deviations. In the context of protecting mobile phones from spoofing, side-information based approaches, such as time sources, inertial sensors and A-GPS (Assisted GPS) information [24] are also investigated.…”

“…Even though existing approaches, such as [23], raise the bar, it is paramount to have trustworthy information from the leveraged alternate sources. If not, in the presence of an adversary that can attack both the GNSS side (e.g., spoofing) and the Internet side (e.g., impersonating or manipulating the alternate source of time information), the detection would fail.…”

Detecting GNSS misbehaviour with high-precision clocks

“…Several countermeasures were proposed, leveraging signal characteristics, e.g. [3], the receiver's attitude [4] or validation of the PVT solution through alternative position and time sources [11,14,16,21].…”