Fingerprinting of GPS Satellites to Detect GPS Spoofing

Transcription

1 Fingerprinting of GPS Satellites to Detect GPS Spoofing Ryan Gerdes 1,2, Bob McGwier 2, and Jeffrey Reed 1 1 Electrical and Computer Engineering, 2 Hume Center, Virginia Tech S2ERC Showcase May, 2018

2 Advancing Attacker Models of Satellite-based Localization Systems The Case of Multi-device Attackers by Jansen and Popper, 2017

3 related work: Advancing Attacker Models of Satellite-based Localization Systems The Case of Multi-device Attackers by Jansen and Popper, 2017

4 related work: 1. multiple receivers/antennas Advancing Attacker Models of Satellite-based Localization Systems The Case of Multi-device Attackers by Jansen and Popper, 2017

5 related work: 1. multiple receivers/antennas (~3.54 m separation) Advancing Attacker Models of Satellite-based Localization Systems The Case of Multi-device Attackers by Jansen and Popper, 2017

6 related work: 1. multiple receivers/antennas (~3.54 m separation) 2. established tracking (single receiver) Advancing Attacker Models of Satellite-based Localization Systems The Case of Multi-device Attackers by Jansen and Popper, 2017

7 related work: 1. multiple receivers/antennas (~3.54 m separation) 2. established tracking (single receiver) Ref. Year MA Aacker Potentially Aack Too Complex Vulnerable Resistant [9] [13] [12] [4] [26] [3] [28] [10] [16] [23 25] 2013/ [8] [27] [17, 18] [22] [20, 21] 2015/ [14] [19] [11] focus on aacks rather than countermeasures 2 and provide a proof for the security of four and more receivers 3 with three or less receivers 4 with four or more receivers 5 secure according to the authors, but we argue that using more antennas as availab channels in the receiver can also circumvent this countermeasure Advancing Attacker Models of Satellite-based Localization Systems The Case of Multi-device Attackers by Jansen and Popper, 2017

8 related work: 1. multiple receivers/antennas (~3.54 m separation) 2. established tracking (single receiver) Ref. Year MA Aacker Potentially Aack Too Complex Vulnerable Resistant [9] [13] [12] [4] [26] [3] [28] [10] [16] [23 25] 2013/ [8] [27] [17, 18] [22] [20, 21] 2015/ [14] [19] [11] focus on aacks rather than countermeasures 2 and provide a proof for the security of four and more receivers 3 with three or less receivers 4 with four or more receivers 5 secure according to the authors, but we argue that using more antennas as availab channels in the receiver can also circumvent this countermeasure propose: 1. low-cost 2. single receiver/antenna 3. stateless Advancing Attacker Models of Satellite-based Localization Systems The Case of Multi-device Attackers by Jansen and Popper, 2017

9 Project Overview USRP 1 Attacker gnuradio USRP 2 GPS Receiver gnss-sdr USRP 3 USRP 4 Victim

10 Project Overview USRP 1 Attacker gnuradio USRP 2 GPS Receiver gnss-sdr USRP 3 USRP 4 Victim proposed approach: physical layer identification of GPS transmitters

11 Project Overview a a has been shown that from a WiSec 17, July 18-20, 2017, Boston, MA, USA wards even a multi-antenna s ntaining a fixed formation, rey = 6 s,l during the attack [29]. This ction technique is principally s Kai Jans Attacker USRP 1 USRP 2 spoofers equidistant to the receiver and a gnuradio, we achieved a stable position lo (ii) e targeted receiver acquired a loc a er 50 s, which is in the range of a nor achieved position accuracy was within a Notably, the time synchronization betw is a crucial requirement for a stable lock sired position. For instance, a time o se in the pseudorange of approx. 300 km. calculations and high position errors. Co dency on the time synchronization, we w achieve a good accuracy that was also re results have been gathered in a non-labo we plan to signi cantly increase the accur by implementing an external time pulse As a result, we were able to success receiver with a setup that uses four an di erent satellite signal. is setup allow single satellite signals separately from eac the complete freedom of how to manip can change individual pseudoranges, sig =6 gnuradio GPS Receiver cker signals are received at all from a rd to prevent if the receivers t -antenna gether). = 6 s 1: A simple experimental multi-antenna attacker 6= Figure setup consisting of four USRPs synchronized and operated r- detection is that ation, re- mechanism by gnuradio targeting a victim s GPS receiver. s S receivers without changes 29]. This a so ware-de ned radio GPS spoofer was presented [15] that is fully customizable and only requires o -the-shelf USRPs such as proposed approach: -he performance of the counfigure 1: ToA satellite Left: The relative a HackRFof [7], which lowers the costs forsignals. a single spoo ng system incipally physical layer identification of GPS transmitters d gnss-sdr USRP 3 Victim USRP 4 to approx. $400. Several systems of this type can be utilized to

12 Project deliverable: a USRP-based GPS receiver that distinguishes between spoofer and a satellites under laboratory conditions

13 Project deliverable: a USRP-based GPS receiver that distinguishes between spoofer and a satellites under laboratory conditions Associated milestones: 1. Identification of the portion of GPS signal to be identified and determination of how it is to be acquired

14 Project deliverable: a USRP-based GPS receiver that distinguishes between spoofer and a satellites under laboratory conditions Associated milestones: 1. Identification of the portion of GPS signal to be identified and determination of how it is to be acquired 2. Acquisition of authentic GPS signals from several satellites on different dates to ensure signals represent varying operating conditions

15 Project deliverable: a USRP-based GPS receiver that distinguishes between spoofer and a satellites under laboratory conditions Associated milestones: 1. Identification of the portion of GPS signal to be identified and determination of how it is to be acquired 2. Acquisition of authentic GPS signals from several satellites on different dates to ensure signals represent varying operating conditions 3. Selection of classification/identification techniques to distinguish signals from different satellites

16 Project deliverable: a USRP-based GPS receiver that distinguishes between spoofer and a satellites under laboratory conditions Associated milestones: 1. Identification of the portion of GPS signal to be identified and determination of how it is to be acquired 2. Acquisition of authentic GPS signals from several satellites on different dates to ensure signals represent varying operating conditions 3. Selection of classification/identification techniques to distinguish signals from different satellites 4. Generation of signals from non-gps satellite device to evaluate performance of signal features and classification/identification techniques to differentiate spoofed from authentic signals.

17 Project deliverable: a USRP-based GPS receiver that distinguishes between spoofer and a satellites under laboratory conditions Associated milestones: 1. Identification of the portion of GPS signal to be identified and determination of how it is to be acquired 2. Acquisition of authentic GPS signals from several satellites on different dates to ensure signals represent varying operating conditions 3. Selection of classification/identification techniques to distinguish signals from different satellites 4. Generation of signals from non-gps satellite device to evaluate performance of signal features and classification/identification techniques to differentiate spoofed from authentic signals.

18 Project deliverable: a USRP-based GPS receiver that distinguishes between spoofer and a satellites under laboratory conditions Associated milestones: 1. Identification of the portion of GPS signal to be identified and determination of how it is to be acquired 2. Acquisition of authentic GPS signals from several satellites on different dates to ensure signals represent varying operating conditions 3. Selection of classification/identification techniques to distinguish signals from different satellites 4. Generation of signals from non-gps satellite device to evaluate performance of signal features and classification/identification techniques to differentiate spoofed from authentic signals.

19 Milestone one, challenge: signal to fingerprint

20 Milestone one, challenge: signal to fingerprint (generic, digital GPS receiver)

21 Milestone one, challenge: signal to fingerprint traditionally perform PLI here (generic, digital GPS receiver)

22 Milestone one, challenge: signal to fingerprint traditionally perform PLI here but (generic, digital GPS receiver)

23 Milestone one, challenge: signal to fingerprint traditionally perform PLI here but GPS: 1. multiple, distinct signals (generic, digital GPS receiver)

24 Milestone one, challenge: signal to fingerprint traditionally perform PLI here but GPS: 1. multiple, distinct signals 2. low-power (generic, digital GPS receiver)

25 Milestone one, challenge: signal to fingerprint traditionally perform PLI here but GPS: 1. multiple, distinct signals 2. low-power 3. high bandwidth (generic, digital GPS receiver)

26 Milestone one, challenge: signal to fingerprint traditionally perform PLI here but GPS: 1. multiple, distinct signals 2. low-power 3. high bandwidth traditional fingerprinting captures noise (generic, digital GPS receiver)

27 Progress: Milestone one: acquisition platform setup/configuration 1. Ettus Research X300 SDR 2. GNU Radio GNSS-SDR Concurrent locks: mobile, outdoor platform 4. Defective board & software bugs

28 Progress: Milestone one: acquisition platform setup/configuration 1. Ettus Research X300 SDR 2. GNU Radio GNSS-SDR Concurrent locks: mobile, outdoor platform 4. Defective board & software bugs Milestone one: ongoing 1. Tap on GNSS-SDR s integrate & dump (save output to disk) 2. Fingerprint for satellites 3. Code inspection/debugging

29 Progress: Milestone one: acquisition platform setup/configuration 1. Ettus Research X300 SDR 2. GNU Radio GNSS-SDR Concurrent locks: mobile, outdoor platform 4. Defective board & software bugs Milestone one: ongoing 1. Tap on GNSS-SDR s integrate & dump (save output to disk) 2. Fingerprint for satellites 3. Code inspection/debugging Milestone three: machine learning/pattern recognition for identification 1. fingerprint individual satellites or satellite vs. non-satellite?

30 Progress: Milestone one: acquisition platform setup/configuration 1. Ettus Research X300 SDR 2. GNU Radio GNSS-SDR Concurrent locks: mobile, outdoor platform 4. Defective board & software bugs Milestone one: ongoing 1. Tap on GNSS-SDR s integrate & dump (save output to disk) 2. Fingerprint for satellites 3. Code inspection/debugging Milestone three: machine learning/pattern recognition for identification 1. fingerprint individual satellites or satellite vs. non-satellite? Milestone four: injection platform 1. GNU Radio GPS-SDR (signal generation) 2. GNU Radio Blade GPS (signal replay) 3. Spoof location (GNSS-SDR & hw receiver)