GNSS Vulnerabilities Providing Maximum User Protection

Transcription

1 GNSS Vulnerabilities Providing Maximum User Protection Dr. Wolfgang Schuster Centre for Transport Studies (CTS) Department of Civil and Environmental Engineering Imperial College London, UK

2 Acknowledgments Prof. Washington Ochieng (Imperial College London) Prof. Izzet Kale (Westminster University, London) 2

3 GNSS Applications Telecommunication PRISONER TRACKING OIL+GAS HEALTH ANIMAL TRACKING Financial systems INFRASTRUCTURE Transport systems TRAVEL INFORMATION SCIENCE FREIGHT TRACKING LBS Power grids SPORT SPACE LBS AGRICULTURE 3

4 Background (1/3) GNSS Applications summary Position-Navigation-Time (PNT) vital for operation of infrastructure PNT derivatives: e.g. velocity, attitude. 900 Billion (6-7% of GDP) in Western Europe E.g. 94 Billion in the UK & increasing 4

5 Background (2/3) Vulnerabilities of GNSS assessed e.g. by: Imperial College London: e.g. SPACE, GAARDIAN, INSIGHT Royal Academy of Engineering, UK» GNSS: reliance and vulnerabilities» Extreme space weather: impacts on engineered systems & infrastructure Volpe National Transportation System Centre, DOT USA Department of Homeland Security, USA Numerous other organisations 5

6 Background (3/3) Conclusions of studies, e.g.: Often little or no non-gnss based back-ups Growing number of mission-critical systems with insufficient integrity Impacts of GNSS vulnerability not well understood (e.g. complex links) 6

7 Why is GNSS a challenge? Complexity control segment, comms, satellites, modelling, signal generation signal path effects, receiver hardware/electronics/algorithms anomalies or failures can occur at any stage Multiple users globally (including mission critical applications) Positioning/Navigation performance varies with: position of users and satellites in space and time Institutional control (some systems) 7

8 Providing maximum user protection? PNT requirements Failure Modes and Impacts Analysis (FMIA) Existing/Planned Protection Mechanisms Limitations? Current vulnerabilities Future Protection? 8

9 GNSS PNT Measures Navigation performance measures accuracy, integrity, continuity, availability and coverage Integrity ability to inform users in the event of a failure most directly related to mission criticality (e.g. safety) need for consensus on methods for performance specification need for appropriate test schemes (vital for certification) 9

10 GNSS PNT Requirements Application Domain Road Aviation Maritime Rail Timing Application Name Trip travel information Road intelligent speed assistance and lane control En-Route Navigation Accuracy Alarm Limit Integrity TTA Integrity Risk Continuity Availability (% per 30 days) Coverage 25m-100m? 10s?? 99 Global 0.01m-1m 1m 1s ?? Highways 0.4nmi (H) 1nmi (H) 15 s Global Mid-Air Refuel 0.01m (3D) 0.1m (3D)? 10-7?? Global Ocean Navigation Automatic Docking Pre-trip information Supervision to buffer stops Power Generation and Distribution Maintenance of International Time Standards 10m-100m (H) 0.1kts (S) 25m- 250m 0.01m-0.1m (H)? 100m 250m (or more) 10 s 10 s 60 s 10-4? 99.8 Global?? 99.8 Ports All 1m 2.5m 1s?? Terminal only 1µs NA NA NA NA 99 All 5ns NA NA NA NA 99 All 10

11 Providing maximum user protection? PNT requirements Failure Modes and Impacts Analysis (FMIA) Existing/Planned Protection Mechanisms Limitations? Current vulnerabilities Future Protection? 11

12 GNSS Failure Modes (1/10) Core System System-level Example failures: Clock jump/drift Orbit errors NAV data errors Power fluctuations Interfrequency bias Augmentations SBAS: GEO satellite clock jump, leading to a range error GBAS: Transmission failure leading to corruption of corrections and integrity messages ABAS: GPS and Inertial sensor data synchronization error leading to a position error Galileo: Incorrect integrity information, leading to the use of a failed satellite 12

13 GNSS Failure Modes (2/10) System-level Natural interference: space weather: solar flares / ionospheric scintillation Troposphere Other (unintentional) interference, e.g. New COM: e.g. LightSquared 4G Intentional interference Receiver noise Multipath 13

14 GNSS Failure Modes (3/10) Intentional Sources of Interference Jamming [1]: Receiver front-end saturated by unwanted strong signals, e.g. block receiver from acquiring PNT information. Disturbance [2]: Wanted signals distorted by unwanted signals Large position errors without warning AFFORDABLE and easily available! 1. Phillip W. Ward, P.E., GNSS Robustness: The interference challenge, ION GNSS proceedings National PNT Advisory Board, A National Security Threat: Recent Events and Potential Cures

15 GNSS Failure Modes (4/10) Intentional Sources of Interference (cont d) Spoofing: RX acquires and tracks fake signals e.g. GNSS simulator attack [1] Misleading information sent to HQ invisible unless appropriate detection in place Meaconing: locally re-broadcast GNSS signal false position/time (e.g. faulty antennae, bad re-radiator deployments) COURTESY - Chronos 1. Warner, J S. A Simple Demonstration that the Global Positioning System (GPS) is Vulnerable to Spoofing, The Journal of Security Administration 15

16 GNSS Failure Modes (5/10) Intentional Interference summary: Type Effects Impact Jamming Receiver stops working (loss of service) Continuity/Availability Disturbance Degraded performance Accuracy/Integrity Spoofing Degraded performance/mi Integrity Meaconing Degraded performance/mi Integrity 16

17 GNSS Failure Modes (6/10) Interesting headlines how real are the threats? March 06, 2011 newscientist.com February 22, 2012 zdnet.com UK GAARDIAN and Sentinel reveal GPS jammer use 17

18 GNSS Failure Modes (7/10) Interesting headlines how real are the threats? (cont d) February 22, 2012 wired.co.uk July 16, 2012 Inside GNSS 18

19 GNSS Failure Modes (8/10) Reasons for Intentional Interference Motivation of jamming, disturbance, spoofing and meaconing Fun Criminal / terrorist Commercial ( time sabotaging ) Privacy Protection Devices (PPDs) Others 19

20 GNSS Failure Modes (9/10) Receiver-level: System-level Hardware Software Position calculation least squares /Kalman Filter; Integrity calculation RAIM & variations: Model failure (e.g. normal distribution) Method failure (incorrect exclusion) Receiver-level Implementation failure (e.g. parameter setting) Spatial database failures Detailed list of can be found in e.g. Bhatti U., Ochieng W. Failure Modes and Models for Integrated GPS/INS Systems, THE JOURNAL OF NAVIGATION (2007), 60, TOPCON 20

21 GNSS Failure Modes (10/10) Operational Context relevant failure modes Domain Application Name Multipath Unintentional Interference Jamming Spoofing ROAD Aviation Maritime Trip travel information Very High Medium Low Low Road intelligent speed assistance and lane control Very High Medium Low Low En-Route Navigation Very Low Medium Low Low Mid-Air Refuel High??? Ocean Navigation Very Low Very Low Low Low Automatic Docking High Medium Medium Medium Rail Pre-trip information Medium Medium Very Low Very Low Supervision to buffer stops Very High Very High Low Low Timing Power Generation and Distribution Maintenance of International Time Standards Very Low Low Very Low Low Very Low Low Very Low Low 21

22 GNSS Failure Impacts (1/3) Severity: e.g. Financial loss Loss of life Positioning errors Timing errors Navigation errors Impacts (e.g. for mission-critical applications) are potentially devastating! 22

23 GNSS Failure Impacts (2/3) Manifestations measurement domain SVN23 (January 2004) SVN27 (August 2004) Chronos System Failures: Atomic Frequency Standard failures Multipath (gantry over highway) 15 minute duration RFI 17 minutes loss of GPS Chronos Space-weather induced disturbance Chronos 23

24 GNSS Failure Impacts (3/3) Manifestations spatial + positioning domains?? Global Regional Local System-level failures Space-weather Space-weather Intentional interference User receiver failure Requirements + Failure modes + risk of occurrence + failure impacts required protection architecture 24

25 Providing maximum user protection? PNT requirements Failure Modes and Impacts Analysis (FMIA) Existing/Planned Protection Mechanisms Limitations? Current vulnerabilities Future Protection? 25

26 Existing/Planned Protection (1/13) System upgrades: GPS - System Modernisation More robust design of hardware Three new signals: L2C, L5 and L1C L2C: BPSK; 10 satellites 24 (2018) L5: BPSK; higher bandwidth, power and advanced signal design 24 (2021) L1C: MBOC; 24 satellites (2026); interoperability with international GNSS 26

27 Existing/Planned Protection (2/13) System Upgrades: GPS - System Modernisation (cont d) Better signal reception: increased transmission power Txcesssurplus.com Better jamming resistance: 3 frequencies Better resilience: e.g. longer codes Increased robustness: multipath (e.g. L5 high chip rate) Better accuracy, e.g.: orbital/clock errors ionospheric delays by 3 carriers ambiguity determination widelane L2C and L5 27

28 Existing/Planned Protection (3/13) System Upgrades: Glonass Modernisation Satellite series Launch Current status n MHz (L1, FDMA) MHz (L1, CDMA) n MHz (L2, FDMA) 1242 MHz (L2, CDMA) MHz (L3, CDMA) MHz (L5, CDM A) Clock error GLONASS 1982 Out of service L1OF, L1SF L2SF GLONASS- M 2003 In service L1OF, L1SF L2OF, L2SF GLONASS- K In service L1OF, L1SF L2OF, L2SF L3OС GLONASS- K Design phase L1OF, L1SF L1OC, L1SC L2OF, L2SF L2SC L3OC GLONASS- KМ 2015 Research phase L1OF, L1SF L1OC, L1OCM, L1SC L2OF, L2SF L2OC, L2SC L3OC L5OC "O": open signal (standard precision), "S": obfuscated signal (high precision); "F":FDMA, "С":CDMA; n= 7, 6, 5,...,6 Glonass-K1 series use MHz for the L3OC signal 28

29 Existing/Planned Protection (4/13) New Systems GALILEO Beidou QZSS IRNSS Alltogether: 100+ MEO satellites 20+ GEO satellites New augmentations 29

30 Existing/Planned Protection (5/13) New Systems (cont d) ESA New signal structures (e.g. Binary Offset Carrier BOC) Multitude of signals Encryption (e.g. ESA GALILEO PRS) 30

31 Existing/Planned Protection (6/13) Benefits of new GNSS signals Greater satellite visibility more satellites, more signal power, longer codes 4 compatible and interoperable systems pilot signals, fast acquisition higher penetration, better interference protection Higher ranging accuracy less multipath, less ionospheric error better tropospheric modelling due to more satellites less orbit and clock errors New opportunities for integrity monitoring built-in integrity greater satellite visibility, system and signal diversity 31

32 Existing/Planned Protection (7/13) User-based mechanisms Antenna, e.g. Arrays Beam-steering Nulling Choke-ring Navsys Polarisation Digital Signal Processing (DSP) Filtering techniques spatial temporal adaptive tracking 32

33 Existing/Planned Protection (8/13) Integrity Monitoring Techniques SAIM SAIM Other Network Currently two main approaches system/ground level (GIC/SBAS/GBAS) sensor/user (R)AIM Future SAIM Ground/Space/User level integrity monitoring (apportionment of integrity risk?) 33

34 Existing/Planned Protection (9/13) Failure Integrity Monitoring: regional/local networks - augmentations GMV SBAS GLA OSNet Euroontrol GBAS 34

35 Existing/Planned Protection (10/13) Failure Integrity Monitoring: regional/local networks augmentations (cont d) SBAS/GBAS designed for: improved accuracy through differential corrections improved integrity (dedicated infrastructure) improved availability by additional ranging (SBAS) Integrity failures detected using ref. station location(s) alerts for major failures quality data sent to users for computation of Protection Level (PL) PL is compared to Alert Limit (AL) to determine compliance 35

36 Existing/Planned Protection (11/13) Local protection: User-based detection/mitigation (cont d) SOFTWARE Code-encryption Receiver Autonomous Integrity Monitoring (RAIM) hackingsec.in step-type failures Detection: sufficient redundancy and geometry Integration with other sensors 36

37 Existing/Planned Protection (12/13) Local protection: network based detection Specialised sensor networks to detect interference, e.g. in Europe Detection: jamming & timing anomalies Localisation Follow on from GAARDIAN Static + dynamic sensors 37

38 Existing/Planned Protection (13/13) Local Protection: Alternative Technologies Application-dependent Examples: Clock+sextant (open sea) Inertial Navigation systems (e.g. approach/landing) Radionavigation (e.g. ILS/MLS, VOR, DME) Multilateration (e.g. mobile phone transmitters) eloran 38

39 Providing maximum user protection? PNT requirements Failure Modes and Impacts Analysis (FMIA) Existing/Planned Protection Mechanisms Limitations? Current vulnerabilities Future Protection? 39

40 Limitations of existing protection (1/4) Alternatives Often performance insufficient for application (implementation issue? E.g. DR on bus) Robustness of integration? Failure Modes: Signal propagation failures poorly understood & under-researched 40

41 Lack of capability of software-based detection & identification 41 Limitations of existing protection (2/4) User-level: GNSS receivers still vulnerable to interference Low level of hardware resilience: existing methods costly and impractical (e.g. power); ability to detect, but not always to identify or efficiently protect. No intelligent receiver hardware nor software (cognitive capability) Profiling and learning capabilities?

42 Limitations of existing protection (3/4) System-level: Common mode failures: potential catastrophic failure back-ups?? problems with intentional interference remain 42

43 Limitations of existing protection (4/4) Existing monitoring networks Typically unable to detect local failures; Lack of intelligent hardware/software Unable to mitigate various failure types Overall: Lack of integration of networks with user Lack of mitigation capabilities No complete end-to-end process for protection 43

44 Providing maximum user protection? PNT requirements Failure Modes and Impacts Analysis (FMIA) Existing/Planned Protection Mechanisms Limitations? Current vulnerabilities Future Protection? 44

45 Future Protection (1/7) Networks Authentication of GNSS Signals Signals of Opportunity Multi-constellation Human Element 45

46 Future Protection (1/7) Multiple Systems and Signals GPS GLONASS GALILEO Beidou ESA QZSS IRNSS ESA 46

47 Future Protection (2/7) Networks Authentication of GNSS Signals Signals of Opportunity Multi-constellation Human Element 47

48 Future Protection (2/7) Resilient Receiver Antenna arrays (Phased Arrays, Adaptive Beamforming) h 1,1 h 1,2 h 1,M R x ( k 1 ) x ( k 2 ) w 1 w 2 + y(k) Intelligent sampling ADCs, e.g. automatic adjustment of dynamic range, bandwidth & centre frequency (k) x M R w M R Advanced DSP on signals from systems to cross-check validity Advanced use and deployment of profiling and historical analyses Adaptive Algorithm x ( k 1 ) T T T Intelligent RAIM w1;1 w1;2 w 1; m 48

49 Future Protection (3/7) Networks Authentication of GNSS Signals Signals of Opportunity Multi-constellation Human Element 49

50 Future Protection (3/7) Integrity Monitoring for Detection of Interference Adaptation of GAARDIAN System Potential options SERVER 1. Combine data from integrity monitoring stns within GIC, SBAS & GBAS Quality of Service Inputs from all probes Pro: systems already available Scope of event (local, regional, global)... Error type (as far as feasible) PROBE Con: low density of the monitoring stations monitors SV monitor Flag SV if NAV Event decision algorithm NAV message: validate most recent message 2. Exploit networks of opportunity orbit/clock error (e.g. OS, IGS, etc.) at server using NAV files from OS network and Internet IGS Ultra Rapid orbits Internet Clock Step error detector Pro: networks already available Clock Ramp/Acceleration error detector Flag if event Ionosphere monitor (proof-of-concept only) Cons: medium density of stations; dedicated processing facility; new Ionosphere-induced delays from OS data Not for real-time implementation investment 3. Deploy dedicated systems/probes either at locations of interest or a network Pro: flexible; UK lead in R&D (GAARDIAN) RINEX Navigation Files & Ultra Rapid orbit and clock prediction Con: new Flaginvestment requested info files about event (e.g. SV & error type) 4. Combination of 1, 2 and 3 Dual-frequency data from OS Pro: better performance stations Cons: complexity and new investment GAARDIAN Probe GAARDIAN Probe GAARDIAN Server GAARDIAN Server User User GAARDIAN Probe GAARDIAN Server IG Internet User IGS Server OS Server OS Server OS Server 50

51 Future Protection (4/7) Integrity Monitoring for Detection of Interference (cont d) Potential options (cont d) 5. User receiver level integrity monitoring [e. (R)AIM] Pro: Self contained; detection of local interference missed by a network BUT: requires resolution of issues (e.g. residual error distribution); characteristics of the effects of interference; need for appropriate test statistics 6. Combination of 1, 2, 3 and 5 Pro: Best protection? Con: Complexity 51

52 Future Protection (5/7) Integrity Monitoring - Conclusions Network level detection of interference feasible with networks of opportunity & dedicated systems (e.g. GAARDIAN) BUT: need for better understanding of characteristics of interference, network density a limitation; responsibility User level detection (with AIM) very good performance especially when integrated with other systems/sensors; local to the user BUT need to address issues with (R)AIM and characteristics of interference; local to the user Combined network level and user level detection (with AIM) potential to offer maximum protection 52

53 Future Protection (6/7) Networks Authentication of GNSS Signals Signals of Opportunity Multi-constellation Human Element 53

54 Future Protection (6/7) Regulation safeguard spectrum! enforcement An acquisition diagram showing two signals of the same PRN code with two different power strengths 54

55 Future Protection (7/7) Networks Authentication of GNSS Signals Signals of Opportunity Multi-constellation Human Element 55

56 Future Protection (7/7) Human Monitoring Common sense? Human behaviour and GNSS vulnerabilities??? Service provider awareness and perception? User awareness and perception? 56

57 Conclusions Better understand applications & requirements Understand failures & manifestations Intelligent user receiver: not only detection! identification and mitigation are key to ensure seamless operation! Networks maximise integration with userreceiver Legislation, governance, standards? Keep the human in the loop training + education! 57

58 Thank you Imperial College London and Westminster University invite members of the audience and beyond to join us in this massive undertaking Questions? Dr. Wolfgang Schuster BA-Phys (Hons), MA, DPhil-Phys (Oxon), CPL(A), AFRIN, MRAeS Assistant Professor Imperial College London Centre for Transport Studies Dept. Civil & Environmental Engineering Skempton Building London SW7 2AZ Tel: