GNSS AUTHENTICITY VERIFICATION USING GNSS/INS COUPLING FOR VEHICULAR NAVIGATION

GNSS AUTHENTICITY VERIFICATION USING GNSS/INS COUPLING FOR VEHICULAR NAVIGATION Al Broumandan, Ranjeeth Sddaatte and Gérard Lachapelle PLAN Group, Unversty of Calgary, 2500 Unversty Dr., NW, Calgary, AB, Canada ABSTRACT Due to rapdly ncreasng applcatons of GNSS dependent systems, motvaton has ncreased to spoof these sgnals for llegal or covered transportaton and msleadng recever tmng used by crtcal nfrastructure. Hence, detecton and mtgaton of spoofng attacs has become an mportant topc. Several contrbutons on spoofng detecton have been made, focusng on dfferent layers of a GNSS recever. Ths paper focuses on spoofng detecton utlzng self-contaned sensors, namely IMUs and vehcle ometer outputs. A spoofng detecton approach based on a consstency chec of GNSS and IMU/ometer mechanzaton s proposed. To detect a spoofng attac, the proposed meth analyses GNSS and IMU/ometer measurements ndependently durng the observaton wndow and cross checs the soluton provded by GNSS and INS/ometer mechanzaton. The performance of the proposed meth has been verfed n real vehcular envronments. 1. INTRODUCTION Spoofng sgnals are desgned to mslead a recever by generatng synchronzed navgaton ces leadng to counterfet navgaton solutons. Hence, detecton and mtgaton of spoofng attacs has become an mportant topc. Several contrbutons on spoofng detecton topc have been made focusng on dfferent layers of a GNSS recever ncludng antenna, IF sample, acquston, tracng and navgatons layers. The spoofng detecton technques mplemented n the pre-despreadng and sgnal processng layers of a GNSS recever are effectve and can detect spoofng attacs faster than the meths mplemented n the navgaton layer. However, these technques requre several mfcatons n the current desgn of recevers. Several spoofng detecton meths mplemented n the navgaton and measurement layers have been proposed. Jafarna et al (2013) mplemented a poston soluton authentcty verfcaton technque based on cloc bas varaton analyss of a movng recever. It s shown that n the presence of a spoofed poston soluton, the recever antenna moton wll hghly affect the cloc bas of the recever and ths could reveal the presence of spoofng sgnals. Ths meth s not effectve n scenaros where the spoofer and the target recever are located on the same platform. Jafarna et al (2016) proposed a spoofng detecton metrc usng carrer phase measurements wth multple recevers. Ths meth detects and classfes fae measurements based on ther tme nvarant carrer phase double dfferences. The proposed detecton procedure s based on a combnaton of GLRT and graph theory formulated to classfy counterfet and authentc sgnals. In addton to the above standalone approaches, spoofng attacs can be detected by checng the consstency of the navgaton solutons under test wth other reference sources. Consstency checs can be performed n dfferent ways ncludng ntra-system, nter-system, mult-frequency and mult-sensor approaches. In the ntra-system consstency chec the presence of spoofng sgnals can be detected by montorng the consstency of the ce and carrer Doppler or by montorng the carrerto-nose rato. Upon the advent of dfferent cvlan GNSS constellatons, mult-constellaton recevers are now common for cvlan applcatons. A mult-constellaton recever can be desgned to perform varous nter-system cross-checs among dfferent sgnal ensembles n order to verfy the authentcty of receved sgnal sets (Humphreys 2012). Mernzed GNSS systems transmt cvlan sgnals n dfferent frequency bands. From a spoofer s vewpont, t s consderably more dffcult/costly to smultaneously spoof many frequency bands. Therefore, a mult-frequency GNSS recever can perform some cross checs to verfy the authentcty of receved sgnal sets. Augmentng data from auxlary devces such as IMUs can help the target recever to dscrmnate aganst the spoofng threat (Gao & Bobye 2013, Nedermeer et al 2012, Nedermeer et al 2010, Whte et al 1998). In addton, a recever can compare the soluton extracted from receved sgnals to poston and navgaton solutons obtaned by other means, e.g. moble networs or W-F access ponts. Therefore, f the confdence regon of dfferent solutons does not have an ntersecton, there s a hgh lelho of a spoofng attac. Khanafseh et al (2014) proposed an ntegrated GPS/INS navgaton system to detect a spoofng attac based on RAIM concept. The ntegrty rs has been evaluated n the presence of hgh-end and low-end INS systems and t s shown that the proposed approach s able to successfully detect spoofng attacs that do not have prevous nowledge of the recever s trajectory. Swasze et al (2014) have used shpboard IMU measurements to detect the presence of spoofng sgnals. Ther proposed approach compares the relatve platform moton estmates provded by a shpboard recever to the ones provded by the onboard IMU. It s shown that hgh frequency ptch/roll moton of the shp caused by mld sea condtons can lead to successful spoofng detecton. 6 th ESA Internatonal Colloquum on Scentfc and Fundamental Aspects of the Galleo, 25-27 October, Valenca, Span Page 1 of 8

Mancam & O'Keefe (2016) mplemented a tghtly coupled GNSS/INS approach to detect spoofng sgnals; the meth detects spoofng attacs by montorng the resduals and sets the spoofng detecton based on mnmum detectable blunder test statstcs; t assumes that a subset of vsble PRNs s spoofed at a gven tme whch lmts ts practcalty. Heren, realstc spoofng scenaros are mplemented to establsh a foundaton to analyze the proposed meth s senstvty to a spoofng attac. Then a spoofng detecton approach based on consstency chec of GNSS and INS/ometer (o) mechanzaton s proposed. To detect a spoofng attac the proposed meth analyzes GNSS and IMU/o measurements durng an observaton wndow and cross checs the soluton provded by GNSS and INS mechanzatons. Here two gven trajectores are compared: The INS/o trajectory and the GNSS trajectory. INS ntegrated wth vehcle speed s not vulnerable to jammng and spoofng. However, le all dead reconng devces t s susceptble to errors nduced by sensor errors, especally drft n the case of INS. The spoofng detecton observaton wndow s defned based on the INS characterstcs and the specfc applcaton. The consstency chec of the vehcle speed from ometer and GNSS based speed s also consdered as a metrc to detect the spoofng attac. GNSS sgnal authentcty s verfed f ts navgaton solutons are consstent wth solutons provded by INS. If the sgnal authentcty s verfed, GNSS/INS/ometer loose couplng s performed to remove IMU errors. 2. SPOOFING Detecton methologes usng IMU/ODO Snce the structure of cvlan GNSS sgnals s publc, a spoofer can generate a waveform wth a structure smlar to that of the authentc sgnals. The spoofng source generates multple consstent PRN sgnals that lead to a fae navgaton soluton. Unle other types of nterference sgnals, spoofng and meaconng sgnals do not deny the postonng capablty of a recever but nduce a fae poston. The spoofng sgnal and ts effect on the correlaton outputs depends on the spoofngauthentc sgnals relatve Doppler, delay and ampltude values. Another spoofng scenaro whch s rarely dscussed n the lterature s the case that the spoofer has access to the GNSS recever antenna n whch case t may deny authentc sgnal recepton by coverng the antenna and feedng the spoofng sgnal. In such a case, most the proposed spoofng detecton meths n varous sgnal processng layers of a recever are not effectve. However, IMU/o-based spoofng detecton can be effectve n such spoofng scenaros. Nevertheless, the ablty to detect spoofng usng ths approach deterorates due to IMU drft whch s a functon of the IMU specfcatons. Hence, spoofng detecton performance becomes a functon of the IMU/ometer performance and relatve dynamcs of the spoofng and authentc vehcles. The relatve authentc-spoofng dynamcs has a major mpact on detecton performance. Trajectory matchng based on relatve postonng and headng matchng between GNSS and IMU/ODO can be used to detect an attac (Georgy et al 2010). Another approach s the dstance or velocty comparson. The advantage of ths approach s that the dfference between true poston and headng versus the estmated trajectory s not crucal snce the compared data s an absolute value. For speed matchng the measured speed by the ometer and that of GNSS are compared. The advantage of usng ometer and GNSS speeds s that durng normal operaton condton both measurements are suffcently accurate. 3. REDUCED IMU and ODO (RIO) MECHANIZATION FOR GNSS SPOOFING DETECTION INS and ther solutons are self-contaned and provde hgh rate measurements. They have go short-term accuracy and provdes atttude nformaton n addton to poston and velocty. However, long term errors grow wthout bound as the nertal sensor errors accumulate due to ntrnsc ntegraton n the navgaton algorthm. On the other hand, navgaton soluton based on GNSS needs a drect lne of sght to at least four satelltes, whch s not always possble due to satellte sgnal blocages by tall buldngs, trees and tunnels. Tang advantage of the complementary characterstcs of these systems, ther ntegraton overcomes ther ndvdual drawbacs and provdes a more accurate and robust navgaton soluton than nether could acheve. The ntegrated navgaton soluton s a contnuous hgh data rate system that provdes a full navgaton soluton (poston, velocty and atttude) wth mproved accuracy n both the short and long term. GNSS prevents the nertal soluton from drftng and INS provdes contnuty n the navgatonal soluton, atttude nformaton, and brdges GNSS sgnal outages. In the loosely coupled ntegraton case, GNSS navgaton solutons and INS mechanzaton operate ndependently and provde separate navgaton solutons. To mprove soluton, the poston and/or velocty from GNSS s fed to some optmal estmator, usually a Kalman flter. The INS soluton s also suppled to the flter, whch taes the dfference between the two, and based upon the error mels, estmates the INS errors. In general, two types of feedbac approaches are mplemented, namely open-loop and closed-loop. In the open-loop confguraton the poston, velocty and atttude correctons are performed n the ntegrated navgaton soluton (external to the INS) where the estmated errors are subtracted from the INS soluton at each teraton. In such a case, the corrected KF states are not fed bac to the INS to correct for ts drft. In the closed-loop confguraton, the error estmates from KF are fed bac n order to correct the INS errors. The output of the INS forms the ntegrated soluton. KF poston, velocty and atttude estmates are reset to zero after the error estmates are fed bac. In the conventonal mplementaton of GNSS/INS, the ntegraton flter runs n predcton me wth the predcted values of the INS durng the GNSS outages. In open sy condtons when the recever antenna has 6 th ESA Internatonal Colloquum on Scentfc and Fundamental Aspects of the Galleo, 25-27 October, Valenca, Span Page 2 of 8

access to LOS sgnals, ether the ntegrated or the unaded GNSS soluton can be used. More specfcally, under nomnal operaton condtons the sgnal and measurement qualty of GNSS are very hgh and the KF puts more weght on the GNSS measurements than on predcton. As mentoned prevously, the ntegraton of GNSS/INS s benefcal n GNSS outage scenaros. However, n the case of a spoofng attac the reasonable assumpton s that the recever antenna receves spoofed GNSS sgnals wth a hgh sgnal strength, resultng n a fae navgaton soluton. In such case, GNSS/INS ntegraton under a closed loop scenaro wth an update rate of a few Hz wll not help to detect the spoofng attac. Ths s due to the fact that n the closed-loop ntegraton, the ntegrated KF soluton s estmated accelerometer and gyroscope errors are fed bac to correct the IMU measurements. These errors are appled on every teraton of mechanzaton, wth feedbac from KF percally updatng the accelerometer and gyroscope errors. Snce the relatve dynamcs between spoofed GNSS solutons and that of INS s probably not sgnfcant for a vehcle durng an update nterval (a few Hz), the spoofng attac may not be detected. The advantage of the open loop confguraton s that n addton to the ntegrated navgaton soluton, the raw INS soluton can support ntegrty montorng and spoofng detecton snce the nertal based navgaton solutons are not affected by the attac. However, due to INS drft, the errors n the INS grow wth tme to the pont that the authentcty verfcaton usng ths approach s not relable. Consderng ths, a possble approach to detect the attac and enhance the performance of the authentcty verfcaton procedure s to use a closed loop confguraton wth a shorter error feedbac update rates. In such a case, the recever wll operate under normal condtons and an addtonal loop wll montor the ntegrty of the soluton. The ntegrty montorng loop taes raw IMU measurement outputs and provdes navgaton solutons wthout the error correcton form GNSS measurements. In ths case, the ntegrty montorng loop error correcton update rate s much smaller than the KF ntegraton update rate. The update rate of the ntegrty montorng loop should be tuned based on the IMU grade and specfc applcaton requrements. To av false spoofng detecton due to IMU drft, t s mportant to characterze the performance of the authentcty verfcaton loop durng the observaton nterval and set a proper detecton threshold. Reduced IMU and ometer (RIO) mechanzaton, whch s sutable for any wheel-based platform, s consdered for GNSS navgaton soluton authentcty verfcaton. RIO mechanzaton elmnates several error sources that exst when usng a tradtonal full IMU, especally low-cost Mcro-Electro-Mechancal Systems (MEMS) grade sensors, and consequently reduces navgaton soluton dvergence durng GNSS outages and enhances the performance of the authentcty verfcaton procedure. The sgnfcance and the mportance of the RIO soluton over full IMU s dscussed by Noureldn (2013). Fgure 1: Loosly coupled RIO mechanzaton for spoofng detecton Fgure 1 shows the authentcty verfcaton loop consderng RIO mechanzaton wth loosely coupled RIO/GNSS ntegraton. The forward velocty nformaton along wth raw accelerometer and gyroscope measurements are fed to the RIO mechanzaton to provde relatve poston, velocty and headng nformaton. The authentcty verfcaton unt compares the navgaton soluton of the GNSS wth that of RIO durng the observaton nterval. If the soluton authentcty s verfed. RIO solutons wll be corrected by GNSS solutons, and accelerometer and gyro errors wll be corrected by the navgaton KF. In the followng, the RIO mechanzaton and loose couplng mel used are descrbed. The local-level frame s the ENU frame wth axes along east, north and vertcal (up) drectons. The sensors measurements provded by the gyroscope, the two accelerometers and the ometer comprse the control nputs represented by the vector o o x y z T u = v, a, f, f, ω (1) o where v s the speed from the ometer output, the acceleraton from the vehcle ometer output, and y f are the x and y accelerometer outputs and o a s z x f ω the vertcal gyroscope output. The vertcal gyroscope s mounted n algnment wth the vertcal axs of the vehcle and two accelerometers are mounted n the transversal and forward drectons. The rate gyroscope s used to measure headng change of the vehcle and two accelerometers to measure changes n roll and ptch of the vehcle. The vehcle atttude nformaton along wth ometer derved forward speed are used to compute the user veloctes n the ENU frame. Subsequently, the user poston s obtaned by ntegratng the velocty soluton. The mechanzaton equaton to compute the vehcle atttude nformaton s gven by f + v ω x o z = sn g cos p r p f y o = sn a g v tanϕ A A t t t E z e = ω + ω snϕ 1 + RN + h where r, p, A are the roll, ptch and headng of the vehcle. The user velocty n ENU frame can be obtaned (2) 6 th ESA Internatonal Colloquum on Scentfc and Fundamental Aspects of the Galleo, 25-27 October, Valenca, Span Page 3 of 8

as E o v = v sn A cos p N o v = v cos A cos p U o v = v sn p User poston can be obtaned as N v ϕ = ϕ 1 + t R + h E v λ = λ + t cosϕ U M ( R + h ) h = h + v t N where ϕ, λ and h are lattude, longtude and heght. In the loose couplng approach, GNSS and RIO navgaton solutons are combned n a navgaton KF. Both system mel and measurement mel are nonlnear. Snce lnearzaton s performed, only the perturbatons n the states are computed n the flter. The lnearzed dscrete system mel s gven by δ x = Φ δ x + G W (5) where δ x s the 9x1 error state vector at tme epoch gven by {,, h, v E, v N, v U, A, S, z } δ x = δφ δλ δ δ δ δ δ δ δω δφ, δλ, δ h are the poston vector components n the geetc coordnate frame, δ v E, δ v N, δ v U are the velocty vectors n East-North-Up (ENU) coordnate frame, δ s S the azmuth angle, δ s the scale factor of z ometer, δω s the vertcal gyroscope drft, Φ s the state transton matrx from tme epoch -1 to, G s the shapng matrx or nose couplng matrx and W the zero mean unty varance whte nose. The lnearzed dscrete system mel s gven by Equaton 6 ADD REFERENCE where, γ and γ ωz are the nverse of autocorrelaton tme for ometer and (3) (4) A 2 2 gyroscope stochastc errors, σ and σ ωz are the varance of ometer and gyroscope nose (Noureldn 2013). The lnearzed dscrete measurement mel s gven by δ z = Hδ x + ε (7) where δ z s the measurement vector gven by GPS RIO φ φ GPS RIO λ λ GPS RIO h h δ z = E, GPS E, RIO v v (8) N, GPS N, RIO v v U, GPS U, RIO v v H s the desgn matrx and ε represents measurement nose. 4. DATA COLLECTION SCENARIO AND SPOOFING DETECTION Actual GPS and IMU data was collected n a suburban area of Calgary. The expermental setup used s shown n Fgure 2. Data was collected usng tactcal and MEMS grade IMUs whose specfcatons are gven n Table 1. A navgaton grade GNSS antenna was mounted on top of a vehcle and GNSS sgnals were passed to a two-way spltter. One branch was connected to NovAtel SPAN/LCI GNSS/INS system usng the NovAtel s Inertal Explorer software n dual-frequency RTK me wth forward and bacward smoothng to provde a sub-metre reference trajectory. The other branch was connected to a u-blox recever to provde GPS trajectores. The IMUs used consst of 3-axs accelerometers and rate gyroscopes. The z gyroscope was algned wth the vertcal axs of the vehcle by frame and used for computng the azmuth angle. Two trajectores were consdered authentc and spoofng. The IMU outputs of the authentc trajectory match wth those of the GPS dynamcs. t δφ 1 0 0 0 0 0 0 0 Rm + h δφ δλ t δλ 0 1 0 0 0 0 0 0 δ h ( 1 ) cos( 1 ) Rn + h φ δ h E δ v 0 0 1 0 0 t 0 0 0 E δ v N δ v 0 0 0 0 0 0 v cos( A ) cos ( p ) t v sn ( A ) cos( p ) = N t 0 δ v + U U δ v 0 0 0 0 0 0 v sn ( A 1 ) cos ( p 1 ) t v cos( A 1 ) cos ( p ) t 0 δ v δ A 0 0 0 0 0 0 0 v sn ( p ) t 0 δ A δ S 0 0 0 0 0 0 1 0 0 δ S z 0 0 0 0 0 0 0 1 γ t t z δω δω 0 0 0 0 0 0 0 0 1 γ ωz t 0 0 0 0 0 (6) 0 0 2 2γ σ t 2 2γ ωzσ ωz t 6 th ESA Internatonal Colloquum on Scentfc and Fundamental Aspects of the Galleo, 25-27 October, Valenca, Span Page 4 of 8

The x and y accelerometers were algned wth the forward and transversal axs of the vehcle by frame and used to calculate ptch and roll respectvely. The nertal sensors measurements are n the by frame. A rotaton matrx from the by frame to the local level frame was estmated at the begnnng. In nematc me, the GPS velocty nformaton was to provde an ntal atttude. An on-board dagnostcs (OBD) devce was connected to the car OBD port and used to collect vehcle speed va a LG G3 cell phone. A cell phone applcaton namely Torque was used to collected vehcle speed. Durng the data collecton process, the cell phone s varous sensor outputs ncludng GNSS navgaton solutons and raw IMU values were also logged. Destnaton Spoofng Authentc Start 200 m Fgure 3: Data collecton scenaro The specfcatons of the IMUs used are provded n Table 1. Fgure 3 shows data collecton trajectory and envronment. Two trajectores were consdered n ths scenaro namely authentc and spoofng. They both start from the same locaton and reach the same destnaton from two dfferent trajectores. The two trajectores overlapped n some parts of the ntal path and then separated and joned agan at destnaton. 5. Fgure 2: Data collecton setup Table 1. IMU error characterstcs. IMU Tactcal MEMS 1 (AD16375) MEMS 2 (MPU650) Parameter Accel bas Accel whte nose Gyro drft Gyro whte nose Value 0.5 mg 40 µg/ Hz 0.3o/hr 0.001 o /s/ Hz Accel bas 16 mg Accel whte nose 60 µg/ Hz Gyro drft 12o/hr Gyro whte nose 0.02 o/s/ Hz LG G3 cellphone SPOOFING DETECTION RESULTS Spoofng detecton performance by comparng reducednertal and ometer (RIO) trajectory to that of GPS s analysed. As mentoned earler there are two man approaches to combne GPS/RIO, namely closed and open loops. In the open loop structure, there are three solutons, namely GPS, RIO and GPS/RIO combned solutons. In the GPS/RIO soluton the RIO errors n each update nterval are corrected wth GPS measurements. Hence, n presence of a spoofng attac wth hgh sgnal power, the GPS/RIO ntegraton can be easly spoofed. On the other hand, comparng GPS solutons wth RIO mechanzaton for a long per of tme s not practcal due to RIO errors (drft and ntal errors). Therefore, for GNSS solutons authentcty verfcaton purpose, the correcton update rate for RIO mechanzaton s adjusted for a gven applcaton n the authentc case. In such a case, the navgaton soluton drft usng RIO s bounded and at the same tme the solutons are not contamnated wth spoofed GPS correctons. For spoofng detecton, the trajectory provded by a GPS recever s compared to that of the RIO mechanzaton. It s assumed that the ntal poston and headng nformaton used s provded by GPS. Spoofng s detected f the nter-system trajectory dfference s hgher than a predefned threshold. Fgure 4 shows pure RIO trajectory estmaton for the 6th ESA Internatonal Colloquum on Scentfc and Fundamental Aspects of the Galleo, 25-27 October, Valenca, Span Page 5 of 8

three dfferent IMUs used n the data collecton n the authentc scenaro. In ths case RIO was ntalzed wth correct poston and headng nformaton and the navgaton solutons were not corrected usng GPS. As shown, the RIO trajectores follow the reference trajectory s pattern, however, the errors n the trajectory estmaton dffer for varous sensors. Fgure 5 shows horzontal errors for varous IMUs shown n Fgure 4. As expected the tactcal grade IMU has the best performance and provdes about 50 m horzontal accuracy after 300 s. The performance of MEMS 2 IMU s comparable to that of the tactcal one for the ntal 150 s of data and t s much better than MEMS 1. Fgure 5 also shows results wth a spoofng detecton threshold set at 10 m. Ths s an arbtrary threshold and can be adjusted based on the requred performance and applcaton. The montorng loop update nterval should be tuned to av false spoofng detecton due to the IMU errors n nomnal operaton condtons. As shown n Fgure 5, durng the frst 30 s of data, assumng correct ntal headng and poston values, all solutons meet the stated performance (horzontal errors below 10 m). Consderng these results, one may correct the RIO mechanzaton errors every 30 s where the GPS authentcty verfcaton process occurs durng or at the end of ths per. Fgure 6 shows the RIO mechanzaton for MEMS 2 IMU wth a 100 s update per to correct for IMU errors. Comparng the results of Fgure 4 wth that of Fgure 6, the horzontal trajectory errors are sgnfcantly reduced when usng the 100 s update rate. Fgure 7 shows the RIO mechanzaton error for dfferent update nterval (t u) values wth GPS measurements n the authentc case for MEMS 2 (cell phone) IMU. The error values are the dfferences between GPS and RIO solutons. As expected ncreasng the update nterval ncreases the errors. For t u=20 s, the error values exceed 10 m n a few epochs. Fgure 5: RIO mechnzaton error for three dffernet IMUs 2000 North (m) 1500 1000 500 RIO (MEMS2) RIO (Tactcal) RIO (MEMS1) reference 0 0 500 1000 1500 2000 East (m) Fgure 4: Standalone RIO mechanzaton for three dfferent IMU grades (350 s of data) Fgure 6: RIO mechanzaton trajectory wth 100 s correcton nterval for MEMS 2 (cellphone) IMU Fgure 8 shows horzontal trajectores for GPS, GPS/RIO (contnuously correctng RIO solutons) and RIO solutons wth correcton nterval of t u =20s n the spoofng case. The actual authentc reference trajectory s also demonstrated n the fgure. The GPS/RIO soluton s completely spoofed and ts trajectory matches that of the spoofed GPS solutons. Ths s due to the fact that GPS has hgh qualty measurements and KF puts more weghts on measurements from GPS. However, the RIO solutons wth t u =20s sgnfcantly devates from the spoofed GPS trajectory at epochs. 6 th ESA Internatonal Colloquum on Scentfc and Fundamental Aspects of the Galleo, 25-27 October, Valenca, Span Page 6 of 8

Fgure 9 shows the RIO mechanzaton errors for dfferent update ntervals (t u) n the spoofng case. The errors are the dfference between GPS and RIO solutons. Durng the frst 80 seconds from the begnnng of data the recever s not spoofed, hence spoofng detecton metrc outputs (error values) are almost below the threshold. However, once the spoofng attac begns, the error values sgnfcantly rse. As expected the hgher the update nterval, the larger the errors. t u=1 represents the conventonal GPS/RIS case. As shown the spoofng attac s not detectable n ths case whereas for other update ntervals consdered, the spoofng attac s successfully detected. Fgure 7: RIO horzontal error for varous update ntervals (tu) n the authentc case for MEMS 2 (cell phone) IMU North (m) 2000 1500 1000 500 RIO, t u =20 s GPS/RIO Reference Spoofed GPS 0 0 500 1000 1500 East (m) Fgure 8: Horzontal trajectory for spoofed GPS, GPS/RIO, RIO wth 20 s correcton update for MEMS 2 (cell phone) IMU 200 180 160 140 120 100 80 60 40 20 t u =20 s t u =10 s t u =5 s t u =1 s Threshold 0 0 50 100 150 200 250 300 tme (s) Fgure 9: RIO horzontal error for varous update ntervals (tu) n the spoofng case for MEMS 2 IMU Detecton performance s a functon of the relatve authentc and spoofng trajectores and consequently the horzontal error values shown n Fgure 9 vary as a functon of tme. For nstance, durng the tme per of 240-260 s the horzontal error for t u=5 s s below the detecton threshold and a spoofng attac durng ths per cannot be detected. Ths s due to the fact that the spoofng relatve trajectory matches that of authentc one durng ths per. 6. CONCLUSIONS A GNSS authentcty verfcaton approach based on ntegraton of an IMU and a vehcle ometer outputs was proposed. Contrary to conventonal GNSS/INS couplng when the INS errors durng go satellte vsblty are updated at each mechanzaton nterval (mechanzaton and error correcton rates are the same), here the authentcty verfcaton loop error correcton rate s much lower than that of the mechanzaton process. In such a case, the IMU/o navgaton solutons can be used to detect spoofng attacs durng each correcton nterval. As shown, the proposed meth performance usng nertal sensors s a functon of the relatve dynamcs between authentc and spoofng trajectores and sensor qualty. Some specfc moton features such as contnuous user velocty and headng changes (e.g. stop n traffc control lghts and turnng nto dfferent streets) provde addtonal features, resultng n better detecton performance. Actual measurements usng varous IMUs provde promsng results n detectng spoofng attacs n practcal vehcular scenaros. REFERENCES Gao, G., M. Bobye (2013) Pushng the Boundary of GNSS Inertal Systemsnto Interference and Jammed Envronments In proceedngs of ION Pacfc PNT, Honolulu, Hawa, Aprl 23-25, pp.411-418 Georgy J, Noureldn A, Korenberg M, Bayoum M (2010) Low-cost three-dmensonal navgaton soluton for RISS/GPS ntegraton usng mxture partcle flter. IEEE Trans Veh Technol 59(2):599 615 6 th ESA Internatonal Colloquum on Scentfc and Fundamental Aspects of the Galleo, 25-27 October, Valenca, Span Page 7 of 8

Humphreys, T. E., J. Bhatt, D. Shepard, K. Wesson (2012) The Texas Spoofng Test Battery: Toward a Standard for Evaluatng GPS Sgnal Authentcaton Technques, n Proceedngs of the 25th Internatonal Techncal Meetng of The Satellte Dvson of the Insttute of Navgaton (ION GNSS 2012), September 17-21, Nashvlle, TN, pp. 3569-3583 Jafarna, A., S. Daneshmand, A. Broumandan, J. Nelsen and G. Lachapelle (2013) PVT Soluton Authentcaton Based on Montorng the Cloc State for a Movng GNSS Recever n the European Navgaton Conference (ENC2013), Aprl 23-25, Venna, Austra, 11 pages Jafarna, A., A. Broumandan, and G. Lachapelle (2016), GNSS Sgnal Authentcty Verfcaton Usng Carrer Phase Measurements wth Multple Recevers, n NAVITEC2016, Noordwj, Netherlands, December 14-16 Khanafseh, S., N. Roshan, S. Langel, F. C. Chan, M. Joerger, and B. Pervan, (2014) GPS spoofng detecton usng RAIM wth INS couplng In Poston, Locaton and Navgaton Symposum-PLANS 2014, IEEE/ION (pp. 1232-1239) Mancam, S. and K. O'Keefe (2016) Usng Tactcal and MEMS Grade INS to Protect Aganst GNSS Spoofng n Automotve Applcatons, Proceedngs of ION GNSS+2016 (Portland, OR, 12-16 Sep), The Insttute of Navgaton, 11 pages Nedermeer, H., H. Becmann, B. Essfeller, O. Pozzobon, R. Grzeszczy, and T. Przybyla (2010) Detecton and Mtgaton of GNSS Decepton by Combnaton of Odometrc Dead Reconng and GNSS Observatons for Vehcles, n Proceedngs of the 23rd Internatonal Techncal Meetng of The Satellte Dvson of the Insttute of Navgaton (ION GNSS 2010), September 21-24, Portland, OR, pp. 1145-1156 Nedermeer, H., H. Becmann, and B. Essfeller (2012) Robust, Secure and Precse Vehcle Navgaton System for Harsh GNSS Sgnal Condtons, n Proceedngs of the 25th Internatonal Techncal Meetng of The Satellte Dvson of the Insttute of Navgaton (ION GNSS 2012), September 17-21, Nashvlle, TN, pp. 1589-1600 Noureldn A., Fundamentals of Inertal Navgaton, Satellte-based Postonng and ther Integraton, DOI: 10.1007/978-3-642-30466-8_4, _ Sprnger-Verlag Berln Hedelberg 2013 Swasze, P. F., S. A. Pratz, B. N. Arocho, K.C. Seals, and R. J. Hartnett (2014) GNSS Spoof Detecton Usng Shpboard IMU Measurements n ION GNSS+ 14, Tampa, FL, September 8-12, pp.745 758 Whte, N.A., P. S. Maybec, and S. L. Devlbss (1998) Detecton of Interference/Jammng and Spoofng n a DGPS-Aded Inertal System n IEEE Transactons on Aerospace and Electronc Systems, vol.34, no.4, Oct., pp.1208-121 6 th ESA Internatonal Colloquum on Scentfc and Fundamental Aspects of the Galleo, 25-27 October, Valenca, Span Page 8 of 8