全球导航卫星系统欺骗攻击及其防御技术综述

需积分: 13 113 浏览量更新于2024-07-17 收藏 596KB PDF 举报

“全球导航卫星系统（GNSS）欺骗攻击与对策调查分析” 全球导航卫星系统（GNSS）欺骗攻击是近年来引起广泛关注的安全问题。这种攻击涉及广播虚假的GNSS服务，对依赖这些系统的设备和服务构成威胁。本文的目的是填补现有文献中的三个空白：首先，详细评估针对最常引用的目标（如航空、航海、通信和定位服务等）的欺骗攻击具体威胁情况；其次，深入研究在实际环境中实施GNSS欺骗攻击所面临的诸多困难和挑战，这些因素往往被低估；最后，全面调查并评估已提出的各种抵御GNSS欺骗攻击的方法的有效性。 GNSS欺骗攻击可能带来的威胁多种多样，包括但不限于误导定位、导航错误、时间同步破坏以及对关键基础设施的影响。例如，航空领域中的飞行安全可能因为导航信息的篡改而受到严重威胁，可能导致飞机偏离预定航线。此外，商业和军事通信也可能因时间同步错误而受到影响，而依赖GNSS定位的移动网络服务可能会遭受服务质量下降甚至中断。在实施GNSS欺骗攻击时，攻击者需要克服的技术障碍包括精确的时间同步、信号强度控制和信号模拟等。这些挑战使得在真实世界中进行欺骗攻击并非易事，但随着技术的发展，这些障碍正逐渐被突破。为了对抗这种威胁，研究者提出了一系列防御策略。这些对策涵盖了硬件加固、软件算法改进、多源信号融合、信号完整性检测和行为分析等多个方面。硬件加固可以通过增强接收机的抗干扰能力来降低欺骗的成功率；软件算法改进则可能包括设计更复杂的伪随机码序列或采用机器学习方法识别异常信号；多源信号融合利用多个导航系统（如GPS、GLONASS、Galileo和BeiDou）的信息来相互验证，减少单点欺骗的可能性；信号完整性检测通过监测信号质量指标来发现潜在的欺骗活动；而行为分析则基于正常操作模式的模型，识别不一致的行为模式。尽管已有许多防御措施，但本文的结论指出，未来的研究方向仍然充满潜力。这可能包括更深入地探索物理层的防御机制，开发智能防御算法，以及研究如何将防御策略集成到现有的GNSS系统中，以实现更全面、更有效的保护。同时，提高公众对GNSS欺骗风险的认识，以及制定相应的法规和政策，也是防止这种攻击的重要步骤。在安全和隐私领域，对GNSS欺骗攻击的研究将继续深化，以应对不断演进的威胁。硬件和信号处理系统的改进，以及对移动网络和基于位置的服务的保护，都是未来研究和技术创新的关键领域。通过这样的努力，我们可以期望构建一个更加安全、可靠和抗干扰的全球导航卫星系统环境。

64:6 D. Schmidt et al.

United Kingdom [RAoE 2011, p.6]), simple jammers can be bought on the Internet for

as little as $15 [Chronos 2014]. Jammers are used to dodge tolls on motorways or to

hide from employers the actual route taken by company vehicles [Marks 2013; Collier

and Harris 2013]. When a GNSS tracking device is jammed, most devices report their

last known location rather than raise an alarm [Chronos 2014; Juneo 2015], although

some do [MeitrackUSA 2015]. Loss of lock occurs so often for legitimate reasons (going

through a tunnel, in heavily built-up areas) that sending an alarm signal at such times

would be more of an annoyance than a help. This weakness can also be exploited to

falsify the whereabouts of a truck with valuable cargo [Economist 2011; ABC 2013]

and can have an impact on vehicles in the vicinity, including emergency vehicles.

The most common jamming technique is to transmit a continuous or “chirping”

(sawtooth pattern) noise signal at the known GPS frequencies, especially L1 [Kar et al.

2014]. Alternatively the GNSS PRN codes can themselves be used as noise, without

any data, to pass through antijamming ﬁlters [RAoE 2011].

Jamming is also a serious threat to aircraft navigation, and networks and monitoring

systems are now being set up to detect illegal GPS jammers on a national scale in

countries like the United States and the United Kingdom [PNT 2010; Economist 2011;

Chronos 2014; Kar et al. 2014]. Jamming events detected by the UK Sentinel system

reported hundreds of incidents at a single provincial airport in its ﬁrst 3 months of

operation (October to December 2013) [Chronos 2014]. Isoz also reported hundreds of

GPS/Galileo interference events per day at Kaohsiung International Airport, Taiwan

[Isoz et al. 2011], and similar interference events have been detected at several

airports in the United States [Dierendonck 2012] and in the London ﬁnancial district

[Weiss 2013].

3.2. Spooﬁng

Spooﬁng is more subtle than jamming, and it relies on the generation of a counterfeit

signal with just the right strength to “lift” a timer or navigation receiver from the

legitimate signal. This can be done because, depending on the position of the satellite

in the sky and atmospheric conditions, GPS signal strength may vary legitimately

between –160dbW and –153dbW [GPS 1995], and the latter is ﬁve times the power of

the former. A power ratio (spoofed vs. authentic signal) of just 1.1 is sufﬁcient to lift

the receiver onto the spoofed signals [Shepard and Humphreys 2011].

The only detectable differences between legitimate satellite signals and spoofed ones

may be in discrepancies in timing, signal direction, strength, Doppler shift (relative

speed between satellite/spoofer and receiver), and signal to noise ratio, which are all

discussed in Section 6.

Most modern receivers are not equipped to detect these differences. The widespread

implementation of automatic gain control (AGC) in GNSS receivers adjusts the signal

gain to compensate for ﬂuctuating signal strength (see Section 6.1) but also makes

receivers more vulnerable to spooﬁng [Borowski et al. 2012; Jafarnia-Jahromi et al.

2013]. In addition, crucially, since the receiving antenna is typically located at one

point in space, a receiver has no way of telling whether the signal is coming from a

locally generated spooﬁng source or a legitimate satellite.

If the receiver is not secured, the spooﬁng signal can even be directly injected by

replacing the antenna cable with the spooﬁng source. Or, if the spoofer knows the

precise location of the target receiver he or she may more easily superimpose the

authentic signals with the spoofed ones. This will be necessary if the receiver is already

in operation and locked onto legitimate signals [G

unter 2014]. Alternatively, if precise

synchronization with legitimate signals is impractical, then stronger unsynchronized

signals may be used to overwhelm the legitimate ones. However, this will only be

ACM Computing Surveys, Vol. 48, No. 4, Article 64, Publication date: May 2016.

A Survey and Analysis of the GNSS Spooﬁng Threat and Countermeasures 64:7

effective if the receiver is starting up or is ﬁrst knocked out of lock by a jamming

attack.

3.2.1. Meaconing.

The simplest form of spooﬁng is meaconing, which is the capture

and retransmission of legitimate GNSS signals after a delay. Meaconing, however, is

difﬁcult in the case of the encrypted military signal, such as the GPS P(Y), because

it is modulated onto a far longer PRN sequence. Since receivers have their own clock,

they could easily detect the out-of-phase alignment of the W code [Humphreys 2013a].

Additionally, because the P(Y) GPS signal is transmitted well below the background

noise level, retransmitting it would require an accurate estimation of the secret W

code, which can be achieved via “semicodeless” techniques [Jung et al. 2003].

For the civilian signals, however, no such difﬁculty of spooﬁng arises. Since the

relative arrival times of the four signals are unchanged by the meaconing process, the

navigation solution will be that of the meaconer [Papadimitratos and Jovanovic 2008a;

Wesson et al. 2012]. The timing solution will likewise be that of the meaconer, plus the

time taken to retransmit the signals to the victim [Wesson et al. 2012].

However, meaconing does not seem suitable for attacks against timers. The ﬁrst

stage of an attack is to substitute the spoofed signal for the real one. Since a timer

already knows its own location, it would read the delayed time being transmitted by the

meaconer, resulting in a sudden shift in the timing solution equal to the time required

to retransmit the signal. This would clash with the known local time maintained by the

clock and could be used to raise an alarm. However, meaconing could also be performed

initially with a zero delay by predicting the signal values in advance and synchronizing

with the true signals [Wesson et al. 2012].

3.2.2. SCER.

A variation of meaconing called security code estimation and replay

(SCER) or “selective delay” [Kuhn 2004] involves the rebroadcast of individual satel-

lite signals after a delay [Wesson et al. 2012]. This can modify both the position and/or

timing solutions. An attacker could then manipulate the position solution only and so

avoid a time jump when starting an attack [Pozzobon 2011]. SCER is described more

fully in Papadimitratos and Jovanovic [2008a].

3.2.3. Other Forms of Spooﬁng.

Other forms of spooﬁng are categorized by the level of

sophistication. Humphreys and Motella divide these into “simplistic” (broadcast of ar-

bitrary GNSS signals without synchronization with legitimate signals), “intermediate”

(spooﬁng synchronized with legitimate signals), and “sophisticated” (using multiple

phase-locked intermediate spoofers) [Humphreys et al. 2008; Motella et al. 2010].

A spooﬁng device, called limpet spoofers [Lo and Enge 2010] can be attached to the

vehicle or timer it is intended to spoof. These devices overcome many of the practical

limitations on spooﬁng described in Section 5 but require both compromise of the

physical security of the receiver and, in practice, also a level of miniaturization that

has not yet been achieved.

4. SPOOFING/JAMMING SCENARIOS

A wide variety of spooﬁng threat scenarios are mentioned in the literature. This section

examines the main ones in sufﬁcient depth to assess the seriousness of the vulnerabil-

ities in practical scenarios. However, this must be combined with an assessment of the

practical limitations on carrying spooﬁng attacks, which is explored in the following

Section 5. The overall assessment of the vulnerabilities will be made at the end of that

section and summarized in Table I.

Jamming threats are also described only when they overlap with spooﬁng. Where

appropriate, a critical assessment of work done in each ﬁeld will be made. However,

most of these threats remain unexplored as separate research topics.

ACM Computing Surveys, Vol. 48, No. 4, Article 64, Publication date: May 2016.

剩余30页未读，继续阅读

zaosui

粉丝: 0
资源: 4

全球导航卫星系统欺骗攻击及其防御技术综述

GnssAnalysis

GNSS-spoofing-detection:GNSS欺骗检测系统

gnss-analysis:用于分析gnss算法和gnss数据的工具

gnss-sdr_manual.pdf git

java tle 计算卫星位置

android.hardware.gnss@2.0-service.rc在哪

ASR 5311gnss中libaboot_tiny.a的作用

android.hardware.gnss@2.0-service.rc在android11源码的哪个位置

ublox digtal iF filter

最新资源