Computer-implemented method for detecting GNSS signal spoofing, data processing device, computer program product, and computer-readable storage medium

Abstract

A computer-implemented method for detecting GNSS (Global Navigation Satellite System) signal spoofing. The method comprises the steps of: storing a sample sequence of a GNSS signal in a GNSS receiver, wherein the GNSS signal contains a predictable portion and an unpredictable portion (120) — the predictable portion contains predictable bits and the unpredictable portion contains unpredictable bits —; verifying the value of the unpredictable bit extracted from the unpredictable sample sequence (125); calculating first and second partial correlations between each unpredictable and predictable sample sequence and a locally stored replica of the GNSS signal (130); calculating a predefined metric from the partial correlation having complex values ​​(140); and comparing the predefined metric with a predefined threshold value (150). In a zero-delay retransmission attack, a spoofer must estimate the unpredictable bit introduced by the GNSS authentication protocol and thereby introduce distortion into the signal. This method detects such distortion to indicate whether the signal under analysis is spoofed or genuine.

Description

Technology Field

[0001] The present invention relates to a computer-implemented method for detecting GNSS (Global Navigation Satellite System) signal spoofing. Additionally, the present invention relates to a data processing device for performing the same task, a computer program product comprising instructions for both of the same task, and a computer-readable storage medium. Background Technology

[0002] GNSS (Global Navigation Satellite System) spoofing attacks are intentional interference aimed at manipulating the Position, Velocity, and Time (PVT) of a target GNSS receiver. Galileo has recently adopted the Open Service Navigation Message Authentication (OSNMA) feature (Fernandez-Hernandez, I., Rijmen, V., Seco-Granados, G., Simon, J., Rodriguez, I., & Calle, JD (2016). A Navigation Message Authentication Proposal for the Galileo Open Service. Journal of the Institute of Navigation (Spring), pp. 85-102). In this feature, the E1B signal component transmitted from the Galileo satellite includes unpredictable bits to allow the GNSS receiver to detect spoofing attacks.

[0003] Types of spoofing attacks are disclosed in "Detection strategy for cryptographic GNSS anti-spoofing" by Humphreys, Todd E. (IEEE Transactions on Aerospace and Electronic Systems 49, no. 2 (2013): 1073-1090). More specifically, a Security Code Estimation and Replay (SCER) attack comprising two steps is disclosed. First, the spoofer tracks the received signals from GNSS satellites and estimates the value of the unpredictable bit of each satellite within its line of sight. Second, in order to gain control of the tracking loop and, ultimately, the user's location, the spoofer generates a set of GNSS signals transmitted to a target GNSS receiver.

[0004] Since the spoofed signal must be synchronized with the authentic signal, generating a SCER attack is far from a trivial task for a spoofer. If the two signals are not aligned in the time domain when the spoofer initiates the attack, this can be detected by the receiver using the target receiver clock. This occurs because the stability of the receiver clock is known, and high fluctuations in the clock offset within a short time period in the PVT stage are known side effects that can be caused by the spoofer. Thus, to perform a SCER attack without being detected by the receiver clock, the spoofer can perform a zero-delay attack, which is based on transmitting a signal that is substantially synchronized with the authentic signal received by the target receiver. By doing so, the spoofer can control the target receiver.

[0005] Fern ndez-Hern "Galileo NMA signal unpredictability and anti-replay protection" by ndez, Ignacio, and Gonzalo Seco-Granados (2016 International Conference on Localization and GNSS (ICL-GNSS), IEEE, 28 June 2016) proposes using Navigation Message Authentication (NMA) to protect against replay attacks. In this method, the receiver stores the first sample of every unpredictable bit and thus generates a sequence in which the correlation gain would be lower if the tracked signal had been replayed by a spoofer. In other words, this method measures gain degradation when tracking unpredictable bits. This specification briefly proposes comparing gain based on an unpredictable sequence with gain based on a predictable sequence as a test statistic for detecting zero-delay attacks, but does not disclose the detection probability of such test statistic.

[0006] US 2011 / 102259 A1 discloses a method for countering GNSS spoofing by triggering an indicator when an outlier, such as a GNSS bit flip or an unexpected signal correlation profile, is identified.

[0007] Other methods for detecting GNSS signal spoofing are known in the art, such as those disclosed in US 7.956,803 and EP 3 495 848 A1, which rely on comparing the GNSS signal with information obtained from an alternative source.

[0008] US 7.956,803 discloses a method for detecting GNSS signal spoofing. The method comprises providing information to a radio device, such that the radio device determines a navigation data message from a reference network. The method further comprises receiving navigation data from a GNSS network and comparing the navigation data from the GNSS network with data derived from the reference network to determine whether one or more of the GNSS signals have been spoofed.

[0009] EP 3 495 848 A1 discloses a method for detecting GNSS signal spoofing by comparing a first GNSS signal with a second non-GNSS signal and using a threshold to detect signal spoofing.

[0010] The object of the present invention is to provide an improved method for detecting GNSS signal spoofing, in particular zero-delay SCER attacks.

[0011] The purpose is a computer-implemented method for detecting GNSS (Global Navigation Satellite System) signal spoofing, comprising: a) digitizing, acquiring, and tracking a GNSS signal from at least one GNSS satellite at a receiver—wherein the GNSS signal comprises a predictable portion and an unpredictable portion, wherein the predictable portion comprises predictable bits and the unpredictable portion comprises unpredictable bits—; b) a sample sequence of the predictable portion of the GNSS signal by the receiver and sample sequence of the above unpredictable part a) a step of storing; c) a step of verifying, by a receiver, the value of the unpredictable bit extracted therefrom the unpredictable sample sequence; d) a step by a receiver of the unpredictable sample sequence and a locally stored replica of the GNSS signal The first partial correlation between and predictable sample sequences and locally stored GNSS signal replicas Second partial correlation between cast:

[0012] ; and

[0013]

[0014] Calculate using, and the signs of the first partial correlation and the second partial correlation above Step of removing by - is the value of the above bit -; e) a predefined metric by the receiver A step of calculating from the first partial correlation and the second partial correlation—the predefined metric silver:

[0015] ;

[0016] ;

[0017] ; and

[0018]

[0019] It is any one of them, and is the number of unpredictable bits stored in step b) of the sample sequence, and And, is the coherent integration time for calculating partial correlation, and Igo is And, is a partial correlation of any part of the bit; and is achieved by a signal spoofing detection method comprising the step of comparing the predefined metric with a predefined threshold value to detect GNSS signal spoofing.

[0020] In one embodiment of the present invention, step b) is: a sample sequence of the beginning portion of an unpredictable bit, as an unpredictable sample sequence. Stores, as a predictable sample sequence, a subsequent part of the unpredictable bit (i.e., any other part excluding the initial part), e.g., a sample sequence of the termination part. Storing; or as an unpredictable sample sequence, a sample sequence at the beginning of the unpredictable bit Stores, as a predictable sample sequence, a sample sequence of predictable bits Includes storing.

[0021] In one embodiment of the present invention, is the duration of one of the stored unpredictable sample sequences (i.e., the duration of the sample taken from the start of the unpredictable bit), and is the duration of one of the stored predictable sample sequences (i.e., the duration of a sample taken at the end of an unpredictable bit or the duration of a sample from any other part of an unpredictable bit or a predictable bit). Preferably, and / or is greater than 0.05 ms, preferably greater than 0.1 ms, more preferably greater than 0.12 ms, less than 1 ms, preferably less than 0.75 ms, and more preferably less than 0.6 ms. The most preferred duration for the stored sample is 0.125 to 0.5 ms.

[0022] In one embodiment of the present invention, step b) comprises storing a sample sequence representing at least some of at least 50, preferably at least 100, more preferably at least 150, and most preferably at least 200 bits for the unpredictable sample and / or the predictable sample.

[0023] In one embodiment of the present invention, the metric under the assumption that the GNSS signal is authentic, based on a predefined threshold It is based on the cumulative density function, and preferably, the above-mentioned predefined threshold is set to a value that causes a false alarm probability of 0.02.

[0024] In one embodiment of the present invention, step f) comprises, preferably: authenticating the GNSS signal when signal spoofing is not detected, if the preset metric is less than a preset threshold; and authenticating the GNSS signal by detecting GNSS signal spoofing when the preset metric exceeds a preset threshold.

[0025] In one embodiment of the present invention, step a) comprises receiving a GNSS signal from at least four different GNSS satellites, wherein the GNSS signal comprises a spreading code and satellite data, and the satellite data comprises the unpredictable portion, and the method further comprises: g) calculating the arrival time of the GNSS signal from the spreading code by a receiver; and h) calculating the position, velocity, and time by demodulating the satellite data by a receiver.

[0026] In one embodiment of the present invention, step f) comprises, when signal spoofing is not detected, preferably: authenticating the GNSS signal when the predefined metric is less than a predefined threshold; and authenticating the GNSS signal by detecting GNSS signal spoofing when the predefined metric exceeds a predefined threshold, and steps g) and h) are performed only when at least four GNSS signals from at least four different GNSS satellites are authenticated.

[0027] In one embodiment of the present invention, step b) is a sample sequence of the unpredictable portion of the GNSS signal. It includes storing based on randomly selected unpredictable bits, or step d) comprises the unpredictable sample sequence and locally stored replicas of the GNSS signal The first partial correlation between It includes calculating based on a randomly selected subset of the above unpredictable sample sequence.

[0028] This objective is achieved according to the present invention by using a data processing device, in particular a GNSS signal receiver, comprising means for carrying out the aforementioned method.

[0029] This objective is achieved according to the present invention by using a computer program product comprising instructions that cause the computer to perform the aforementioned method when the program is executed by a computer.

[0030] This objective is achieved according to the present invention by using a computer-readable storage medium comprising instructions that cause the computer to perform the aforementioned method when executed by a computer.

[0031] It will be readily understood that one or more of the aforementioned embodiments can be easily combined with one another.

[0032] The inventors of the present invention realized that in a zero-delay SCER attack, a spoofer needs to estimate the unpredictable bit introduced by OSNMA with near-zero delay. Because of this fact, the spoofer introduces some distortion into the signal, which is based on current GNSS signal spoofing detection methods.

[0033] More specifically, due to the fact that the spoofer cannot know the value of the unpredictable bit a priori, the signal transmitted by the spoofer contains some error, particularly within the first few microseconds of the unpredictable bit. The inventors realized that this error can be detected by calculating a first partial correlation between the unpredictable sample sequence (particularly the beginning of the unpredictable bit) and the corresponding local replica, together with a second partial correlation between the predictable sample sequence (particularly the end of the unpredictable bit) and the corresponding local replica. In particular, various metrics were defined to compare the first correlation with the second correlation, and these metrics indicate whether the signal under analysis is being reproduced (i.e., spoofed) or is genuine (when compared with a threshold value).

[0034] A metric according to the present invention (i.e., based on partial correlation) is Fern ndez-Hern It was found that better results were achieved than the gain-based test metric proposed by ndez, Ignacio, and Gonzalo Seco-Granados in "Galileo NMA signal unpredictability and anti-replay protection" (2016 International Conference on Localization and GNSS (ICL-GNSS), IEEE, 28 June 2016) (as described in more detail below). Possible reasons for the improved performance may be that, while partial correlation is a complex value, gain (although derived from partial correlation) is a real value and therefore contains less information about the received signal.

[0035] Using the termination portion of an unpredictable bit as a predictable sample sequence is beneficial because time-dependent signal disturbance variations (e.g., multipath or unintentional interference) are minimized in this way.

[0036] Furthermore, using only randomly selected unpredictable bits or randomly selected stored unpredictable sample sequences improves the robustness of the detection capability of the GNSS signal spoofing method and prevents a spoofer from stealing information about which unpredictable bits were used in the detection method. Brief explanation of the drawing

[0037] The present invention will be further explained using the following description and the accompanying drawings. Figure 1 shows a typical example of a spoofing attack on a single satellite. FIG. 2 illustrates a flowchart showing a GNNS signal spoofing detection method according to the present invention. Figures 3a through 3c illustrate three different types of zero-delay SCER attacks. Figure 4 shows the detection probability versus the number of unpredictable bits for a false alarm probability of 0.02. In the upper graph, the user and the spoofer receive the signal at the same power. In the lower graph, the spoofer has a 3-dB advantage. Figure 5 shows the detection probability versus the number of unpredictable bits for a false alarm probability of 0.02. The spoofed signal is received at 3 dB more power than the actual signal. Figure 6 shows the detection probability versus the number of unpredictable bits for a false alarm probability of 0.02 and different window lengths (window length of 0.125 ms for the upper graph and window length of 0.500 ms for the lower graph). The spoofer has a 3-dB advantage over the user. Figure 7 shows the metric obtained from Monte Carlo simulation and theoretical simulation based on the Rayleigh formula. The probability of the null hypothesis and false alarm It shows a comparison between the probability density function under (top graph) and the probability of a false alarm (bottom graph). Specific details for implementing the invention

[0038] The present invention will be described with respect to specific embodiments and specific drawings, but the invention is not limited thereto and is limited only by the claims. The described drawings are schematic and non-limiting. In the drawings, the size of some elements may be exaggerated for illustrative purposes and is not depicted to scale. Dimensions and relative dimensions do not necessarily correspond to the actual scaled-down form for the practice of the invention.

[0039] Furthermore, in the detailed description and claims, terms such as first, second, third, etc. are used to distinguish similar elements and do not necessarily describe a sequential or chronological order. The terms are interchangeable where appropriate, and embodiments of the invention may operate in a different sequence than those described or illustrated herein.

[0040] Furthermore, terms such as top, bottom, upper, and lower in the detailed description and claims are used for illustrative purposes. Such terms are interchangeable where appropriate, and embodiments of the invention may operate in orientations different from those described or illustrated herein.

[0041] Furthermore, although referred to as "desirable," various embodiments should be understood not as limiting the scope of the invention, but as exemplary ways in which the invention may be implemented.

[0042] FIG. 1 illustrates a typical example of a spoofing attack on a satellite (10), and the following Table 1 provides definitions of each parameter shown in FIG. 1. A GNSS (Global Navigation Satellite System) satellite (10) broadcasts its own GNSS signal to be received by both a spoofer (20) and a GNSS receiver (30). Then, in order to take control of the GNSS receiver (30), the spoofer (20) generates and broadcasts its own GNSS signal.

[0043] variable definition of the actual signal received by the spoofer . of the actual signal received by the user . of the spoofed signal received by the user . The time during which the spoofer does not know the value of the unpredictable bit. The number of unpredictable bits used in spoofing detection techniques. The duration of the partial cross-correlation used at the start of the bit. The duration of the partial cross-correlation used at the end of the bit.

[0044] Table 1: Parameter definitions for spoofing zero-latency attacks on GNSS signals containing unpredictable symbols

[0045] Generally, spoofing detection is a binary hypothesis testing problem, which involves two hypotheses: namely, that a spoofer exists. or non-existent Under this, it can be modeled as follows:

[0046]

[0047] Here is the received signal, and is the number of satellites, and is the signal amplitude, and is the amplitude of the spoofing signal, and is an unpredictable bit, and is a pseudo-random noise code, and is the Doppler frequency, and is a phase, is the number of satellites used to perform a spoofing attack, and is an unpredictable bit transmitted by a spoofer, and is added white Gaussian noise.

[0048] Because the present invention primarily focuses on zero-delay SCER (Security Code Estimation and Replay) attacks, the spoofer Assuming that is used, but and Is and It may differ from the spoofed signal amplitude of our spoofer Controlling and this in some cases It is assumed that it can be made equal to, but this cannot align the carrier phase measurements to the actual values ​​because aligning the carrier phase measurements requires a very high level of accuracy. Two additional model assumptions exist. First, it is assumed that the receiver is tracking the true signal at the start of the attack; that is, the receiver starts in a controlled environment and performs acquisition. While spoofing is involved during acquisition, the GNSS receiver is in the tracking stage most of the time. Second, in a zero-delay SCER attack, it is assumed that the spoofer does not force reacquisition of the signal. A spoofer that forces reacquisition to take control of the loop would need to cause the signal to be lost for longer than one minute to properly estimate the unpredictable bit from the onset. Furthermore, under these conditions, taking control of the loop would result in a cycle slip, which can be detected by the GNSS receiver.

[0049] As previously mentioned, the inventors realized that the vulnerability of a zero-delay attack is that the signal transmitted by the spoofer contains some error in the first part of the unpredictable bit. In order not to be easily detected by the target receiver, the spoofer can primarily perform three types of attacks: an estimate attack, a random value attack, and a zero value attack, as illustrated in FIGS. 3a to 3c.

[0050] An estimate attack is illustrated in FIG. 3a. The spoofer attempts to estimate an unpredictable bit at each sample and introduces this estimate into the spoofed signal. By doing so, the first part of the bit will contain several changes in sign because it is not feasible to obtain a reliable estimate of the bit; however, after a reasonable number of samples, the spoofer provides the actual value of the unpredictable bit.

[0051] A random value attack is illustrated in FIG. 3b. A spoofer introduces a random value of 1 or -1 at the start of a bit for a short period of time, and when the spoofer obtains a reliable estimate of an unpredictable bit value, this is included in the remainder of the bit.

[0052] A zero-value attack is illustrated in Fig. 3c. A spoofer introduces a value of 0 at the start of a bit for a short period of time, and if the spoofer estimates an unpredictable bit value, this is included in the remainder of the bit.

[0053] In FIGS. 3A, 3B, and 3C, the period during which the spoofer generates random values ​​or zeros is the parameter defined in Table 1. W s We pay attention to the fact that...

[0054] FIG. 2 illustrates a flowchart (100) illustrating a GNSS signal spoofing detection method according to the present invention. In step 110, a GNSS receiver digitizes, acquires, and tracks a GNSS signal from at least one GNSS satellite, and the GNSS signal comprises a predictable portion and an unpredictable portion, wherein the predictable portion comprises predictable bits and the unpredictable portion comprises unpredictable bits. Methods for digitizing, acquiring, and tracking a GNSS signal are known in the art and will not be further described.

[0055] In step 120, the receiver samples a sequence of predictable portions of one or more tracked GNSS signals. and sample sequence of unpredictable parts It stores. In the embodiments described below, the stored sequence is part of the same unpredictable bit. In other words, the initial part of the unpredictable bit is the unpredictable sample sequence. It is stored as, and the end part of the unpredictable bit is a predictable sample sequence It is stored as. As previously mentioned, although a predictable sample sequence is obtained from unpredictable bits, the non-initial part of the unpredictable bits (i.e., not the beginning part) is typically accurately estimated by a spoofer and is therefore considered predictable.

[0056] In step 125, the receiver verifies the value of the unpredictable part of the signal (i.e., the bit value), that is, the value of the unpredictable bit from which the unpredictable sample sequence is extracted. More specifically, although usually all unpredictable bit values ​​will be verified, the method according to the present invention requires that only the unpredictable bit value from which the sample sequence is stored be verified. Then, computational resources within the receiver can be saved. This verification of the unpredictable part can be performed by a GNSS authentication protocol, such as the OSNMA function in Galileo.

[0057] In step 130, the receiver calculates a first partial correlation between an unpredictable sample sequence and a locally stored GNSS signal replica, and a second partial correlation between a predictable sample sequence and a locally stored GNSS signal replica. Preferably, step (130) occurs only after the unpredictable bit has been verified in step 125.

[0058] The calculation of partial correlation is performed in Step 132 using the following mathematical formula:

[0059] ; and

[0060] ,

[0061] Here and is of the received signal within one code period, respectively. and Unpredictable samples and predictable samples during, and are corresponding local replicas, and and Each indicates the total number of unpredictable and predictable stored samples. and Note that they do not need to be identical. In this way, partial correlation represents the first and last parts of the unpredictable bits.

[0062] In the subsequent step (134), the cross-part correlation corresponding to the after removing the code of the unpredictable bit is followed. and is defined as follows:

[0063] ; and

[0064] ,

[0065] Here is the value of the unpredictable bit (1, -1).

[0066] In step (140), the receiver uses several predefined metrics that use partial correlation after decoding. Calculate one or more of them. Several embodiments are described below.

[0067] An intuitive method for detecting spoofing is the Fern satellite code gain based on multiple unpredictable bits. ndez-Hern As proposed by ndez, Ignacio, and Gonzalo Seco-Granados in "Galileo NMA signal unpredictability and anti-replay protection" (2016 International Conference on Localization and GNSS (ICL-GNSS), IEEE, 28 June 2016), it would be to compare with gains obtained from various predictable bits. One way to perform this (i.e., gain comparison) is the partial correlations It is to calculate the ratio of the sums. Then, the absolute value of the ratio between the two metrics is calculated:

[0068] .

[0069] If there is a spoofer, It must be close to 0; however, if no spoofer exists, this must be close to 1. However, the metric One disadvantage is that if the received signal includes a spoofed signal and a true signal having different phase values, this H 1 It is possible to provide arbitrary values, and these different phase value behaviors are optimally represented in the complex part of the partial correlation having complex values.

[0070] To solve these problems, the present invention provides four different metrics based on comparing partial correlations having complex values ​​rather than gains having real values. It depends on. First metric R 2 Is:

[0071]

[0072] am.

[0073] R 2 The idea behind it is, if there were no spoofer It becomes close to 0, but if there is a spoofer This means that it becomes larger. Then, defining the detection threshold becomes easier.

[0074] Additional metrics are However, this consists of calculating the average of the differences between the initial and final partial correlations:

[0075] .

[0076] If is a large value, a spoofer exists. However, If the value is small, the spoofer does not exist.

[0077] Other interesting metrics is the carrier noise of the initial part of the unpredictable bit ( It deals with comparing the estimate to the estimate of another part that is considered predictable. To estimate this, a well-known NWPR (Narrow-band Wide-band Power Ratio) estimator can be used. Basically, this is the signal wideband power and that narrowband power It requires evaluating the ratio between as follows:

[0078] ,

[0079] Here Igo is, is the partial correlation of any part of the bit, for example, the beginning and end parts of an unpredictable bit. Finally, carrier-noise ( The ) estimate can be estimated as follows:

[0080] ,

[0081] Here is the coherent integration time for calculating partial correlation. Predefined metric is the predictable and unpredictable parts of one bit Based on the difference between the dog estimates:

[0082] am.

[0083] Spoofing attacks can be detected using these metrics because if no spoofing attack is present, the aforementioned metric must be close to zero, whereas if a spoofing attack is present, the magnitude of these metrics must provide a larger value.

[0084] Last metric It uses only the phases of the initial and final partial correlations:

[0085] .

[0086] If the presence of a spoofed signal modifies the phase of the received signal, the spoofer can be detected using this metric.

[0087] In step (150), the receiver is a predefined metric GNSS signal spoofing is detected by comparing it with a predefined threshold. In practice, the threshold is set in such a way that a predefined false alarm probability, e.g. 0.02 or any other desired value, is obtained. The threshold value (and the corresponding false alarm probability) is the aforementioned metric It will be easy to understand that it can be different for each case. For example, metrics In this case, the threshold can be set to a value that induces a false alarm probability of 0.02, and the metric If it is below this threshold, the signal can be authenticated in step 152, and the metric If it is higher than the threshold, it can be considered a spoofed signal in step 154.

[0088] Generally, a predefined threshold is the false alarm probability Linked to, and under the null hypothesis (i.e., the absence of a spoofer), the metric By deriving the cumulative density function of each metric It can be determined regarding. More specific examples are described later.

[0089] The method illustrated in FIG. 2 further includes the step (160) of the receiver calculating the time of arrival of a GNSS signal from a spreading code and the step (170) of the receiver calculating its position, velocity, and time by demodulating satellite data. This is generally accomplished by using GNSS signals from at least four different GNSS satellites, each GNSS signal containing a spreading code and satellite data, and the satellite data containing unpredictable portions. Preferably, steps (160 and 170) are performed only after the GNSS signals from at least four satellites have been authenticated in step 150.

[0090] In other embodiments, it will be readily understood that a predictable sample sequence may be obtained from other parts of the signal, for example, from a predictable bit (part of) and / or from other parts of an unpredictable bit (i.e., not the first or last part).

[0091] A spoofer that knows which unpredictable bits and which parts thereof should be correlated can leverage these advantages. First, because it can implement a variable-power random value attack depending on the success or failure of a previous guess; and second, because it can alter predictable correlations to spoof the detector. The advantages of both can be mitigated by the randomization of correlations. In other words, in some embodiments, all stored sample sequences are metrics It is not necessary to use in the calculation. For example, the randomized number of unpredictable bits is not used. Then, the robustness of the detection capability of the GNSS signal spoofing method is improved, especially when a spoofer expects this kind of defense.

[0092] It will be understood that the preceding description focused on a single spoofing signal for only one satellite. However, this method can also be easily used to detect multiple spoofing signals simultaneously. In fact, as described below, since the method according to the present invention can detect a single spoofing signal, it will operate better for detecting spoofing in cases where a spoofer wishes to continuously spoof a full PVT solution, as this would require successfully spoofing multiple satellite signals simultaneously.

[0093] In the following description, performance analysis of different metrics in the presence of zero-delay attacks is provided, where A metric is used to represent a baseline comparison of prior art, and ... represents the present invention. Then, under the most relevant attack situation, the proposed Simulation results regarding the metric's spoofing detection capability are obtained. The provided results constitute the most difficult spoofing scenarios to detect in terms of spoofing power advantages and attack types. Spoofing simulation parameters are provided in Table 2 below. Regarding the attack types among the three aforementioned attacks, focus is placed on this estimation attack to perform the provided simulation, because it provides an upper limit on the required number of unpredictable bits compared to the other two attacks. This attack consists of estimating unpredictable bits per sample and introducing these estimations into the spoofed signal. The estimation of unpredictable bits performed by the spoofer can be easily performed at the tracing stage using the following mathematical formula:

[0094] .

[0095] By doing so, the spoofer each Obtain an estimate of the bits for .

[0096] A variation of this attack consists of estimating bits on a sample basis and then transmitting the bit estimates using scalar factors depending on the attacker's confidence level. This sub-case has also been analyzed and does not differ significantly from the standard estimate attack.

[0097] In addition, the spoofer up to 5 dB compared to the receiver Further evaluation is conducted on cases where advantages are present. Regarding the relative power between the spoofed signal and the actual signal, cases with the same power and +3 dB power for the spoofed signal are evaluated. The results are tested for AWGN channels using the actual number of visible GPS and Galileo satellites. In the simulation, a threshold value that triggers a false alarm probability, such as 0.02, is used because it provides a good benchmark for comparing various metrics.

[0098] Zero-Delay Attack Type Estimation attack 0 dB advantage compared to; +3 dB advantage; +5 dB advantage Power like; +3 dB compared to ; 0.125 ms; 0.25 ms; 0.5 ms. Channel Model AWGN signal model Five Galileo E1B-E1C signals and eight GPS signals according to Equation 1. Only one Galileo satellite is spoofed. P fa 0.02

[0099] Table 2: Parameterization of Spoofing Simulation

[0100] In all cases, spoofing detection probability under different combinations of these parameters different number of bits It is measured for.

[0101] Figure 4 shows the number of unpredictable bits for the probability of detecting a spoofing attack versus the probability of a false alarm of 0.02, with a 250-ms correlation per bit. This figure is based on an estimate attack, assuming that the user receives both the actual signal and the spoofed signal. In the top figure, the spoofer receives a signal from the satellite with the same power as the user, whereas in the bottom figure, the spoofer receives a signal with a higher power (3 dB) than the user. The figure and It demonstrates that the technique provides optimal performance. In the case where the spoofer has a 3 dB advantage over the user's receiver, and The detector can detect spoofing attacks with a detection probability of 0.9 using 200 and 220 bits, respectively. However, if the spoofer receives a signal of the same power as the user receiver, the user receiver and Spoofing attacks can be detected using approximately 100 and 120 bits, respectively, by using the techniques. The metric is better than all other metrics, and the number of unpredictable symbols Note that if the amount is small, it operates more poorly.

[0102] Previous simulations assume that the user receives signals of the same power from the spoofer and the satellite. Nevertheless, for the graph at the top of Fig. 5, it is assumed that the user receives the signal transmitted by the spoofer at a power 3 dB higher than the signal transmitted by the satellite. In this scenario, the user receiver can detect spoofing attacks more easily than in previous simulations. If the user receives the same signal power from the spoofer and the satellite, with the spoofer having a 3 dB advantage over the user receiver, The metric requires 200 bits to detect a spoofing attack with a detection probability of 0.9 (Fig. 4, bottom graph). However, if the user receives a signal from the spoofer that is 3 dB louder than the signal transmitted from the satellite, It requires only 65 bits to detect a spoofing attack with a detection probability of 0.9 (Fig. 5). Under these conditions, the best detector is is. Due to the fact that the user's receiver receives more power from the spoofer than from the satellite, in these simulations It is worth mentioning that its performance is not very poor.

[0103] In Fig. 6, we analyze how detector performance is affected by using different window lengths to calculate partial correlation: 0.125 ms (top) and 0.500 ms (bottom). Note that the case with a window length of 0.250 ms is exemplified in the bottom graph of Fig. 4. Although much shorter than the standard 4-ms Galileo E1 code, this correlation ensures that sufficient gain exists for detection even in the presence of cross-correlation noise from other satellites. The results are, It shows that while provides very similar performance for different window lengths used to calculate partial correlation, others are more sensitive to these parameters. It is a metric that also demonstrates solid performance in specific situations. It is affected by the window length. If the window length is appropriate, this can provide very good performance. However, if the time window is too short or too large, this technique suffers some degradation in detection probability.

[0104] The conclusion from this simulation analysis is, A metric (based on partial correlation with complex values) based on gain (i.e., real values ​​obtained from partial correlation with complex values) The point is that it performs much better than the metrics. Furthermore, among the proposed metrics, The conclusion is that if it operates most effectively and accumulates sufficient energy from sufficient bits, it is sufficiently robust for all situations. With a sufficient number of about 200 bits, the detector can detect spoofing attacks with a probability higher than 90%, even if the spoofer has a power advantage over the user receiver.

[0105] One remaining aspect of the implementation of this method defines unpredictable parts, symbols, or bits of GNSS signals. The current Galileo OSNMA protocol is intended to authenticate satellite navigation data. A baseline use case for OSNMA was considered, consisting of two MACK (Message Authentication Code and Key) blocks, a 20-bit MAC, a 96-bit key, and four MACs per block. This configuration allows the receiver to have 80 unpredictable bits per 15-second MACK block without considering the KEY bit, and approximately 160 bits if the first 80 bits of the corresponding key are considered unpredictable. Even if the key is predictable, it can be concluded that the detector may rely on 30 or 45 seconds (i.e., two or three MACK blocks) to acquire 160 or 240 unpredictable bits. Based on the simulation results, it can be seen that some of the metrics can operate even in cases favorable to the spoofer. To increase the reliability of the metrics, the receiver can decide to wait for a total of 60 seconds for two Galileo I / NAV subframes and provide 320 unpredictable bits.

[0106] Since the metric appears to be the most superior metric for detecting GNSS spoofing, its detection threshold is described below. An example of the calculation is provided. Spoofer detection uses a metric to distinguish whether the user's receiver is being spoofed. It is simplified by a comparison between and the detection threshold. The detection threshold is influenced by the individual probability of false alarms:

[0107]

[0108] Here Is It is the cumulative density function of the metric.

[0109] The probability of a false alarm is the null hypothesis (i.e., no spoofer) under It requires knowledge of the cumulative density function. If no spoofer exists, The metric is very similar to the Rayleigh distribution. This is because the partial correlation values ​​at the beginning and end of the bit (or other predictable parts of the signal) have substantially the same constant value to which Gaussian noise is added. As such, the term within the absolute value can be regarded as zero-means complex Gaussian noise, and the metric It follows a Rayleigh distribution. By utilizing the relationship between the Rayleigh distribution and the underlying Gaussian variable, the mean of the Rayleigh distribution is a predictable part It can be obtained from the standard deviation of the partial correlation within. That is, the mean of the Rayleigh distribution is It's like that, but here Is It is the variance of. Therefore, the detection threshold can be defined as follows.

[0110] .

[0111] Figure 7 is a metric Compares the theoretical probability density function under the null hypothesis with the simulated probability density function (top graph) and the probability of false alarms (bottom graph). These plots represent the metric It shows that it is actually well approximated by the Rayleigh distribution.

[0112] metric to have the desired probability of false alarms It will be easy to understand that the aforementioned example of how to calculate the threshold value for can be applied to other metrics. Furthermore, other threshold values ​​that are not linked to the false alarm probability and / or are not based on the cumulative density function of the metric may be used.

[0113] Although the method according to the present invention has been described with reference to the Galileo OSNMA protocol, the present invention should not be considered limited thereto, and the proposed method may be applied to other protocols.

[0114] Although aspects of the present invention have been described with respect to specific embodiments, it will be readily understood that such aspects may be implemented in other forms within the scope of the present invention as defined by the claims.

Claims

Claim 1 A computer-implemented method (100) for detecting GNSS (Global Navigation Satellite System) signal spoofing, comprising: a) a step (110) of digitizing, acquiring, and tracking a GNSS signal from at least one GNSS satellite at a receiver, wherein the GNSS signal comprises a predictable portion and an unpredictable portion, wherein the predictable portion comprises predictable bits and the unpredictable portion comprises unpredictable bits; and b) a sample sequence of the predictable portion of the GNSS signal by the receiver. and sample sequence of the above unpredictable part c) a step of storing (120); c) a step of verifying, by a receiver, the value of the unpredictable bit extracted therefrom the unpredictable sample sequence (125); d) a replica of the unpredictable sample sequence and the locally stored GNSS signal by a receiver The first partial correlation between and predictable sample sequences and locally stored GNSS signal replicas Second partial correlation between cast: ; and Calculate using (130), and the signs of the first partial correlation and the second partial correlation , Step of removing by , (134) - is the value of the above bit -;e) a predefined metric by the receiver Step (140) of calculating from the first partial correlation and the second partial correlation - the predefined metric silver: A signal spoofing detection method comprising: -; and f) a step (150) of comparing the predefined metric with a predefined threshold value to detect GNSS signal spoofing. Claim 2 In claim 1, step b) is, - unpredictable sample sequence As, a sample sequence at the beginning of the unpredictable bit Store and predictable sample sequence As, a subsequent part of the above unpredictable bit, e.g., a sample sequence of the termination part Storing; or- an unpredictable sample sequence As, a sample sequence at the beginning of the unpredictable bit Store and predictable sample sequence As, a sample sequence of predictable bits A signal spoofing detection method including storing Claim 3 In Article 1, is the duration of one of the stored unpredictable sample sequences, and A signal spoofing detection method, which is the duration of one of the stored predictable sample sequences. Claim 4 In Paragraph 3, and A signal spoofing detection method in which at least one of the following is greater than 0.05 ms, greater than 0.1 ms, greater than 0.12 ms, less than 1 ms, less than 0.75 ms, or less than 0.6 ms. Claim 5 A signal spoofing detection method according to claim 1, wherein step b) comprises storing a sample sequence representing at least some of at least 50, or at least 100, or at least 150, or at least 200 bits for at least one of the unpredictable sample and the predictable sample. Claim 6 In claim 1, the predefined threshold is the metric under the assumption that the GNSS signal is authentic. Signal spoofing detection method based on the cumulative density function. Claim 7 A signal spoofing detection method according to claim 6, wherein the predefined threshold is set to a value that causes a false alarm probability of 0.

02. Claim 8 A signal spoofing detection method according to claim 1, wherein step f) includes, when signal spoofing is not detected: - authenticating the GNSS signal (152) when the preset metric is less than a preset threshold; and - authenticating the GNSS signal by detecting GNSS signal spoofing (154) when the preset metric exceeds a preset threshold. Claim 9 A signal spoofing detection method according to claim 1, wherein step a) comprises receiving a GNSS signal from at least four different GNSS satellites, wherein the GNSS signal comprises a spreading code and satellite data, wherein the satellite data comprises the unpredictable portion, and the method further comprises: g) a step (160) of calculating the arrival time of the GNSS signal from the spreading code by a receiver; and h) a step (170) of calculating the position, velocity, and time by demodulating the satellite data by a receiver. Claim 10 A method for detecting signal spoofing according to claim 9, wherein step f) includes, when signal spoofing is not detected: - authenticating the GNSS signal (152) when the preset metric is less than a preset threshold; and - authenticating the GNSS signal by detecting GNSS signal spoofing (154) when the preset metric exceeds a preset threshold, and steps g) and h) are performed only when at least four GNSS signals from at least four different GNSS satellites have been authenticated. Claim 11 In claim 1, step b) is a sample sequence of the unpredictable portion of the GNSS signal. ...including storing based on randomly selected unpredictable bits, or step d) includes the unpredictable sample sequence and locally stored GNSS signal replicas The first partial correlation between A signal spoofing detection method comprising calculating based on a randomly selected subset of the above unpredictable sample sequence. Claim 12 A data processing device comprising means for performing the method of claim 1. Claim 13 A computer program stored on a computer-readable storage medium, comprising instructions that cause the computer to perform the method of claim 1 when the program is executed by the computer. Claim 14 A computer-readable storage medium comprising instructions that cause the computer to perform the method of claim 1 when executed by the computer.

Images