(12) united states patent us 8,159,391 b2 papadimitratos et a1....

(12) United States Patent Papadimitratos et a1.

US008159391B2

US 8,159,391 B2 Apr. 17, 2012

(10) Patent N0.: (45) Date of Patent:

(54) METHOD TO SECURE GNSS BASED LOCATIONS IN A DEVICE HAVING GNSS RECEIVER

(75) Inventors: Panagiotis Papadimitratos, Lausanne (CH); Aleksandar Jovanovic, Lausanne (CH)

(73) Assignee: Ecole Polytechnique Federale de Lausanne (EPFL), Ecublens (CH)

Notice: Subject to any disclaimer, the term of this patent is extended or adjusted under 35 U.S.C. 154(b) by 238 days.

(21)

(22)

App1.No.: 12/618,465

Filed: Nov. 13, 2009

(65) Prior Publication Data

US 2010/0117899 A1 May 13, 2010

Related US. Application Data

Provisional application No. 61/193,277, ?led on Nov. 13, 2008.

(60)

Int. Cl. G01S 19/21 (2010.01) US. Cl. ................................................ .. 342/357.59

Field of Classi?cation Search ........... .. 342/357.59,

342/357.58, 357.45 See application ?le for complete search history.

(51)

(52) (58)

(56) References Cited

U.S. PATENT DOCUMENTS

4,983,980 A 1/1991 Ando 5,036,329 A 7/1991 Ando 5,808,581 A * 9/1998 Braistedet a1. ........ .. 342/357.58

OTHER PUBLICATIONS

Panagiotis Papdimitratos et al., “GNSS-Based Positioning: Attacks and Countermeasures”, IEEE MILCOM 2008 Nov. 17-19, 2008 (7 pages).

Walter Franz et at, “Inter-Vehicle-Communications Based on Ad Hoc Networking Principles”, The FleetNet Project, Universitatsverlag Karlsruhe 2005, pp. i-vii, and 1-287. Elliott D. Kaplan, Understanding GPSiPrinciples and Applications, Artech House, 1996, pp. 1-65. Nicolaj Bertelsen et al., “The GPS Code Software Receiver at Aalborg University”, Aalborg University, 2004 (8 pages). Markus G. Kuhn, “An Asymmetric Security Mechanism for Naviga tion Signals”, 6th Information Hiding Workshop 2004, LNCS 3200, pp. 239-252 (2004). Jean-Marie Zogg, “GPS Basicsilntroduction to the System Appli cation Overview”, U-BloX AG, 2002, pp. 1-94. “Vulnerability Assessment of the Transportation Infrastructure Rely ing on the Global Positioning System: Final Report”, John A. Volpe National Transportation Systems Center, Aug. 29, 2001, pp. ii-vi, ES1-ES8, and 1-99. Guenter W. Hein at al., “Authenticating GNSS Proofs Against Spoofs: Part 1”, lnsideGNSS, Jul./Aug. 2007, pp. 58-63.

(Continued)

Primary Examiner * Thomas TarcZa

Assistant Examiner * Fred H Mull

(74) Attorney, Agent, or Firm * DLA Piper LLP US

(57) ABSTRACT

A method to detect at a GNSS receiver whether the received GNSS signals and navigation messages are the product of an attack. If there is evidence, as provided by the method described here, that the received signals and messages origi nate from adversarial devices, then receiver equipped with an instantiation of the method noti?es the user or the computing platform that integrates the GNSS receiver that the calculated via the GNSS functionality position and time correction are not trustworthy. In other words, our method enables any GNSS receiver, for example, GPS, GLONASS, or Galileo, or any other GNSS system, to detect if the received navigation messages are the legitimate ones (from the satellites) or not (e.g., from attacker devices that generate fake messages that overwrite the legitimate messages). Based on this detection, neither the user and nor any application running in the com puting platform is misled to utiliZe erroneous position infor mation.

15 Claims, 17 Drawing Sheets

Doppler-shift variation SV-04 time period t=300s

2700"? -- -- - » -- ->

Linear approximation a ‘Doppler shift [Hz] vs. time Is]v measured

2650 Fred bnds (Linear approximation)

US 8,159,391 B2

OTHER PUBLICATIONS

Guenter W. Hen et al., “Authenticating GNSS Proofs Against Spoofs: Part 2”, InsideGNSS, Sep./Oct. 2007, pp. 71-78. Aron Pinker et al., “Vulnerability of the GPS Signal to Jamming”, GPS Solutions, vol. 3. No. 2, pp. 19-27 (1999). Logan Scott, “Anti-Spoo?ng & Authenticated Signal Architectures for Civil Navigation Systems”, ION GPS/GNSS 2003, Portland, OR, Sep. 9-12, 2003, pp. 1543-1552. Saurabh Ganeriwal et al., “Secure Time Synchronization Service for Sensor Networks”, WiSE’05, Cologne, Germany, Sep. 2, 2005 (10 pages). “Navstar Global Positioning System: Interface Speci?cation: Navstar GPS Space Segment/Navigation User Interfaces: IS-GPS 200, Revision D”, Dec. 7, 2004, pp. ii-Xiv, and 1-193. “GPS Horizontal Position Accuracy”, http://users.erols.com/ dlwilson/gpsacchtml, printed Jul. 8, 2010 (8 pages) (Publication Date Unknown). “AIUB’s Anonymous FTP Server”, http://www.bernese.unibe.ch/ download.html, Printed Jul. 8, 2010 (6 pages) (Publication Date Unknown).

Saurabh Godha, “Performance Evaluation of Low Cost MEMS Based IMU Integrated With GPS for Land Vehicle Navigation Appli cation: UCGE Reports No. 20239”, University of Calgary: Dept. of Geomatics Engineering, Feb. 2006, pp. ii-XX, and 1-210. Panagiotis Papadimitratos et al., “Protection and Fundamental Vul nerability of GNSS”, IEEE IWSSC 2008 (5 pages). A.D. Rabbany, “Introduction to GPS: The Global Positions System”, Artech House, 2002, pp. 101-115. AD. Rabbany, “Introduction to GPS: The Global Positions System, Second Edition”, Artech House, 2006, pp. 163-174. Hengqing Wen et al., “Countermeasures for GPS Signal Spoo?ng”, The University of Oklahoma, 2004 (8 pages). Srdjan Capkun et al,. “Secure Positioning in Wireless Networks”, IEEE Journal on Selected Areas in Communications, vol. 24, No. 2, pp. 221-232 (Feb. 2006). Wener Gurtner et al., “RINEX: The Receiver independent Exchange Format, Version 3.00”, Nov. 28, 2007, pp. I-II, 1-22, and A1-A15.

* cited by examiner

US. Patent Apr. 17, 2012 Sheet 1 0117 US 8,159,391 B2

umEwmmEE m5: .m> Fr: 5%. Egg .

5, .GE


comw

E was, , cobm snow coo? , o

@2 Km E5 @5392. 5350a

, cook! ,88, 52%. W832 Qoow

E @EF

0

one? cccmw. .

".5

goes, 1} 1631,10 ,riouenbe

8.3 8%

1

comm; m: Min“

24> Em @Ew 5,533: 223cm

,QSN ygmw 8% comm ; ooov. , oomw 000m comm {2H} zesga fiauenbeg


E 95

5 we;

98 SN 8N Q3 2.: 1%

............1

a

cow cm; on; om D

1% gm

3,5, 295 3m 8m 3m 9: 02, gm.

1, S D P82, w W ‘.1 su 2H 0 rblvlurA

EN 2; 09 S Q

wgw 5 we; com com om; as r i

Mo 1 1

_ khi/mw 1 , E $5;

515

1% 82,

PH} 198116 KOUQHbSJj


$2.6m mam; ESQ: 2.5

9: cm, cow?

2,5

w @E

om: cow 0mm ovw 0mm


NE 1

mlxi


62 cm cm

m m W m __ W . m _

....... ..... .. ............ ......... . . . . . , . , , ,,,,, ,,,,,, ............... ............... .............. g

. €§§§£§xw? ii§$$§?x€ wfipifggiwiiw?gxig 111R ?wigwiéaig §%i»~§wi#§§ a .............. a, ................................................. ............... ................ ............... ................ ............... .............. .21 0:5 EmEwizng ,,,,,,,,,,,,,,,,, . ., ,,,,,,,,,,,,,, ..................................................................... 5, ............... ............. .1 6% E s 358w ......................... , ........................................................ , . W .. .,

Li:l-fslggk..V.€:s-i$i<}<.\/Mk~r=.1H).\7.\\r.fwvami€€<.?CK(Q4181.r1\.>wx.f\.T:J~\‘ixrrxwfkiwi N.....,~{~.\..J,J{R1Jfllr 1

. w

X . , . . . . . . . . . v . . . . . . . . . . . I _ , . 1 1 . . r . . , , K . , . . , . . . . . . . . . . . . . , v 1 . . , . . . , , \ . , . 1 , . I.“ 1 . . 1 y . . . . . . . . . . . I . , 1 » . . . _ . . . . . | . . , . l . _\. l _ . I .1“ 1

w

0% cm cm cw om om Q 9. o _ _. _ m

@

mmd v0 mwd mc mmc Q0 mwd 50 011,21 guswexxmdwg [11115112113 1a>§se11v


5E3 E 32 a; 525a 3253s,;

E, g 3 3 cm 2., 9, Q

1 m 1, , _

_


AL

wfgigiv Ram?“

me:

A

is $292 mEEEmw


E 5; com 0mm mom om: 02 o

._ _ 1 a“ 1

n W Q Q

80m 1 a

m H U

. so? Rim

22.;

com S?

F . W H

1w @

.. 1 L

M mam

35w E5 3532 EEQQQ E 9:? won cow on“ so? 0.

_ G

1. m

Rim rim 553cm; 553a

@ Y"

Z 25

MN

com on; ......... 1 aim 3% 55391930 5 was. com Qmw com S 1v 03 am 0

s00? 000m

_ mi/w aim \mgwmzvmc .MMEQQQ , 2 mac,

0cm 0? con‘ 0w 0

a m ......... .i

@E

T>m aim 18535.: $258

PH} 193210 PH] 288.140 ,lisuanbeuj ?ouenbsig

{111i $68440 mu anbel 3


E wnocg mEc. om F ‘>0 Egg? $53 $205.1 HE mwommc. 9:? 0m!

cam

can‘ Om

co

. 2

ESQ 323mm

g.

E 200:8 m8;

com 0mm ow? om:

_ <

Dom

mT>w scams“? 5.3001 tea/Eta? miw comma? 626a @2681

om.

F @6013 m5?

cow

T>w comma?) 526a 828mm

: @K

{an} lame {gm ,SMOG Dengasag psmeaea pangeoag pemgaoag


TE $62208 x whim 2S mw?m g8 nwzgcooaéxumsm ucm 3958:, N’, QUE

mmm 11') w. in

[111} 312113131001) ,1


E mocmm 95% com o1. N.

m3, @E

w M a l 1W, U d! 0% MO mm. 11A As rmup. AU 0% M0 Gm .WD. d a we 111m. “9 mm? pemeoeg

US 8,159,391 B2 1

METHOD TO SECURE GNSS BASED LOCATIONS IN A DEVICE HAVING GNSS

RECEIVER

RELATED APPLICATION

This application claims priority under 35 U.S.C. Section. 119 to US. provisional Application No. 61/193,277, entitled “Detection of Adversarial GNSS transmissionsiSecuring GNSS enabled positioning” ?led Nov. 13, 2008, the content of Which is hereby incorporated by reference herein.

INTRODUCTION

An object of the methods and devices disclosed herein is to detect at a GNSS receiver Whether or not the received GNSS signals and navigation messages are the product of an attack. As Wireless communications enable an ever-broadening

spectrum of mobile computing applications, location or posi tion information becomes increasingly important for those systems. Devices need to determine their oWn position, to enable location-based or location-aWare functionality and services. Examples of such systems include: sensors report ing environmental measurements; cellular telephones or por table digital assistants (PDAs) and computers offering users information and services related to their surroundings; mobile embedded units, such as those for Vehicular Commu nication (VC) systems seeking to provide transportation safety and ef?ciency; or, merchandise (container) and ?eet (truck) management systems.

Global navigation satellite systems (GNSS), such as the Global Positioning System (GPS), its Russian counter-part (GLONASS), and the upcoming European GALILEO sys tem, are the most Widely used positioning technology. GNSS transmit signals bearing reference information from a con stellation of satellites; computing platforms nodes, equipped With the appropriate receiver, can decode them and determine their oWn location. HoWever, commercial instantiations of GNSS systems, Which are Within the scope of this paper, are open to abuse: An adversary can in?uence the location infor mation, loc(V), a node V calculates, and compromise the node operation. For example, in the case of a ?eet manage ment system, an adversary can target a speci?c truck. First, the adversary can use a transmitter of forged GNSS signals that overWrite the legitimate GNSS signals to be received by the victim node (truck) V. This Would cause a false loc(V) to be calculated and then reported to the ?eet center, essentially concealing the actual location of V from the ?eet manage ment system. Once this is achieved, the physical compromise of the truck (e.g., breaking into the cargo or hijacking the vehicle), is easier, as the ?eet management system Would have limited or no ability to protect its assets (e. g., by notify ing accordingly the laW enforcement on the incident or recover the assets otherwise). This is an important problem, given the consequences such attacks can have.

Disclosed herein are methods to mitigate such vulnerabil ity. In particular, disclosed herein are mechanisms to detect and reject forged GNSS messages, and thus avoid manipula tion of GNSS-based positioning. These mechanisms are complementary to cryptographic protection, Which civilian, commercial GNSS systems do not currently provide but are expected to do so in the future (e.g., authentication services by the upcoming GALILEO system). The approach disclosed herein is motivated by the fundamental vulnerability of GNSS-based positioning to replay attacks, Which can be mounted even against cryptographically protected GNSS. If indeed there is evidence, as provided by the method described

20

25

30

35

40

45

50

55

60

65

2 here, that the received signals and messages originate from adversarial devices, then a receiver equipped With an instan tiation of the method noti?es the user or the computing plat form that integrates the GNSS receiver that the calculated via the GNSS functionality position and time correction are not trustWorthy. In other Words, this method enables any GNSS receiver, for example, GPS, GLONASS, or Galileo, or any other GNSS system, to detect if the received navigation mes sages are the legitimate ones (from the satellites) or not (e. g., from attacker devices that generate fake messages that over Write the original, legitimate ones). Based on this detection, neither the user and nor any application running in the com puting platform is misled to utiliZe erroneous position infor mation (as it Would be induced by the adversary).

BRIEF DESCRIPTION OF THE INVENTION

As already stated, an object of this document is to provide a method to discriminate betWeen legitimate signals and fake signals.

Accordingly, it is proposed a method to secure GNSS based locations in a device having a GNSS receiver receiving a plurality of satellite signals, processor and a memory, said method comprising the steps of:

acquiring ?rst positions by the GNSS receiver, acquiring or extracting position relevant values of said ?rst

positions and storing them into a memory, setting those position-relevant values as trusted values, acquiring at least one second position by the GNSS

receiver, acquiring or extracting the second position-relevant value

of said second position, calculating an expected relevant value based on the trusted

values, calculating a metric representing the difference betWeen

the second position relevant value and the expected rel evant value,

setting an invalid ?ag When the metric is above a threshold. Basic Method Outline The method operates in three steps: 1. Storage of at least one position that is considered trusted

With the environment parameter of that position 2. Estimation (prediction, at one or more steps in the future)

of system-speci?c parameter value(s), denoted as V, based on the GNSS speci?cation and the measurements the receiver has collected in step 1, based on that GNSS functionality, prior to the said estimation.

3. Comparison of the (estimated) V to the obtained/mea sured M values that correspond to the same parameters as those forV; the M values are obtained from the GNSS PVT or navigation solution or are by-products of it. If a metric for M and V, denoted as dl(M, V) and being a function dependent on the exact format of M and V, is larger than some threshold T 1, then the security-enabled receiver declares the GNSS signal(s) and message(s) that resulted in the calculation of M as adversarial and noti?es of the attack.

Or it operates using non-GNSS data: 3. Comparison of M values to other data available at the

GNSS receiver (or the receiver bearer), denoted as B (for example, information on mobility, surroundings, communi cation environment), WithV or its by-products (for example, calculation of velocity or acceleration from successive posi tion samples). Note that such data, B, are not related to the prior undisrupted operation of the GNSS receiver, thus the method can Work even if the receiver has no memory of prior measurements based on Which it can perform the prediction

(12) united states patent us 8,159,391 b2 papadimitratos et a1....

Documents