Digitala Vetenskapliga Arkivet

Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
UnReference: analysis of the effect of spoofing on RTK reference stations for connected rovers
KTH, School of Electrical Engineering and Computer Science (EECS), Computer Science, Software and Computer systems, SCS. (Networked Systems Security (NSS) Group)ORCID iD: 0000-0001-8919-0098
KTH, School of Electrical Engineering and Computer Science (EECS), Computer Science, Software and Computer systems, SCS. (Networked Systems Security (NSS) Group)ORCID iD: 0000-0002-3267-5374
2025 (English)In: Proceedings of the 2025 IEEE/ION Position, Localization and Navigation Symposium (PLANS), Salt Lake City, UT, USA, 2025, p. 1-12Conference paper, Published paper (Refereed)
Abstract [en]

Global Navigation Satellite Systems (GNSS) provide standalone precise navigation for a wide gamut of applications. Nevertheless, applications or systems such as unmanned vehicles (aerial or ground vehicles and surface vessels) generally require a much higher level of accuracy than those provided by standalone receivers. The most effective and economical way of achieving centimeter-level accuracy is to rely on corrections provided by fixed reference station receivers to improve the satellite ranging measurements. Differential GNSS (DGNSS) and Real Time Kinematics (RTK) provide centimeter-level accuracy by distributing online correction streams to connected nearby mobile receivers typically termed rovers. However, due to their static nature, reference stations are prime targets for GNSS attacks, both simplistic jamming and advanced spoofing, with different levels of adversarial control and complexity. Jamming the reference station would deny corrections and thus accuracy to the rovers. Spoofing the reference station would force it to distribute misleading corrections. As a result, all connected rovers using those corrections will be equally influenced by the adversary independently of their actual trajectory. We evaluate a battery of tests generated with an RF simulator to test the robustness of a common DGNSS/RTK processing library and receivers. We test both jamming and synchronized spoofing to demonstrate that adversarial action on the rover using reference spoofing is both effective and convenient from an adversarial perspective. Additionally, we discuss possible strategies based on existing countermeasures (self-validation of the PNT solution and monitoring of own clock drift) that the rover and the reference station can adopt to avoid using or distributing bogus corrections.

Place, publisher, year, edition, pages
2025. p. 1-12
National Category
Security, Privacy and Cryptography Electrical Engineering, Electronic Engineering, Information Engineering Signal Processing
Identifiers
URN: urn:nbn:se:kth:diva-361268OAI: oai:DiVA.org:kth-361268DiVA, id: diva2:1944727
Conference
IEEE/ION Position, Localization and Navigation Symposium (PLANS), Salt Lake City, Utah, US, April 28 - May 1, 2025
Funder
Swedish Research Council, 2020-04621
Note

QC 20250317

Available from: 2025-03-15 Created: 2025-03-15 Last updated: 2025-03-17Bibliographically approved
In thesis
1. Data verification for GNSS systems and protection of GNSS services
Open this publication in new window or tab >>Data verification for GNSS systems and protection of GNSS services
2025 (English)Doctoral thesis, comprehensive summary (Other academic)
Abstract [en]

 Global Navigation Satellite Systems (GNSS) provide ubiquitous precise localization and synchronization for a wide gamut of applications, spanning from location-based service to core industrial functionalities in communications and large infrastructure. Civilian use of GNSS relies on publicly available signals and infrastructure designed to operate at a high level of interoperability. Nevertheless, such systems proved to be vulnerable to voluntary and involuntary interference aiming to deny, modify, and falsify the GNSS-provided solution. This poses a significant threat to the robustness of satellite-based timing and localization. A decreasing entry threshold from the knowledge and tools accessibility perspective makes mounting such attacks feasible and effective even against low-value targets. In this work, this issue is targeted, with a practical approach, from three directions, by cross-checking the navigation solution with alternative providers of time, by localizing the interference source and characterizing it, and by relying on specific receiver dynamics to eliminate falsified signals. We discuss protection mechanisms targeting the consumer market based on available infrastructure or on sensing supported by sensors embedded in the GNSS-enabled platform itself. These efforts collectively aim to improve the robustness of consumer GNSS solutions, without modifying the GNSS receiver or the signal structure, to provide secure and reliable navigation and timing in an increasingly adversarial environment.

Abstract [sv]

Globala system för satellitnavigering (eng. global navigation satellite systems, GNSS) tillhandahåller allestädes närvarande precis platsbestämning och synkronisering för ett brett spann av tillämpningar, från platsbaserade tjänster till industriella kärnfunktioner i kommunikation och stora infrastrukturer. Civil användning av GNSS förlitar sig på allmänt tillgängliga signaler och infrastruktur som är designad att användas på en hög nivå av interoperabilitet. Dessa system har visat sig sårbara för störningar som söker att neka, modifiera och falsifiera GNSS-lösningar. Detta utgör ett allvarligt hot mot tillförlitligheten av satellitbaserad tids- och platsbestämning. En sänkning av tröskeln för tillgängligheten av kunskap och verktyg gör det möjligt och effektivt att inleda sådana attacker, även mot lågvärdesmål. I detta verk angrips problemet praktiskt via tre tillvägagångssätt: genom dubbelkontroll av navigationslösningen med alternativa internettidsleverantörer, genom lokalisering av störningskällan och karaktärisera den, och genom att förlita sig på specifik mottagardynamik för att eliminera falsifierade signaler. Vi diskuterar skyddsmekanismer ämnade för konsumentmarknaden baserat på tillgänglig infrastruktur eller m.h.a. mätningar från inbyggda sensorer i GNSS-plattformen i sig. Dessa ansträngningar söker att gemensamt förbättra tillförlitligheten hos konsument GNSS-lösningar, utan att modifiera GNSS-mottagaren eller signalstrukturen, för att erbjuda säker ochpålitlig navigation och tid i enalltmer fientlig miljö

Place, publisher, year, edition, pages
Stockholm, Sweden: KTH Royal Institute of Technology, 2025. p. xxvi, 62
Series
TRITA-EECS-AVL ; 2025:36
National Category
Other Electrical Engineering, Electronic Engineering, Information Engineering
Research subject
Information and Communication Technology
Identifiers
urn:nbn:se:kth:diva-361272 (URN)978-91-8106-231-1 (ISBN)
Public defence
2025-04-15, https://kth-se.zoom.us/j/62121217840, Sal C, Kistagången 16, Stockholm, 14:00 (English)
Opponent
Supervisors
Note

QC 20250317

Available from: 2025-03-17 Created: 2025-03-17 Last updated: 2025-03-25Bibliographically approved

Open Access in DiVA

fulltext(17548 kB)1493 downloads
File information
File name FULLTEXT01.pdfFile size 17548 kBChecksum SHA-512
264e4795df58da866b0a64f19cbb514f8c24c8654574fb24a98bd6d03d2a44cdd9afa1327b93e11fd02c85f8ad8e5d17fce52ab4893fc4012cbe9bbc566a0d79
Type fulltextMimetype application/pdf

Search in DiVA

By author/editor
Spanghero, MarcoPapadimitratos, Panos
By organisation
Software and Computer systems, SCS
Security, Privacy and CryptographyElectrical Engineering, Electronic Engineering, Information EngineeringSignal Processing

Search outside of DiVA

GoogleGoogle Scholar
Total: 1493 downloads
The number of downloads is the sum of all downloads of full texts. It may include eg previous versions that are now no longer available

urn-nbn

Altmetric score

urn-nbn
Total: 341 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf