Analysis of a Simple, Multi-Receiver GPS Spoof Detector

GPS spoofing is a hot topic of late; technical discussions vary widely based upon the assumed capabilities and a priori knowledge of the spoofer. For a single GPS receiver, various methods to detect a spoofing event have been proposed in the literature. These range from simple ideas (e.g. monitoring the power levels of the GPS signals) to more complex concepts (e.g. looking for vestigial peaks in the correlator outputs) to the comparison to nonGPS signals (e.g. an IMU). Much of this prior work has been on the conceptual level with limited experimentation; little appears to have been done to analyze the resulting detection performance. The detector of interest here monitors the GPS signals using not one, but two or more receivers with their antennas at known relative positions. The assumption is that during a spoofing event these multiple receivers will receive the same spoofer RF signal in that the satellites’ characteristics (i.e. relative times of arrival) are identical at all of the antennas. With no spoofer present, each antenna would receive a unique RF signal, consistent with its position in space. The concept of the detector, then, is that the presence of spoofing is discernible from the near equivalence of the receivers’ receptions. While one could compare these multiple receptions at the RF level, we compare the position solutions across receivers, declaring a spoofing event if the resulting position solutions are too close to each other as compared to the (known) relative locations of the antennas. The primary advantage of such an approach is that the hypothesis test does not require receiver hardware modification or even access to software GPS methods; a separate processor could easily monitor the positions output from the receivers. In this paper we analyze such a detector from a Neyman-Pearson perspective assuming Gaussian statistics on the position solution data. We consider four cases: (1) two receivers with fixed (known) locations, (2) two receivers with fixed separation and known orientation (but unknown absolute position), (3) two receivers with fixed separation and unknown orientation, and (4) a three receiver example. INTRODUCTION The Global Positioning System (GPS) is well known to be an accurate provider of position and time information across the globe. Consulting a dictionary, the term “spoof” or “spoofing” generally refers to a light-hearted deception. When combined together, GPS spoofing refers Proc. ION ITM, San Diego CA, Jan. 2013 to intentional (and considered malicious) interference of a GPS user’s inputs so as to distort the position and/or time information gained from the system. GPS spoofing is a hot topic of late; technical discussions can vary widely based upon the assumed capabilities and a priori knowledge of the spoofer. In 2003 Warner and Johnston [1] suggested several possible methods to detect a spoofing event: monitoring the power levels of the GPS signals (absolute, relative, and across satellites), checking that the constellation itself is correct for the given time (e.g. number and IDs of the satellites), testing the accuracy of the clock component, and even checking against some non-GNSS source (e.g. an IMU). Since then various authors have experimented with spoofing and suggested detectors including correlating the P(Y) code at the RF level, looking for vestigial peaks in the correlator outputs, comparing to trusted reference signals, and using antenna arrays to spatially identify signals (see e.g. [210]). Much of this prior work has been on the conceptual level with limited analysis of the resulting detection performance. In this paper we examine a spoofing detection concept and attempt to assess its performance. We assume that the spoofer, with only one broadcast antenna, has the ability to present a realistic, but incorrect RF signal at the user’s location; this would be possible currently using one of the inexpensive GPS simulators available on the market. We also assume that the spoofer does not have the ability to interfere with the receiver itself; hence, this is spoofing by an external entity, not the operator of a vehicle trying to deceive his/her local GPS. The detector of interest here monitors the GPS signals using not one, but two or more receivers with their antennas at known relative positions. The assumption is that during a spoofing event these multiple receivers will receive the same spoofer RF signal (since the spoofer can only create one) and that each satellite’s characteristic in this signal is identical at all of the antennas. With no spoofer present, each antenna would receive a unique RF signal consistent with its position in space. The concept of the detector, then, is that the presence of spoofing is discernible from the near equivalence of the receivers’ receptions. A conceptual discussion of such a detector, and its ability to detect a single spoofer, was presented by Tippenhauer et al [11]. While one could compare these multiple receptions at the RF level (and several of the authors listed above have proposed such detection schemes), a simpler approach that could be implemented with existing GPS receivers would be to have each antenna/receiver compute its position and compare the results across receivers. With such a detector, one could declare a spoofing event if the resulting position solutions are too close to each other as compared to the known, perhaps relative, locations of the antennas. The primary advantage of such an approach is that the hypothesis test does not require receiver hardware modification or even access to software GPS algorithms; a separate processor could easily monitor the positions output from the receivers. Given the uncertainty of the statistics of the signal generated by the spoofer, in this paper we describe the problem as a hypothesis test and analyze the detector from a Neyman-Pearson perspective. We note that our analysis might also be useful for spoof detection schemes based on comparing sequential positions of a vehicle with a single receiver traversing a known trajectory [12]. Assuming m antenna/receiver pairs, the hypothesis test of no spoofer versus spoofer is based upon m sets of computed positions. Under the null hypothesis (no spoofer), each position solution corresponds to the actual antenna position plus a random offset due to noise. Under the alternative hypothesis (spoofer present), the positions’ means would be equal across receivers and the noise statistics could be different. Assuming Gaussian statistics on the position solution offsets, we present detection and false alarm probabilities for several cases: (1) two antennas with fixed (known) locations, (2) two antennas with fixed separation and known orientation (but unknown absolute position), (3) two antennas with fixed separation and unknown orientation, and (4) an example with three receivers/antennas. The organization of the paper is as follows: (1) we first review the terminology of the detection problem and present the assumed statistics of the data observed, (2) we present some experimental results as a sanity check of the assumptions of the data model, and (3) we develop detection procedures for the 4 distinct cases listed above. Recognizing that our efforts are initial and limited, we conclude with suggested directions for future work (some obvious and easy, some not so). HYPOTHESIS TESTING The development of an algorithm to recognize a spoofing event is an example of a binary hypothesis test. To describe our spoofing results, we will employ standard terminology to specify the test between two hypotheses, H0 and H1: H0: no spoofer H1: spoofer The detector decides for either H0 or H1 based upon some observed data. Usually this is implemented by evaluating some scalar function (called the test statistic) of the data, T(data), and comparing this value to a fixed value (called the threshold), λ. Common notation for this concept is Proc. ION ITM, San Diego CA, Jan. 2013