DANGERS of SPOOFING and
ANTI-SPOOFING SOLUTIONS
Dinesh Manandhar, Ryosuke Shibasaki
Center for Spatial Information Science (CSIS)The University of Tokyo, Japan
Contact: dinesh@iis.u-tokyo.ac.jp
http://www.csis.u-tokyo.ac.jp/~dinesh/
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 1

11:26:28 PM

Can You Trust GPS Position & Time Data?

Yes, You can…
…But Need to Verify
Because of Spoofing Issues
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 2

What is Location Spoofing?
• Falsify Location Data as If it were True Location

TOKYOOrHawaii?

Where is it?
Tokyo or Hawaii?

TOKYOHAWAIIThis movie is allabout GPS Spoofing

SpooferDinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 3

Software-Based GPS Signal Generator (Spoofer?)
Ephemeris Data
RINEX File

User Motion
Data
Static or Dynamic

Transmit
SignalSelectVisibleSatellites

Simulation Date,
Time andDuration

Generate
SignalAdjust Signal
OutputPowerDigital Signal
Properties(Sampling Freq,Bit Rate, IF etc)

Antenna
Gain
PatternDigital I/Q
SignalOutputDigitalIQ Signal
fs = 26MHz
A/D = 12bit

Digital to Analog(D/A) Conversion

Hardware

Software
Software Source available from Dr. Ebinuma, Chubu University
Signal Generation

GPS L1C/A
f = 1575.42MHz

Digital IQ
SignalDinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 4

What is GPS Signal Authentication?
• To authenticate or verify that a GPS signal in the receiver isactually from a GPS satellite.

Is this GPS Signal froma GPS Satellite or a
Spoofer / Simulator?

Spoofer or Simulator

GPS Signal Authentication is necessary to detect SPOOF Signals
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 5

GPS Spoofing in Black Sea?

24th June 2017
A GPS spoofing attack in June, involving
over 20 vessels in the Black Sea, has beenreported. Probably the first official recordof spoofing. More……….

Black Sea

https://www.rin.org.uk/newsitem/4969/GPS-Spoofing-in-Black-Sea

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 6

SPOOFing a Car: Is he driving the car?

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jpSlide : 7

Why Authentication or Anti-Spoofing is Necessary ?
Insurance
Pay-As-YouDrive

Geo-Fencing

Toll FeeADAS
ITS

Geo-Security

AutoDriving

Importance ofAuthentication
Alternate forFuel TaxCollection

IoT
M2M

SecuredTransport ofDangerous
Goods

V2V / V2X

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 8

ISO/TC204 WG-18• Discussions in ISO/TC-204, WG18
• To Draft regulations for ITS-S related with PVT Data

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 9

SBAS Signal Authentication• New SBAS Signals (L5 Band) can also beAuthenticated without modifying the current
signal structure.
• ICAO is already highlighting the necessity andimportance of SBAS Signal Authentication• New regulations that will require to Authenticate SBAS
Signals for Anti-spoofing will emerge
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 10

We or You can solve the problem of Spoofing
by Signal Authentication

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 11

Concept of Signal Authentication or Anti-Spoofing

Simply, Broadcast a Digital Signature Data
from QZSS Navigation Message

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 12

Authentication System Architecture
GPSSpace Segment

GPSUser Segment

Control Segment
GNSS
Receiver

I/F

I/F

QZSS Control
Authentication
GNSS Monitoring
Station
Data Center (ADC)
Stations in Japanand ASEAN
NAV Data Bits from
Digital Signature Data
Countries
QZSS Monitoring Stations
for Authentication

USER
Marine / AIS

Aviation / WAAS

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jpITS / ADAS

RailwaySlide : 13

Authentication System: Control Segment Development
QZSS
Monitoring Stations

Interface to upload
Encrypted Digital Signature
via L1S Message toQZSS Control System

QZSS

Digital Signature Data Generation
Get a Portion of NAV
Data Bitsfrom visible GPS, QZSSInterface to access
QZSS monitoring stations
and receive NAV Data

Make
RAND

Reference
Authentication
NAV Data

Hash

ADC
ServerEncrypt
RAND Data =(Digital Signature)

Make L1S
NAV MSG
250bitGenerateKeys

Make L1S
NAV MSG
250bitDinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

QZSS MCSInterface to upload Public Key
via L1S Message toQZSS Control System

Slide : 14

Digital Signature
Generation forAuthentication

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 15

Authentication System: User Segment

GPSQZSSQZSS Signal with
Digital Signature
for Authentication

L1C/A

Make RAND
From L1C/A
NAV MSGHash
MSG A
Check HASHMSG A & B

GNSS ReceiverGet Digital
Signature Data
from L1S NAV MSG

ADC
ServerDecrypt

Get KEY
from ADC
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jpHashMSG B

If HASH MSG A =HASH MSG B
Authentication OKElseAuthentication Fails

Slide : 16

Prototype Anti-Spoofing Receiver
GPSQZSS

L1C/A

QZSS Signal withDigital Signature
for Authentication

GNSS
Receiver

Connect
through
OTG
Cable

TabletAUTH
APPVer. : 1.0

Request for KEY
Provide KEY &Other Services

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

WiFi Link

Authentication
Data Center(Service Provider)
Slide : 17

Real-time Authentication Test by Car Driving

Authentication Signal is broadcasted from QZSS L1S signal for 3
months on various occasions for Live Authentication Test.
Dinesh Manandhar, CSIS,The Universityof Tokyo,Thanks
to JAXA
fordinesh@iis.u-tokyo.ac.jp
broadcasting Test Authentication Signal.

Slide : 18

Summary• QZSS Signals can be used to Authenticate GPS• Other GNSS signals can also be authenticated• GALILEO, BEIDOU etc• This method can be implemented without any
impact on HW• Only Software/Firmware modifications are required
control and user systems
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 19Recommendation

Please include SPOOFING andANTI-SPOOFING Issues in ICG IDM WG

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 20

Additional Information

Please visit website at
http://www.csis.u-tokyo.ac.jp/~dinesh/
Or Contact:
dinesh@csis.u-tokyo.ac.jp

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 21

Reference Slides

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 22

GPS Spoofing Poses Risk of Future Havoc

NOV 28, 2016

GPS 'Spoofing' is No Joke: Dangers of GPS Data
Hacking Realized

GNSS spoofing will attain virus
status, warns expert – GPS World
Hacking Global Positioning System with GPS‘Spoofing’ Can Lead To Fatalities
http://www.techworm.net/2016/11/gps-spoofingdangers-gps-data-hacking.html
Dangers of GPS spoofing and hacking for location
based services
Faking of GPS Data a growing and potentiallylethal danger – The Japan Times, FB
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 23

Japan Supreme Court Ruling: GPS Tracking is Illegal without Warrant
15th March 2017
New rules might be
implemented to makeGPS tracking legal with warrant
But, there is also
fear of GPS Signal Spoofing.

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 24

Spoofing Methods
Spoofing Level 0

Spoofing Level 1

Spoofing Level 2

Self-Spoofing

Self-Spoofing

Self-Spoofing or 3rd Party Spoofing

Receiver and Spoofer directly
connected by cable

Receiver and Spoofer
directly connected by cable

Over-the-Air Spoof Signal Transmission
Real Signal Present

Real Signal Present

Real Signal not Present

Spoofer
Antenna

GNSSAntenna

SPOOFERGNSSReceiverGNSSReceiver

GNSSReceiver

SPOOFERGNSSAntenna

SPOOFER

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 25

How to get Anti-Spoofing Solutions?
• Encrypt PRN Codes• Similar to GPS P(Y) Code• Very Secure but not a practical solution for normal operation• Can’t use for existing signals• Requires signal modification• All applications do not need Anti-Spoofing protection• Encrypt Navigation Message (NAM: Navigation Message Authenticate)• Secure but position output always requires decryption of navigation data
• Not a practical solution for normal operation• All applications do not need anti-spoofing protection• Requires signal modification• Broadcast Digital Signature in Navigation Message• Broadcast a Digital Signature based on the Satellite Signal that need to be authenticated• Very practical solution• Need to verify only when required• Can be used for existing signals• No impact on Hardware. Only software modification

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Slide : 26