MGA Webinar Series : 5Threats to GNSS : Can We Falsify GPS Data?
Dinesh ManandharCenter for Spatial Information Science
The University of Tokyo
Contact Information: dinesh@iis.u-tokyo.ac.jp
22nd June 2018
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp1Webinar Information• Webinar ID : MGA Webinar # 5• Webinar Topic :• Threats to GNSS : Can We Falsify GPS Data?

• Date :• 22nd June 2018 Friday, Time : 18:00 (JST) 09:00 (UTC)• Duration : 45min + 15min (Q/A)• Resource Person :• Dinesh Manandhar, Associate Professor, The University of Tokyo• Registration : https://gnss.peatix.com• Further Information:• http://www.csis.u-tokyo.ac.jp/~dinesh/WEBINAR.htm
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp2

Threat Types• Intentional Threats• Interference, Jamming, Spoofing and Meaconing• Non-Intentional Threats• Interference, Jamming• Interference from Cell-towers• Natural Threats• Solar Flares, Sun Spots (Space Weather)• Impact on Satellite Orbit

In this webinar, we discuss about SPOOFING Threats
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

3Background Information : GPS Signal Structure
900 Phase Reversex154

L1 Carrier, 1575.42Mhz∑x1/10
X1, Clock10.23Mhz

C / A Code, 1.023Mhz

x1/204600

Navigation Data, 50Hz

L1 Band GPS Signal

P Code, 10.23Mhz
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

4GPS Signal

Block Diagram of GPS Receiver
Antenna

AGC

Pre-Amp
LNA

Oscillator

Down
Converter

A/D Converter

Frequency
Generator

Baseband Signal
Processing

Acquisition

Tracking

Navigation Data

Position Output
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

5How does GPS Signal Look Like?
Time Domain Plot of IF Data
File: JAX_LIV.dat

61035Magnitude, dB

10-1

14000

0-5-10-15-2-3-20-4-25
00.005

0.01

0.015

0.02
Time (ms)

0.025

0.03

0.035

16000

Number of Samples in a Bin

42Amplitude

Histogram of GPS IF Signal

155-5Histogram of IF Data
File: JAX_LIV.dat

Frequency Domain Plot of IF Data
File: JAX_LIV.dat

Frequency-domain Plot of
GPS IF Signal (Fourier Transform)

Time-domain Plot of GPS IF Signal

12000
10000
8000
6000
4000
200002Acquisition of GPS L1C/A Signal with Low Noise

468Frequency (MHz)10120-5-4-3-2-101Bin Value

2345Acquisition of GPS L1C/A Signal with Higher Noise

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

6Why is GPS Signal So Vulnerable?
• The signal is extremely weak

• It is below the thermal noise of the receiver,-111dBm• No signal protection scheme is implemented• except P(Y) code, military use signal• Signal specifications are open to everyone• Even new signals do not have protection plans
against spoofing• QZSS Signal is also equally vulnerable as GPS signal• QZSS signals are almost the same as GPS signals• JIS devices are commercially available off-the-shelf
JIS: Jamming, Interference & Spoofing
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

7GPS Signal Power: How Strong or How Weak?
• GPS satellites are about 22,000km
away• Transmit power is about 30W• This power when received at thereceiver is reduced by 1016 times.

30Watt• The power reduces by 1/distance2• This is similar to seeing a 30W bulb
22,000Km far• GPS signals in the receiver isabout 10-16 Watt, which is below
the thermal noise
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

10-16 Watt8

GPS Signal Power: How Strong or How Weak?
• GPS Signal Power at Receiver• -130dBm or -160dBW• Thermal Noise Power• Defined by kTeffB, where• K = 1.380658e-23JK-1, Boltzman Constant• Teff = 362.95, for Room temperature in Kelvin at 290• Teff is effective Temperature based on Frii’s formula• B = 2.046MHz, Signal bandwidth• Thermal Noise Power = -110dBm for 2MHz bandwidth• If Bandwidth is narrow, 50Hz
• Noise Power = -156dBm
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

9GPS Signal PowerGPS Signal is hidden inside Thermal
GPS Signal
Noise due to Spread Spectrum
Level -130dBm
Noise Level-111dBm

GPS Signal power level is below the thermal noise level of the system. Hence, it is notpossible to measure GPS signal level without demodulation (de-spreading).
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

10Power of GPS Signal vs. Other Signals
Signal TypePower (based on calculations, not measured)

Below
Noise

Above
NoiseWattMobile Phone
Handset TX Power *RX Power at Mobile
Phone Handset*

dBW

dBm

1W

0dBW

30dBm

100e-6W-40dBW-70dBmZigBee316e-16W-115dBW-85dBm

VHF

200e-16W-137dBW-107dBm

Thermal Noise79e-16W-141dBW-111dBm

GPS**

1e-16W-160dBW-130dBm• * Actual power values will differ. These are just for comparison purpose• ** GPS Signals are hidden under the noise. Thus, it can’t be measured directly
e.g. using a Spectrum Analyzer
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

11Impact on Signal Processing due to Noise or Interference Signal
PRN 13Presence of high level noise Integration Time : 1ms
This requires longer
integration of data
More processing power

PRN 13Integration Time : 3ms

PRN 13Integration Time : 6ms

PRN 22Integration Time : 1ms

PRN 22Integration Time : 3ms

PRN 22Integration Time : 6ms

PRN 3
Integration Time : 1ms

PRN 3
Integration Time : 3ms

PRN 3Integration Time : 6ms

Presence of noise

Very small noise

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

12GPS Spoofing

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp13

11:26:28 PM

Quiz : Can You Trust GPS Position & Time Data?

Yes, You can…
…But Need to Verify
Because of Spoofing Issues
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

14What is Location Spoofing?
• Falsify Location Data as If it were True Location
James Bond’sTomorrow Never Dies
movie is all about GPS
Spoofing by using a
Spy Satellite tobroadcast GPS likespoof signal.

TOKYOOrHawaii?

Where is it?
Tokyo or Hawaii?

TOKYOHAWAII

SpooferDinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

15

Why SPOOFING is Dangerous
compared to Interference & Jamming?
Spoofing

Jamming and Interference

Intentional

Intentional and
Non-Intentional

Difficult to Detect

Can be Detected

Available of Service but
Lead to False Position Data

Denial of Service

No Effective Solution for
Existing Signals

Many Solutions ExistFewer Research and Studies Many Research and Studies
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

16Software-Based GPS Signal Generator (Spoofer?)
Ephemeris Data
RINEX File

User Motion
Data
Static or Dynamic

Transmit
SignalSelectVisible
Satellites

Simulation Date,Time andDuration

Generate
SignalAdjust Signal
OutputPowerDigital Signal
Properties(Sampling Freq,Bit Rate, IF etc)

Antenna
Gain
Pattern

Digital I/Q
SignalOutputDigital
IQ Signal
fs = 26MHz
A/D = 12bit

Digital to Analog(D/A) Conversion

Hardware

Software
GPS L1C/A
f = 1575.42MHz
Signal Generation

Digital IQ
SignalDinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

17

SPOOFing a Car: Is he driving the car?

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

18GPS Spoofing in Black Sea?

24th June 2017
A GPS spoofing attack in June, involving
over 20 vessels in the Black Sea, has beenreported. Probably the first official recordof spoofing. More……….

Black Sea

Dinesh Manandhar, CSIS, The University ofhttps://www.rin.org.uk/newsitem/4969/GPS-Spoofing-in-Black-Sea
Tokyo, dinesh@iis.u-tokyo.ac.jp

19Fishing Vessels might be Spoofed !
BABA

Exclusion Zone
Vessel B approaches Vessel A

BVessel B setup the Spoofing
System for Vessel A.
Vessel A uses Vessel B’s
Coordinates
AAABThe Spoofing System is disabled.
Vessel A and Vessel B takes
normal route to go to theirdestinations.

Vessel A enters Exclusion Zone
but it Transmits Vessel B’sCoordinates.
So, the Authority sees Vessel A
at the location of Vessel B.

Based on JRC Technical notes: Report on Authentication in Fisheries Monitoring
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

No Ships
shall Enter
this Zonefor Fishing20Drug Traffickers Are Spoofing Border Drones: DHS, USA
DHS: Department of Homelands Security, USA

http://www.defenseone.com/technology/2015/12/DHS-Drug-Traffickers-Spoofing-Border-Drones/124613/

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

21

Published on 10th NOV 2017

US Defense Bill 2018:

Use GPS with Galileo and QZSS to Improve Accuracy andResiliency
The House and Senate agreed Wednesday on the final National Defense
Authorization Act (NDAA) for 2018. It included at least two provisionsof interest to our readers:SEC. 1606. DEMONSTRATION OF BACKUP AND COMPLEMENTARYPOSITIONING, NAVIGATION, AND TIMING CAPABILITIES OF GLOBALPOSITIONING SYSTEM - Requires the Departments of Defense,
Transportation and Homeland Security to conduct a $10M technology
demonstration/ proof of concept for a GPS backup system. This
demonstration is to be based upon information gathered from arequirements and alternatives analysis study mandated by last year's
NDAA.
SEC. 1607. ENHANCEMENT OF POSITIONING, NAVIGATION, AND
TIMING CAPACITY - Requires the Secretary of Defense to ensure DoD
receivers incorporate Europe's Galileo and Japan's QZSS satellite signals
along side GPS in order to improve accuracy and resiliency. It also
directs the secretary to assess use of non-allied satellite navigation inDoD receivers.

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

22Became Public Law No: 115-91, 12/12/2017

US President Signs Law Requiring GPS Backup Demo

QZSS could be a part ofGPS back-up system for Resiliency
Source: https://www.congress.gov/bill/115th-congress/house-bill/2810/text
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

23GPS Spoofing Poses Risk of Future Havoc
GPS 'Spoofing' is No Joke: Dangers of GPS Data
Hacking Realized
GNSS spoofing will attain virus status, warns expert– GPS WorldHacking Global Positioning System with GPS‘Spoofing’ Can Lead To Fatalities
http://www.techworm.net/2016/11/gps-spoofingdangers-gps-data-hacking.html
Dangers of GPS spoofing and hacking for location
based services
Faking of GPS Data a growing and potentiallylethal danger – The Japan Times, FB
Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

24GPS Tracking is Illegal without Warrant: Japan Supreme Court Ruling

15th March 2017

New rules might be
implemented to make GPS
tracking legal with warrant.
But, there is also
fear of GPS Signal Spoofing.

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

25

Why Authentication is Necessary ?
Insurance
Pay-As-YouDrive

Geo-Fencing

Toll FeeADAS
ITS

Geo-Security

AutoDriving

Importance ofAuthentication
Alternate forFuel Tax
Collection

IoT
M2M

SecuredTransport ofDangerousGoods

V2V / V2X

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

26

Spoofing Methods
Self-Spoofing
Connect by cable
Real Signal Absent

Self-Spoofing
Connect by cable
Real Signal Present

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

Self or 3rd Party SpoofingOver the air transmission

27

Experiment Setup to Test GPS Spoofing
GNSS Antenna

Live GPSSignal fromAntenna

GPS Receiver

PCSignal
Combiner

GPSReceiver

GNSS Signal
Generator

ATTSPOOFER

Attenuator0 – 30dB

SPOOFER

Attenuator

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp28

Online Spoofing Demo

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

29

Examples of TRUE signal and SPOOF Signal
Power Spectrum of IF Data

TRUE Signal

SPOOF Signal during the Attack Period

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

30

Examples of TRUE signal and SPOOF Signal
Time Series IF Data, I & Q Channels

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

31

Examples of TRUE signal and SPOOF Signal
Histogram of IF Data, I & Q Channels

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

32

Examples of TRUE signal and Very Strong SPOOF Signal
Power Spectrum, Time Series and Histogram of IF Data

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

33

We will cover Anti-Spoof
Solutions in the next webinar

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp34Additional Information
Please visit websites
For Webinar: http://www.csis.u-tokyo.ac.jp/~dinesh/WEBINAR.htm
https://gnss.peatix.com
Contact:
dinesh@iis.u-tokyo.ac.jp

Dinesh Manandhar, CSIS, The University of Tokyo, dinesh@iis.u-tokyo.ac.jp

35