International GNSS Summer School 2019
Organized by Tokyo University of Marine Science and Technology

CourseModule A: GNSS Signal Security
Module B: Spoofing & GNSS Signal Authentication
Module C: Android GNSS Raw Data Processing
Dinesh MANANDHAR
Center for Spatial Information Science
The University of Tokyo
dinesh@iis.u-tokyo.ac.jp
29th July – 3rd August 2019, Tokyo
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 1

• Dinesh Manandhar• Associate Professor (Project), Center for Spatial Information Science, The
University of Tokyo• Adjunct Associate Professor, Asian Institute of Technology, Thailand• Member, ISO/TC-204, WG18
• Member, ICAO/NSP, DFMC/SBAS Signal Authentication

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 2

Outline of the Lecture• Module A: GNSS Signal Security• Introduction to GNSS Vulnerabilities• Interference• Jamming• Spoofing• Module B: Spoofing and GNSS Signal Authentication• Detail discussions on Spoofing• Demonstration of Spoofing• Anti-Spoofing Methods• Demonstration of Anti-Spoofing Method• Module C: Android GNSS Raw Data Processing• Introduction• Android Devices• Data Logging Tools• Data Processing Tools• Data Processing Outputs• Innovative and Challenging Applications

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 3

Module – BSpoofing and GNSS Signal Authentication

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 4

Module – B: Contents• Introduction• Spoofing Issues• What is Spoofing?
• How to Spoof?

• Anti-Spoofing• Anti-Spoofing Methods• Authentication System Development• POC (Proof-Of-Concept) Tests• GPS & GALILEO Authentication Status• Conclusions

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 5

11:26:28 PM

Can You Trust GPS Position & Time Data?

Yes, You can…
…But Need to Verify
Because of Spoofing Issues
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 6

What is Location Spoofing?
• Falsify Location Data as If it were True Location

TOKYOOrHawaii?

Where is it?
Tokyo or Hawaii?

TOKYO

HAWAII

Watch
James Bond’sMovie:“Tomorrow NeverDies”
to understand How
a GPS receiver canbe spoofed.

This movie is allabout GPS Spoofing

SpooferDinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 7

Why GPS is Vulnerable to Spoofing ?
• GPS Signal Power is Extremely Low• GPS Signal Structures are Published and Accessible to Everyone

20dB

Thermal Noise Power of the Receiver

GNSS Signal Power Level at Receiver

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 8

Software-Based GPS Signal Generator (Spoofer?)
Ephemeris Data
RINEX File

User Motion
Data
Static or Dynamic

Transmit
SignalSelectVisibleSatellites

Simulation Date,Time andDuration

Generate
SignalAdjust Signal
OutputPowerDigital SignalProperties(Sampling Freq,Bit Rate, IF etc)

Antenna
Gain
Pattern

Digital I/Q
SignalOutputDigitalIQ Signal
fs = 26MHz
A/D = 12bit

Digital to Analog(D/A) Conversion

Hardware

Software
GPS L1C/A
f = 1575.42MHz
Signal Generation

Digital IQ
SignalDinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 9

Current Situation with Position Data from GNSSQZSSGPSGPSCan I TRUST
this Position
Data?
Is this Signal
Spoof-Free?

Your Location is35.123, 139.456

You may TRUST the data BUT need to VERIFY
However, there is No Method to VERIFY GPS Signal

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 10

What is GPS Signal Authentication?
• To authenticate or verify that a GPS signal in the receiver is actuallyfrom a GPS satellite not a Spoofer
Is this GPS Signal froma GPS Satellite or aSpoofer / Simulator?

Spoofer or Simulator

GPS Signal Authentication is necessary to detect SPOOF Signals
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 11

Spoofing Methods
Spoofing Level 0

Spoofing Level 1

Spoofing Level 2

Self-Spoofing

Self-Spoofing

Self-Spoofing or 3rd Party Spoofing

Receiver and Spoofer directly
connected by cable

Receiver and Spoofer
directly connected by cable

Over-the-Air Spoof Signal Transmission
Real Signal Present

Real Signal Present

Real Signal not Present

Spoofer
Antenna

GNSS
Antenna

SPOOFER

GNSS
Receiver

GNSS
Receiver

GNSS
ReceiverSPOOFER

GNSS
Antenna

SPOOFER

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 12

GPS Spoofing in Black Sea?
24th June 2017
A GPS spoofing attack in June, involving
over 20 vessels in the Black Sea, has beenreported. Probably the first official recordof spoofing. More……….

Black Sea

https://www.rin.org.uk/newsitem/4969/GPS-Spoofing-in-Black-Sea

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 13

SPOOFing a Car: Is he driving the car?

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 14

Output of GNSS Receiver, True Data and Spoof Data
Quiz: Can you identify TRUE Data and SPOOF Data?

Ship going along
the Ferry Route

Ship goingaround the Port Area

Visible Satellites

Visible Satellites

GNSS Raw Data

Speed

GNSS Raw Data

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Speed

Slide : 15

GPS Spoofing Poses Risk of Future Havoc
GPS 'Spoofing' is No Joke: Dangers of GPS Data
Hacking Realized

GNSS spoofing will attain virus status, warns expert– GPS World
Hacking Global Positioning System with GPS‘Spoofing’ Can Lead To Fatalities
http://www.techworm.net/2016/11/gps-spoofingdangers-gps-data-hacking.html
Dangers of GPS spoofing and hacking for location
based services
Faking of GPS Data a growing and potentiallylethal danger – The Japan Times, FB
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 16

GPS Tracking is Illegal without Warrant: Japan Supreme Court Ruling

15th March 2017
New rules might be
implemented to make GPS
tracking legal with warrant.
But, there is also
fear of GPS Signal Spoofing.

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 17

Why SPOOFING is Dangerous
compared to Interference & Jamming?
Spoofing

Jamming and Interference

Intentional

Intentional and
Non-Intentional

Difficult to Detect

Can be Detected

Available of Service but
Lead to False Position Data

Denial of Service

No Effective Solution for
Existing Signals

Many Solutions ExistFewer Research and Studies Many Research and Studies
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 18

Why do we need to care about Spoofing?
Insurance
Pay-As-YouDrive
Geo-Fencing

Toll FeeADAS
ITS

Geo-Security

AutoDriving

Importance ofAnti-Spoofing
Alternate forFuel Tax
Collection

IoT
M2M
SecuredTransport ofDangerousGoods

V2V / V2X

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 19

Importance of Anti-Spoofing for Trust-worthy PVT Data for ITS• Discussions in ISO/TC-204, WG18
• To Draft regulations for ITS-S related with PVT Data

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 20

Importance of Anti-Spoofing for Trust-worthy PVT Data for Aviation• New SBAS Signals (L5 Band) can also be
Authenticated without modifying the current
signal structure.
• ICAO is already highlighting the necessity andimportance of SBAS Signal Authentication• New regulations that will require to Authenticate SBAS
Signals for Anti-spoofing will emergeDinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 21

How to Mitigate Spoofing?

P-Code Reference
RAIM or ARAIM
Signal Sanity Check
Multi-Correlator• Signal Encryption• PRN Code Encryption• NAV Message Encryption

SW Level••••

Implementation ComplexityLow• Signal Monitoring

Platform

Technology Adaptation

Flexible• AGC Monitoring

HW Level• RF Level

High• Multi-antenna• Direction of Arrival
• ….

Rigid

• Hardware Level• Navigation Message Authentication• GALILEO Open Signal Navigation Message Authentication• Our Method  Broadcasting Digital Signature

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 22

How to Solve Spoofing?
• Hardware Level• Multi-antenna• Direction of Arrival• ….

• Signal Monitoring• P-Code Reference• RAIM or ARAIM• Signal Sanity Check• Multi-Correlator• Signal Encryption• PRN Code Encryption• NAV Message Encryption• Broadcasting Digital Signature• Navigation Message Authentication• GALILEO Open Signal Navigation Message Authentication• TESLA

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 23

Anti-Spoofing Design Requirements• No Change in Hardware• Receiver side, Control System or Satellite system• No Change in Signal Structure• Satellite Side

• Shall be able to• Implement only with FW/SW modification in the receiver• Provide Position Solution even if Authentication Fails• Authenticate only when required• Authenticate in Real-time as well as in Post-processing mode
• Authenticate GPS L1C/A Signals as well
• Authenticate consumer grade receivers• IoT, ITS, ADAS, V2X, Mobile Phones etc

These requirements impose certain limitations on Authentication
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 24

Our Solution for Anti-Spoofing  Signal Authentication
QZSSGPSGPSYour Location is35.123, 139.456

Can I Trust thisPosition Data?

SignalAuthentication
SystemCheck theSignal

Solution developed forSpoofing Check

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 25

Authentication System: Space, Control and User Systems
GPSSpace System

GPS

User System

Control System

GNSS
Receiver

I/F

I/F

QZSS ControlAuthentication
GNSS Monitoring
StationData Center (ADC)
Stations in Japanand ASEAN
NAV Data Bits from
Digital Signature DataCountries
QZSS Monitoring Stations
for Authentication

USER
Marine / AIS

Aviation / WAAS
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

ITS / ADAS

Railway

Slide : 26

Prototype Anti-Spoofing Receiver
GPS
QZSS

L1C/A

QZSS Signal with
Digital Signature
for Authentication

GNSS
Receiver

Connect
through
OTG
Cable

TabletAUTH
APPVer. : 1.0

Request for KEY
Provide KEY &Other Services
WiFi Link

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Authentication
Data Center(Service Provider)

Slide : 27

GPS Signal Authentication
Output of Signal Authentication APP when visible
GPS signals are successfully authenticated.

GreenRed: Authentication Successful: Authentication FailDinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 28

GPS Signal Authentication
Output of Signal Authentication APP when visible
GPS signals are successfully authenticated.

GreenRed: Authentication Successful: Authentication Fail / SPOOF Signal

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 29

Sample Authentication Output (KML)

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 30

Sample Authentication Output (KML)

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 31

POC Test Results, Dynamic User, Car Driving

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 32