# Advanced Smartphone-Based Identification of Transport Modes: Resilience under GNSS-Based Attacks
## 3 Deceiving the Ticketing System
### Only-GNSS-Based Transport Mode Identification
#### 3.2.1 System-Under-Attack Check B  
Positioning satellites are equipped with atomic clocks with a stable drift synchronized with each other [14]. The GNSS receiver clock of the smartphone is not synchronized with the GPS time. Therefore, there is an offset between the GPS time and the GNSS receiver clock of the smartphone [14].  
However, in the case of an attack, the offset between the GPS time and the GNSS receiver clock of the smartphone suddenly changes when the attack starts, since the smartphone does not receive the legitimate navigation signal from the satellites anymore but rather the faulty navigation signal from another transmitter.  
The transmitter of the faulty navigation signal requires an atomic clock and needs to synchronize its oscillator with GPS time to avoid a sudden change in the offset between clocks. This is unlikely to happen for the purpose of deceiving the e-ticketing system.  
Therefore, the continuous observation of the offset between the GPS time and the GNSS receiver clock of the smartphone allows detecting the attack. In [15], the authors explain the limitations of commercial off-the-shelf receivers and why and how the clock bias can be used to detect attacks. This method does not require additional hardware or software, and the required information is provided by the navigation chip. Furthermore, in [16] the authors experimentally demonstrate how the clock bias analysis allows for the detection of such attacks.  
Figure 17 shows an outlier when there is a variation between the GNSS receiver clock of the smartphone and the GPS time. This happens when the spoofing attack starts and ends. The faulty navigation signal we generated for the journey recorded in Munich was introduced at minute 16 and it lasted until minute 23.  
Figure 16: This figure presents the flow diagram of the only-GNSS-based identification of transport modes.  
Figure 17: This figure shows an outlier when there is a variation between the GNSS receiver clock of the smartphone and the GPS time. The faulty navigation signal is introduced at minute 16 and it lasted until minute 23.  
Figure 18 shows an outlier when there is a variation between the GNSS receiver clock of the smartphone and the GPS time. This happens when the spoofing attack starts and ends. The faulty navigation signal we generated for the journey recorded in Paris was introduced at minute 21 and it lasted until the end of the journey. From minute 6 until minute 32 (see Figure 15) there was no satellite reception. The periods of no satellite reception have been indicated in Figure 18 with a gray shadow. The signal loss yields to no signal interruption because the out-of-the-box GNSS solution of the smartphone extrapolates the offset between the clocks during the period of no reception.  
The attack starts under no satellite reception conditions at minute 21. The introduction of the faulty navigation signal produces an outlier in the offset of the clocks, as shown in Figure 18.  
However, there are limitations of the method of detecting the attack based on the GNSS receiver clock: if the attack occurs exactly at the same time as the smartphone recovers the GNSS reception, e.g., when leaving an underground station, there is no possibility of differentiating between an attack and the pure recovery of GNSS reception. Nonetheless, the out-of-the-box GNSS navigation signal provided by the smartphone is usually extrapolated from the last received GNSS signal to cover the periods of no reception.