GNSS Simulation Application: Spoofing Testing

March 2016

2 12 March 2016

Spectracom: GNSS Essential Ingenuity

Bringing Technology to:

Military, Aerospace

UAV’s

Electronic Warfare

C4ISR

High-End Commercial Apps

Datacenters Robotics/Telematics IDM GIS Data Mining

Spectracom simplifies the integration of Position, Navigation, and Timing into our customer’s systems.

GNSS Simulation Application: Spoofing Testing

• An attempt to deceive a GPS receiver by broadcasting false GPS signals that the receiver will use instead of the live sky signals

• Two Testing Applications: • Hardening Receivers – understand how a

receiver reacts in a spoofing situation and test the effectiveness of mitigation techniques or counter measures

• Defensive Disruption – understand how spoofing can be used to actively take control of a UAS and deflect or re-direct its flight path

• Different than Jamming

• Spoofing is hard. Jamming is easy. • Jamming can disrupt a receiver but not re-locate

or trick it

3 12 March 2016

What is GPS Spoofing?

GNSS Simulation Application: Spoofing Testing

1. TIME SYNC Signal (Live Sky Time vs. Spoofer Time)

2. POSITION Accuracy (Actual Receiver Position vs. Spoofer Starting Position)

3. POWER Level (Live Sky Received Power vs. Spoofer Transmitter Power)

Critical Parameters for Spoofing

4 12 March 2016

Detect the POSITION

Aggressor Path

Disrupted Path

Transmit the TIME

SIGNAL with specific

POWER LEVEL

Spoofer Assuming spoofer signal, protocols, etc. are correct

GNSS Simulation Application: Spoofing Testing

1. TIME SYNC Signal (Live Sky Time vs. Spoofer Time)

2. POSITION Accuracy (Actual Receiver Position vs. Spoofer Starting Position)

3. POWER Level (Live Sky Received Power vs. Spoofer Transmitter Power)

Critical Parameters for Spoofing

5 12 March 2016

Assuming spoofer signal, protocols, etc. are correct

GNSS Simulation Application: Spoofing Testing

• The spoofing signal must be synchronized with the live sky signal to capture a receiver already tracking the real signal

• SYNC required depends on the receiver’s tracking algorithms

• Test: Quantify the sensitivity of the receiver to the variation in TIME SYNC between live sky and spoofer

• Or in other words, how close does the spoofer time need to be to the live sky time (at the receiver’s antenna)?

6 12 March 2016

Critical Parameters – TIME SYNC

Spoofer Signal (False)

Live Sky Signal (True)

Time Sync Delay

GNSS Simulation Application: Spoofing Testing

• The spoofing signal must be synchronized with the live sky signal to capture a receiver already tracking the real signal

• SYNC required depends on the receiver’s tracking algorithms

• Test: Quantify the sensitivity of the receiver to the variation in TIME SYNC between live sky and spoofer

• Or in other words, how close does the spoofer time need to be to the live sky time (at the receiver’s antenna)?

7 12 March 2016

Critical Parameters – TIME SYNC

GNSS Simulation Application: Spoofing Testing

• Test: Quantify the sensitivity of the receiver to the variation of the POSITION between the calculated live sky position and the transmitted spoofer position

• In other words, how close does the spoofer position need to be?

• Again, depends on the receiver’s tracking algorithms

8 12 March 2016

Critical Parameters - POSITION

Live Simulator Position

500m position offset

Spoofer Simulator

Start Position

GNSS Simulation Application: Spoofing Testing

• Quantify the sensitivity of the receiver to the difference in power between live sky and the spoofer

• In other words, how much more power does the spoofer need in order to take over the receiver?

• Note that too strong of a signal can jam the receiver!

9 12 March 2016

Critical Parameters – POWER LEVEL

GNSS Simulation Application: Spoofing Testing

Simulate both Live Sky and Spoofer

1. 1x GSG™ Simulator for “Sky”

2. 1x GSG™ Simulator for Spoofer

3. 1x SecureSync ™ for sync

• Full control over: • Time sync

• Power Level

• Both positions

Live Sky plus Simulated Spoofer

1. Live Sky Antenna

2. 1x GSG™ Simulator for Spoofer

3. 1x SecureSync ™ for sync

• Gets very complicated quickly • Hard to determine power levels

• Difficult to track moving vehicle

10 12 March 2016

Spoofing Testing Configurations

Configuration A is preferred

A B

GNSS Simulation Application: Spoofing Testing

11 12 March 2016

Test Setup – Configuration A

GNSS Simulation Application: Spoofing Testing

• Hardening GNSS receivers against spoofing and jamming is crucial

• The threat is new, real and increasing

• Testing with a simulator is a very effective tool for designing and evaluating countermeasures

12 12 March 2016 GNSS Simulation Application: Spoofing Testing

Conclusions

"The bad guys on the borders have lots of

money, and what they're putting money into is in

spoofing and jamming of GPS…”

Timothy Bennett, Program Mgr, US Dept of Homeland

Security Science and Technology Directorate