thoughts on gps security and integrity todd humphreys, ut austin aerospace dept. dhs visit to ut...
TRANSCRIPT
![Page 1: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/1.jpg)
Thoughts on GPS Security and Integrity
Todd Humphreys, UT Austin Aerospace Dept.
DHS Visit to UT Radionavigation Lab | March 10, 2011
![Page 2: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/2.jpg)
GPS: The Big Issues
Weak GPS Signals Like a 30-Watt lightbulb held 4000 km away GPS does not penetrate well indoors GPS is easy target for jamming GPS is vulnerable to natural interference (e.g.,
solar radio bursts and ionospheric scintillation)
Unauthenticated Civil GPS Signals Civil GPS broadcast “in the clear” Makes civil GPS vulnerable to spoofing
![Page 3: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/3.jpg)
Emerging Threat: GPS Jamming
![Page 4: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/4.jpg)
Emerging Threat: Civil GPS Spoofing
![Page 5: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/5.jpg)
Spoofing and Jamming are Different Threats Spoofing is more difficult & costly Spoofing leaves no trace – victim receiver
doesn’t know it’s being spoofed Spoofer typically targets a single receiver Many countermeasures to jamming are
ineffective against spoofing
![Page 6: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/6.jpg)
Assessing the Spoofing Threat Multi-frequency, multi-system receivers
inherently resistant to spoofing Vast majority of GPS receivers in critical
applications are single-frequency L1 C/A (easily spoofable)
Software radio techniques are game-changer, enabling one to “download” a spoofer
Strong financial incentives encourage “complicit spoofing” (spoofing one’s own receiver)
Timing receivers used in communications infrastructure are attractive target
![Page 7: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/7.jpg)
Civil GPS Spoofing Testbed at UT Austin
Vestigial signal defense Data bit latency defense Cryptographic defenses Phase trauma monitoring Dual-frequency tracking
Spoofer
Defender
GPS L1 C/A output Software radio platform Output precisely synchronized with
authentic signals via feedback Finely adjustable output signal
strength Remotely commanded via Internet
![Page 8: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/8.jpg)
Inside the BoxDigital attenuator for precise control of output signal power
![Page 9: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/9.jpg)
Inside the BoxSpoofing signal feedback for precise signal alignment
![Page 10: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/10.jpg)
Inside the BoxInterface board for remote operation
![Page 11: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/11.jpg)
Inside the BoxTracking, data-bit prediction, and synthesis on single DSP
Total bill of materials: ~$1,000
![Page 12: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/12.jpg)
Civil Anti-Spoofing Techniques Inspired by Work to Date Data bit latency defense (weak but easy to implement) Multi-antenna defense (patented in 1996; strong against
single spoofer; fails against multiple spoofers; requires additional hardware)
Vestigial signal defense (work in progress; appears strong)
Navigation message authentication (strong, practical, more on this later)
Cross-correlation using P(Y) code (pioneered by Lo, refined by Psiaki, very strong but not so practical)
![Page 13: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/13.jpg)
Thoughts on the Way Forward for Civil GNSS Authentication
More signals means more inherent security, but probably insufficient Some civil cryptographic authentication scheme is likely required “Signal definition inertia is enormous” – Tom Stansell Navigation message authentication (NMA) appears to be best, practical
option (advocated by Logan Scott in 2003, others since, more on this later)
Goal of cryptographic authentication: force adversary to use directional antennas in a replay attack
Preliminary evaluation of NMA for L2C suggests optimism (more on this later)
Cryptography must be paired with detection theory
![Page 14: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/14.jpg)
Spoofing Detection as a Hypothesis Testing Problem (Soft W-chip Estimation)
Spoofing detection depends on rough estimates of nominal (C/No)s and (C/No)r
See forthcoming paper on this topic: “Detection strategies for civil cryptographic anti-spoofing.”
![Page 15: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/15.jpg)
Navigation and Timing Resilience Through Opportunistic Navigation
![Page 16: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/16.jpg)
Tightly-Coupled Opportunistic Navigation
Enabling configuration: (1) Same clock: Downmix and sample
GPS and SOO with same oscillator(2) Same silicon: Sample GPS and SOO
in same A/D converter
Enabling configuration: (1) Same clock: Downmix and sample
GPS and SOO with same oscillator(2) Same silicon: Sample GPS and SOO
in same A/D converter
![Page 17: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/17.jpg)
TCON for Legacy GPS Receivers: The GPS Assimilator
![Page 18: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/18.jpg)
Assimilator Prototype
![Page 19: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/19.jpg)
More Information
http://radionavlab.ae.utexas.edu
![Page 20: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/20.jpg)
Backup Slides
![Page 21: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/21.jpg)
Synchrophasor-Aided Power Distribution
![Page 22: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/22.jpg)
Usage Example: Protecting a GPS Time and Frequency Receiver
![Page 23: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/23.jpg)
Usage Example: Reducing Ionospheric Errors
![Page 24: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/24.jpg)
Usage Example: Harnessing CDMA Cellular Signals as Aid for Weak GPS Signal Tracking
![Page 25: Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011](https://reader034.vdocuments.us/reader034/viewer/2022052414/56649db05503460f94a9ee50/html5/thumbnails/25.jpg)
User
LEOcrosslinks
Aiding signal from LEO high-powerspot beams over area of operations
400-km switchable beams
GPS Signals
Strong signals Stable clocks Navigational backup to GPS Civilian Anti-spoofing
Usage Example: Iridium-Augmented GPS