[Paper Review] SemperFi: A Spoofer Eliminating GPS Receiver for UAVs

Harshad Sathaye, Gerald LaMountain+2 more|arXiv (Cornell University)|May 5, 2021

GNSS positioning and interference47 references4 citations

TL;DR

SemperFi is a single-antenna GPS receiver for UAVs that autonomously detects and eliminates spoofing signals by leveraging inertial sensor stability and successive interference cancellation to recover legitimate time-of-arrival (ToA) information. It achieves true location recovery within 10 seconds of a spoofing attack using flight maneuvers under 50 m long.

ABSTRACT

It is well-known that GPS is vulnerable to signal spoofing attacks. Although several spoofing detection techniques exist, they are incapable of mitigation and recovery from stealthy attackers. In this work, we present SemperFi, a single antenna GPS receiver capable of tracking legitimate GPS satellite signals and estimating the true location even during a spoofing attack. The main challenge in building SemperFi is, unlike most wireless systems where \emph{the data} contained in the wireless signals is important, GPS relies on the time of arrival (ToA) of satellite signals. SemperFi is capable of distinguishing spoofing signals and recovering legitimate GPS signals that are even completely overshadowed by a strong adversary. We exploit the short-term stability of inertial sensors to identify the spoofing signal and extend the successive interference cancellation algorithm to preserve the legitimate signal's ToA. We implement SemperFi in GNSS-SDR, an open-source software-defined GNSS receiver, and evaluate its performance using UAV simulators, real drones, a variety of real-world GPS datasets, and various embedded platforms. Our evaluation results indicate that in many scenarios, SemperFi can identify adversarial peaks by executing flight patterns that are less than 50 m long and recover the true location within 10 seconds (Jetson Xavier). We show that our receiver is secure against stealthy attackers who exploit inertial sensor errors and execute seamless takeover attacks. We design SemperFi as a pluggable module capable of generating a spoofer-free GPS signal for processing on any commercial-off-the-shelf GPS receiver available today. Finally, we release our implementation to the community for usage and further research.

Motivation & Objective

• Address the critical vulnerability of GPS in UAVs to spoofing attacks that bypass traditional detection and mitigation techniques.
• Enable autonomous recovery of legitimate GPS signals even when completely overshadowed by strong adversarial signals.
• Design a solution that works with single-antenna, commercial-off-the-shelf (COTS) GPS receivers without requiring cryptographic infrastructure or additional hardware.
• Overcome limitations of existing spoofing detection schemes that fail against stealthy, seamless takeover attacks.
• Develop a pluggable module that generates spoofer-free GPS signals for integration with any COTS GPS receiver.

Proposed method

• Use short-term inertial measurement unit (IMU) stability to correlate motion patterns with GPS signal estimates and detect spoofing signals.
• Implement an Adversarial Peak Identifier (API) that distinguishes spoofing signals from legitimate ones based on correlation between IMU motion and GPS signal timing.
• Apply a modified successive interference cancellation (SIC) algorithm to preserve the true time-of-arrival (ToA) of legitimate GPS signals while suppressing spoofing signals.
• Design a signal recovery mechanism in the Legitimate Signal Retriever (LSR) that reconstructs the correct ToA using amplitude, phase, and timing estimates of both legitimate and spoofing signals.
• Integrate the system into GNSS-SDR, an open-source software-defined GNSS receiver, to enable real-time operation on embedded platforms like Jetson Xavier.
• Trigger a randomized flight maneuver (10–20 s, <50 m) upon spoofing detection to enhance signal discrimination and enable recovery.

Experimental results

Research questions

• RQ1 Can a single-antenna GPS receiver detect and eliminate spoofing signals without relying on cryptographic authentication or additional hardware?
• RQ2 How effectively can inertial sensor stability be leveraged to distinguish spoofing signals from legitimate GPS signals during dynamic flight maneuvers?
• RQ3 Can successive interference cancellation be adapted to preserve the time-of-arrival (ToA) of legitimate GPS signals while suppressing strong spoofing signals?
• RQ4 To what extent can SemperFi recover the true GPS location within a short timeframe (e.g., 10 seconds) under strong, stealthy spoofing attacks?
• RQ5 Can SemperFi be deployed as a pluggable module on any COTS GPS receiver to provide spoofer-free positioning?

Key findings

• SemperFi successfully identifies adversarial peaks using flight maneuvers less than 50 m in length, enabling effective spoofing detection.
• The system recovers the true GPS location within 10 seconds on the Jetson Xavier platform, even when the legitimate signal is completely buried under a strong spoofing signal.
• SemperFi is resilient against stealthy, seamless takeover attacks that evade traditional detection by mimicking inertial sensor errors.
• The receiver maintains accurate positioning during spoofing attacks by preserving the time-of-arrival (ToA) of legitimate satellite signals through customized SIC.
• Evaluation on real drones (e.g., DJI Flamewheel F450), UAV simulators, and real-world GPS datasets confirms robust performance across diverse scenarios.
• The open-source implementation in GNSS-SDR enables community adoption and further research, with full release available for public use.