[论文解读] SPREE: Spoofing Resistant GPS Receiver

Aanjhan Ranganathan, Hildur Ólafsdóttir+1 more|arXiv (Cornell University)|Mar 17, 2016

GNSS positioning and interference参考文献 17被引用 11

一句话总结

SPREE 是一种新型单天线 GPS 接收机，通过利用辅助峰值跟踪技术，基于信号的时间行为和特性识别欺骗信号，可检测所有已知的欺骗攻击，包括无缝接管攻击。其将欺骗引起的定位误差限制在 1 公里以内，显著提升了传统接收机易被欺骗至任意位置的安全性。

ABSTRACT

Global Positioning System (GPS) is used ubiquitously in a wide variety of applications ranging from navigation and tracking to modern smart grids and communication networks. However, it has been demonstrated that modern GPS receivers are vulnerable to signal spoofing attacks. For example, today it is possible to change the course of a ship or force a drone to land in an hostile area by simply spoofing GPS signals. Several countermeasures have been proposed in the past to detect GPS spoofing attacks. These countermeasures offer protection only against naive attackers. They are incapable of detecting strong attackers such as those capable of seamlessly taking over a GPS receiver, which is currently receiving legitimate satellite signals, and spoofing them to an arbitrary location. Also, there is no hardware platform that can be used to compare and evaluate the effectiveness of existing countermeasures in real-world scenarios. In this work, we present SPREE, which is, to the best of our knowledge, the first GPS receiver capable of detecting all spoofing attacks described in literature. Our novel spoofing detection technique called auxiliary peak tracking enables detection of even a strong attacker capable of executing the seamless takeover attack. We implement and evaluate our receiver against three different sets of GPS signal traces and show that SPREE constrains even a strong attacker (capable of seamless takeover attack) from spoofing the receiver to a location not more than 1 km away from its true location. This is a significant improvement over modern GPS receivers that can be spoofed to any arbitrary location. Finally, we release our implementation and datasets to the community for further research and development.

研究动机与目标

• 解决现代 GPS 接收机在面对复杂欺骗攻击（包括可绕过传统防护措施的无缝接管攻击）时的关键脆弱性。
• 开发一种独立的、即插即用的 GPS 接收机，不依赖加密认证、外部传感器或额外硬件，实现欺骗检测。
• 通过提供硬件平台和公开发布的信号追踪数据，实现欺骗防护措施的现实世界评估。
• 即使在强多径效应或移动运行环境下，也能检测欺骗信号。
• 确保对民用和军用 GPS 欺骗攻击（包括重放和信号操控攻击）具备韧性。

提出的方法

• 提出一种新型欺骗检测技术——辅助峰值跟踪，通过监测 GPS 信号互相关函数中出现的意外且持续存在的辅助相关峰值来检测欺骗信号。
• 设定最大允许时间延迟阈值（τ_max = 500 ns），当辅助峰值延迟超过此值时触发欺骗警报。
• 利用欺骗信号的物理特性——如持续存在的高功率辅助峰值，且相位和幅度一致——与瞬时衰减的多径信号区分开来。
• 利用辅助峰值的时间行为，将欺骗信号与通常短暂且受极化与路径损耗衰减影响的合法多径反射信号区分开。
• 在软件定义 GPS 接收机中直接实现检测逻辑，仅使用标准接收机可观测量，避免依赖外部硬件或信号认证。
• 通过分析在渗透测试（wardriving）过程中收集的真实 GPS 信号追踪数据，验证检测的鲁棒性：在正常条件下未观察到延迟超过 500 ns 的辅助峰值。

实验结果

研究问题

• RQ1 独立的、单天线 GPS 接收机能否在不依赖加密认证的情况下，检测所有已知的欺骗攻击，包括无缝接管攻击？
• RQ2 辅助峰值跟踪能否基于时间行为和信号特性，有效区分欺骗信号与合法多径信号？
• RQ3 当接收机采用 SPREE 的检测机制时，欺骗攻击者在多大程度上能操控 GPS 接收机的位置估计？
• RQ4 该检测方法在具有强多径效应和移动接收机动态的现实环境中是否具备鲁棒性？
• RQ5 公开可用的硬件平台和数据集能否在实践中实现欺骗防护措施的可复现评估与对比？

主要发现

• SPREE 可成功检测文献中描述的所有已知欺骗攻击，包括强攻击者实施的无缝接管攻击，且不破坏接收机的正常运行。
• 辅助峰值跟踪机制通过检测延迟超过 500 ns 的持续辅助相关峰值，可靠识别欺骗信号，而这类峰值在合法多径环境中极不可能出现。
• 在渗透测试期间收集的真实世界信号追踪数据中，未观察到延迟超过 500 ns 的合法辅助峰值，验证了基于阈值的检测方法的实用性。
• 即使强攻击者实施无缝接管，SPREE 也能将欺骗后的位置限制在真实位置的 1 公里以内，相比传统接收机可被欺骗至任意位置，安全性实现显著提升。
• 该接收机的检测机制对强多径效应和移动运行具有鲁棒性，因为合法多径信号不会产生超过阈值的持续高功率辅助峰值。
• 作者已向研究社区发布 SPREE 的实现代码和所有收集的 GPS 信号追踪数据，支持可复现的评估与未来欺骗防护措施的开发。