1. Thoughts on GPS Security and Integrity Todd Humphreys, UT Austin Aerospace Dept. DHS Visit to UT Radionavigation Lab | March 10, 2011

2. GPS: The Big Issues  Weak GPS Signals  Like a 30-Watt lightbulb held 4000 km away  GPS does not penetrate well indoors  GPS is easy target for jamming  GPS is vulnerable to natural interference (e.g., solar radio bursts and ionospheric scintillation)  Unauthenticated Civil GPS Signals  Civil GPS broadcast “in the clear”  Makes civil GPS vulnerable to spoofing

3. Emerging Threat: GPS Jamming

4. Emerging Threat: Civil GPS Spoofing

5. Spoofing and Jamming are Different Threats  Spoofing is more difficult & costly  Spoofing leaves no trace – victim receiver doesn’t know it’s being spoofed  Spoofer typically targets a single receiver  Many countermeasures to jamming are ineffective against spoofing

6. Assessing the Spoofing Threat  Multi-frequency, multi-system receivers inherently resistant to spoofing  Vast majority of GPS receivers in critical applications are single-frequency L1 C/A (easily spoofable)  Software radio techniques are game-changer, enabling one to “download” a spoofer  Strong financial incentives encourage “complicit spoofing” (spoofing one’s own receiver)  Timing receivers used in communications infrastructure are attractive target

7. Civil GPS Spoofing Testbed at UT Austin  Vestigial signal defense  Data bit latency defense  Cryptographic defenses  Phase trauma monitoring  Dual-frequency tracking Spoofer Defender  GPS L1 C/A output  Software radio platform  Output precisely synchronized with authentic signals via feedback  Finely adjustable output signal strength  Remotely commanded via Internet

8. Inside the Box Digital attenuator for precise control of output signal power

9. Inside the Box Spoofing signal feedback for precise signal alignment

10. Inside the Box Interface board for remote operation

11. Inside the Box Tracking, data-bit prediction, and synthesis on single DSP Total bill of materials: ~$1,000

12. Civil Anti-Spoofing Techniques Inspired by Work to Date  Data bit latency defense (weak but easy to implement)  Multi-antenna defense (patented in 1996; strong against single spoofer; fails against multiple spoofers; requires additional hardware)  Vestigial signal defense (work in progress; appears strong)  Navigation message authentication (strong, practical, more on this later)  Cross-correlation using P(Y) code (pioneered by Lo, refined by Psiaki, very strong but not so practical)

13. Thoughts on the Way Forward for Civil GNSS Authentication  More signals means more inherent security, but probably insufficient  Some civil cryptographic authentication scheme is likely required  “Signal definition inertia is enormous” – Tom Stansell  Navigation message authentication (NMA) appears to be best, practical option (advocated by Logan Scott in 2003, others since, more on this later)  Goal of cryptographic authentication: force adversary to use directional antennas in a replay attack  Preliminary evaluation of NMA for L2C suggests optimism (more on this later)  Cryptography must be paired with detection theory

14. Spoofing Detection as a Hypothesis Testing Problem (Soft W-chip Estimation) Spoofing detection depends on rough estimates of nominal (C/No)s and (C/No)r See forthcoming paper on this topic: “Detection strategies for civil cryptographic anti-spoofing.”

15. Navigation and Timing Resilience Through Opportunistic Navigation

16. Tightly-Coupled Opportunistic Navigation Enabling configuration: (1) Same clock: Downmix and sample GPS and SOO with same oscillator (2) Same silicon: Sample GPS and SOO in same A/D converter Enabling configuration: (1) Same clock: Downmix and sample GPS and SOO with same oscillator (2) Same silicon: Sample GPS and SOO in same A/D converter

17. TCON for Legacy GPS Receivers: The GPS Assimilator

18. Assimilator Prototype

19. More Information http://radionavlab.ae.utexas.edu

20. Backup Slides

21. Synchrophasor-Aided Power Distribution

22. Usage Example: Protecting a GPS Time and Frequency Receiver

23. Usage Example: Reducing Ionospheric Errors

24. Usage Example: Harnessing CDMA Cellular Signals as Aid for Weak GPS Signal Tracking

25. User LEO crosslinks Aiding signal from LEO high-power spot beams over area of operations 400-km switchable beams GPS Signals  Strong signals  Stable clocks  Navigational backup to GPS  Civilian Anti-spoofing Usage Example: Iridium-Augmented GPS