Radio frequency fingerprinting (RFF) methods are becoming more and more popular in the context of identifying genuine transmitters and distinguishing them from malicious or non-authorized transmitters, such as spoofers and jammers. RFF approaches have been studied to a moderate-to-great extent in the context of non-GNSS transmitters, such as WiFi, IoT, or cellular transmitters, but they have not yet been addressed much in the context of GNSS transmitters. In addition, the few RFF-related works in GNSS context are based on post-correlation or navigation data and no author has yet addressed the RFF problem in GNSS with pre-correlation data. Moreover, RFF methods in any of the three domains (pre-correlation, post-correlation, or navigation) are still hard to be found in the context of GNSS. The goal of this paper was two-fold: first, to provide a comprehensive survey of the RFF methods applicable in the GNSS context; and secondly, to propose a novel RFF methodology for spoofing detection, with a focus on GNSS pre-correlation data, but also applicable in a wider context. In order to support our proposed methodology, we qualitatively investigated the capability of different methods to be used in the context of pre-correlation sampled GNSS data, and we present a simulation-based example, under ideal noise conditions, of how the feature down selection can be done. We are also pointing out which of the transmitter features are likely to play the biggest roles in the RFF in GNSS, and which features are likely to fail in helping RFF-based spoofing detection.

In the proposals for Global Navigation Satellite Systems (GNSS) Navigation Message Authentication (NMA) that are based on adapting the Timed Efficient Stream Loss-Tolerant Authentication (TESLA) protocol, the length of the one-time keys is limited (e.g. to 80 bits) by the low transmission rate. As a consequence, the hash function that is used to build the one-way key chain is constructed having a longer, secure hash function (e.g. SHA-256), preceded by a time-varying yet deterministic padding of the input and followed by a truncation of the output. We evaluate the impact of this construction on the collision resistance of the resulting hash function and of the whole chain, and show that with current proposed parameters, combined with the use of efficient hashing hardware, it can lead to a feasible attack with significant collision probability. The collision can be leveraged to mount a long lasting spoofing attack, where the victim receiver accepts all the one time keys and the navigation messages transmitted by the attacker as authentic. We conclude by suggesting possible modifications to make TESLA-based NMA more robust to such attacks.

The threat of Global Navigation Satellite Systems (GNSS) signal spoofing has grown in recent years and has motivated the research community to develop anti-spoofing techniques. Different approaches were developed, from those operating at digital signal processing level to those based on cryptography. This work focus on the class of anti-spoofing mechanisms that aims at protecting the GNSS signal by encrypting, completely or partially, the ranging code. The goal of this approach is to force the attacker to estimate the secret chips rather than arbitrarily generate a spoofing signal based on the known spreading code. This work will analyse the effective security level offered by this class of security mechanism as a function of the clock uncertainty of the victim receiver, the C/N₀ advantage of the attacker and its attack strategy. Finally, a framework that allows to derive the amount of secret chips that the receiver needs to accumulate in order to meet its security target is presented, together with example obtained with a GNSS software receiver.

We consider a cellular Internet of things (CIoT) network where many source nodes aim at exchanging messages with a single concentrator node. To this end, they are assisted by anchor nodes that are trusted and securely connected with the concentrator node. In this context, we aim at providing a message authentication scheme based on the characteristics of the channel between the source nodes and the anchor nodes. According to this approach, the anchor nodes estimate the channel to source nodes in an initially externally authenticated fashion, while forthcoming messages are authenticated by comparing the current channel estimate with the initial estimate. Moreover, assuming that the anchor nodes have a limited energy availability, we derive suitable scheduling policies for the activation of the anchor nodes for authentication purposes. In particular, we aim at maximizing the anchors lifespan while guaranteeing given false alarm and missed detection probabilities of the authentication process. The performance of the proposed authentication protocols is evaluated in a typical CIoT scenario.