Security of global navigation satellite systems (GNSS) is important since the navigation capability provided by the GNSS is a key enabler for many civilian and military applications. Spoofing attacks threaten the GNSS security and have caught much attention recently. The spatial processing method is one of the most robust GNSS spoofing countermeasures, which detects spoofing signals with a moving antenna or multi-antenna, but it cannot work in a static single-antenna receiver. In this paper, we propose a spoofing countermeasure based on the power measurements of a single rotating antenna, which can be implemented in a static receiver. The method takes advantages of the anisotropy of the antenna's gain pattern to detect spoofing signals. When the antenna is rotating, the power measurements of the spoofing signals coming from the same direction change similarly and the correlation coefficients between them are close to 1, but the power measurements of the authentic signals are uncorrelated. Since it is not easy to evaluate the anti-spoofing performance of the correlation coefficient, another metric named phase difference of power measurements is proposed. Its theoretical performance is derived based on generalized likelihood ratio test and validated with simulations. Actual experiments indicate that both the simulated and meaconing spoofing signals can be distinguished from the authentic ones, and the method can be implemented in a static or low-dynamic conventional receiver, only with an additional low-cost rotary table.

Spoofing attacks are threatening the global navigation satellite system (GNSS). The maximum likelihood estimation (MLE)-based positioning technique is a direct positioning method originally developed for multipath rejection and weak signal processing. We find this method also has a potential ability for GNSS anti-spoofing since a spoofing attack that misleads the positioning and timing result will cause distortion to the MLE cost function. Based on the method, an estimation-cancellation approach is presented to detect spoofing attacks and recover the navigation solution. A statistic is derived for spoofing detection with the principle of the generalized likelihood ratio test (GLRT). Then, the MLE cost function is decomposed to further validate whether the navigation solution obtained by MLE-based positioning is formed by consistent signals. Both formulae and simulations are provided to evaluate the anti-spoofing performance. Experiments with recordings in real GNSS spoofing scenarios are also performed to validate the practicability of the approach. Results show that the method works even when the code phase differences between the spoofing and authentic signals are much less than one code chip, which can improve the availability of GNSS service greatly under spoofing attacks.

Autonomous driving, Unmanned Aerial Vehicles (UAVs), and various other vehicular navigation schemes heavily depend on the accurate Position, Velocity, and Timing (PVT) information offered by Global Navigation Satellite Systems (GNSSs). Meanwhile, the security of this vital service is challenged by spoofing attacks, which aim to deceive users by inducing false PVT solutions. Therefore, a timely alarm to victim users in the context of spoofing is crucial to the security of vehicular navigation. As the counterfeit signals are transmitted from a spoofer rather than real satellites, the spatial information is hard to be coordinated. To this end, the Doppler shift, which essentially reveals the spatial features of the transmitter and receiver, is regarded as an effective metric for spoofing detection. Especially for a vehicle, induced by its relative motion with respect to the spoofer, Doppler bias is appended to the raw measurement, providing an observable signature of spoofing. Conventional approaches tend to directly monitor the Doppler bias concealed in the measurement, by committing to eliminate the remaining part caused by satellite motion and clock drift. However, the resulting requirements (such as keeping static for initialization, random motion patterns, and multi receivers) introduce considerable complexity that limits their practical applicability. Moreover, the commonly utilized single-antenna assumption renders them ineffective against multi-antenna spoofing attacks. In this paper, we propose a new approach that indirectly exploits the Doppler bias by examining the affected consistency of velocities. We introduce a Direct Velocity Determination (DVD) method, which calculates the velocity directly from the Doppler measurements. The provided solution is then utilized for consistency-checking along with the velocity given by the conventional pseudorange-aided approach. We thoroughly investigate the adverse impact of Doppler bias on these velocities and analyze their consistency performance across different scenarios. Also involved are the Generalized Likelihood Ratio Test (GLRT) based spoofing detector and its performance evaluation. Field tests are conducted to validate the effectiveness of the proposed GNSS spoofing detection method. The superiority of the proposed method is demonstrated in comparison with the previous Doppler-based methods as well as the widely used Receiver Autonomous Integrity Monitoring (RAIM) method.

GNSS (Global Navigation Satellite System) spoofing has become a great threat in recent years because of its elusiveness and harmfulness. For anti-spoofing usages, utilization of additional independent sensors is a preferred choice. In this work we develop a MEMS (Micro-Electro-Mechanical-Systems) IMU (Inertial Measurement Unit) based spoofing detection and exclusion method by first analyzing the relationship between the Doppler frequency from each navigation signal and the output from the IMU and then evaluating the residual. The detector is a steady-state spoofing detector which can provide continual anti-spoofing result throughout the spoofing attack, as it only requires raw measurements from the two sensors and a rather rough prior knowledge of the position of the host. Simulations are conducted to verify the theoretical derivation and to evaluate the anti-spoofing performance of the proposed method. Field experiments are carried out and the experiment results are analyzed, in which the proposed steady-state detector exhibits improved ability of spoofing identification over traditional methods under continuous spoofing attacks, by clearly distinguishing the authentic navigation signals from the counterfeited ones. Moreover, both the simulation and the field experiment demonstrate that a prior knowledge of the position of the host with the uncertainty of hundreds of kilometers, which can be readily obtained from various methods, is acceptable for the proposed detector.

This article is concerned with the security problem of industrial networks. Smart grids, telecommunications, and many other wide-area networks heavily depend on the time synchronization service of the global navigation satellite system (GNSS). This service is exposed to the time synchronization attack (TSA) which can spoof GNSS timing results and bring serious consequences. Therefore, to improve the time security of networks, a novel TSA detection method named the separate clock drift matched filter (SCD-MF) is introduced. It aims at concealed TSA signals that would not bring conspicuous abnormalities in positioning or timing solutions. This method works by monitoring the synchronicity of signal pseudorange measurements, which are expected to be synchronously changed by concealed TSA signals. This article also presents real-world experiment results. TSA detection experiments are done on a self-developed testbed that contains a real-time TSA spoofer. Compared with two benchmark methods, the SCD-MF shows better detection abilities in different conditions. Moreover, the detection performance of the SCD-MF method is analyzed both theoretically and experimentally.