This article is concerned with the security problem of industrial networks. Smart grids, telecommunications, and many other wide-area networks heavily depend on the time synchronization service of the global navigation satellite system (GNSS). This service is exposed to the time synchronization attack (TSA) which can spoof GNSS timing results and bring serious consequences. Therefore, to improve the time security of networks, a novel TSA detection method named the separate clock drift matched filter (SCD-MF) is introduced. It aims at concealed TSA signals that would not bring conspicuous abnormalities in positioning or timing solutions. This method works by monitoring the synchronicity of signal pseudorange measurements, which are expected to be synchronously changed by concealed TSA signals. This article also presents real-world experiment results. TSA detection experiments are done on a self-developed testbed that contains a real-time TSA spoofer. Compared with two benchmark methods, the SCD-MF shows better detection abilities in different conditions. Moreover, the detection performance of the SCD-MF method is analyzed both theoretically and experimentally.

For cybersecurity concerns in smart girds, this paper has focused on the vulnerability analysis and defense technique against the Time Synchronization Attack (TSA). This kind of attack can spoof satellite-signal-based time synchronization processes that are widely utilized in modern power systems. A quick-impact TSA experiment is presented in this paper, based on live satellite signals and a commercial time server used in current smart grids. Experiment results are alarming. Intolerable timing errors have been imposed on the server within a few tens of seconds, and it hasn’t reported any alarms. So a new cybersecurity concern for distributed power systems is revealed: stealthy TSAs must be detected at the early stage due to their quick impacts, yet current studies have underestimated this problem. In response to this potential threat, a fast-triggered detection method is proposed in this paper. It is named the Rapid Detection of Signal Distortions (RDSD) and can detect early stage signal distortions caused by TSAs at the beginning. Apart from this ability, we have also verified, via simulations and real-world comparative experiments, that the proposed method can provide improved detection and false alarm rejection capacity compared with existing methods of this type. Overall, this paper can raise attention to the cybersecurity problem caused by TSAs and facilitate the defense against them in modern smart grids.

Direction-of-arrival (DOA) is a pivotal measurement in GNSS anti-spoofing, which provides key information for spoofing discrimination and orienting. Notably, even sophisticated spoofing attacks employing multiple transmitting antennas can be effectively addressed using DOA measurements, due to the inherent challenge for spoofers to align signal directions with authentic satellites. Nevertheless, traditional DOA estimation methods using antenna arrays are costly and computationally complex. The methods that use the synthetic aperture or dual-polarization antenna (DPA) offer a promising avenue for reducing system complexity. However, synthetic aperture techniques demand precise knowledge of antenna movement trajectories, while dual-polarization antenna (DPA) methods rely on dedicated hardware structures. To overcome such limitations, this paper proposes a Space-Time-Ambiguity Decomposition method for DOA estimation to boost anti-spoofing with rotating dual antennas. By jointly leveraging the measurements across both spatial and temporal dimensions, the signal DOA is estimated with dual antennas when absenting the information of the antenna moving trace. A maximum clique search method is employed for spoofing discrimination, which synthesizes DOA estimations from multiple signals to enhance discrimination performance. Monte Carlo simulations are conducted compared with the Cramer-Rao Low Bound (CRLB). Field experiments in a multi-antenna spoofing scene indicate the validity of the proposed method.

In this article, an innovation-bounded Kalman filter (IBKF) is proposed to address the delay problem in detecting the time synchronization attack (TSA), one serious concern for various Global Navigation Satellite Systems (GNSS) timing users in modern industrial networks. The IBKF can improve the weakness of traditional timing methods, such as the regular Kalman Filter, by bounding the influences of unauthenticated signals during a detection window range. So, when TSA begins, even if detection that requires a certain observation window is not finished, timing errors can still be limited. The IBKF algorithm and its application in securing GNSS timing are theoretically introduced, together with performance analyses. Moreover, both simulations and real-world experiments are conducted to show that the IBKF can effectively limit the timing error in actual TSA conditions and also provide similar timing accuracy and stability in normal conditions compared with traditional methods.

This paper delves into the distributed GNSS spoofing threat, a sophisticated deployment structure wherein multiple spoofing antennas each emit a single spoofing signal to the victim receiver. This study analyzes the challenges associated with executing distributed spoofing and proposes potential structures to address them. To validate the distributed spoofing threat, an experimental platform is designed specifically for distributed spoofing. Field test results confirm that distributed spoofing can effectively manipulate the victim’s PVT solution, underscoring the potential hazard of this sophisticated GNSS spoofing threat.

Aiming at fabricating a false positioning solution towards the victim user, spoofing attacks are nowadays challenging the security of Global Navigation Satellite Systems (GNSS). Due to the relative motion between the spoofer and victim user, the potential inconsistency involved in the measurement of Doppler shift could be an efficient basis to reveal the attacks. Although several researches on anti-spoofing techniques via measured Doppler have been developed, weaknesses in terms of implementation complexity and strict assumptions such as single-antenna spoofing still remain. To this end, Doppler Residual Monitoring (DRM) is proposed and investigated in this paper as a novel anti-spoofing scheme. Firstly, caused by the presence of the spoofing attacks, abnormal bias within the measured Doppler shifts is demonstrated based on the modeling of GNSS spoofing. Due to the difficulty in directly observing the Doppler bias concealed in the counterfeit signal, Doppler positioning technique is exploited to reveal this part of the variation in an indirect way. In particular, Doppler residual provided by Doppler positioning equations is proposed and the relationship between Doppler bias and Doppler residual is illustrated. More specifically, Sum of Squares of Errors (SSE), which denotes the sum of squares of Doppler residual, is utilized as the test statistics for spoofing detection. To further distinguish all the counterfeit signals, a random traversal technique is investigated in this paper. Moreover, Doppler Shift Difference (DSD) is proposed to match the spoofing signals with its transmitting antenna based on the discrimination results, which could be an essential basis for the anti-spoofing techniques towards multi-antenna spoofing scenario. Also provided is the analysis of the theoretical performance along with the simulation results. Finally, the validity of our method is demonstrated through field tests with two spoofing scenarios, where the spoofing attacks are respectively achieved by one antenna and two antennas. Without external facilities assistance, our DRM-based scheme could be a significant complement to the GNSS anti-spoofing techniques as a novel spoofing discrimination method.