Does GPS spoofing ever come from space? How are spoofings usually detected?

Question

The BBC News article Study maps 'extensive Russian GPS spoofing' says:

(GPS spoofing) involves the state using strong radio signals to drown out reliable navigation data, says non-profit C4ADS.

The report by the think tank documents almost 10,000 separate GPS spoofing incidents conducted by Russia.

Most incidents affected ships, said C4ADS, but spoofing was also seen around airports and other locations.

C4ADS, or the Centre for Advanced Defence, is a research organisation that uses sophisticated data analysis techniques to investigate global security and conflict issues.

Its report drew on more than 12 months of work analysing Global Navigation Satellite Systems (GNSS) positioning data taken from several sources. These included:

• automatic route logging systems on ships
• low-earth satellite signals
• route histories taken from users of the Strava exercise app
• public reports of vessels, aircraft and vehicles going off course

The analysis showed Russia was "pioneering" the use of GPS spoofing techniques to "protect and promote its strategic interests", the report said.

Generally, said the research group, the spoofing was being done to deflect commercial drones from entering sensitive airspace.

The spoofing was concentrated around 10 key locations including the Crimea, Syria, as well as ports and airports in Russia.

Question: Does GPS spoofing ever come from space? A directional antenna system, or three antennas + three receivers could probably work out the direction of the incoming signal, but is this really how spoofings are detected?

Possibly related (I can't tell) GPS Receiver Autonomous Integrity Monitoring (RAIM) - parity space method

Answer 1

Spoofing from a satellite would need a substantial amount of power , especially if you want to use a GEO satelitte. Doing it from LEO would potentially be lower power than the GPS sats themselves but pose difficulties denying an area long enough to be useful, and make locating the cause easier by matching complaints against orbital elements. It would certainly be against FCC rules (if operating inside the US) and upset an organization with both global reach and ASAT capability.

More normally GPS jamming happens from a portable transmitter that just needs to drown out at <1km enough satellite signals to prevent a fix. Suspect finding those just involves looking at things like the Strava data sets, finding the circular holes and then deleting the lakes.

More complex jamming transmits strong fake satellite signals, and causes receivers to appear to teleport, so again delectable in data sets by looking at impossible speeds or complaints from users missed the left at Albuquerque.

If you have the antenna real estate you can get multi antenna systems that look for low angle signals and flag up jammer warnings or shape the sensitivity to suppress them.

Answer 2

First, on the practical side, it is most likely that GPS spoofing will come from a terrestrial spoofing source rather than a LEO, much less a rogue GEO. This allows several exploitable factors to detect spoofed signals. To answer your question(s), no, they are unlikely to come from space, and second, direction finding is one of the possibilities.

• Direction finding - using something like a CRPA antenna, can tackle both jamming and spoofing, and so a directional approach is often the baseline preference. On the plus side, DF approaches rarely make changes to the receiver design (they just add additional front-end layers). This makes DF very attractive. It tackles jamming AND spoofing by creating a "spatial filter" via beamforming, 'steering' the beam in the direction of the GPS satellites, accepting in signals that only come from a direction it expects, and cancelling out signals from unlikely directions. Remember, that GPS receivers usually also hold an almanac of GPS satellite ephemerides so it has a rough idea of what the direction of each GPS satellite is already in - useful for a first-run initialisation.

More on direction-finding approaches here!

Other methods also include using and comparing the encrypted P(Y) code (a signal spoofer is unlikely to know the code sequence as it is kept secret). There is also work in signal-based authentication. Check out Logan Scott's work, on CHIMERA. In a nutshell of how it works (all credits to Logan Scott and AFRL):

1. CHIMERA inserts digitally encrypted signatures and watermarks them within the GPS L1C signal.
2. After a slight delay (6 seconds), the GPS satellite reveals the keys that generate those encrypted watermarks.
3. Every 3 minutes, the entire system then changes the key.
4. Since the receiver has already recorded the signal with its watermarks before the key is sent, spoofers cannot know the correct key ahead of time, in time to insert correct watermarks of their own.
5. This means that any spoofed signal can be identified, because the subsequent key will not match up with the spoofed watermarks, or there will be no watermarks at all.

More on CHIMERA here!

GPS or any GNSS system spoofing is a real, and likely to-be-heavily-used threat in any period of hostility or tension and we are bound to see more techniques used to identify spoofed attacks in the years to come.

Answer 3

Transmitters on GPS satellites are very weak (~60W) so by the time the signal reaches the Earth's surface, it is below the noise floor. That is; the signal is weaker than the normal level of background electromagnetic noise, making it hard to detect. This is why GPS signals can't usually be seen indoors without an external antenna, for example.

It is trivially easy to jam GPS signals because of the weak signal strength, all you need to do is generate a stronger signal in the same band. Even a small jammer powered from a car’s 12V socket can jam GPS in a radius 10s of metres in size. It is not much more difficult to spoof them - either intentially or accidentally. The L1 civillian band has no encryption or authentication so a receiver will just accept whatever signal it finds.

Although space based spoofing is feasible, given how easy it is to do from the ground it seems entirely pointless going to the expense and trouble.

There are systems that can mitigate and detect interference (jamming or spoofing) - some use multiple antennae, some use a learned pattern of behavoiur to detect anomalies. Recievers that can use multiple GNSS constellations (e.g. GLONASS uses slightly different frequencies to GPS) can also help.