Tuning-Free, Low Memory Robust Estimator to Mitigate GPS Spoofing Attacks

TL;DR

This paper introduces a tuning-free, low memory robust estimator designed to detect and mitigate GPS spoofing attacks, ensuring accurate timing for critical infrastructure without complex parameter tuning or heavy computation.

Contribution

The paper presents a novel observer-based estimator that operates without parameter tuning, suitable for real-time GPS spoofing attack mitigation using real data.

Findings

Effective in real GPS data scenarios

Maintains accurate timing under spoofing attacks

Reduces computational and tuning requirements

Abstract

The operation of critical infrastructures such as the electrical power grid, cellphone towers, and financial institutions relies on precise timing provided by stationary GPS receivers. These GPS devices are vulnerable to a type of spoofing called Time Synchronization Attack (TSA), whose objective is to maliciously alter the timing provided by the GPS receiver. The objective of this paper is to design a tuning-free, low memory robust estimator to mitigate such spoofing attacks. The contribution is that the proposed method dispenses with several limitations found in the existing state-of-the-art methods in the literature that require parameter tuning, availability of the statistical distributions of noise, real-time optimization, or heavy computations. Specifically, we (i) utilize an observer design for linear systems under unknown inputs, (ii) adjust it to include a state-correction algorithm, (iii) design a realistic experimental setup with real GPS data and sensible spoofing attacks, and (iv) showcase how the proposed tuning-free, low memory robust estimator can combat TSAs. Numerical tests with real GPS data demonstrate that accurate time can be provided to the user under various attack conditions.

Tables

Table 1. TABLE I: Vector nomenclature.

Notation	Description
${𝒙}_{\mathrm{GT}}$	ground truth state vector
${𝒙}_{\mathrm{EKF}}$	estimated state vector from EKF
${𝒙}_{\mathrm{Luen}}$	estimated state vector from Luenberger Observer
${\widehat{𝒙}}_m$	modified state vector estimates
${\widehat{𝒙}}_c$	corrected state vector via (16)
$𝒅$	attack vector vector applied to $𝒙$
${\widehat{𝒅}}_c$	corrected spoofing attack vector via (15)

Equations

$$\begin{array}{r}{t}_R=t_R^{\mathrm{GPS}}+b_{\mathrm{u}},t_n=t_n^{\mathrm{GPS}}+b_n\end{array}$$

$$\begin{array}{r}{\rho }_n=\text{Arrowvert}{\mathbf{p}}_n-{\mathbf{p}}_{\mathrm{u}}{\text{Arrowvert}}_2+c(b_{\mathrm{u}}-b_n)+{ϵ}_{{\rho }_n}\end{array}$$

$$\begin{array}{r}{\dot{\rho }}_n=({\mathbf{v}}_n-{\mathbf{v}}_{\mathrm{u}}{)}^{\top }\frac{{\mathbf{p}}_n-{\mathbf{p}}_{\mathrm{u}}}{\text{Arrowvert}{\mathbf{p}}_n-{\mathbf{p}}_{\mathrm{u}}\text{Arrowvert}}+{\dot{b}}_{\mathrm{u}}+{ϵ}_{{\dot{\rho }}_n}\end{array}$$

$$\begin{bmatrix}x_{\mathrm{u}}[k+1]\\ y_{\mathrm{u}}[k+1]\\ z_{\mathrm{u}}[k+1]\\ b_{\mathrm{u}}[k+1]\\ \dot{b}_{\mathrm{u}}[k+1]\end{bmatrix}=\begin{bmatrix}\begin{array}[]{c;{2pt/2pt}r}\bm{I}_{3\times 3}&\begin{matrix}\bm{0}_{3 \times 2} \end{matrix}\\ \hdashline[1.5pt/1.5pt]\bm{0}_{2\times 3}&\begin{matrix}1 &\Delta t \\ 0 &1 \end{matrix}\end{array}\end{bmatrix}\begin{bmatrix}x_{\mathrm{u}}[k]\\ y_{\mathrm{u}}[k]\\ z_{\mathrm{u}}[k]\\ b_{\mathrm{u}}[k]\\ \dot{b}_{\mathrm{u}}[k]\end{bmatrix}+\bm{w}[k]$$

$$\begin{array}{r}\left[\begin{array}{c}c{b}_{\mathrm{u}}[k+1]\\ c{\dot{b}}_{\mathrm{u}}[k+1]\end{array}\right]=\mathbf{A}\left[\begin{array}{c}c{b}_{\mathrm{u}}[k]\\ c{\dot{b}}_{\mathrm{u}}[k]\end{array}\right]+\mathbf{w}[k]\end{array}$$

$$\begin{array}{r}\left[\begin{array}{c}\mathbf{\rho }[k]\\ \dot{\mathbf{\rho }}[k]\end{array}\right]=\mathbf{C}\left[\begin{array}{c}c{b}_{\mathrm{u}}[k]\\ c{\dot{b}}_{\mathrm{u}}[k]\end{array}\right]+{\mathbf{c}}_l[k]+\mathbf{ϵ}[k]\end{array}$$

$$\begin{array}{rl}\mathbf{x}[k+1]& =\mathbf{A}\mathbf{x}[k]+\mathbf{w}[k]\\ \mathbf{y}[k]& =\mathbf{C}\mathbf{x}[k]+{\mathbf{c}}_l[k]+\mathbf{ϵ}[k].\end{array}$$

$${\color[rgb]{0,0,0}\boldsymbol{\rho_{s}[k]=\boldsymbol{\rho}[k]+s_{\rho}[k]},\;\boldsymbol{\dot{\rho}_{s}[k]=\boldsymbol{\dot{\rho}}[k]+s_{\dot{\rho}}[k]}.}$$

$$\mathbf{x}[k+1]=\mathbf{A}\mathbf{x}[k]+\mathbf{d}[k]$$

$$\begin{array}{rl}\mathbf{x}[k+1]=& \mathbf{A}\mathbf{x}[k]+\mathbf{d}[k]\\ \mathbf{y}[k]=& \mathbf{C}\mathbf{x}[k]+{\mathbf{c}}_l[k]+\mathbf{ϵ}[k]\end{array}$$

$$\begin{array}{r}{\mathbf{x}}_m[k+1]=\mathbf{x}[k+1]-\mathbf{d}[k]=\mathbf{A}\mathbf{x}[k].\end{array}$$

$$\begin{array}{rl}{\mathbf{x}}_m[k+1]=& \mathbf{A}{\mathbf{x}}_m[k]+\mathbf{A}\mathbf{d}[k-1]\\ \mathbf{y}[k]=& \mathbf{C}{\mathbf{x}}_m[k]+{\mathbf{c}}_l[k]+\mathbf{C}\mathbf{d}[k-1].\end{array}$$

$${\hat{\mathbf{x}}}_m[k+1]=$$

$$\hat{}\mathbf{y}[k]=$$

$$\mathbf{e}[k]=$$

$$\hat{\mathbf{d}}[k]=$$

$$\mathrm{find}$$

$$s.t.$$

$$\{\mathbf{P},\mathbf{Q},\mathbf{M}\}=\{{\mathbf{P}}^{\top },{\mathbf{Q}}^{\top },{\mathbf{M}}^{\top }\}\succ 0,$$

$${\mathbf{L}}_1={\mathbf{P}}^{-1}\mathbf{G},{\mathbf{L}}_2=\mathbf{M}{\mathbf{Q}}^{-1}.$$

$$\begin{array}{rl}{\mathbf{x}}_m[k+1]& =\mathbf{A}{\mathbf{x}}_m[k]+\mathbf{A}\mathbf{d}[k-1]\\ & =\mathbf{A}(\mathbf{A}{\mathbf{x}}_m[k-1]+\mathbf{A}\mathbf{d}[k-2])+\mathbf{A}\mathbf{d}[k-1].\end{array}$$

$${\hat{\mathbf{d}}}_c[k]=\left[\begin{array}{c}\sum _{l=1}^k{\hat{d}}_1[l]+\sum _{l=1}^{k-1}(k-l){\hat{d}}_2[l]\\ \sum _{l=1}^{k-1}{\hat{d}}_2[l]\end{array}\right]$$

$$\begin{array}{rl}{\hat{\mathbf{x}}}_c[k]& ={\hat{\mathbf{x}}}_m[k]-{\hat{\mathbf{d}}}_c[k],{\hat{\mathbf{y}}}_c[k]=\hat{\mathbf{y}}[k]-\mathbf{C}{\hat{\mathbf{d}}}_c[k]\end{array}$$

Full text

I Introduction and Motivation

The Global Positioning System (GPS) is widely utilized in an abundance of applications. The study [1] in particular emphasizes how critical infrastructures such as communications, the power grid, transportation, and even financial services can be disrupted if the integrity of the GPS is compromised.

Since most systems rely on non-encrypted civilian GPS signals [2], the GPS is vulnerable to intentional attacks. There are two types of deliberate attacks on GPS: jamming and spoofing [3]. While jamming completely blocks signal reception by transmitting high power noise, spoofing changes the transmitted signal or data to deceive the GPS receiver. Various experiments have shown that different types of spoofing attacks such as data level spoofing, signal level spoofing, delaying, and record-and-reply attacks [4, 5, 6] could affect off-the-shelf GPS receivers.

A Time Synchronization Attack (TSA) is a particular class of spoofing attacks on stationary GPS receivers that provide precise timing in various applications, including phasor measurement units (PMUs), cellphone towers, and financial institutions [7, 8]. The objective of the attack is to mislead the time estimated by the receiver which, in the case of the power grid for example, can disrupt the reliable monitoring of the grid’s cyber-physical status.

Countermeasures against spoofing attacks have been proposed in [9, 10, 11] and include techniques that rely on multiple GPS receivers [12, 13] or check the magnitude of error in the GPS data [9]; see [5] for a review of anti-spoofing techniques. Another approach to mitigate and detect spoofing TSAs is through robust, dynamic state estimation routines that are designed to deal with outliers and malicious attacks.

The robust state estimation literature is indeed rich with two main classes of methods. The first class is based on robust observers and Lyapunov theory which often does not assume any statistical distribution for unknown inputs or noise [14, 15]. The second class is based on Kalman filter and its derivatives, that often assume statistical distribution of noise [16, 17, 18]. Relevant to the robust estimation problem under TSAs, a novel anti-spoofing particle filter is devised to find the receiver position even under spoofing interference [10]. In our recent work [11], we develop a real-time optimization method to detect and mitigate TSAs using weighted $\ell_{1}$ minimization. The aforementioned methods all require either tuning of some parameters, real-time optimization, or availability of the statistical distribution of noise.

The objective of this paper is to design a robust state estimator that combats TSAs while being endowed with the following properties: (i) It is a tuning-free method that does not require any training; (ii) it has low memory requirement in the sense no heavy computations are needed in real-time; and (iii) the designed tuning-free, low-memory robust estimator can correctly reconstruct the actual physical state of the receiver using a realistic testbed. We note here that our objective is not to develop a generalized theory for robust estimation, but rather to build on the recent theoretical advancement in this field and adapt it to the GPS spoofing problem through a realistic testbed. The robust state estimation method presented in this paper is an adaptation of the method in [19]. The motivation for using this estimator is provided in great detail in the next sections; the paper’s organization is given next.

Section II presents the dynamic modeling of bias and drift in GPS receivers and showcases how TSA attacks can be modeled and designed to mislead standard state estimators. Section III presents a robust state estimator in addition to a state correction and TSA reconstruction routine. Section IV concludes the paper with realistic numerical tests on real GPS data. For reproducibility, the data used in the numerical tests and the results are all provided through a Github link.

II Dynamic Modeling Under GPS Spoofing

The primary goal of GPS localization is to accurately estimate the position, velocity, clock bias, and clock drift of the receiver in every time step—conventionally referred to as the position, velocity, and time (PVT) solution.

The position of the GPS receiver (user) in Earth Centered Earth Fixed coordinates is denoted by $\bm{p}_{\mathrm{u}}=[x_{\mathrm{u}},y_{\mathrm{u}},z_{\mathrm{u}}]^{\top}$. To estimate the receiver’s location and velocity, the GPS exploits the known location of satellites and the distance from each satellite to the receiver. Let $N$ denote the number of fixed satellites visible by the receiver, then $\bm{p_{n}}=[x_{n}(t_{n}),y_{n}(t_{n}),z_{n}(t_{n})]^{\top}$ for $n=1,2,\ldots,N$ is the satellite position at the time of transmission $t_{n}$. Also, we consider that $t_{R}$ models the arrival time of transmitted signal at the receiver. The approximate distance between each satellite and the receiver can be written as $\rho_{n}=c(t_{R}-t_{n})$, where $c$ is the speed of light and $\rho_{n}$ is commonly known as the pseudorange [20]. The pseudoranges differ from the true distances because $t_{R}$ and $t_{n}$ are offset by clock biases denoted by $b_{u}$ and $b_{n}$. This relationship is established as

[TABLE]

where $t^{\mathrm{GPS}}_{R}$ defines the reception time in the absolute GPS time, while $t^{\mathrm{GPS}}_{n}$ is the signal transmission time in GPS time. Then, if $d_{n}$ represents the true distance from the receiver to each satellite, it holds that $d_{n}=c(t^{\mathrm{GPS}}_{R}-t^{\mathrm{GPS}}_{n})$ using the unbiased transmission and reception times. Alternatively, $d_{n}$ can be expressed by taking the 2-norm of position difference between the satellite and the receiver, given by $d_{n}=||\bm{p_{n}}-\bm{p_{\mathrm{u}}}||_{2}$. The following pseudorange equation is generated by combining the previous two equations for $d_{n}$ [20]

[TABLE]

where $\epsilon_{\rho_{n}}$ captures atmospheric effects and receiver noise.

In addition to the pseudoranges, the GPS receiver can also measure the rate at which the pseudoranges vary over time, denoted by $\dot{\rho}_{n}$, and called pseudorange rate. The pseudorange rates are expressed in terms of the satellite velocities $\bm{v}_{n}$ and the user (GPS receiver) velocity $\bm{v}_{\mathrm{u}}$ as

[TABLE]

where $\dot{b}_{\mathrm{u}}$ represents the GPS receiver clock drift and $\epsilon_{\dot{\rho}_{n}}$ is the noise. In (2) and (3), the unknown PVT variables ()user position ($\bm{p}_{\mathrm{u}}$), user velocity ($\bm{v}_{\mathrm{u}}$), clock bias ($b_{\mathrm{u}}$), and clock drift ($\dot{b}_{\mathrm{u}}$)] are usually computed using nonlinear weighted least squares.

The random walk model captures the dynamics relating variables in (2) and (3) for stationary applications [20]. The following is the stationary random walk model:

[TABLE]

where $k$ is the time index; $\Delta t$ is the time resolution; and $\bm{w}$ is noise in the system. Generally, stand-alone receivers like those present in PMUs, use the Extended Kalman Filter (EKF) to estimate the PVT solution [20].

Since the receiver is stationary, the position ($\bm{p}_{\mathrm{u}}$) can be treated as known constant while the receiver velocity ($\bm{v}_{\mathrm{u}}$) is known to be zero. Thus, the only variables to be estimated are in fact the clock bias and drift, ${b}_{\mathrm{u}}[k]$ and $\dot{b}_{\mathrm{u}}[k]$. Based on (2), (3) and the dynamic model in (4), the fundamental plant model is constructed as follows using $\boldsymbol{\rho}[k]=[\rho_{1}[k],...,\rho_{N}[k]]^{\top}$ and $\boldsymbol{\dot{\rho}}[k]=[\dot{\rho}_{1}[k],...,\dot{\rho}_{N}[k]]^{\top}$:

[TABLE]

[TABLE]

where

$\bm{A}$ = $\begin{bmatrix}1&\Delta t\\ 0&1\end{bmatrix}$,  $\bm{C}$ = $\begin{bmatrix}\bm{1}_{N\times 1}&\bm{0}_{N\times 1}\\ \bm{0}_{N\times 1}&\bm{1}_{N\times 1}\end{bmatrix}$

$\bm{c}_{l}[k]$ = $\begin{bmatrix}\Arrowvert\bm{p}_{1}[k]-\bm{p}_{\mathrm{u}}[k]\Arrowvert-cb_{1}[k]\\ \vdots\\ \Arrowvert\bm{p}_{N}[k]-\bm{p}_{\mathrm{u}}[k]\Arrowvert-cb_{N}[k]\\ (\bm{v}_{1}[k]-\bm{v}_{\mathrm{u}}[k])^{\top}.\dfrac{\bm{p}_{1}[k]-\bm{p}_{\mathrm{u}}[k]}{\Arrowvert\bm{p}_{1}[k]-\bm{p}_{\mathrm{u}}[k]\Arrowvert}-c\dot{b}_{1}[k]\\ \vdots\\ (\bm{v}_{N}[k]-\bm{v}_{\mathrm{u}}[k])^{\top}.\dfrac{\bm{p}_{N}[k]-\bm{p}_{\mathrm{u}}[k]}{\Arrowvert\bm{p}_{N}[k]-\bm{p}_{\mathrm{u}}[k]\Arrowvert}-c\dot{b}_{N}[k]\end{bmatrix}$

and $\bm{w}[k]$ and $\bm{\epsilon}[k]$ represent process/measurement noise; vector $\bm{c}_{l}[k]$ is based on the known satellite position, velocity and clock characteristics—a time-varying, known quantity. Equations (5) and (6) can be written as

[TABLE]

The state space model (7), however, does not model potential spoofing attacks. While many different physical spoofing mechanisms are devised to deceive the victim receiver [6], time synchronization attack (TSA) is applied on the stationary GPS receiver. In practical sense, TSA alters the timestamp estimate by inserting the spoofing signal into the authentic pseudorange signals:

[TABLE]

where $\boldsymbol{s_{\rho}}[k]$ and $\boldsymbol{s_{\dot{\rho}}}[k]$ denote the spoofing attacks, and $\boldsymbol{\rho}_{s}[k]$ and $\boldsymbol{\dot{\rho}_{s}}[k]$ are the spoofed measurements.

Specifically, there are two different types of TSAs according to the shape of $\boldsymbol{s_{\rho}}$. While Type I attack injects an abrupt signal, e.g., $\boldsymbol{s_{\rho}}[k>\alpha]=8000\ \mathrm{m}$ where $\alpha$ indicates the initial time of attack, Type II attack modifies the clock bias in gradual manner manipulated by $\boldsymbol{s_{\rho}}[k]=\boldsymbol{s_{\rho}}[k-1]+\boldsymbol{s_{\dot{\rho}}}[k]\Delta t$; see [21]. The actual effect of each type of attack on the clock state is thoroughly reviewed in [22].

As an example, in order for the spoofing signal to be considered as intentional attack on a PMU, it has to satisfy certain conditions. According to the IEEE C37.118 Standard, the attack has to result in 1% total variation error, which is equivalent to 26.65 $\mu$s clock bias error, or 7989 $\mathrm{m}$ of distance equivalent bias error in order for the attack to be considered infringing [23]. These types of spoofing attacks—regardless of their physical mechanism—impact the state dynamics as

[TABLE]

where $\bm{d}[k]=[d_{1}[k]\ d_{2}[k]]^{\top}$ models and lumps TSAs and any process noise. Concrete examples of TSAs are given in Section III. In our previous work [11, Section III], we show how specific forms of $\bm{d}[k]$ can mislead the receiver.

III Robust State Estimator

In this section, we present a state estimation algorithm that is endowed with the following properties: (i) It is a tuning-free method that does not require any knowledge of noise distribution, initial parameters or states, or other coefficients; (ii) it has low memory requirements in the sense no heavy computations are needed which is befitting to devices with limited computational power and limited internet connectivity; (iii) it is robust to GPS spoofing, time-synchronization attacks.

III-A GPS Clock Model and Estimator Dynamics

The plant model under the spoofing attack based on the previous can be written as

[TABLE]

where $\bm{x}[k]\in\mathbb{R}^{2}$ represents the state vector of clock bias and drift at time $k$; $\bm{y}[k]\in\mathbb{R}^{2N}$ represents a single column vector of pseudoranges and pseudorange rates where $N$ indicates the fixed number of visible satellites at every time index; $\bm{d}[k]\in\mathbb{R}^{2}$ is the unknown spoofing attack applied to the bias and drift which also includes process noise; state-space matrices $\bm{A}$, $\bm{C}$, $\bm{c}_{l}$ are discussed in the previous section.

Consider now a new modified state vector $\bm{x}_{m}[k]\in\mathbb{R}^{2}$ which represents the state vector without spoofing attack and follows the following dynamics:

[TABLE]

The left-hand side of (9) essentially represents the original state vector considering that the spoofing attack $\bm{d}[k]$ is removed. The modified state vector $\bm{x}_{m}[k]$ propagates through to $\bm{y}[k]$. This yields:

[TABLE]

The presented state estimator in this paper is an adaptation of the observer from [19] and follows the difference equation:

[TABLE]

where $\hat{\bm{x}}_{m}[k]\in\mathbb{R}^{2}$ is a state estimate of corrected state vector ${\bm{x}}_{m}[k]$ at time $k$; $\hat{\bm{y}}[k]\in\mathbb{R}^{2N}$ is the estimate vector of observation $\bm{y}[k]$; $\hat{\bm{d}}[k]$ is an estimate of the spoofing attack $\bm{d}[k]$. We note here that $\hat{\bm{d}}[-1],\hat{\bm{x}}_{m}[0]$, and $\hat{\bm{y}}[0]$ should be initialized before iteration starts at $k=0$ with arbitrary initial conditions. Matrices $\bm{L}_{1}\in\mathbb{R}^{2\times 2N}$ and $\bm{L}_{2}\in\mathbb{R}^{2\times 2}$ are optimization variables where $\bm{L}_{1}$ is akin, in principle, to a Luenberger gain that is designed here to ensure robustness of the state estimation to spoofing attacks.

III-B Design of Robust Gains $\textbf{{L}}_{1,2}$

The design of the robust estimator gains $\bm{L}_{1,2}$ is based on linear matrix inequalities (LMIs). Simply put, the objective of the designed observer is to guarantee asymptotically stable estimation error dynamics. That is, matrices $\bm{L}_{1}$ and $\bm{L}_{2}$ are designed to guarantee that $\lim_{k\rightarrow\infty}\bm{e}[k]=0$ under non-zero spoofing attack $\bm{d}[k]$ and bounded estimation error under spoofing attacks. The RobustEstimator variables are designed via solving this low-dimensional feasibility problem with one linear matrix inequality (LMI), given as follows:

[TABLE]

where the symbol $\star$ is used to represent symmetric components in symmetric block matrices. After solving (12) for positive definite matrix variables $\bm{P},\bm{Q},$ and $\bm{M}$, and real matrix variable $\bm{G}$, the observer gains are computed as follows

[TABLE]

As mentioned earlier, the state estimator design is derived from [19]; the reader is referred to that paper for the derivation of the above LMIs. Note that no tuning is required to solve EstimatorDesign, and this LMI can be solved analytically via evaluating the Karush-Kuhn-Tucker conditions for feasibility [24]. Furthermore, any convex optimization toolbox or LMI solver can be used to solve (12). These include Matlab’s LMI solver, CVX [25], and Yalmip [26].

We note the following. First, the necessary conditions for existence of $\bm{L}_{1,2}$ are standard. These conditions are (a) the detectability of $(\bm{A},\bm{C})$; (b) the classical rank matching condition stating that $\mathrm{rank}(\bm{C}\bm{B}_{d})=\mathrm{rank}(\bm{B}_{d})$ where $\bm{B}_{d}=\bm{I}_{2}$ is the matrix coefficient of $\bm{d}[k]$ in (8); and (c) bounded variations of the unknown spoofing signal $\bm{d}[k]$. Second, this robust estimator not only estimates $\bm{x}[k]$, but also the spoofing attack $\bm{d}[k]$. This is instrumental in mitigating and correcting the attack. The next section showcases the design of the gain matrices.

III-C State Correction Algorithm under Spoofing

Upon solving the LMIs and running the RobustEstimator from any arbitrary initial conditions, the estimator is guaranteed theoretically to produce bounded estimation error $\bm{e}[k]$, thereby estimating the then-spoofed bias and drift, and reconstructing the spoofing attack $\hat{\bm{d}}[k]$. With that in mind, this does not indicate that the bias and drift are correctly estimated seeing that spoofing attack had already changed the state through the state propagation and difference equation. To that end, this section develops a state correction algorithm to recover the authentic bias and drift values in real-time.

To that end, the dynamics (9) can be written as

[TABLE]

This relationship reveals that current spoofing during one time instant comprises the cumulative attacks from the previous time steps. Consequently, the disturbance estimate $\hat{\bm{d}}$ is not sufficient enough to correct the attacked states. Rather, a new disturbance estimate vector $\bm{d}_{c}$ is formulated to account for the accumulated disturbances. Considering the estimate of spoofing attacks $\hat{\bm{d}}[k]=\begin{bmatrix}\hat{d}_{1}[k]&\hat{d}_{2}[k]\end{bmatrix}^{\top}$ computed by (11), we propose estimating the new disturbance estimate vector $\bm{d}_{c}$ via

[TABLE]

This equation acknowledges the fact that estimated state $\bm{x}_{m}$ is still contaminated by the attack from the past time step. Therefore, the corrected state $\bm{x}_{c}$ and authentic observation state $\bm{y}_{c}$ could be retrieved by subtracting $\hat{\bm{d}}_{c}$ from $\bm{x}_{m}$ and $\hat{\bm{y}}$ as follows:

[TABLE]

Algorithm 1 showcases the overall problem design, robust state estimation, and the reconstruction of the corrected bias and drift of the GPS receiver. The algorithm takes as inputs: the fixed number of satellites $N$, $\bm{A}$ and $\bm{C}$, and satellites data which is encoded through $\bm{c}_{l}[k]$. The algorithm is divided into two stages—an offline stage and an online one. In the offline stage, the RobustEstimator gains $\bm{L}_{1}$ and $\bm{L}_{2}$ are computed via solving (11) and evaluating (13). The online stage includes running the RobustEstimator (11) and the cumulative corrections for the states and spoofing attacks. The algorithm returns the attack-free, yet still slightly noisy estimates of the bias and drift $\hat{\bm{x}}_{c}[k]$ and an estimate of the actual spoofing attack $\hat{\bm{d}}_{c}[k]$.

It is noteworthy to mention the following. First, the offline component of the algorithm—albeit offline—can be solved analytically seeing that the problem dimension is very small, when considering that only few satellite measurements are needed. Second, the algorithm and the LMI feasibility problem both only require a fixed number of satellites, rather than a fixed satellite combination. This is important considering that different satellites are visible each time. In short, the proposed algorithm in this paper only assumes a minimum fixed number of satellites $N$, where these $N$ satellites can be changing in real time without impacting the algorithm or the design of the robust estimator.

Third, Algorithm 1 works for any reasonable initial conditions, that is, the estimation should converge regardless of the initial conditions choice. Fourth, this method is truly tuning-free: no prior knowledge of the statistical distribution of noise, or prior knowledge or tuning of any parameters is needed. The algorithm is also low-memory, as the only computation needed to be performed online is running the RobustEstimator and the correction models—both require a small number of matrix-vector multiplications. This implies that the proposed algorithm can be implemented in low-memory devices without the need for any intensive computational effort or internet connectivity. Finally, we note that the proposed algorithm has no stopping criterion seeing that it runs in real time.

IV Case Studies: A Realistic Testbed

This section discusses the detection and mitigation of TSAs via various approaches. First, the experimental procedure is discussed. Then, we compare the performance of the extended Kalman filter (EKF)—which has long been used in the literature [20] as a ground truth for estimating the bias and drift—and the classical Luenberger observer under spoofing attacks. Then, the performance of the proposed robust estimator under TSAs is showcased, followed by thorough comparison of the performance of the approaches. The following link includes all codes and data used to generate the results, including the acquired GPS data: github.com/junhwanlee95/Robust-Estimator. Table I summarizes the important vector nomenclature.

IV-A Setup: Model Simulation & Obtaining Raw GPS Data

A Google Nexus 9 tablet, which has an embedded GPS chipset, is used to collect real GPS signals, which are recorded on November 4, 2018 at the University of Texas at San Antonio main campus. The data are available for the reader through the aforementioned Github link. While the receiver acquires the signal, the device remained still to simulate the stationary scenario. Raw GPS data is post-processed to obtain pseudorange and pseudorange rate data by GNSS Logger, the Android application released by the Google Android location team [27]. Then, Type I and II attacks are injected into the pseudorange and pseudorange rate data to simulate spoofing as discussed in Section II and shown in [11, Section III]. The initial conditions for the robust estimator are chosen to be different than the actual, ground truth conditions.

IV-B EKF and Luenberger Performances Under Attacks

Here, we are interested in testing whether the EKF and the classical Luenberger observer [28] can withstand TSAs of Type I and II. After Type I and II attacks are applied from $t=30\ \mathrm{s}$ to $t=400\ \mathrm{s}$, the performance of the EKF and Luenberger observer—which does not assume any statistical distribution about the noise—are shown in Fig. 1 and 2.

While the ground truth clock bias and drift, $\bm{x}_{\mathrm{GT}}$, are acquired through EKF by processing the authentic pseudorange data, the $\bm{x}_{\mathrm{EKF}}$ bias and drift are generated by applying the EKF to the spoofed pseudoranges. Another comparison to $\bm{x}_{\mathrm{GT}}$ is offered by the Luenberger observer estimate $\bm{x}_{\mathrm{Luen}}$ produced after designing the observer gain $\bm{L}_{1}$ such that the closed loop system eigenvalues are at $0.5$ and $0.7$. The performances of EKF and Luenberger observer are shown respectively in Fig. 1 and Fig. 2. It is evident that both approaches fail to estimate the correct states in the presence of the attack.

IV-C *Robust Estimator Performance under Type I/II TSAs *

In this section, we test the proposed robust estimator and run Algorithm 1 which contains an offline stage and an online one. First, we set $N=4$, i.e., we choose to sample data from only four satellites. We solve the LMIs (12) for the estimator gains. Using these estimator gains, the online portion of Algorithm 1 is run. Pertaining to Type I attack, Fig. 3 showcases the performance of RobustEstimator. Due to the attack at $t=30$ s, the $\hat{\bm{x}}_{\mathrm{c}}$ clock estimates are initially not correct, but the clock bias and drift approach the respective ground truth values within approximately 3 and 11 seconds (cf. Fig. 3(a) and 3(b) respectively).

Under the same condition and procedure, Algorithm 1 is applied on Type II attack to detect and correct the spoofed states. The results of obtaining the corrected state $\hat{\bm{x}}_{c}$ are shown in Fig. 4. In order to accurately depict the performance of RobustEstimator, the relative estimation error is calculated as $\frac{\mid\hat{\bm{x}}_{\mathrm{c}}-\bm{x}_{\mathrm{GT}}\mid}{{\bm{x}}_{\mathrm{GT}}}$ for each of the two states in $\bm{x}$ over time. The resulting graphs are shown in Fig. 5. Comparison between $\hat{\bm{x}}_{c}$ and the $\bm{x}_{\mathrm{GT}}$ reveals that the maximum error between the two biases is $952.09\;\mathrm{m}$ or $3.17\ \mu\mathrm{s}$. It is thus demonstrated that the Robust Estimator of Algorithm 1 successfully detects and corrects the Type II attack.

In the interest of gauging the performance of each approach, the root mean square error ($\mathsf{RMSE}$) of the estimated clock bias is calculated under both attack types. Let $K$ denote the total length of observation time ($K=400$ in this experiment). The RMSE is defined as $\small\mathsf{RMSE}=\sqrt{\frac{1}{K}\sum_{k=0}^{K-1}(c\hat{b}_{u}[k]-c\check{b}_{u}[k])^{2}}$ where $c\check{b}_{u}[k]$ is the ground truth clock bias under normal conditions, and $c\hat{b}_{u}[k]$ equals to the estimated clock bias value from each approach. Under Type II attack, the RMSE for EKF and the Luenberger observer are $\mathsf{RMSE}_{\mathrm{EKF}}=\mathrm{74344\ m}$ and $\mathsf{RMSE}_{\mathrm{Luenberger}}=\mathrm{74433\ m}$ respectively, while that of the robust estimator is $\mathsf{RMSE}_{\mathrm{RobustEstimator}}=\mathrm{354.9\ m}$. As for Type I attack, the RMSEs are as follows: $\mathsf{RMSE}_{\mathrm{EKF}}=\mathrm{8477.3\ m}$, $\mathsf{RMSE}_{\mathrm{Luenberger}}=\mathrm{8104.9\ m}$, and $\mathsf{RMSE}_{\mathrm{RobustEstimator}}=\mathrm{1029\ m}$. This illustrates the performance of this tuning-free, low-memory robust estimator in detecting spoofing attacks, while correctly reconstructing the bias and drift states of the GPS receiver.

V Paper Summary and Future Work

In this paper, the design and realistic application of a low-memory, real-time RobustEstimator is studied. Utilizing the GPS receiver on a Google Nexus 9, real GPS data are collected and post-processed by injecting time-synchronization attacks to spoof the clock bias and drift of the device. Two types of attacks are introduced, and tested by the designed estimator. The estimator successfully detects and estimates the spoofing attacks on each state, and mitigates the spoofing on both types of attack by furnishing the corrected clock states to the user. Future work will focus on developing robust estimators under spoofing attacks for non-stationary GPS receivers, which involve nonlinearities in the GPS measurement model.