Protecting GNSS-based Services using Time Offset Validation

TL;DR

This paper proposes a method to detect GNSS spoofing attacks by cross-validating GNSS time with alternative sources like WiFi and NTP, enhancing security for critical timing-dependent applications.

Contribution

It introduces a validation framework for GNSS time using existing network sources and evaluates its effectiveness against specific attack thresholds.

Findings

WiFi-based time validation detects shifts over 23.942 microseconds.

NTP-based validation detects shifts over 2.046 milliseconds.

The approach limits adversaries' ability to manipulate GNSS timing.

Abstract

Global navigation satellite systems (GNSS) provide pervasive accurate positioning and timing services for a large gamut of applications, from Time based One-Time Passwords (TOPT), to power grid and cellular systems. However, there can be security concerns for the applications due to the vulnerability of GNSS. It is important to observe that GNSS receivers are components of platforms, in principle having rich connectivity to different network infrastructures. Of particular interest is the access to a variety of timing sources, as those can be used to validate GNSS-provided location and time. Therefore, we consider off-the-shelf platforms and how to detect if the GNSS receiver is attacked or not, by cross-checking the GNSS time and time from other available sources. First, we survey different technologies to analyze their availability, accuracy, and trustworthiness for time synchronization. Then, we propose a validation approach for absolute and relative time. Moreover, we design a framework and experimental setup for the evaluation of the results. Attacks can be detected based on WiFi supplied time when the adversary shifts the GNSS provided time, more than 23.942us; with Network Time Protocol (NTP) supplied time when the adversary-induced shift is more than 2.046ms. Consequently, the proposal significantly limits the capability of an adversary to manipulate the victim GNSS receiver.