Detecting GNSS spoofing using INS for an en route ADS-B equipped aircraft
Birendra Kujur, Samer Khanafseh, and Boris Pervan, Illinois Institute of Technology
Date/Time: Friday, Sep. 25, 3:20 p.m.
In this paper, we develop a novel method to detect spoofing for an en route Automatic Dependent Surveillance-Broadcast (ADS-B) equipped aircraft. The Federal Aviation Administration (FAA) mandates  all civil aircraft to be ADS-B Out equipped by January 1, 2020. The ADS-B Out broadcast consists of the aircraft’s position, velocity and other specific information, all of which being unencrypted pose serious integrity threat. With readily available ADS-B trackers [19, 20], a spoofer can track an aircraft perfectly to generate a spoofed trajectory that will go undetected . We propose a novel method to modulate the ADS-B Out broadcast such that a spoofed trajectory generated using the modulated ADS-B will be detectable by comparing free Inertial Navigation System (INS) position and velocity outputs, against those obtained using the spoofed Global Navigation Satellite Systems (GNSS) signal. The amplitude of ADS-B modulation is selected to exceed the free inertial drift covariance so that spoofing is observable. In this work, we analytically quantify the magnitude and direction of ADS-B modulation that will be sufficient for spoofing detection. Given enough time the INS solution drift will grow large enough such that the spoofed GNSS solution might be within the INS error covariance envelope and go undetected. Since GNSS is nominally used to recalibrate INS, the monitor will need to be reset after each calibration event. We analytically quantify the monitor reset time based on the magnitude of ADS-B broadcast modulation such that probability of missed detection is minimized.
The civil infrastructure of safety critical fields such as aviation, maritime and terrestrial navigation rely on GNSS. This brings a major responsibility to ensure absolute GNSS integrity. The civil GNSS signal structure is publicly known and vulnerable to spoofing attacks, which endangers public safety . Spoofing attacks consist of intentional jamming of the authentic radio-frequency signals and feeding a predetermined faulty signal to the user. The fault can be injected to cause gradual position or time offsets. Potential detection techniques include signal processing techniques, cryptographic authentication , spoofing discrimination using spatial processing by antenna arrays, and automatic gain control schemes , , GNSS signal direction of arrival comparison , code and phase rate consistency checks , high-frequency antenna motion , and signal power monitoring techniques . Some of these methods are indeed effective but they have various computational, logistical and physical limitations.
Augmenting data from auxiliary sensors such as Inertial Measurement Units (IMU), barometric altimeters, and independent radar sensors to discriminate spoofing has also been proposed , . The first stochastic description and quantification of the performance of IMU-based GNSS spoofing monitor against worst-case faults was introduced by us [11-17]. We specifically investigated anti-spoofing solutions utilizing IMUs since all modern vehicles are equipped with them, thereby requiring minimal additional cost or system modification. An IMU is immune to external interference, which makes it the best candidate for counter measure against GNSS spoofing attacks. INS, when used in the navigation solution in various integration schemes with GNSS (such as uncoupled, loosely-, tightly-, or ultra-tightly coupled), provides redundancy to the system, which is a direct means of resisting spoofing attacks.
ADS-B is a next generation surveillance technology incorporating both air and ground aspects that provide air traffic control (ATC) with an accurate picture of the aircraft’s three-dimensional position in en route, terminal, approach and surface environments . The aircraft provides the airborne portion in the form of a broadcast (ADS-B Out) of its identification, position, altitude, velocity and other information. Aircraft equipped with ADS-B In capability can also receive these broadcasts and display the information to improve the pilot’s situational awareness. The FAA has mandated that aircraft be equipped with ADS-B Out capability by January 1, 2020 to be compliant to fly in airspace classes A and B, where most civil aircraft operate. The FAA plans to use ADS-B as ATC’s sole source for aircraft tracking and to revert to back up surveillance systems, such as secondary surveillance radar (SSR), whenever GNSS position sources can no longer meet integrity requirements. The ADS-B broadcast is not encrypted and hence can be used by anyone to track an aircraft’s position . In our prior work [11-17], we showed that a spoofer capable of perfectly tracking an aircraft can generate a worst-case spoofing trajectory and be undetected. Access to ADS-B broadcast allows the spoofer to track an aircraft without the need to employ sophisticated radar or electrooptical tracking. Readily available low-cost ADS-B tracking systems  make an aircraft more vulnerable to spoofing.
The position alert limit requirement for en route phase of flight is 2 nmi . While en route, an aircraft may utilize only single frequency GNSS measurements without any differential corrections. Typical horizontal position and velocity standard deviations are 7 m and 2 cm/s, respectively. Because INS is calibrated using GNSS prior to spoofing, a spoofer injecting a GNSS position and velocity fault consistent with this nominal uncertainty cannot be detected using INS. The ADS-B Out broadcast requires the accuracy for position and velocity to be within standard deviations of 46 m and 5 m/s, respectively . This means that there is significant margin such that an aircraft can broadcast ADS-B Out purposely with some bias, or other modulation, in its position and velocity, while still being within the accuracy requirements of ADS-B. A spoofer using ADS-B broadcast will thus generate a spoofed trajectory based on the modulated value of position and velocity. The position and velocity solutions from INS can be directly compared to those obtained from the spoofed GNSS. For given monitor run time, we do not use GNSS to correct or calibrate the INS monitor, but instead simply compare the free inertial solution to GNSS solution. Thus, if a spoofer uses biased or modulated ADS-B to generate the spoofed trajectory, the monitor will detect it if the spoofed GNSS solution is outside the INS drift covariance envelope. We analytically quantify the magnitude and direction of this bias or other modulation that would ensure that spoofing is detected for a given time of attack and integrity risk requirement. Since the INS solution drifts, it cannot be used to check the GNSS solution indefinitely without reset using GNSS. Given a modulated ADS-B Out broadcast, after some time the INS covariance drift grow large enough such that the spoofer’s injected fault will fall within the INS covariance. We also analytically quantify the monitor reset time based on the magnitude of position and velocity modulation in the ADS-B Out broadcast.
In this work, we first expose the vulnerabilities of an ADS-B equipped aircraft to spoofing. We show that for en route aircraft, a spoofer with access to ADS-B information can generate false GNSS trajectories that will go undetected using INS-GNSS solution separation monitoring. Then we introduce a novel method to modulate ADS-B broadcast of position and velocity as an anti-spoofing aid to the INS-GNSS solution separation monitor. We also address the issue associated with monitor reset time by quantifying the probability of missed detection as a function of monitor run time.
 T. E. Humphreys, B. M. Ledvina, M. L. Psiaki, and B. W. O’Hanlon, “Assessing the spoofing threat: development of a portable GPS civilian spoofer,” in Proc. IEEE/ION PLANS, Savannah, GA, 2008, pp. 2314–2325.
 K. D. Wesson, M. P. Rothlisberger, and T. E. Humphreys, “A proposed navigation message authentication implementation for civil GPS anti-spoofing,” in Proc. IEEE/ION PLANS, Portland, OR, 2011, pp. 2314–2325.
 D. M. Akos, “Who’s afraid of the spoofer? GPS/GNSS spoofing detection via automatic gain control (AGC),” Navigation, vol. 59, no. 4, pp. 281–290, Winter. 2012.
 J. Nielsen, A. Broumandan, and G. Lachapelle, “Spoofing detection and mitigation with a moving handheld receiver,” GPS World, vol. 21, no. 9, pp. 27–33, Sep. 2010.
 M. Meurer, A. Konovaltsev, M. Cuntz, and C. Hattich, “Robust joint multi-antenna spoofing detection and attitude estimation using direction ¨ assisted multiple hypotheses RAIM,” in Proc. ION GNSS+, Nashville, TN, 2012, pp. 3007–3016.
 S. Moshavi, “Multi-user detection for DS-CDMA communications,” IEEE Communications Magazine, vol. 34, no. 10, pp. 124–135, Oct. 1996.
 M. L. Psiaki, S. P. Powell, and B. W. O’Hanlon, “GNSS spoofing detection using high-frequency antenna motion and carrier-phase data,” in Proc. ION GNSS+, Nashville, TN, 2013, pp. 2949–2991.
 A. Jafarnia-Jahromi, A. Broumandan, J. Nielsen, and G. Lachapelle, “GPS spoofer countermeasure effectiveness based on signal strength, noise power and C/N0 observables,” International Journal of Satellite Communications and Networking, vol. 30, no. 4, pp. 181–191, Jul. 2012.
 P. F. Swaszek, R. J. Hartnett, and K. C. Seals, “GNSS spoof detection using independent range information,” in Proc. ION ITM, Monterey, CA, 2016, pp. 739–747.
 A. J. Kerns, D. P. Shepard, J. A. Bhatti, and T. E. Humphreys, “Unmanned aircraft capture and control via GPS spoofing,” Journal of Field Robotics, vol. 31, no. 4, pp. 617–636, 2014.
 S. Khanafseh, et. al., “GPS Spoofing Detection Using RAIM with INS Coupling,” in Proc. ION PLANS Conference, Monterey, CA, 2014.
 C. Tanil, S. Khanafseh, and B. Pervan, “Impact of Wind Gust on Detectability of GPS Spoofing Attack Using RAIM with INS Coupling,” in Proc. IEEE/ION PNT Conference, Honolulu, HI, 2015, pp. 1232–1239.
 C. Tanil, S. Khanafseh, and B. Pervan, “GNSS spoofing attack detection using aircraft autopilot response to deceptive trajectory,” in Proc. ION GNSS+, Tampa, FL, 2015, pp. 3345–3357.
 C. Tanil, S. Khanafseh, M. Joerger, and B. Pervan, “Kalman filter-based Innovation monitor to detect GNSS spoofers capable of tracking aircraft position,” in Proc. IEEE/ION PLANS, Savannah, GA, 2016, pp. 1027–1034.
 C. Tanil, S. Khanafseh, and B. Pervan, “An Innovation monitor against GNSS Spoofing Attacks during GBAS and SBAS- assisted Aircraft Landing Approaches,” in Proc. ION GNSS+, Portland, OR, 2016.
 C. Tanil, S. Khanafseh, and B. Pervan, “Detecting Global Navigation Satellite System spoofing using inertial sensing of aircraft disturbance,” Journal of Guidance, Control, and Dynamics, vol. 40, no. 8, pp. 2006–2016, 2017.
 C. Tanil, S. Khanafseh, M. Joerger, B. Pervan, “An Innovation monitor to Detect GNSS Spoofers Capable of Tracking Aircraft Position,” IEEE Transactions on Aerospace and Electronics, vol. 54, no. 1, pp. 131–143, Feb 2018.
 Advisory Circular, Department of Transportation, Federal Aviation Administration: Subject: Airworthiness Approval of Automatic Dependent Surveillance - Broadcast (ADS-B) Out Systems: AC-20-165.
 “How flight tracking works,” retrieved October 21, 2019 from https://www.flightradar24.com/ how-it-works.
 “Build your own ADS-B receiver,” retrieved October 21, 2019 from https://www.flightradar24.com/build-your-own.
 RTCA DO-208, Minimum Operational Performance Standards for Airborne Supplemental Navigation Equipment Using Global Positioning System.