Authenticated Timing Protocol Based on Galileo ACAS

Abstract

Global navigation satellite systems (GNSSs) provide accurate positioning and timing services in a large gamut of sectors, including financial institutions, Industry 4.0, and Internet of things (IoT). Any industrial system involving multiple devices interacting and/or coordinating their functionalities needs accurate, dependable, and trustworthy time synchronization, which can be obtained by using authenticated GNSS signals. However, GNSS vulnerabilities to time-spoofing attacks may cause security issues for their applications. Galileo is currently developing new services aimed at providing increased security and robustness against attacks, such as the open service navigation message authentication (OS-NMA) and commercial authentication service (CAS). In this paper, we propose a robust and secure timing protocol that is independent of external time sources, and solely relies on assisted commercial authentication service (ACAS) and OS-NMA features. We analyze the performance of the proposed timing protocol and discuss its security level in relation to malicious attacks. Lastly, experimental tests were conducted to validate the proposed protocol.

1. Introduction

Timing and synchronization are two key services provided by global navigation satellite systems (GNSSs). GNSS receivers use ranging signals and satellite-reported time information to obtain a position, velocity, and time (PVT) solution, providing time with nanosecond-level accuracy [1]. Moreover, synchronization between receivers at different locations can be established and maintained using GNSS reference time, such as coordinated universal time (UTC) or the Galileo system time (GST). Thanks to this level of accuracy, several sectors rely on GNSS for synchronization operations, from financial institutions that use GNSS to timestamp transactions to Industry 4.0 and Internet of things (IoT) applications. The main standards for the dissemination of time and frequency over digital networks are the network time protocol (NTP) and the precision time protocol (PTP). The accuracy of NTP is usually within tens of milliseconds over the Internet, and it can be less than 1 ms in local area networks (LANs) with ideal network conditions [2], while PTP provides better accuracy, from hundreds of nanoseconds to microseconds [3]. Consequently, when nanosecond-level accuracy is required, a good solution is to adopt a local time server that relies on GNSSs.

For many of the mentioned applications and others that will be considered, accurate, reliable, and trustworthy time synchronization is required, and it can be obtained by relying only on authenticated GNSS signals. Indeed, the authentication feature provides trustfulness as it incorporates specific features that cannot be predicted or falsified into the broadcast GNSS signals, and an authentication-enabled receiver can interpret these characteristics to distinguish authentic signals from forgeries. The authentication can take place at two complementary levels: at the data level, i.e., on navigation messages, and at the ranging level, on pseudoranges between the satellite and receiver. The combination of data and code authentication enables the calculation of a secure PVT solution.

Navigation message authentication (NMA) techniques aim to ensure the authenticity of the content of the navigation messages, providing the user with the integrity protection of data. Open service navigation message authentication (OS-NMA) is a data authentication function for public Galileo E1B signals [4] in which the message transmitted by the satellites is interleaved with authentication data generated through broadcast authentication protocol timed-efficient stream loss-tolerant authentication (TESLA) [5], suitably adapted for optimal transmission via Galileo [1,6]. The TESLA protocol employs a one-way chain shared by Galileo satellites with a public root key. The keys in the chain are used in reverse order to generate message authentication codes (MACs). Keys are then shared (always in reverse order) in broadcast mode with a delay of a few seconds. The receiver can verify the MACs as soon as it becomes aware of the key.

Securing the pseudorange measurements computed by the receiver means authenticating the signal’s source and the time that it takes for the signal to reach the receiver. Spreading code encryption (SCE) techniques are the most reliable option to limit access to GNSS signals, as they render the spreading code unpredictable. Some SCE-type solutions in the literature are the P(Y) code for GPS and the commercial authentication service (CAS) for Galileo, which complement OS-NMA by offering spreading code level authentication in the E6 band. The assisted commercial authentication service (ACAS), recently presented in [7,8], provides a code authentication method that is based on navigation data received and authenticated by OS-NMA, including the key to generate the digital signature. This is part of Galileo commercial service (CS). A change in the SCE approach for public GNSS signals was proposed in [9], where a spreading code authentication (SCA) technique was proposed that authenticates a transmitted signal by watermarking the public spreading code with unpredictable sequences. A similar SCA technique was proposed in [10], where short sequences called spread spectrum security codes (SSSCs) were interleaved with the public spreading code. This approach was refined in [11,12], where the authentication scheme called chips-message robust authentication (CHIMERA) was introduced, which aims at jointly authenticating the navigation data and the spreading code of GPS signals for civil usage. This scheme replaces a small part of the spreading code with a secret, cryptographically generated sequence that can subsequently be reproduced by the receivers when they become aware of the key. In this context, a way to optimize trade-offs between security level and signal availability to receivers that do not know the modified code was derived in [13]. In the following, we focus on the combination of OS-NMA and ACAS.

In this paper, we introduce a secure timing protocol that relies solely on E6C authentication features and OS-NMA authenticated messages. We used E6C ACAS to build a clock model that is both robust and thus able to compute reliable time corrections, and secure since it could detect signal tampering. Our approach comprised two consecutive steps: first, the receiver processes the E6C measurements to estimate the receiver clock bias and drift; second, the receiver combines the obtained measurements to estimate the current clock bias by either using a Kalman filter, or fitting a linear or quadratic least squares model. Moreover, we propose strategies for timing attack detection in which we check the consistency of each new measurement with the model that had been calculated. We look at two approaches for this task: clock monitoring and innovation testing. We model a time-push attack to validate the performance of the proposed security checks. Moreover, we evaluate the proposed protocol on both simulated and experimental data collected with a professional GNSS receiver in nominal conditions and under-attack scenarios.

The rest of the paper is organized as follows. Section 2 briefly reviews the main concepts of the ACAS mode; then, the scenario for our analysis is described in Section 3. The main contribution of this paper is provided in Section 4, where we describe our proposed approach for secure ACAS-based timing, while the attack and its detection are described is Section 5. Simulation and experimental results are discussed in Section 6. Lastly, Section 7 draws the conclusions of the paper.

2. Review of ACAS

CAS is the Galileo’s SCE service aiming at providing signal authentication without modifications to Galileo first-generation core infrastructure and signals, and requiring only minimal changes to both the system and the receiver. CAS is currently under development but expected to be established by 2024: in particular, a proposal known as ACAS was presented in [7,8]. In ACAS, the E6C pseudo-random noise (PRN) spreading codes are neither short nor periodic sequences, but are generated by the system as a stream known as encrypted code sequence (ECS). Part of the ECS is re-encrypted using the TESLA keys employed by the OS-NMA protocol, and disseminated with the E1 open signal, generating the re-encrypted code sequence (RECS). The RECS are stored and published at predefined times on servers accessible to the public, such as the GNSS service center (GSC). Together with RECS, the server also publishes additional useful files for PVT computation, such as the broadcast group delay (BGD) for the E1–E6 bands. Once the RECS are retrieved from the server, the user can decrypt them by using the corresponding TESLA key, obtaining the related ECS. Lastly, the ECS is tested against previously stored samples received from the E6C signal, allowing for the user to verify the authenticity of the received signals. The TESLA key related to one (or more) RECS is revealed within the public Galileo E1B signal with a few seconds of delay compared to the transmission of the latter by the satellites.

This approach enables the receiving user to operate in standalone mode for the validity period of the predownloaded data (i.e., the RECS files) and without storing any secret cryptographic key. The RECS lengths are defined by the number of chips in these sequences, which is one of the key parameters in ACAS design as it determines the duration of the signal fragment used in correlation during the acquisition phase. Together with the size of the bins used for the Doppler frequency search, they define the acquisition search space and thereby the ability to find correlation peaks from which the pseudoranges and the authenticated PVT solution are computed. Another key parameter in ACAS is the distance between two consecutive RECS sequences, which determines how often the receiver can compute an authenticated solution. However, with ACAS, users assess the authenticity of the signals by checking the consistency between E6 and E1, which is not authenticated at the ranging level. In this work, we propose an authenticated timing protocol that relies only on ACAS and the navigation messages, which are both authenticated.

The PVT solution calculated via ACAS may also be useful for initializing the time synchronization required by OS-NMA, as RECSs files are designed to include the transmission time associated with the corresponding ECS of the keystream E6C, which can be used to resynchronize the receiver. The default ACAS operating mode is snapshot mode, since no navigation message and thus no ephemeris data are transmitted on E6.

3. System Model

We consider a scenario where a master clock is responsible for the synchronization of a network, composed of several devices or sensors connected via LAN. We assumed that this network was isolated; therefore, no attacker could influence the time dissemination process. The master clock is connected to a GNSS receiver, for instance, by being placed on the roof of a building with clear view of the sky. For this reason, we may assume that the received signals are transmitted by satellites mostly in line-of-sight (LOS), and that the effects of the multipath are minimal. The antenna position was fixed and known. We examined the case of a single-antenna receiver. Multiple antennas may still be employed, for example, to enhance the performance or security of the scheme by, e.g., checking the angle of arrival of a GNSS signal [14,15]. A representation of the considered scenario is depicted in Figure 1.

We considered a multifrequency receiver enabled to acquire and track Galileo signals (at least) in bands E1 ($f_{\mathrm{c}}=1575.42$ MHz) and E6 ($f_{\mathrm{c}}=1278.75$ MHz). Moreover, the receiver exploits both Galileo OS-NMA and ACAS. As briefly described in Section 2 and depicted in Figure 2, once the RECS files are published in the server and the TESLA key is received, the receiver decrypts the RECSs by using the corresponding key to obtain a local replica of the ECSs. Next, for the subset of Galileo satellites in view $\mathcal{S}\subseteq \{1,2,\dots 24\}$, it correlates the local replica with the prerecorded Galileo E6C signal samples and, from the correlation peaks, it computes code delay $u_i^{\left(s_i\right)}$ and the Doppler frequency $f_{\mathrm{D},i}^{\left(s_i\right)}$, measured by the receiver on signal on band E6, transmitted by satellite $s_i\in \mathcal{S}$ and received at time $t_i$.

After collecting M observables, the aim is to estimate the current master clock bias. In detail, at time $t_0$, we used M measurements collected from the satellites in $\mathcal{S}$ at times $t_1,\dots ,t_M$, with $t_{i+1}\ge t_i$ and $t_0>t_M$. Unlike the PVT computation, the proposed protocol provides timing even with fewer than four satellites in view.

4. Proposed Approach

In this section we propose a protocol that relies only on the observables authenticated by ACAS and the message, authenticated instead by OS-NMA, to compute the master clock correction. An ACAS observation is a 4-ple ${\mathit{O}}_i=\{t_i,s_i,u_i,f_{\mathrm{D},i}\}$, where $t_i$ is the observation time, $s_i\in \mathcal{S}$ is the satellite ID, $u_i$ is the observed code delay, and $f_{\mathrm{D},i}$ is the observed frequency offset (Doppler shift). We define the set of observables $\mathcal{O}$ as

$$\mathcal{O}=\{{\mathit{O}}_i:i=1,\dots ,M\}=\{(t_i,s_i,u_i,f_{\mathrm{D},i}):i=1,\dots ,M\},$$

(1)

with $\left|\mathcal{O}\right|=M$, where all the measurements are obtained from the E6 signal. In the preprocessing phase, from observation in $\mathcal{O}$, we derived ${\widehat{T}}_{\mathrm{b},i}$, estimated the clock bias at time $t_i$ on the basis of observation ${\mathit{O}}_i$, and ${\widehat{T}}_{\mathrm{d},i}$, and estimated the clock drift at time $t_i$ on the basis of observation ${\mathit{O}}_i$. So, the output of the preprocessing phase is the set

$$\mathcal{T}=\{({\widehat{T}}_{\mathrm{b},i},{\widehat{T}}_{\mathrm{d},i}):i=1,\dots ,M\},$$

(2)

which had the same cardinality as $\mathcal{O}$. Each measurement in $\mathcal{T}$, indexed by $i=1,\dots ,M$, may be acquired by a different satellite. Next, the current-state estimation phase follows where measurements in $\mathcal{T}$ are used to compute the master clock correction, at time $t_0$, ${\widehat{T}}_{\mathrm{b},0}$. Figure 3 summarizes both the two phases.

The last phase concerns security checks, where we tried to detect anomalous estimates ${\widehat{T}}_{\mathrm{b},0}$ of the clock bias; we considered the clock monitoring and innovation test as solutions for this task.

4.1. Preprocessing

Starting from each code delay measurement $u_i\in \mathcal{O}$, following the procedure described in [16], we computed pseudorange $R_i$ at time $t_i$ associated with satellite $s_i$. As indicated in Section 3, receiver position ${\mathit{P}}_{\mathrm{rx}}\left(t\right)$ is fixed and publicly known. Satellite position ${\mathit{P}}_{\mathrm{sat}}\left(t\right)$ and clock bias $T_{\mathrm{b},\mathrm{sat}}\left(t\right)$ can be retrieved from the authenticated OS-NMA message; thus, both can be considered to be authenticated at any time t. The computed pseudorange can be decomposed as

$$R_i=r_i+c(T_{\mathrm{b},i}-T_{\mathrm{b},\mathrm{sat}}^{\left(s_i\right)}\left(t_i\right))+D_i+{\eta }_i,$$

(3)

where $r_i=\left|\right|{\mathit{P}}_{\mathrm{sat}}^{\left(s_i\right)}\left(t_i\right)-{\mathit{P}}_{\mathrm{rx}}\left(t_i\right)\left|\right|$ is the geometric range, $T_{\mathrm{b},\mathrm{sat}}^{\left(s_i\right)}\left(t_i\right)$ is the satellite $s_i$ clock bias, $D_i=D_{\mathrm{iono}}^{\left(s_i\right)}\left(t_i\right)+D_{\mathrm{tropo}}^{\left(s_i\right)}\left(t_i\right)$ is the sum of ionospheric and the tropospheric delays, ${\eta }_i$ is the additional noise due to the signal processing errors and multipath, and c is the speed of light.

The pseudoranges computed for E1 are corrected by using the estimations of ionosphere and troposphere delays transmitted in the E1B navigation message. In this case, we worked with E6 pseudoranges: however, since the troposphere is a nondispersive medium, the corrections for the tropospheric delay of band E1, ${\widehat{D}}_{\mathrm{tropo},\mathrm{E}1}^{\left(s\right)}\left(t\right)$, and E6, ${\widehat{D}}_{\mathrm{tropo},\mathrm{E}6}^{\left(s\right)}\left(t\right)$ were identical for all $s\in \mathcal{S}$. On the other hand, if the ionosphere is instead a dispersive medium, given the correction for E1, the correction for E6 is [17]

$${\widehat{D}}_{\mathrm{iono},\mathrm{E}6}^{\left(s\right)}\left(t\right)={\widehat{D}}_{\mathrm{iono},\mathrm{E}1}^{\left(s\right)}\left(t\right)\frac{f_{\mathrm{E}1}^2}{f_{\mathrm{E}6}^2},$$

(4)

for all $s\in \mathcal{S}$ and for every time instant t. Correction ${\widehat{D}}_{\mathrm{iono},\mathrm{E}1}^{\left(s\right)}\left(t\right)$ must be obtained through a proper ionospheric correction model such as the Klobuchar model [18], or more precise models, such as Galileo NeQuick [19] or the IRI-P 2017 [20]. Only the measurements from E6 were actually authenticated; therefore, we could not exploit the measurements from another band (e.g., E1 or E5) to remove the ionospheric delay contribution, as it is typically performed in multifrequency GNSS receivers; instead, we had to use the model computed by using the parameters in the authenticated navigation message.

The receiver clock bias estimation at time $t_i$ is then calculated from (3) and (4) as

$${\widehat{T}}_{\mathrm{b},i}\triangleq \frac{1}{c}\left(R_i-r_i-{\widehat{D}}_i\right)+T_{\mathrm{b},\mathrm{sat}}^{\left(s_i\right)}\left(t_i\right)=T_{\mathrm{b},i}+{\xi }_{\mathrm{b},i},$$

(5)

where $T_{\mathrm{b},i}$ is the real receiver clock bias at time $t_i$, and ${\xi }_{\mathrm{b},i}$ is the clock bias estimation error taking into account the error residuals due to the nonperfect atmospheric delays estimation and the additional noise component ${\eta }_i$.

Next, we compute the pseudorange rate ${\dot{R}}_i$ at time $t_i$ as

$${\dot{R}}_i=-\lambda f_{\mathrm{D},i},$$

(6)

where $f_{\mathrm{D},i}$ belongs to the authenticated observables set $\mathcal{O}$ and $\lambda$ is the wavelength of E6. From (3), the pseudorange rate can then be decomposed as

$${\dot{R}}_i={\dot{r}}_i+c\left(T_{\mathrm{d},i}-T_{\mathrm{d},\mathrm{sat}}^{\left(s_i\right)}\left(t_i\right)\right)+{\gamma }_i+{\dot{\eta }}_i,$$

(7)

where

$${\gamma }_i={\gamma }^{\left(s_i\right)}\left(t_i\right),{\gamma }^{\left(s\right)}\left(t\right)\triangleq \frac{\partial }{\partial t}\left[D_{\mathrm{iono}}^{\left(s\right)}\left(t\right)+D_{\mathrm{tropo}}^{\left(s\right)}\left(t\right)\right]$$

(8)

is a term modeling both the time derivatives of the the atmospheric delays and the signal processing errors. Moreover, the geometric range derivative ${\dot{r}}^{\left(s\right)}\left(t\right)$ is given by

$$\begin{array}{c}\hfill {\dot{r}}^{\left(s\right)}\left(t\right)=\frac{\partial }{\partial t}\left|\right|{\mathit{P}}_{\mathrm{sat}}^{\left(s\right)}\left(t\right)-{\mathit{P}}_{\mathrm{rx}}\left(t\right)\left|\right|={({\mathit{v}}_{\mathrm{sat}}^{\left(s\right)}\left(t\right)-{\mathit{v}}_{\mathrm{rx}}\left(t\right))}^T\frac{{\mathit{P}}_{\mathrm{sat}}^{\left(s\right)}\left(t\right)-{\mathit{P}}_{\mathrm{rx}}\left(t\right)}{\left|\right|{\mathit{P}}_{\mathrm{sat}}^{\left(s\right)}\left(t\right)-{\mathit{P}}_{\mathrm{rx}}\left(t\right)\left|\right|}\\ \hfill ={({\mathit{v}}_{\mathrm{sat}}^{\left(s\right)}\left(t\right)-{\mathit{v}}_{\mathrm{rx}}\left(t\right))}^T{\mathit{e}}^{\left(s\right)}\left(t\right)=v_{\mathrm{LOS}}^{\left(s\right)}\left(t\right),\end{array}$$

(9)

where ${\mathit{e}}^{\left(s\right)}\left(t\right)$ is the unit vector that points to the receiver antenna from the satellite, so $v_{\mathrm{LOS}}^{\left(s\right)}\left(t\right)$ is the velocity projected into the LOS direction. Moreover, ${\mathit{v}}_{\mathrm{rx}}\left(t\right)=0\forall t$, since the position of the GNSS receiver is fixed. Thus, term ${\dot{r}}_i$ appearing in (7) is obtained as

$${\dot{r}}_i={\dot{r}}^{\left(s_i\right)}\left(t_i\right)=v_{\mathrm{LOS}}^{\left(s_i\right)}\left(t_i\right).$$

(10)

Analogously to (5), we compute

$${\widehat{T}}_{\mathrm{d},i}\triangleq \frac{1}{c}\left({\dot{R}}_i-v_{\mathrm{LOS}}^{\left(s_i\right)}\left(t_i\right)\right)+T_{\mathrm{d},\mathrm{sat}}^{\left(s_i\right)}\left(t_i\right)=T_{\mathrm{d},i}+{\xi }_{\mathrm{d},i},$$

(11)

where $T_{\mathrm{d},i}$ is the real receiver clock drift at time $t_i$ and ${\xi }_{\mathrm{d},i}$ is the clock drift estimation error. Repeating this procedure for $i=1,\dots ,M$, we obtain the set $\mathcal{T}$.

It is possible to statistically model both ${\xi }_{\mathrm{b},i}$ and ${\xi }_{\mathrm{d},i}$. A partial model for the first term is provided in [7,21,22]; however, the second-order descriptions of ${\xi }_{\mathrm{b},i}$ and ${\xi }_{\mathrm{d},i}$ are sufficient for the analysis in this paper.

4.2. Current-State Estimation

In the previous section, we showed how to derive measurements in $\mathcal{T}$ starting from the authenticated observables in $\mathcal{O}$. These estimates are exploited to compute the actual receiver clock bias that is used to correct the master clock. The design of a specific algorithm for this task is justified, since the clock bias and drift estimations are relative to time $t_i,i=1,\dots ,M$; therefore, we need a model that exploits the past measurements to compute the current one. Moreover, past measurements are affected by noise, modeled by ${\xi }_{\mathrm{b},i}$ and ${\xi }_{\mathrm{d},i}$. We analyzed three different approaches to this task: a least squares (LS) quadratic model, a LS linear model, and a Kalman filter.

4.2.1. LS-Quadratic and Linear Model

The first two solutions leverage the idea that clock bias increases (or decreases) over time following a parabola, where the quadratic term, with coefficient drift rate, is expected to have a low impact. For instance, considering the time of ephemeris $t_{\mathrm{oe}}$, the Galileo satellite clock bias is computed as follows [23]

$$T_{\mathrm{b},\mathrm{sat}}^{\left(s\right)}\left(t\right)=a_0^{\left(s\right)}+a_1^{\left(s\right)}(t-t_{\mathrm{oe}})+a_2^{\left(s\right)}{(t-t_{\mathrm{oe}})}^2,$$

(12)

where $a_0^{\left(s\right)}$, $a_1^{\left(s\right)}$, and $a_2^{\left(s\right)}$ represent the satellite clock bias, clock drift, and clock drift rate measured at time $t_{\mathrm{oe}}$, respectively. Typically the drift rate is transmitted to as $a_2^{\left(s\right)}=0$, leading to a de facto linear model. Thus, we consider both a quadratic and a linear model.

Analogously to (12), calling ${\tau }_i=t_0-t_i$ the time difference between the current time at which we want to compute the clock bias estimation and the time associated to the measurements, we can write

$$\begin{array}{cc}\hfill {\widehat{T}}_{\mathrm{b},i}=& a_0+a_1{\tau }_i+a_2{\tau }_i^2+{ϵ}_{\mathrm{b},i},\hfill \end{array}$$

(13)

$$\begin{array}{cc}\hfill {\widehat{T}}_{\mathrm{d},i}=& a_1+2a_2{\tau }_i+{ϵ}_{\mathrm{d},i},\hfill \end{array}$$

(14)

where $a_0$, $a_1$ and $a_2$ are now the parameters modeling the receiver clock behavior, ${\widehat{T}}_{\mathrm{b},i}$ and ${\widehat{T}}_{\mathrm{d},i}$ are the measurements in $\mathcal{T}$ computed in the preprocessing phase, ${ϵ}_{\mathrm{b},i}$ and ${ϵ}_{\mathrm{d},i}$ are the estimation errors related to the i-th measurement. Equivalently to (13) and (14), in matrix form, we have

$$\left(\begin{array}{c}{\widehat{T}}_{\mathrm{b},i}\\ {\widehat{T}}_{\mathrm{d},i}\end{array}\right)=\left(\begin{array}{ccc}1& {\tau }_i& {\tau }_i^2\\ 0& 1& 2{\tau }_i\end{array}\right)\left(\begin{array}{c}{a}_0\\ a_1\\ a_2\end{array}\right)+\left(\begin{array}{c}{ϵ}_{\mathrm{b},i}\\ {ϵ}_{\mathrm{d},i}\end{array}\right)=\left(\begin{array}{c}{\mathit{E}}_{\mathrm{b},i}\\ {\mathit{E}}_{\mathrm{d},i}\end{array}\right)\mathit{a}+{\mathit{ϵ}}_{\mathit{i}},$$

(15)

where $\mathit{a}={\left[a_0{a}_1{a}_2\right]}^T$ is the vector of parameters we aim to estimate. Next, considering all the measurements in $\mathcal{T}$, we stack the matrices, obtaining

$$\mathit{y}=\left(\begin{array}{c}{\mathit{y}}_{\mathrm{b}}\\ {\mathit{y}}_{\mathrm{d}}\end{array}\right)=\left(\begin{array}{c}{\mathit{E}}_{\mathrm{b}}\\ {\mathit{E}}_{\mathrm{d}}\end{array}\right)\mathit{a}+\left(\begin{array}{c}{\mathit{ϵ}}_{\mathrm{b}}\\ {\mathit{ϵ}}_{\mathrm{d}}\end{array}\right)=\mathit{E}\mathit{a}+\mathit{ϵ},$$

(16)

where ${\mathit{y}}_{\mathrm{b}}$ and ${\mathit{y}}_{\mathrm{d}}$ are the columns vectors collecting the M bias and drift measurements, respectively, in $\mathcal{T}$, ${\mathit{E}}_{\mathrm{b}}={[{\mathit{E}}_{\mathrm{b},1}^T,\dots ,{\mathit{E}}_{\mathrm{b},M}^T]}^T$ and ${\mathit{E}}_{\mathrm{d}}={[{\mathit{E}}_{\mathrm{d},1}^T,\dots ,{\mathit{E}}_{\mathrm{d},M}^T]}^T$ contain the time difference terms associated to each measurement in ${\mathit{y}}_{\mathrm{b}}$ and ${\mathit{y}}_{\mathrm{d}}$, respectively, and $\mathit{ϵ}={[{\mathit{ϵ}}_1,\dots ,{\mathit{ϵ}}_M]}^T$. In order to minimize the mean square error (MSE), we performed the estimation by using the pseudoinverse

$$\widehat{\mathit{a}}={\left({\mathit{E}}^T\mathit{E}\right)}^{-1}{\mathit{E}}^T\mathit{y},$$

(17)

and we obtained the estimations of clock bias and drift at time $t_0$ as

$$\begin{array}{cc}\hfill {\widehat{T}}_{\mathrm{b},0}& ={\widehat{a}}_0,\hfill \end{array}$$

(18)

$$\begin{array}{cc}\hfill {\widehat{T}}_{\mathrm{d},0}& ={\widehat{a}}_1.\hfill \end{array}$$

(19)

An analogous derivation can be performed starting from a linear model, replacing (15) with

$$\left(\begin{array}{c}{\widehat{T}}_{\mathrm{b},i}\\ {\widehat{T}}_{\mathrm{d},i}\end{array}\right)=\left(\begin{array}{cc}1& {\tau }_i\\ 0& 1\end{array}\right)\left(\begin{array}{c}{a}_0\\ a_1\end{array}\right)+\left(\begin{array}{c}{ϵ}_{\mathrm{b},i}\\ {ϵ}_{\mathrm{d},i}\end{array}\right).$$

(20)

4.2.2. Kalman Filter

In this section, we investigate the use of a Kalman filter to estimate the bias. In particular, every time a new estimate $\{{\widehat{T}}_{\mathrm{b},i},{\widehat{T}}_{\mathrm{d},i}\}$ was available, we updated the model and perform a new prediction; moreover, even when no new measurement was available, we exploited the previously trained model to estimate the current clock correction. A more detailed description of the Kalman filter can be found in [24].

The procedure was divided into two phases, prediction and model update. We call ${\mathit{x}}_i$ the true state at time $t_i$, and ${\mathit{z}}_i$ the input at time $t_i$, that is,

$${\mathit{x}}_i=\left(\begin{array}{c}{T}_{\mathrm{b},i}\\ T_{\mathrm{d},i}\\ {\dot{T}}_{\mathrm{d},i}\end{array}\right),{\mathit{z}}_i=\left(\begin{array}{c}{\widehat{T}}_{\mathrm{b},i}\\ {\widehat{T}}_{\mathrm{d},i}\end{array}\right),$$

(21)

where ${\dot{T}}_{\mathrm{d},i}$ represents the clock drift rate, which we did not measure directly. Then, the state-transition matrix and the observation matrix are given by

$${\mathit{F}}_i=\left(\begin{array}{ccc}1& t_i-t_{i-1}& {(t_i-t_{i-1})}^2\\ 0& 1& 2(t_i-t_{i-1})\\ 0& 0& 1\end{array}\right),{\mathit{H}}_i=\left(\begin{array}{ccc}1& 0& 0\\ 0& 1& 0\end{array}\right).$$

(22)

Differently from the general model for the Kalman filter, we had no control input. In the prediction step, we computed a priori state estimate ${\widehat{\mathit{x}}}_{i|i-1}$ and its covariance matrix ${\mathit{P}}_{i|i-1}$:

$${\widehat{\mathit{x}}}_{i|i-1}={\mathit{F}}_i{\widehat{\mathit{x}}}_{i-1|i-1}$$

(23)

$${\mathit{P}}_{i|i-1}={\mathit{F}}_i{\mathit{P}}_{i-1|i-1}{\mathit{F}}_i^{\mathrm{T}}.$$

(24)

Calling ${\mathit{R}}_i$ the measurement noise covariance, during the update step, we computed

$${\mathit{y}}_i={\mathit{z}}_i-{\mathit{H}}_i{\widehat{\mathit{x}}}_{i|i-1}$$

(25)

$${\mathit{B}}_i={\mathit{H}}_i{\mathit{P}}_{i|i-1}^{-1}{\mathit{H}}_i^{\mathrm{T}}+{\mathit{R}}_i$$

(26)

$${\mathit{K}}_i={\mathit{P}}_{i|i-1}{\mathit{H}}_i^{\mathrm{T}}{\mathit{B}}_i^{-1}$$

(27)

$${\widehat{\mathit{x}}}_{i|i}={\widehat{\mathit{x}}}_{i|i-1}+{\mathit{K}}_i{\mathit{y}}_i$$

(28)

$${\mathit{P}}_{i|i}=({\mathit{I}}_2-{\mathit{K}}_i{\mathit{H}}_i){\mathit{P}}_{i|i-1}.$$

(29)

We call ${\widehat{\mathit{x}}}_{i|i}$ and its covariance ${\mathit{P}}_{i|i}$ the updated a posteriori estimate of the state. Term ${\mathit{y}}_i$ is called innovation and is used together with its covariance ${\mathit{B}}_i$ during the innovation check in the security steps. Repeating this procedure for every measure in $\mathcal{T}$, we obtained the M-th estimation ${\mathit{x}}_M$. Then, from (23), we computed the a posteriori estimation at time $t_0$ as ${\widehat{\mathit{x}}}_{0|M}={\mathit{F}}_0{\widehat{\mathit{x}}}_{M|M}$, where

$${\mathit{F}}_0=\left(\begin{array}{ccc}1& t_0-t_M& {(t_0-t_M)}^2\\ 0& 1& 2(t_0-t_M)\\ 0& 0& 1\end{array}\right).$$

(30)

Lastly, ${\widehat{T}}_{\mathrm{b}}$ is the first element of ${\widehat{\mathit{x}}}_{0|M}$.

5. Timing Attack and Detection

In the system model of Section 3, we assumed that the position of the GNSS receiver was fixed and publicly known. Therefore, the receiver was assumed to perform a consistency check on the received signal, such that, if the receiver PVT computation yielded a position much different from the expected one or a significant velocity, an alarm would be raised. Moreover, since the satellites’ position was known, the receiver could reject any signal coming from satellites that should not be in view: thus, the attacker is also forced to generate signals corresponding only to satellites actually in view by the legitimate receiver. Hence, the attacker knows that (1) all the attacks causing a relevant change in the victim’s computed position or velocity are detected, and (2) signals transmitted by satellites that should not be in view by a legitimate receiver are neglected.

For these reasons, we consider an attacker performing a time-push attack: this is a meaconing attack where the receiver records signals and retransmits them with additional delays, adding an equal bias in all pseudoranges, which results in error in the time calculation of the PVT solution by the receiver, while the computed position does not change, as is proven in Section 6. Moreover, this attack may indeed target ACAS, where the signal cannot be tracked since the receiver operates in snapshot mode: this grants the attacker a time window to record the signal and perform a time-push attack. Sudden changes in the estimated clock bias may alert the receiver: thus, the attacker performs a time push in a smoothly progressive manner, gradually increasing the delay. However, to be effective, the attacker must be close to the victim’s antenna to have the same satellites in view of the legitimate receiver.

A possible countermeasure to prevent this attack would be to render the area around the receiver inaccessible by, for instance, installing surveillance cameras and/or surrounding the building with a fence. Still, we considered a worst-case scenario where the attacker managed to approach close enough to the receiver antenna and isolate the legitimate receiver, ensuring that only fake signals are received to perform the time-push attack.

To detect the presence of false measurements among the obtained corrections, we considered clock-monitoring and innovation-testing [25,26] methods. Formally, we frame this problem as hypothesis testing: considering null-hypothesis ${\mathcal{H}}_0$ as the nominal condition where the signals are transmitted by the legitimate transmitter, the receiver observes a test statistic, $\beta$, and decides whether $\beta$ is compatible with ${\mathcal{H}}_0$ or not.

5.1. Clock Monitoring

As discussed in Section 4.2, the receiver clock bias is typically assumed to have either linear or quadratic behavior over time: we can then analyze the clock bias corrections over time and if anomalous discontinuities are detected we raise an alarm. This is the idea behind clock-monitoring techniques. Given the clock model ${\widehat{\mathit{a}}}^{\prime }$ estimated through either (15) or (20) at time $t_i-\delta$, i.e., the previous epoch, it is possible to compute a prediction $\{{\tilde{T}}_{\mathrm{b},i},{\tilde{T}}_{\mathrm{d},i}\}$ of the measurements at time $t_i$, as

$$\left(\begin{array}{c}{\tilde{T}}_{\mathrm{b},i}\\ {\tilde{T}}_{\mathrm{d},i}\end{array}\right)=\left(\begin{array}{ccc}1& \delta & {\delta }^2\\ 0& 1& 2\delta \end{array}\right){\widehat{\mathit{a}}}^{\prime }.$$

(31)

Hence, for bias and drift, we adopted as the test statistic the quantities

$${\beta }_{\mathrm{b},i}\triangleq {\tilde{T}}_{\mathrm{b},i}-{\widehat{T}}_{\mathrm{b},i},$$

(32)

$${\beta }_{\mathrm{d},i}\triangleq {\tilde{T}}_{\mathrm{d},i}-{\widehat{T}}_{\mathrm{d},i},$$

(33)

and test

$${\widehat{\mathcal{H}}}_i=\left\{\begin{array}{c}{\mathcal{H}}_0\mathrm{if}\left|{\beta }_{\mathrm{b},i}\right|<{\lambda }_{\mathrm{b}}\mathrm{and}\left|{\beta }_{\mathrm{d},i}\right|<{\lambda }_{\mathrm{d}},\hfill \\ {\mathcal{H}}_1\mathrm{otherwise},\hfill \end{array}\right..$$

(34)

where thresholds ${\lambda }_{\mathrm{b}}$ and ${\lambda }_{\mathrm{d}}$ are chosen a priori by the user as a predefined false alarm (FA) probability. When a specific attack model is available, it may be possible to instead set the thresholds on the missed detection (MD) probability. More in detail, considering, for instance, drift threshold ${\lambda }_{\mathrm{d}}$, it may be worth taking into account the actual clock specifications, thus evaluating a bound of the clock drift in nominal conditions [27].

If the distribution of the tests statistics ${\beta }_{\mathrm{b},i}$ and ${\beta }_{\mathrm{d},i}$ were known, it would be possible to replace (34) with two generalized likelihood ratio tests (GLRTs); however, the statistical characterization of such quantities is out of the scope of this work and is left to future works. Lastly, while we show the effectiveness of the clock monitoring only in relation to the LS models, such techniques may also be employed with the Kalman filter.

5.2. Innovation Testing

While using the Kalman filter, during the update step, each prediction is corrected by innovation term (25) that, in steady-state conditions, has mean and covariance

$$E\left[{\mathit{y}}_i\right]=0$$

(35)

$$\mathrm{COV}\left({\mathit{y}}_i\right)={\mathit{B}}_i.$$

(36)

We can then use the normalized innovation as a test statistic, computed as follows:

$${\beta }_{\mathrm{K},i}={\mathit{y}}_i^{\mathrm{T}}{\mathit{B}}_i{\mathit{y}}_i.$$

(37)

In nominal conditions, ${\beta }_{\mathrm{K},i}$ is assumed to have chi-squared distribution [26] with as many degrees of freedom as the size of the measurement $z_i$, ${\beta }_{\mathrm{K},i}\sim {\chi }^2$. Thus, to assess the authenticity of the measurement, we could use the GLRT test against a uniform distribution

$${\widehat{\mathcal{H}}}_i=\left\{\begin{array}{c}{\mathcal{H}}_0\mathrm{if}p\left({\beta }_{\mathrm{K},i}\right|{\mathcal{H}}_0)\ge {\lambda }_{\mathrm{k}}\hfill \\ {\mathcal{H}}_1\mathrm{otherwise}\hfill \end{array}\right.,$$

(38)

where ${\lambda }_{\mathrm{k}}$ is chosen by the user to match a predefined FA probability.

6. Results and Discussion

In this section, first, we validate the proposed approach; next, we show that the time-push attack described in Section 5 is successful even if a legitimate receiver knows its actual position, highlighting the need for additional security checks.

We collected experimental data to build the set of authenticated observables $\mathcal{O}$ serving as input for the preprocessing phase. The detection capabilities of the methods proposed in Section 5.1 and Section 5.2 were tested against a simulated time-push attack.

6.1. Validation Using Experimental Data

To validate the proposed approach described in Section 4 we performed experimental tests collecting signals from an open-sky environment with a Septentrio PolarRx5 receiver connected to a A42 Hemisphere antenna. The experimental setup is depicted in Figure 4.

The output of the receiver was logged using the Septentrio binary format (SBF) standard and postprocessed after the experiments, obtaining a dataset of measurements from different constellations and frequency bands, summarized in

Table 1. Constellations and central frequencies of the measurements collected in the experimental dataset.

	Central Frequency, ${\mathit{f}}_{\mathit{c}}$ [MHz]
	1176.45	1207.14	1227.60	1245.5	1278.75	1268.52	1561.098	1575.42	1601.5
Galileo	E5a	E5b			E6			E1BC
			L2 C/A					L1 C/A
GPS	L5		L2 P(Y)					L1 P(Y)
Beidou	B2a	B2l				B3l	B1l	B1C
GLONASS				L2 C/A					L1 C/A

.

We considered only measurements from two Galileo satellites that were visible during the whole experiment. As ground truth $T_{\mathrm{b}}$ that was later used to evaluate the goodness of our estimates ${\widehat{T}}_{\mathrm{b}}$, we used the clock bias measurements calculated from the PVT solution computed by the receiver using the whole set of measurements available in the dataset: on average, the PVT was computed by the receiver using the signal coming from 16 satellites. The Septentrio PolaRx5 is equipped with a voltage-controlled and temperature-controlled crystal oscillator (VCTCXO). Since only E6C ranging measurements were authenticated, we set the receiver to use the Klobuchar ionospheric correction model, which is the one typically used for GNSS receivers, estimating the ionospheric delay as in (4). More precise sophisticated models as Galileo NeQuick [19] and IRI-P 2017 [20] can be employed. For the sake of simplicity, we show that even the simpler Klobuchar model is enough to obtain satisfactory results, showing our method’s robustness. Next, we extracted set $\mathcal{O}$ from our dataset considering only the measurements from E6C.

Figure 5 shows the master clock bias estimation error as the difference between the ground truth and the clock estimations, $\Delta {\widehat{T}}_{\mathrm{b}}$, obtained using the LS quadratic, LS linear estimation methods and the Kalman filter in Figure 5. The LS methods described in Section 4.2.1 were used to compute one clock bias estimation ${\widehat{T}}_{\mathrm{b}}$ every 2 s using the 4 most recent available measurements, so that $M=4$. The Kalman filter computed one new estimate ${\widehat{T}}_{\mathrm{b}}$ every second. All the tested methods were effective, achieving an error limited to less than 50 ns, obtaining precise timing with fewer than four satellites in view.

6.2. Numerical Results and Attack Detection

To simulate the attacks, we used our signal generator and software receiver developed for the MORE Galileo open service signal integrity protection (MORE GOSSIP) project, funded by the European Space Agency (ESA) (see also [28]). We simulated the Galileo E6 baseband signal (the carrier frequency still influenced the Doppler frequency), generating both data (E6B) and pilot (E6C) components as in Galileo specifications [23], modulated with a BPSK(5), i.e., with code frequency $f_{\mathrm{code}}=5.115$ MHz. We considered an additional linear (deterministic) clock drift of $0.5$ parts per million (ppm). We modeled a noiseless scenario with RECS duration equal to the PRN code length on E6, i.e., 5115 chips. Concerning CAS, we assumed that one new RECS would be disclosed every second. We generated 5 channels, i.e., 5 signals from five different satellites with 16 bit quantization. The sampling frequency was set to $f_s=2f_{\mathrm{code}}=10.23$ MHz, and each simulation scenario lasted for 100 s. On the receiver side, the acquisition was performed by using the same sampling frequency, and the Doppler bin size was set to 75 Hz. The receiver collected measurements $\{{\widehat{T}}_{\mathrm{b},i},{\widehat{T}}_{\mathrm{d},i}\}$ with a frequency of 1 Hz; as indicated before, since we assumed that the one RECS was made public every 60 s, we used only one of the measurements of the satellite in view per acquisition round as input for the model.

6.2.1. Nominal Scenario

We start by considering legitimate dataset ${\mathcal{H}}_0$. Only one RECS is disclosed at every epoch; thus, only one signal every epoch can be used to update the state.

Figure 6 shows the results obtained for the current-state estimation phase described in Section 4.2. In particular, we show $\Delta {\widehat{T}}_{\mathrm{b}}$, i.e., the difference between ground truth and clock estimations obtained by using the LS quadratic, LS linear, and the Kalman filter: all the methods were effective, achieving maximal deviation lower than 200 ns and a zero mean even using only one (new) measurement per epoch (i.e., per minute). Thus, all the methods could be employed for this task.

6.2.2. Attack Scenario

In this section, we evaluate under-attack scenarios, such as the ones described in Section 5.

In the first part of this section, we show the impact of a time-push attack, proving that such attacks cannot be detected just by the check on the receiver position. In the second part, we discuss the performance of the clock-monitoring and innovation-check methods, showing the different behaviors of the test statistics ${\beta }_{\mathrm{b}}$, ${\beta }_{\mathrm{d}}$, and ${\beta }_{\mathrm{K}}$ in the legitimate and under-attack scenarios, i.e., ${\mathcal{H}}_0$ and ${\mathcal{H}}_1$.

As indicated in Section 5, a sudden spike in the estimated clock bias may alert the receiver; thus, the attacker introduces the delays in a ramplike fashion. We modeled a scenario where the attacker managed to isolate the victim receiver and acquired only the forged E6 signals.

Figure 7 reports the results: while the positioning error statistic was indeed indistinguishable in ${\mathcal{H}}_0$ and ${\mathcal{H}}_1$, the impact on the clock bias is clear. This confirms that we cannot trust the timing obtained on a PVT that passes by the naive position check. Hence, we suggest dedicated algorithm and strategies specifically designed for secure timing.

Next, we validate the security checks described in Section 5 considering a legitimate scenario and three attack scenarios. Each attack lasted 20 s with a constant drift of 1, 2 and 3 ppm, and achieved a final delay of 20, 40, and 60 μs, respectively. Each attack started at a different time.

Figure 8 shows the test statistic obtained via clock monitoring in nominal conditions and an under-attack scenario: both ${\beta }_{\mathrm{b}}$ and ${\beta }_{\mathrm{d}}$ presented spikes associated to the start and end of the attack, which had a magnitude much greater than the standard deviation of the same test statistic in the nominal conditions. This test was, thus, indeed effective in detecting time-push attacks, since it is easy for the user to set a threshold to distinguish legitimate from under-attack scenarios. Moreover, performing more tests, it could be possible for the user to fine-tune the threshold by observing the receiver operating characteristic (ROC) curves.

Figure 9 shows the test statistic ${\beta }_{\mathrm{K}}$ used for the innovation testing and described in Section 5.2. A jump is presented when the attacker starts (and ends) the time-push attack. Therefore, this technique is also successful at detecting time-push attacks.

7. Conclusions

In this work, we presented a secure timing protocol that may be used, for instance, by Industry 4.0 applications to synchronize multiple IoT devices within a facility. We considered a scenario where the master clock was securely connected to a GNSS receiver, and all the devices or sensors aimed to be synchronized. The protocol was based upon the new Galileo ACAS protocol and relied only on authenticated measurements to obtain the clock correction.

The procedure was composed by three blocks: first, exploiting the fact that the facility position is known, the receiver processes the E6C measurements to obtain an estimation of the receiver clock bias and drift; second, the receiver merges the previously obtained measurements to compute the current clock bias estimation by fitting either a linear or a quadratic least-squares model, or by using a Kalman filter. Lastly, we also considered the employment of a security evaluation phase where we tested the consistency of each new measurement with the previously estimated model. For this task, we considered two methods: clock monitoring and innovation test. We validated the proposed procedure using an experimental dataset collected with a Septentrio PolaRx5 receiver, and simulated data considering both legitimate and under-attack conditions. The obtained numerical and experimental results show that our protocol was both able to compute a reliable timing correction and to reject time-push attacks.