{'fraction_non_alphanumeric': 0.03100558659217877, 'fraction_numerical': 0.00707635009310987, 'mean_word_length': 5.208670520231214, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
POSTER: Detecting GNSS misbehaviour with high-precision clocks

To mitigate spoofing attacks targeting global navigation satellite systems (GNSS) receivers, one promising method is to rely on alternative time sources, such as network-based synchronization, in order to detect clock offset discrepancies caused by GNSS attacks. However, in case of no network connectivity, such validation references would not be available. A viable option is to rely on a local time reference; in particular, precision hardware clock ensembles of chip-scale thermally stable oscillators with extended holdover capabilities. We present a preliminary design and results towards a custom device capable of providing a stable reference, with smaller footprint and cost compared to traditional precision clocks. The system is fully compatible with existing receiver architecture, making this solution feasible for most industrial scenarios. Further integration with network-based synchronization can provide a complete time assurance system, with high short- and long-term stability.


INTRODUCTION
Ubiquitous GNSS receivers provide precise location and time to a wide gamut of applications, beyond navigation, for mobile communication systems. The inherent vulnerability of GNSS signals allows attackers to produce adversarial signals that purposely alter the GNSS receiver position, velocity, and timing (PVT) solution. Broad availability of affordable Software Defined Radios (SDRs) and open-source tools for GNSS spoofing/meaconing pose a significant threat to GNSS receivers deployed in critical applications [9,15,18]. Authentication methods, such as the Galileo Navigation Message Authentication (NMA), do not fully addresses the problem [17], as they do not preclude attacks that relay/replay legitimate signals [13,19,20]. Moreover, NMA is not backwards compatible with existing receiver hardware and requires changes to the structure of the signal in space. Several countermeasures were proposed, leveraging signal characteristics, e.g. [3], the receiver's attitude [4] or validation of the PVT solution through alternative position and time sources [11,14,16,21].
Attackers tampering with the PVT solution produce noticeable effects on the GNSS receiver clock, independently of their specific target. Countermeasures based on the observation of the receiver clock state could be agnostic to the exact attack form deployed or the attacker's objective. Considering the attack detection, intuitively, it is reasonable to compare the progression of time in the GNSS receiver against a trusted reference (e.g., remote time servers) to monitor for changes that would hint to an adversarial action. In fact, modern receivers are rarely used as stand-alone devices, and they are often integrated into complex devices with different types of network connectivity, allowing fusion with other sensor-and Internet-provided data.
On the other hand, the receiver might be prevented from accessing network based synchronization services for extended periods of times (e.g., scarce network coverage or even adversarial denial of service). The fall-back approach for the GNSS-enabled system is to rely on on-board crystal oscillators. Performing a so-called 'time test' is not a new idea [2,10,12], but integration of cheap clock references with the GNSS receiver is challenging due to environmentdependant effects, such as temperature variations, or the precision of the oscillator itself. To overcome some of these limitations, one could rely on improved reference clocks (e.g., oven-or double ovencompensated oscillators or rubidium references). But this comes at an increase in cost, footprint and power consumption, making such an not feasible for many mobile platforms.
Ultimately, an option is to use ensembles of multiple, local, chipscale high precision hardware reference oscillators. This approach compensates for errors caused by manufacturing inaccuracies, thermal deviations or frequency instability that affect single references. In [7], an optimal method based on Kalman filters was presented, to produce clock ensembles, improving the long-term stability over a single reference up to one order of magnitude. By adopting stability improvement mechanisms, our aim is to provide a stable clock reference the receiver can use to evaluate the state of the GNSS time information and by extension detect GNSS attacks.
This work investigates the feasibility of a solution based on precision chip-scale clocks to provide a detection (and recovery) system from GNSS attacks (spoofing, replaying/relaying). Initial results based on our system, using a single-precision chip-scale, oven-compensated oscillators (OCXOs) are presented. The device is tested in a realistic scenario, using the Texas Spoofing Battery (TEXBAT) trace files [8] to spoof a commercial GNSS receiver. Additionally, we present a preliminary design with multiple oscillators, to achieve a low-power, high-stability clock ensemble that can be used to provide cost-effective (compared to existing time assurance systems based on chip-scale atomic clocks), high-performance reference for GNSS attack/fault detection.

DESIGN
GNSS receivers can benefit from high-precision stable clocks to improve their performance. Ultra-stable clocks allow GNSS receivers to operate with a reduced number of satellites, providing a PVT solution even if less than four satellites are in view; although with  Figure 1: Block diagram of the system: the phase offset is used to detect potential GNSS attacks. some limitations for extremely long integration times [5]. On the other hand, such stable clocks are expensive, bulky, and often not suited for embedded computing devices or many relatively smallfootprint mobile devices. Low-cost oscillators can be used, but they have poor stability and require continuous tuning. For this reason, they are not stable enough for attack detection. In contrast, chipscale OCXOs provide adequate performance as clock references, in a compact and power-efficient form factor. This is why we develop a custom platform based on commercially available components, designed to work in tight integration with the GNSS receiver. The clock states (phase offset, frequency offset and frequency drift) of the GNSS receiver are continuously tested against the custom reference, to detect misbehavior effects on the GNSS receiver clock. The design estimates the relative phase between the 1-Pulse-per-Second (PPS) signal (which is synchronous to the top of the second of the GNSS PVT solution) against a 1-PPS clock obtained from a free-running hardware clock. Any deviation of the GPS time induced by the attacker causes a phase change to the victim receiver PPS. If such variation is beyond the normal drift rate of the reference clock, it can be an indication of an attack.
The device is implemented with mixed clock domain blocks in a Field Programmable Gate Array (FPGA). The FPGA implementation allows for high-resolution measurements of the phase deviation, with predictable latency. Figure 1 shows the implementation of the detection and control logic. The reference high-precision, chipscale OCXO is down-converted to produce the 1-PPS reference signal, and up-converted with a Phase-Locked Loop (PLL) clock synthesizer to provide the fast measurement clock. The reference OCXO has a frequency of 10 MHz, the measurement clock derived from the PLL is 200 MHz, allowing a resolution of 5 ns.
To precisely track the phase offset, a Kalman filter is designed as described in [6]. Due to its low computational complexity, the filter can be computed on embedded hardware. At this stage, for development, the computation is offloaded to the acquisition laptop.

EXPERIMENTAL SETUP
The proposed design is implemented on an Intel Altera MAX10 FPGA. The phase detection and measurement system is implemented in hardware and validated up to a frequency of 200Mhz. The receiver tested is a u-Blox C099-F9P high-performance dualband receiver, configured to operate on a single frequency of the GPS constellation only, to comply to the TEXBAT scenarios. The PPS frequency is 1 Hz, commonly used in industrial applications.
The spoofing signals are generated using a Nuand BladeRF SDR, that transmits raw I/Q samples from the TEXBAT scenario under test. Figure 2 shows   the acquisition computer and validated against the Agilent counter. Both instruments use the same high-precision chip-scale OCXO (Allan deviation ( ) = 8e−11) reference to produce comparable measurements.

PRELIMINARY RESULTS
The proposed system was tested against two time-focused scenarios from TEXBAT (scenarios ds-2 and ds-3). After the receiver obtains a legitimate PVT solution, the attack starts roughly at sample 100; once the phase offset reaches 2 µs (Figure 3a), the target is considered completely captured. Our design detects adversary-induced errors in accordance with [8], demonstrating the validity of the presented approach. Figure 3b shows the abnormal change in the phase offset, as detected by the proposed method, revealing the attacker-induced drift of the GNSS clock. The total deviation allowed to avoid a false positive detection depends on the specific application (e.g., power grid synchrophasors must not drift more than 25.6 µs [1]). The stability of our reference clock suggests that the detection threshold could be improved, but initial observations suggest that the phase noise (denoted by the slope of the phase measurements) of the embedded PLL limits the detection factor. The observed phase drift of the PLL output against a rubidium reference is ≈ 90 ns/s, establishing the lower detection bound for our proposed system.

CONCLUSIONS AND FUTURE WORK
The initial design can detect phase changes in the PPS edge against our high-precision reference, with a 5 ns resolution, and stability of 90 ns/s. Limitations due to the PLL phase stability were identified and possible solutions are under investigation.  design evaluated here. Based on a non-uniform sampling Kalman filter, the ensemble aims at providing a long-term stable reference for detecting GNSS spoofing attacks. Figure 4 presents a preliminary overview of the hardware ensemble. A group of free-running OCXO clocks is used to fine-tune a voltage-controlled OCXO that provides a system-wide clock for the measurement, estimation and misbehaviour detection. The hardware implementation of such system would provide extended holdover capabilities and result in a computationally efficient and cost-effective solution. This would strengthen GNSS receivers against spoofing attacks. Integration of this system with network-based time provision systems, would provide a complete solution for time based GNSS attack detection.