2.2 Future Cryptographic GNSS Protec- tion tack, or more precisely, before the suspected onset of an attack. We investigate mechanisms that rely on own (i) location information, calculated by GNSS navigation mes- sages, (ii) clock readings, without any re-synchronization with the help of the GNSS or any other system, and (iii) received GNSS signal Doppler shift measurements. Based on those different types of information, our mechanisms can detect if the received GNSS signals and messages orig- inate from adversarial devices. If so, location information induced by the attack can be rejected and manipulation of the location-aware functionality be avoided. We clarify that the reaction to the detection of an attack, and mecha- nisms that mitigate unavailability of legitimate GNSS sig- nals is out of the scope of this paper. Cryptographic protection ensures the authenticity and in- tegrity of GNSS messages, i.e., ensures that NAV messages generated solely by GNSS entities, with no modification, are accepted and used by nodes. Currently, cryptography is used in military systems, but it is not available for commer- cial systems to provide authenticity and integrity. Public or asymmetric key cryptography is a flexible and scalable approach that does not require tamper-resistant receivers. 2 Independently of the number of receivers present in the sys- tem (possibly, millions or eventually hundreds of millions), a pair of private/public keys k$_{i}$, K$_{i}$ can be assigned to each satellite S$_{i}$ , with the public key bound to the satellite iden- tity via a certificate provided by a Certification Authority. Each receiver obtains the certified public keys of all satel- lites in order to be able to validate NAV messages digitally signed with the corresponding k$_{i}$ . Navigation Message Au- thentication (NMA) [5] will be available as a GALILEO service. We briefly introduce the GNSS operation and related work in Sec. 2. We discuss the adversary model and specific attack methods in Sec. 3.2. We then present and analyze the three defensive mechanisms in Sec. 4. Our findings support that highly accurate clocks can be very effective at the expense of appropriate clock hardware; but they can otherwise be susceptible, when off-the-shelf hardware is used. Location-based mechanisms can also be defeated relatively easily. On the contrary, our Doppler Shift Test (DST) provides accurate detection of attacks, even against a sophisticated adversary. To further enhance protection, a different public-key NMA approach was proposed in [7]. Each S$_{i}$ chooses a secret spreading code for each NAV message but discloses this, along with a hidden timing marker , in a delayed and authenticated manner to the receiving nodes. If nodes can maintain accurate clocks by means other than the GNSS system alone, they can then safely detect messages that are forged or replayed between the time of their creation and the code disclosure. A similar idea using Secret Spreading Codes (SSC) was presented in [11]. Each GNSS-equipped node V can receive simultaneously a set of navigation messages NAV$_{i}$ from each satellite S$_{i}$ in the visible constellation . Satellite transmitters utilize a spread-spectrum technique and each satellite is assigned a unique spreading code C$_{i}$ . These codes are a priori pub- licly known. Navigation messages allow V to determine its position, loc ( V ) = ( X$_{V}$ , Y$_{V}$ , Z$_{V}$ ), in a Cartesian system, as well global time, by obtaining a clock correction or time offset , t$_{V}$ , also called the synchronization error . At least four satellites should be visible in order for a receiver to compute position and exact time, the so-called PVT (Po- sition, Velocity and Time) or navigation solution [6]. This computation relies on the pseudo-range measurements per- formed by V , one pseudo-range per visible satellite, that is, estimating the satellite-receiver distance based on the esti- mated signal propagation delay, ρ$_{i}$ . For each pseudo-range ρ$_{i}$ estimated at V , the following equation is formed: The location (position) GNSS-equipped nodes obtain can be manipulated by an external adversary, without any ad- versarial control on the GNSS entities (the system ground stations, the satellites, the ground-to-satellite communica- tion, and the receiver). If any cryptographic protection is present, we assume that cryptographic primitives are not breakable and that the private keys of satellites can- not be compromised. The adversary can receive signals from all available satellites (depending on the locations of the adversary-controlled receivers). It is also fully aware of the GNSS implementation specifics and thus can pro- duce fully compliant signals, i.e., with the same modula- tion, transmission frequency equal to the nominal one, f$_{t}$ , or any frequency in the range of received ones, f$_{r}$ ; similarly, transmitted and received signal powers, as well as message preambles and body format (header, content). 3 Attacking GNSS 2 GNSS Overview 2.1 Basic Operation 3.1 Adversary model ρ$_{i}$ = | s$_{i}$ − loc ( V ) | + c · t$_{V}$ (1) We classify adversaries based on their ability to re- produce GNSS messages and signals, considering ones equipped with: The satellite S$_{i}$ position is s$_{i}$ , the receiver position is loc ( V ), c is the speed of light, and t$_{V}$ is the synchronization error for V . $^{2}$To prevent the compromise of a single, system-wide symmetric key, shared among the GNSS and all nodes. 2