RAIM and SBAS based Detection of GNSS Spoofing by Timing and Content Consistency Rules

In this paper, we analyze the GNSS spoofing problem from the perspectives of timing and content of GNSS messages. Among various types of GNSS attacks, we focus on the most powerful form of stealthy GNSS spoofing, based on the sequence of Receive, Modification, and Transmission ( RMT) of GNSS messages. When precisely implemented, a RMT based spoofing attack can alter both the timing and content of GNSS messages at will, which can be very difficult for an unprepared regular receiver to detect and reject the bogus messages carried on the L1 channel. To address this open problem, in this work we explore high level software techniques to detect GNSS spoofing based on consistency checking among the timing and content of GNSS messages. We show that one can tailor the RAIM ( Receiver Autonomous Integrity Monitoring) model to detect timing inconsistency provided that at least one authentic GNSS channel is intact. Next, we analyze the SBAS message broadcast system and estimate the challenge in SBAS spoofing. It is clear that it is significantly harder to spoof the timing alone of SBAS channels due to the dynamic content broadcast. Simulation and experiments on the TEXBAT spoofing dataset were conducted to validate the proposed spoofing detection method.