无参考站分析:针对连通漫游器的RTK参考站欺骗效应研究

UnReference: analysis of the effect of spoofing on RTK reference stations for connected rovers

摘要 Abstract

全球导航卫星系统(GNSS)为广泛的应用场景提供独立精确定位服务。然而,无人驾驶车辆(空中、地面车辆或水面舰艇)等应用或系统通常需要比独立接收机更高的精度水平。实现厘米级精度的最有效且经济的方式是依赖固定参考站接收机提供的校正信息来改善卫星测距测量。差分GNSS(DGNSS)和实时动态定位(RTK)通过在线分发校正流给附近的移动接收机(通常称为漫游器),从而提供厘米级精度。然而,由于参考站的静态特性,它们成为GNSS攻击的主要目标,包括简单的干扰和高级欺骗,具有不同程度的对抗控制和复杂性。干扰参考站会拒绝向漫游器提供校正信息,从而降低精度;而欺骗参考站则会强制其分发误导性的校正信息。因此,所有使用这些校正信息的连接漫游器都将受到敌方的影响,无论其实际轨迹如何。我们利用射频仿真器生成了一系列测试,评估了通用DGNSS/RTK处理库和接收机的鲁棒性。我们测试了干扰和同步欺骗,证明从对抗者的角度来看,针对漫游器的参考站欺骗既有效又方便。此外,我们讨论了漫游器和参考站可以采用的一些可能策略,基于现有的反制措施(位置、导航和时间解算方案的自验证以及自身时钟漂移的监控),以避免使用或分发虚假校正信息。

Global Navigation Satellite Systems (GNSS) provide standalone precise navigation for a wide gamut of applications. Nevertheless, applications or systems such as unmanned vehicles (aerial or ground vehicles and surface vessels) generally require a much higher level of accuracy than those provided by standalone receivers. The most effective and economical way of achieving centimeter-level accuracy is to rely on corrections provided by fixed \emph{reference station} receivers to improve the satellite ranging measurements. Differential GNSS (DGNSS) and Real Time Kinematics (RTK) provide centimeter-level accuracy by distributing online correction streams to connected nearby mobile receivers typically termed \emph{rovers}. However, due to their static nature, reference stations are prime targets for GNSS attacks, both simplistic jamming and advanced spoofing, with different levels of adversarial control and complexity. Jamming the reference station would deny corrections and thus accuracy to the rovers. Spoofing the reference station would force it to distribute misleading corrections. As a result, all connected rovers using those corrections will be equally influenced by the adversary independently of their actual trajectory. We evaluate a battery of tests generated with an RF simulator to test the robustness of a common DGNSS/RTK processing library and receivers. We test both jamming and synchronized spoofing to demonstrate that adversarial action on the rover using reference spoofing is both effective and convenient from an adversarial perspective. Additionally, we discuss possible strategies based on existing countermeasures (self-validation of the PNT solution and monitoring of own clock drift) that the rover and the reference station can adopt to avoid using or distributing bogus corrections.