Comment by MrUnderhill | Hacker News Reader

Comment by MrUnderhill | Hacker News Reader

Parent Full thread

The "GPS 2.0" label used in the article is a bit of a misnomer I think, and possibly just something the author came up with. There is no radically new satellite navigation system described, just some rather superficial mentions of the need for alternative electronic navigation aids to augment satellite navigation (Loran, inertial sensors etc), which are not limited, or directly related, to GPS.

The closest thing to bear a "next gen" GPS label is the new block IIIA satellites, sometimes (officially) referred to as GPS III.

For civilian users, the most notable change in block III is that there will be a signal L2C available on the L2 frequency. With 2 frequencies, you can calculate ionospheric delay, resulting in better accuracy and resilience. Before this, L2 only carried the encrypted military Y code (but L2 could still be used for carrier phase tracking, so industrial non-military GNSS receivers could still make some use of it).

There will also eventually be an improved (backward-compatible) signal on the L1 frequency, and even a 3rd signal on L5. There fundamental system remains the same though, this is more of an evolution than a revolution. E.g, L2C is already available on some block II satellites. For military uses, there are some other interesting changes in block III, notably a new military signal M with a spot-beam antenna that can target a limited area, which is pretty cool.

Russia's GLONASS satellites evolve similarly, with the new 3rd gen K satellites getting more frequencies etc, and using CDMA just like GPS (previously the GLONASS signals used FDMA, i.e. each visible satellite used a different frequency slot). Galileo and BeiDou are also quite similar, but BeiDou is notable for using geostationary and inclined geostationary satellites in addition to regular medium earth orbit satellites (essentially to get improved coverage in Asia). A possibly interesting feature of Galileo is that there may be a "commercial service" signal, i.e. that non-navigational data may be broadcast via the Galileo satellites.

I for one would like to take advantage of the slow deployment of L2C and L1C to change the payload. The program delay is potentially an opportunity to add cryptographically strong authentication to the signal structure. The greatest near-term threat to GPS isn't jamming as mentioned in the article, its spoofing. Strong authentication is the most promising antispoofing defense, and the growing commercial drone industry is going to need it.

You seem to know a lot about this and it always interested me.

How does current GPS prevent from spoofing. My understanding is that only military GPS signals are encrypted. If so, how strong is the encryption? What type it is?

It's not so much that the military signal (ranging code) is encrypted, per se, but it uses a DRNG for which the parameters are kept secret.

To be able to spoof GPS, you need to be able to duplicate the ranging code for a given satellite. This is easy for civilian GPS, where the code repeats ~1000 times/sec and the details are public; much harder for military code where it repeats 1 time/week and the parameters are secret.

You can still jam either one, though, just by overwhelming appropriate frequencies with noise. This is what the spot beam in newer satellites is for -- getting more power to areas of conflict to make the signal harder to jam.

> but it uses a DRNG for which the parameters are kept secret

A standard block cipher running in CTR mode would provide the same functionality. So I don't think its wrong to say that the signal is encrypted.

By this logic, crypt(3) creates encrypted (rather than hashed) passwords, because it can be implemented with DES.

The civilian C/A code isn't protected at all. A modern spoofing attack works by initially providing the target with the same GPS signal that the target is already reading. By "same" I mean phase-correct for that target in that position and time. Then the magnitude of the spoof signal is increased such that the target's tracking loops will follow the spoof signal instead of the real signals. Finally, the spoof signal is slewed in either space or time to drive the target's position or time estimate to where the attacker wants it to be.

There are a few anti-spoofing defenses available right now, but they are either expensive or ineffective. If the target has a high-quality inertial navigation system or clocks, then the slew rate available to the attacker is greatly reduced. There are also some defenses related to DGPS, but they require a separate base station and communication side-channel to execute.

Right now, the hardware cost to deploy an advanced attack like that is relatively cheap, and subject to Moore's Law. A GNU Radio USRP could do it right now, for example. The hardware cost to defend against it is expensive, and not getting any better. Changing the signal structure to incorporate cryptographically strong authentication is the only solution I can see to swing the pendulum back the other way.

Reply on news.ycombinator.com