/ / 8:24 AM THU AUG 4, 2016
GPS security is increasingly implicated in both physical and information security: from steering a super-yacht (or a super-tanker) into pirate-friendly waters to diverting self-driving cars or even unlocking geo-tagged tokens and AR game objectives.
GPS receivers compare timestamped signals from a constellation of satellites, inferring their position through calculations on the lightspeed lag from each signal. Faking the signal from these distant satellites with nearby spoofing stations isn’t trivial, but it’s not transcendentally hard, either — and there’s plenty of reason to suspect that it will get easier, thanks to faster, cheaper computers, carried by autonomous vehicles (both ground- and air-based).
Detecting a spoofed GPS signal is hard. The computational load associated with cryptographic signatures on the signal is high, and the inability to interact with the sending satellites makes it impossible to use a challenge-response protocol where the receiver generates a random number, signs it with the satellite’s public key, sends it to the satellite and then gets it back from the satellite signed with the sat’s private key, then sets up a one-time session key.
Other tactics for validating signals involve direction-detection (raising the bar on spoofers, who’d have to physically array their fake base-stations in spatially plausible locations — think of a cluster of drones) and distortion-detection.
But both of these tactics have easily imagined countermeasures, and both are difficult/costly to implement.
The US military has an encrypted, hardened GPS system for its own use, but that is also potentially vulnerable, and in any event, they’re not interested in sharing.
