Professor Dr. Thomas Pany (Satellite Navigation) has raised funding for the NeedForPRS project as part of the German PRS program and has concluded the study.
Aside from mobile phone operators that manage mobile phone networks with an expanded fiber-optic network without GNSS (global navigation satellite system), there are also mobile phone operators that depend on GNSS. The latter use open GNSS signals for the precise timing and synchronization of individual cell sites. The synchronization of data is a prerequisite for correct data transmission. This project examined the weak points of mobile communications when it comes to spoofing attacks. Spoofing is the falsification of a GNSS signal to mislead the GNSS receiver. Receivers can be misled about time, position or clock drift. For mobile communications, time spoofing is critical as it can render cell synchronization inoperative, which leads to disconnections for mobile phone subscribers. There are various spoofing techniques, all of which were tested in the project. What they all have in common is that the spoofer sends the false signal towards the mobile communications station with higher energy than the real satellite signal.
Left: Cell tower | Middle: Spoofer antenna | Right: Test course, the orange line is the spoofing signal (Galileo E1BC signal). The green line is the genuine signal (Galileo E1ABC signal).
This is done with a directional antenna. Since this and other equipment can be hidden in a cardboard box, for example, an aggressor could place them unobtrusively in a car, for example, in front of a cell site. Since the signal is enhanced, a distance of more than 100 m from the cell site is feasible. For the project, we recreated a base station to determine exactly when disconnections occur. Another aspect of the research project focused on defensive measures against spoofing attacks.
For this purpose, the test setup for sending signals 100 m from one institute building to another was enhanced, particularly the transmitter station. We developed artificial GNSS signals that were emitted on a slightly different medium frequency in order not to interfere with real satellite signals. In our case, software solutions were used as defensive measures. We looked for indications of spoofing in unusual behavior in various parameters during signal processing in the receiver. In addition, the use of Galileo PRS (public related service) was discussed as a solution for mobile communications.
Galileo is a European satellite navigation system that is similar to the American GPS system. PRS is presently under development. Its signals are encoded and therefore better for countering attacks. As certain kinds of spoofing cannot be countered in this manner, however, mobile phone operators are advised to use a combination of PRS and anti-spoofing software.
This project has now been completed.
Project period: 1 January 2018 to 30 November 2019
Funding by: German Aerospace Center, commissioned by the Federal Ministry of Transport and Digital Infrastructure