Abstract
The Global Positioning System (GPS) is commonly used in civilian Unmanned Aerial Vehicles (UAVs) to provide geolocation and time information for navigation. However, GPS is vulnerable to many intentional threats such as the GPS signal spoofing, where an attacker can deceive a GPS receiver by broadcasting incorrect GPS signals. Defense against such attacks is critical to ensure the reliability and security of UAVs. In this work, we propose a signaling game framework in which the GPS receiver can strategically infer the true location when the attacker attempts to mislead it with a fraudulent and purposefully crafted signal. We characterize the necessary and sufficient conditions of perfect Bayesian equilibrium (PBE) of the game and observe that the equilibrium has a PLASH structure, i.e., pooling in low types and separating in high types. This structure enables the development of a game-theoretic security mechanism to defend against the civil GPS signal spoofing for civilian UAVs. Our results show that in the separating part of the PLASH PBE, the civilian UAV can infer its true position under the spoofing attack while in the pooling portion of the PLASH PBE, the corresponding equilibrium strategy allows the civilian UAV to rationally decide the position that minimizes the deviation from its true position. Numerical experiments are used to corroborate our results and observations.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Similar content being viewed by others
References
Amazon.com: Amazon prime air (2017). https://www.amazon.com/Amazon-Prime-Air/b?node=8037720011.Accessed 12 Apr 2017
Casey, W., Morales, J.A., Nguyen, T., Spring, J., Weaver, R., Wright, E., Metcalf, L., Mishra, B.: Cyber security via signaling games: toward a science of cyber security. In: Natarajan, R. (ed.) ICDCIT 2014. LNCS, vol. 8337, pp. 34–42. Springer, Cham (2014). doi:10.1007/978-3-319-04483-5_4
Casey, W.A., Zhu, Q., Morales, J.A., Mishra, B.: Compliance control: managed vulnerability surface in social-technological systems via signaling games. In: Proceedings of the 7th ACM CCS International Workshop on Managing Insider Security Threats, pp. 53–62. ACM (2015)
Crawford, V.P., Sobel, J.: Strategic information transmission. Econom. J. Econom. Soc. 1431–1451 (1982)
Curry, C., et al.: SENTINEL Project-Report on GNSS Vulnerabilities. Chronos Technology Ltd., Lydbrook (2014)
Hein, G., Kneissl, F., Avila-Rodriguez, J.A., Wallner, S.: Authenticating GNSS: proofs against spoofs, Inside GNSS 2(5), 58–63 (2007). part 2
Humphreys, T.: Cockrell school researchers demonstrate first successful spoofing of UAVs (2012). https://www.engr.utexas.edu/features/humphreysspoofing. Accessed 5 Apr 2017
Infrastructure, Transportation: Vulnerability assessment of the transportation infrastructure relying on the global positioning system (2001)
Kartik, N.: Strategic communication with lying costs. Rev. Econ. Stud. 76(4), 1359–1395 (2009)
Kashyap, A., Basar, T., Srikant, R.: Correlated jamming on mimo gaussian fading channels. IEEE Trans. Inf. Theor. 50(9), 2119–2123 (2004)
Khalil, H.K.: Nonlinear Systems. Prentice Hall, Upper Saddle River (2002)
Kuhn, M.G.: An asymmetric security mechanism for navigation signals. In: Fridrich, J. (ed.) IH 2004. LNCS, vol. 3200, pp. 239–252. Springer, Heidelberg (2004). doi:10.1007/978-3-540-30114-1_17
Ledvina, B.M., Bencze, W.J., Galusha, B., Miller, I.: An in-line anti-spoofing device for legacy civil GPS receivers. In: Proceedings of the 2010 International Technical Meeting of the Institute of Navigation, pp. 698–712 (2001)
Mailath, G.J.: Incentive compatibility in signaling games with a continuum of types. Econom. J. Econom. Soc. 1349–1365 (1987)
Noe, T.H.: Capital structure and signaling game equilibria. Rev. Financ. Stud. 1(4), 331–355 (1988)
Papadimitratos, P., Jovanovic, A.: GNSS-based positioning: attacks and countermeasures. In: Military Communications Conference, MILCOM 2008, pp. 1–7. IEEE (2008)
Pawlick, J., Zhu, Q.: Strategic trust in cloud-enabled cyber-physical systems with an application to glucose control. IEEE Trans. Inf. Forensics Secur. (2017)
Pozzobon, O.: Keeping the spoofs out: signal authentication services for future GNSS. Inside GNSS 6(3), 48–55 (2011)
Raya, M., Manshaei, M.H., Félegyházi, M., Hubaux, J.P.: Revocation games in ephemeral networks. In: Proceedings of the 15th ACM Conference on Computer and Communications Security, pp. 199–210. ACM (2008)
Sagduyu, Y.E., Berry, R., Ephremides, A.: MAC games for distributed wireless network security with incomplete information of selfish and malicious user types. In: International Conference on Game Theory for Networks, GameNets 2009, pp. 130–139. IEEE (2009)
Schmidt, D., Radke, K., Camtepe, S., Foo, E., Ren, M.: A survey and analysis of the GNSS spoofing threat and countermeasures. ACM Comput. Surv. (CSUR) 48(4), 64 (2016)
Shepard, D.P., Bhatti, J.A., Humphreys, T.E., Fansler, A.A.: Evaluation of smart grid and civilian UAV vulnerability to GPS spoofing attacks. In: Proceedings of the ION GNSS Meeting, vol. 3 (2012)
Wang, J., Tu, W., Hui, L.C., Yiu, S., Wang, E.K.: Detecting time synchronization attacks in cyber-physical systems with machine learning techniques. In: 2017 IEEE 37th International Conference on Distributed Computing Systems (ICDCS), pp. 2246–2251. IEEE (2017)
Warner, J.S., Johnston, R.G.: A simple demonstration that the global positioning system (GPS) is vulnerable to spoofing. J. Secur. Adm. 25(2), 19–27 (2002)
Wesson, K., Rothlisberger, M., Humphreys, T.: Practical cryptographic civil GPS signal authentication. Navigation 59(3), 177–193 (2012)
Wikipedia: Cheap talk — wikipedia, the free encyclopedia (2017). https://en.wikipedia.org/w/index.php?title=Cheap_talk&oldid=771947821. Accessed 4 Apr 2017
Wullems, C., Pozzobon, O., Kubik, K.: Signal authentication and integrity schemes for next generation global navigation satellite systems. In: Proceedings of the European Navigation Conference GNSS (2005)
Xu, Z., Zhu, Q.: A cyber-physical game framework for secure and resilient multi-agent autonomous systems. In: 2015 IEEE 54th Annual Conference on Decision and Control (CDC), pp. 5156–5161. IEEE (2015)
Xu, Z., Zhu, Q.: A game-theoretic approach to secure control of communication-based train control systems under jamming attacks. In: Proceedings of the 1st International Workshop on Safe Control of Connected and Autonomous Vehicles, pp. 27–34. ACM (2017)
Zhu, Q., Basar, T.: Game-theoretic methods for robustness, security, and resilience of cyberphysical control systems: games-in-games principle for optimal cross-layer resilient control systems. IEEE Control Syst. 35(1), 46–65 (2015)
Zhu, Q., Fung, C., Boutaba, R., Basar, T.: A game-theoretical approach to incentive design in collaborative intrusion detection networks. In: International Conference on Game Theory for Networks, GameNets 2009, pp. 384–392. IEEE (2009)
Acknowledgement
This research is partially supported by NSF grants CNS-1544782, CNS-1720230 and the DOE grant DE-NE0008571.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
A Appendix
A Appendix
1.1 A.1 Appendix A: Proof of Lemma 1
Proof
Since we require \(\frac{d \alpha _z(t_z)}{d t_z}\ge 0\), the strategy \(\alpha _z(t_z)\) in the separating portion must satisfy \(\alpha _z(t_z)> s^*_z(t_z) = \frac{t_z}{1+\rho }\). Suppose that \(\alpha _z\) is constant on some interval \(\varPhi \subseteq (t^s_z,t^l_z))\), then there exists some type \(t_z\in \varPhi \) such that S can send a signal \(s_z(t_z+\delta )\) with \(\delta >0\) indicating a slightly higher type \(t_z+\delta \in \varPhi \) without inducing the additional deception cost, which contradicts the hypothesis of separating equilibrium in Lemma 1; therefore, \(\alpha _z\) is strictly increasing on \((t^s_z, t^l_z)\); thus, \(\alpha _z \in (t^m_z, t^M_z)\) for any \(t_z \in (t^s_z, t^l_z)\).
The incentive compatibility of SPBE requires that for any \(t_z\in (t^s_z, t^l_z)\), \(\alpha _z(t_z) \in \arg \min _{s_z} \ C^{S,z}(t_z, t_z, s_z).\) (8) is obtained by differentiating \(C^{S,z}(t_z, t_z, s_z)\), which can be done only if \(\alpha _z(t_z)\) is differentiable. In order to prove that \(\alpha _z(t_z)\) on \((t^s_z, t^l_z)\), we first prove that \(\alpha _z(t_z)>\arg \min _s C^{D,z}\) and \(\alpha _z(t_z)\) is continuous for all \(t_z\in (t^s_z, t^l_z)\).
We prove \(\alpha _z(t_z) >s^*_z = \frac{t_z}{1+\rho }\) for all \(t_z\in (t^s_z, t^l_z)\) in two steps as follows.
Step 1: Suppose \(\alpha _z(\bar{\tau }_z) = s^*_z(\bar{\tau }_z)=\frac{\bar{\tau }_z}{1+\rho }\) for some \(\bar{\tau }_z\in (t^s_z, t^l_z)\). Then, \(C^{D,z}_2(t_z, \alpha _z(\bar{\tau }_z)) = 0\). Let \(\delta >0\) be a position constant with small enough \(| \delta |\). Let \(U(\delta )\) be the expected change in the cost for type \( \bar{\tau }_z - \delta \in (t^s_z, t^l_z)\) by changing from \(\alpha _z(\bar{\tau }_z-\delta )\) to \(\alpha _z(\bar{\tau }_z)\). Then,
Since \(C^{A,z}(\bar{\tau }_z, \bar{\tau }_z-\delta )<C^{A,z}(\bar{\tau }_z-\delta , \bar{\tau }_z-\delta )\) and \( C^{D,z}(\bar{\tau }_z-\delta , s^*_z(\bar{\tau }_z-\delta ))\le C^{D,z}(\bar{\tau }_z-\delta , \alpha _z(\bar{\tau }_z-\delta ))\), \(U(\delta )<0\), which implies that S strictly prefers to use the strategy \(\alpha _z(\bar{\tau }_z)\) when the type is \(\bar{\tau }_z -\delta \); this means that S uses the strategy \(\alpha _z(\bar{\tau }_z)\) for both type \(\bar{\tau }_z -\delta \) and type \(\bar{\tau }_z \), which contradicts the hypothesis of SPBE for \(\bar{\tau }_z\). Thus, \(\alpha _z(\bar{\tau }_z)\ne s^*_z(\bar{\tau }_z)\).
Step 2: Suppose there exists a \(\hat{\tau }_z\in (t^s_z, t^l_z)\) such that \(\alpha _z(\hat{\tau }_z)<s^*_z(\hat{\tau }_z)<\hat{\tau }_z\). From (8), we have \(\frac{d \alpha _z(\hat{\tau }_z)}{d \hat{\tau }_z}<0\). Thus, the strict monotonicity of \(\alpha _z(t_z)\) gives that \(\alpha _z(\hat{\tau }_z-\delta )>\alpha _z(\hat{\tau }_z)\) for all \(\delta >0\). Then for small enough \(\delta >0\), we have \(C^{D,z}(\hat{\tau }_z-\delta , \alpha _z(\hat{\tau }_z))<C^{D,z}(\hat{\tau }_z-\delta ,\alpha _z(\hat{\tau }_z-\delta ))\). Also, we have \(C^{A,z}(\hat{\tau }_z, \hat{\tau }_z-\delta )< C^{A,z}(\hat{\tau }_z-\delta , \hat{\tau }_z-\delta )\). As a result, \(C^{S,z}(\hat{\tau }_z, \hat{\tau }_z-\delta , \alpha _z(\hat{\tau }_z)) < C^{S,z}(\hat{\tau }_z-\delta , \hat{\tau }_z-\delta , \alpha _z(\hat{\tau }_z-\delta ))\). Therefore, S prefers to use the same strategy \(\alpha _z(\hat{\tau }_z)\) for \(\hat{\tau }_z-\delta \) as for \(\hat{\tau }_z\), which contradicts the hypothesis of SPBE for \(\hat{\tau }_z\). Thus, Step 1 and 2 yield that \(\alpha _z(t_z)> s^*_z(t_z)\).
Now we prove the continuity of \(\alpha _z(t_z)\) on \(t_z\in (t^s_z, t^l_z)\). Suppose that there exists a discontinuity point at some \(\textit{t}_z\in (t^s_z, t^l_z)\). Let \(\alpha _z(\textit{t}_z)> \lim _{t_z\rightarrow \textit{t}_z^-}=\hat{\alpha }_z\). Then,
Since \(\alpha _z\) is strictly increasing and \(s^*_z(\textit{t}_z)\le \hat{\alpha }_z<\alpha _z(\textit{t}_z)\), we also have
Therefore, the cost of \(\alpha _z(\textit{t}_z-\delta )\) is less than \(\alpha _z(\textit{t}_z)\); thus, S prefers to use the same strategy \(\alpha _z(\textit{t}_z-\delta )\) for \(\textit{t}_z\) as for \(\textit{t}_z-\delta \) for small enough \(\delta >0\), which contradicts the hypothesis of SPBE. Similar proof for the case \(\alpha _z(\textit{t}_z)< \lim _{t_z\rightarrow \textit{t}_z^+}=\hat{\alpha }_z\) can show that S prefers to use the same strategy \(\alpha _z(\textit{t}_z+\delta )\) for \(\textit{t}_z\) as for \(\textit{t}_z+\delta \) for small enough \(\delta >0\), contradicting the SPBE. Therefore, \(\alpha _z(t_z)\) is continuous on \((t^s_z, t^l_z)\).
Based on the same argument of the Proposition 2 in the Appendix of Mailath’s work in [14] (also see the proof of [9]), \(\alpha _z\) is differentiable. Therefore, Lemma 1 is proved.
1.2 A.2 Appendix B: Proof of Theorem 1
In this part, we prove that there exists a unique solution on \([\hat{t}, t^M_z]\) to (8) with initial condition \(\alpha ^*_z(t^M_z) = t^M_z = \hat{s}_z(t^M_z)\) and \(\frac{d \alpha ^*_z(t_z)}{d t_z}>0\).
Proof
Step 1: Local uniqueness and existence
Let \(B_z(t_z, s_z)\) be the inverse initial value problem and let \(\eta _z(s_z)\) be the solution of \(B_z(t_z, s_z)\). Then,
From the definition of \(C^{S,z}\), \(B_z \) is Lipschitz continuous on \(T\times T\). Then, from the existence and uniqueness theorems [11], we can find some \(\delta >0\) such that \(\hat{s}_z(t_z)-\delta \ge s^*_z(t_z) = \frac{t_z}{1+\rho }\) and there exists a unique solution \(\hat{\eta }_z\) to (16) on \([\hat{s}_z(t^M_z)-\delta , \hat{s}_z(t^M_z))\), and \(\hat{\eta _z}\) is continuously differentiable on \([\hat{s}_z(t^M_z)-\delta , \hat{s}_z(t^M_z))\). From the definition of \(\hat{s}_z(t^M_z)\), we have \(B_z(t^M_z, \hat{s}_z(t^M_z))>0\), \(B_z(t^M_z, s^*_z(t^M_z))=0\) and \(\hat{s}^{-1}_z(t^M_z) = \frac{1}{\hat{s}_z(\hat{s}^{-1}_z(t^M_z) )}>0\); \(\delta \) can be small enough such that \(s_z<\hat{s}_z(\hat{\eta }_z(s_z))\) for all \(s_z\in (\hat{s}_z(t^M_z)-\delta , \hat{s}_z(t^M_z)))\); and thus \(\hat{\eta }'_z(s_z)>0\). Let \(\hat{\alpha }_z = \hat{\eta }^{-1}_z\) be a solution to 8 on \((\breve{t}_z, t^M_z]\) for some \(\breve{t}_z <t^M_z\) with \(\frac{d \hat{\alpha }_z}{d t_z}>0\). Since the solution \(\hat{\eta }_z\) to the inverse initial value problem is locally unique, the solution to the initial value problem (8) is locally unique.
Step 2: Suppose \(\hat{\alpha }_z\) is the a solution to (8) with initial condition \(\alpha ^*_z(t^M_z) = t^M_z = \hat{s}_z(t^M_z)\) and \(\frac{d \alpha ^*_z(t_z)}{d t_z}>0\), on \((t'_z, t^M_z]\). Let \(\bar{\alpha }_z = \lim _{t_z\rightarrow t'_z} \hat{\alpha }_z\). As been proved above, \(\hat{\alpha }_z > s^*_z(t_z)\) for all \((t'_z, t^M_z]\), and \(\bar{\alpha }_z\ge s^*_z(t_z)\). Suppose \(\bar{\alpha }_z = s^*_z(t_z)\). Then, \(C^{S,z}_3 = 0\), which yields \(\lim _{t_z\rightarrow t'_z} = \infty \). Let \(\zeta = \sup _{t_z\in [t'_z, t^M_z]} (s^*_z(t_z))' = \frac{1}{1+\rho }<\infty \). Since \(\hat{\alpha }'_z(t^M_z)>0\) exists, there exists a \(t^{''}_z>t'_z\) such that \(\alpha _z(t^{''}_z)>\zeta \) for all \(t_z\in [t'_z, t^{''}_z]\). Let \(\epsilon > 0\) such that \(\hat{\alpha }_z(t^{''}_z)>s^*_z(t^{''}_z)+\epsilon \). Since \(\bar{\alpha }_z = \lim _{t_z\rightarrow t'_z} \hat{\alpha }_z\), it follows
which contradicts that \(\bar{\alpha }_z = s^*_z(t_z)\). Therefore, we have \(\bar{\alpha }_z > s^*_z(t_z)\).
If the solution \(\hat{\alpha }_z(t_z)\) is well defined on \((t'_z, t^M_z]\) with \(\lim _{t_z\rightarrow t'_z} \hat{\alpha }_z(t_z)>t^M_z\), then \(-\frac{C^{S,z}_1}{C^{S,z}_3}\) is Lipschitz continuous and bounded in a neighborhood of \(( \bar{\alpha }_z, t'_z)\). According to the existence and uniqueness theorems, there exists a unique differentiable solution \(\hat{\alpha }_z\) to (8) on \(( t'_z- \epsilon ', t^M_z]\) for some \(\epsilon '>0\) with \(\lim _{t_z\rightarrow t'_z- \epsilon '} \hat{\alpha }_z(t_z) > s^*_z(t'_z- \epsilon ')\) for \(t'_z \in (t^m_z, t^M_z)\).
Clearly, \(\hat{t}_z = \sup \{\hat{\tau }_z: \hat{\alpha }_z \text { is well defined on} \,(\hat{\tau }_z, t^M_z]\}\), and setting \(\hat{\alpha }_z(\hat{t}_z )= t^m_z\) finishes the proof of Theorem 1.
Rights and permissions
Copyright information
© 2017 Springer International Publishing AG
About this paper
Cite this paper
Zhang, T., Zhu, Q. (2017). Strategic Defense Against Deceptive Civilian GPS Spoofing of Unmanned Aerial Vehicles. In: Rass, S., An, B., Kiekintveld, C., Fang, F., Schauer, S. (eds) Decision and Game Theory for Security. GameSec 2017. Lecture Notes in Computer Science(), vol 10575. Springer, Cham. https://doi.org/10.1007/978-3-319-68711-7_12
Download citation
DOI: https://doi.org/10.1007/978-3-319-68711-7_12
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-68710-0
Online ISBN: 978-3-319-68711-7
eBook Packages: Computer ScienceComputer Science (R0)