One of the most significant innovations of the last 50 years is the Global Positioning System (GPS). I was first introduced to GPS when I joined Stanford Telecommunications, Inc. (STel) in 1978. STel made some of the first GPS receivers in the world, and one of its founders (Dr. Jim Spilker) was a key contributor in developing the GPS signal format. GPS, along with its augmentations and evolutionary upgrades, has been a part of my career for more than 40 years.
Initially conceived as a navigation and timing system for the military, GPS has now affected our lives in ways that its developers could never have imagined. Today, GPS is used in precision agriculture, timing for cellular phone systems, golf, E911 emergencies, generating cryptographic keys for financial transactions, tracking continental drift, watching magma reservoirs bulge under volcanoes, measuring atmospheric weather parameters, and navigation of self-driving cars (to name just a few applications). Without a doubt, GPS (and similar systems provided by other nations) has been a boon to human civilization and supports a large and diverse array of applications.
Unfortunately, as our reliance on GPS has grown, so too has our sensitivity to its corruption. Simple failure or loss of signal is well-known, and most engineers and users are familiar with these impairments. But what of signal “corruption” – so-called “spoofing”, and malicious cyber attacks designed to create false reports of position or time? Forty years ago, many engineers and most users thought such attacks against GPS were either physically impossible, or so technically challenging that they could be safely ignored. Those people were wrong.
As early as the 1990’s, the Department of Defense was looking for ways to spoof (fool) civilian GPS receivers that might be in the hands of an enemy. I remember considering a bid on such a study contract (I declined to submit a bid).
In 2012, Tyler Nighswander and his colleagues, at Carnegie Mellon Univ. and Coherent Navigation, successfully demonstrated several devastating internet- and software-based attacks against GPS receivers – in one case, permanently disabling a GPS receiver using nothing but a spoofed data message that the receiver accepted as genuine.
In 2017, at an industry conference in Portland, Oregon, an accidental spoofing event was linked to an unshielded simulator. It affected numerous cell phones, including one type that experienced a “time error” that invalidated various internet security certificates.
UT professor Todd Humpreys has successfully spoofed small UAVs as well as an $80M superyacht, causing them to be led astray (note: these demonstrations were performed with safety protocols in place, and yacht officers were aware and ready to take manual control if needed). The necessary spoofing hardware was relatively low-cost.
Assisted-GPS (A-GPS) and differential data links – a key element of many high-accuracy applications we all rely on daily (including location-enabled cell phone apps and aircraft navigating in the national airspace) — provide a “back door” for malicious actors if they can pose as the authorized provider of the assistance and/or correction data.
As we become more dependent on GPS, its vulnerabilities become more glaring and the consequences of a malicious attack become greater. A multi-layered defensive strategy is needed. Luckily, industry and Government agencies are starting to wake up to the threat.
For the receiver manufacturers, more rigorous software testing is needed to ensure that malicious attacks are identified by the receiver operating system and rejected. For the GPS industry as a whole, working with Government agencies, there is a need for operating and performance standards emphasizing data integrity and authentication. The legacy GPS navigation message does not contain any meaningful authentication features for the GPS downlink signals accessible by the civilian community, and no way to introduce such features (although the military P(Y) code could potentially be leveraged as a watermark in special cases). On the other hand, the modernized signals (which are now available on many GPS satellites) contain protocol features that could be leveraged to introduce several useful authentication features (although they are not used that way today). By working together to standardize and implement authentication features for GPS’s civil signals, some of the most significant vulnerabilities to GPS can be addressed – and we can prevent a potentially devastating attack (or sequence of attacks) on a par with 9/11.
Beyond the spoofing of a “victim” GPS receiver and the impact of such an attack on the host vehicle or user, there is the issue of validating a GPS report from a user – for example, a position report from an aircraft in flight, or a ship at sea, or an E911 call from a cellular user in distress. While some data links used to report a location may be encrypted for privacy – such as cellular data links — there is no special feature that ensures the underlying GPS data is truthful. This opens another back door for malicious actors who might be interested in e.g. spoofing a traffic management system or faking the true location of a vehicle (with the cooperation of the vehicle operator) to mask a crime. Typical crimes of this sort can include relatively minor crimes such as evading road taxes, or more serious crimes such as illegal fishing in protected waters or smuggling. As with the spoofing of a “victim” receiver discussed above, there are known techniques that can be applied to identify common methods of deception and increase our confidence in the underlying data – we have only to take the initiative to apply them.
Over the coming decade, I expect the GPS industry and Government agencies to take a stronger position in protecting the integrity of the GPS broadcast signals, the assisted- and differential data links that are integral to many of today’s applications, and GPS position reports generated by users. While many useful ideas and technologies are already known, more innovation is certainly possible and expected. In my opinion, this will be an area of intense research and development; and potentially, a fruitful domain of new intellectual property.
Steve was one of our beloved Exclusive Experts for over a decade. He loved working with and through Round Table Group and sent all his cases to be managed by RTG. All of us at Round Table Group will miss him.
Dr. Heppe had over 40 years of experience in the area of telecommunications, electrical engineering, radio/radar, unmanned aircraft, and GPS/GNSS with General Electric Space Division, Stanford Telecommunications, Telenergy, Insitu/Boeing, and independent consultancies.
Our agriculture expert witnesses, speakers, and consultants include scholars and industry professionals whose areas of expertise include agricultural economics, agricultural policy, farm animal health, crop science, genetically modified plants, food safety, public health, business marketing and management, chemical toxicology, environmental contamination, mammalian reproduction, forest management practices, and recycling systems. Our agriculture experts have worked with the Centers for Disease Control, the Environmental Protection Agency, public health departments, and other agencies and have experience in personal injury/product liability, product evaluation and performance, patents dealing with agricultural equipment and grounds maintenance equipment, and other areas.
New ideas, devices, or methods that generate value or a customer will pay to acquire are known as innovations. In today’s business economy, innovations are essential. It is important these innovations can be replicated economically and fill a specific need.
Software is the programs that make it possible for a computer to complete specific tasks. There are two categories of software. Systems software consists of the computer’s operating system and utilities that allow the computer to function. Without this type of software, the instructions for everything would have to be typed in each time it was used. Application software lets the user do specific tasks, such as word processing and spreadsheets. These programs need to be loaded into a computer’s storage.
Software development is the process of visualizing, detailing, designing, programming, documenting, testing, and fixing bugs. Software developers are the creative minds in charge of the entire development process from beginning to end.
Software engineering is the engineering division that develops software products using scientific methods, standards and techniques to create effective and dependable products. By studying the user’s needs when designing, building, and testing new applications, software engineers can achieve their goals of satisfying the user’s needs and create software that is used in offices, schools, and homes every day for work, education, and fun.
Technology is the use of science or knowledge to solve problems or invent useful tools. The advantages of modern technology are easy access to information, promotes creativity and invention, improve communication, productivity, and efficiency. Mechanical technology includes wheels, levers, gears, engines, and belts. Electronic technology like computers and washing machines use electricity to accomplish a goal. Industrial and Manufacture technology is used to create a product. For instance, robots used to manufacture automobiles. Medical technology like MRIs and ventilators help diagnose, prevent and treat disease.