A Comparison of Smartphone GPSL1 and Galileo E1-B/C Spoofing Resilience

Abstract: Location-based services have grown in importance as smartphones, and location-based applications have become an integral part of everyday life. While Global Navigation Satellite Systems (GNSSs) provide the most accurate position determination, open service GNSS signals remain unprotected and susceptible to spoofing attacks. Previous work within the domain highlighted this issue, with many smartphone receivers shown susceptible to GPS L1 spoofing, suggesting that their resilience experiments should be extended to include other GNSS signals in the future. Given that multi-GNSS receivers now have become the norm in smartphones, this thesis investigates whether smartphone GNSS receiver spoofing resilience depends on the type of signal; by conducting a series of comparative spoofing experiments involving GPS L1 and Galileo E1-B/C signals. To conduct the experiments, we developed a Galileo E1-B/C signal simulator that, together with the open-source GPS-SDR-SIM signal simulator, was the basis for conducting a series of experiments designed to identify the potential presence of anti-spoofing measures. The result of our experiments indicates that smartphone multi-GNSS receivers were significantly more resilient towards Galileo E1-B/C spoofing attacks, often accepting GPS L1 signals with significant position, time, and data errors, while refusing to accept corresponding Galileo E1-B/C signals. While we never observed cases of E1-B/C signals being accepted while rejecting GPS L1 signals, external factors limited the scope of the investigation and do not allow a generalized conclusion. As such, to deepen our understanding of these issues and how they relate to the development of anti-spoofing measures and trust in different signals, it is essential to extend this research to include more devices and other GNSS signals.