A Feasibility Study and Risk Assessment of Security Code Estimation and Replay (SCER) Attacks

The scope of the paper is to evaluate security code estimation and replay (SCER) attacks for GNSS signals. In the last years, many authentication methods have been presented to verify at the receiver that the incoming signal comes from the satellite. The authentication proposals can be divided in those that suggest the encryption of the navigation data, those that suggest the encryption of the spreading code sequence, and those that suggest a combination of both techniques. However, these techniques are still vulnerable against SCER attacks, which uses the estimation of the signal components in order to know the encrypted code and if required, modify it before retransmitting the signal. The primary goal of the investigation is to assess the feasibility of those attacks when applied on civil GNSS signals equipped with authentication features on spreading code level. For this purpose, different estimation techniques are taking into account and applied on different signal modulations received on different carrier to noise densities to illustrate the potential threat. For demonstration purposes, a parabolic dish antenna with a diameter of 2.4 m, which provides an antenna gain of 30 dBi, is used to illustrate the threat in real conditions. Furthermore, antenna arrays are also evaluated as alternative to using high-gain parabolic antennas. The scope of the current assessment is to define criteria and design drivers for future authentication components for open service users that are robust and resistant against attacks based on estimation and retransmission of partial or full encrypted spreading sequences.