A GNSS Time Synchronization Attack Detection Method for Commercial Off-the-Shelf Receivers: Cumulative Second-Order Difference of Pseudoranges

The security of time synchronization is crucial in the Internet of Things (IoT), as it enables sensors and actuators to collect and transmit various types of data. However, root and critical nodes in the IoT are typically connected to the global navigation satellite system (GNSS) receivers, increasing the susceptibility of the system to GNSS-based time synchronization attacks (TSAs). When subjected to TSAs, the scheduling and messages of nodes will conflict, especially in distributed IoT systems. To address this issue, a TSA detection method named the cumulative second-order difference of pseudoranges (CD2-P) is proposed in this article. Furthermore, we propose an alarm strategy called CD2-P-alarm based on TSA characteristics. When an attacker tries to manipulate the GNSS receiver’s time, this method can detect the time discrepancy and provide an early warning. This article verifies that the proposed method outperforms the other methods by using software-defined receivers based on the Texas spoofing test battery data set. Compared with the state-of-the-art methods, the proposed method can provide more than a 10% improvement in detection probability. Moreover, the practical applicability of the proposed method on a U-blox receiver and an Android mobile phone is validated through real-world experiments. This indicates that the proposed method can be seamlessly integrated into current commercial receivers without the need for modification. By focusing on processing the output data produced by commercial off-the-shelf receivers, the method effectively increases the real-time security of existing IoT systems.