% !TEX root = ../toptesi-scudo-example.tex
% !TEX encoding = UTF-8 Unicode
%*****************************************************************
%*********************** Sixth chapter ***************************
%*****************************************************************

%%%%% CHAPTER 6. Interference Threats to GNSS in Service Robotics %%%%%
\chapter{Interference Threats to GNSS in Service Robotics}\label{InterferenceThreats}

% ********************** Define Graphics Path ********************
    \graphicspath{{Chapter8/}}

\par The chapter presents the work carried out towards the thesis to study interference threats to GNSS receivers. In the first section, an assesment of the vulnerability of different COTS GNSS receivers is carried out by tests in an anechoic chamber. A more detailed analysis is carried out in the next section, presenting the effects of spoofing in raw GNSS measurements of Android smartphones. The last section presents an arguement for cooperative positioning as a defence against interference.


\section{Overview and Assessment of Vulnerability}\label{Overview_and_Assessment_of_Vulnerability}

\par In recent years, mass-market applications relying on user positioning has increased significantly increase and as a consequence, more precise and reliable services are demanded. However, due to the weakness of GNSS signals, the GNSS receiver performance could be easily disrupted by anthropogenic disturbances, i.e. jamming and spoofing. The swept-frequency jamming signal is a typical intentional Radio Frequency Interference (RFI) that can be broadcasted by the Personal Privacy Devices (PPDs) with carrier frequency varying over the GNSS bands. Whereas the spoofing refers to the transmission of counterfeit GNSS like signals, with the intention to generate false position at the victim receivers without disrupting the GNSS receiver operation.

\par The countermeasures for the threats of jamming and spoofing have been extensively discussed and proposed in the literatures \cite{dovis2015gnss,borio2016impact}. The new generation of the high-end GNSS receivers already start to integrate RFI detection and mitigation units based on advanced signal processing techniques to counteract jamming signals at Intermediate Frequency (IF) level before the correlation process performed. Some of the extensively investigated pre-mitigation techniques including Adaptive Notch Filtering \cite{borio2008two,qin2019comparison} and Wavelet Packet Decomposition \cite{musumeci2014use}. Compared to the jamming disturbance which could significantly influence parameters at the receiver level thus allowing easy detection, the spoofing disturbance challanges the detectors as the receiver operation is not interrupted.

\par Depending on the features of the spoofing characteristics and complexity, it is possible to classify the spoofing disturbance into three categories: simplistic, intermediate and sophisticated \cite{dovis2015gnss,manfredini2014validation}. The simplistic spoofing is the one chosen to test in the experimental scenarios which is technically possible to be counteracted since the time flag of the spoofing signal is not strictly synchronized with the real GNSS signals. However, being the design of most of the mass-market navigation unit driven by low-cost, low-power, small-size requirements, they hardly implement anti-jamming and anti-spoofing techniques that would increase the complexity of the system. As of today, the risks induced by jamming and spoofing are not yet perceived as a major, widespread, threat. Therefore, it is worth investigating the impairment of these anthropogenic disturbances on the low-cost positioning and navigation units integrated in the mass-market receivers and further to estimate their resilience to the attacks. In this regard, two classes of navigation unit designed for drones and a smartphone with integrated GNSS units are selected for the assessment. Previous assessment of drones in an anechoic chamber has been performed in \cite{farlik2016detectability} and \cite{farlik2019multispectral}.

\par Several experimental scenarios were designed in this work to estimate the effects of the jamming and spoofing. The tests are performed in an anechoic chamber with realistic jammer and spoofer employed to generate disturbances on the GNSS L1 signal transmitted by a signal generator. Performance of the different drones under the intentional disturbances are examined.

\subsection{Experimental Setup}

\subsubsection{Jamming Scenario}

\par Figure \ref{fig:2.testbenchblock} presents a generic block diagram for the setup to carry out interference tests on GNSS receivers. GNSS inputs (top left of the figure) and interference inputs (bottom left of the figure) are combined to be fed to the front end of GNSS receivers or broadcasted directly through an antenna in a controlled scenario. An overall experimental setup in the anechoic chamber for the test scenarios carried out in this work is shown in Figure \ref{fig:1.setup}.

\begin{figure}[!hbt]
\centering
\includegraphics[width=0.85\textwidth]{testbenchblock.png}
\caption{Generic block diagram of interference test setup}
\label{fig:2.testbenchblock}
\end{figure}

\begin{figure}[!hbt]
\centering
\includegraphics[width=0.85\textwidth]{1.setup.pdf}
\caption{Experimental setup in the anechoic chamber.}
\label{fig:1.setup}
\end{figure}

Dual GPS frequency signals, i.e. L1 and L5 are intentionally configured and broadcasted by a signal simulator through a transmitting antenna in the anechoic chamber. Three types of drones, including a popular commercial drone and a customized drones with PX4 autopilot \cite{meier2015px4} were tested under different jamming and spoofing scenarios for sake of comparison. Henceforth, these drones are referred as UAV1 and UAV2 respectively. The estimation is based on the output of the devices under jamming and spoofing disturbances. Furthermore, a commercial GNSS receiver is used as a benchmark for data collection and PVT estimation for comparison purpose. The linear chirp signals varying over the GPS L1 band are generated by a “commercial” jammer with additional variable attenuation to control the output power level. A low-cost spoofer implemented by using a HackRF One front-end \cite{HackRF} with Software-Defined GPS signal simulator is employed to simulate the spoofing signals. The test scenario for the jamming investigation is defined decreasing the attenuation of the jammer along time. 

\begin{figure}[!hbt]
\centering
\includegraphics[width=0.85\textwidth]{3.jamming.pdf}
\caption{Parameters of the commercial receiver under jamming activities.}
\label{Fig:3.jamming}
\end{figure}

\par The first 4 minutes are under the clean simulated GNSS signals, in absence of any jamming signals. Starting from the 5th minute, the jammer is switched on to broadcast linear chirp signals over GPS L1 bands as disturbances. %The experimental settings of the scenario is listed in \ref Table I. 
With the variable attenuator, the power level of the output chirp signals is increased at a step of 5 dB every 3 minutes during the test. The jamming activities of the test scenario can be easily noticed by checking the commercial receiver (benchmark) performance as depicted in Figure \ref{Fig:3.jamming}. The values on the top of the figure stands for the attenuation level in dBs. A smaller value of the attenuation refers to a stronger power level of the jamming signal. It can be seen in the figure how the jamming activity influence the receiver. The estimated position by the benchmark receiver is shown in Figure \ref{Fig:4.jamming2}. A noticeable degradation of the performance appears around the 11th minute when the total attenuation of the jamming signal changed to 40 dB, reflecting the resistance of the benchmark receiver towards the jamming signals.

\begin{figure}[!h]
\centering
\includegraphics[width=0.85\textwidth]{4.jamming2.pdf}
\caption{Estimated position of the commercial receiver as benchmark.}
\label{Fig:4.jamming2}
\end{figure}

\subsubsection{Spoofing Scenario}
\par The spoofing investigation scenario is defined along 10 minutes of simulated signals. In the first 2.5 minutes, clean simulated GNSS signals with coordinates 48.1715N, 11.808E (Poing, Germany) are transmitted in absence of any spoofing signals. Following this first phase, the HackRF One frontend is switched on with running Software-Defined GPS signal simulator, thus to broadcast spoofing signals over GPS L1 band in order to force the receiver to compute the position with coordinates 48.17878N, 11.79368E, which is 1.3 km away from the initial location. The spoofing activities lasted for 5 minutes before stopped and followed by
another 2.5-minutes with only clean simulated signals.

\subsection{Analysis of the RFI Effects on the Navigation Performance}

\subsubsection{Under Jamming}
\par For UAV 1, the position obtained from the GPS unit and the IMU unit are shown respectively in Figure \ref{Fig:6.pos1} and Figure \ref{Fig:7.pos2}. 

\begin{figure}[!h]
\centering
\includegraphics[width=0.85\textwidth]{6.pos1.pdf}
\caption{Estimated position by GPS unit from UAV 1 under jamming}
\label{Fig:6.pos1}
\end{figure}

\begin{figure}[!h]
\centering
\includegraphics[width=0.85\textwidth]{7.pos2.pdf}
\caption{Estimated position by IMU unit from UAV 1 under jamming}
\label{Fig:7.pos2}
\end{figure}

\begin{figure}[!h]
\centering
\includegraphics[width=0.85\textwidth]{8.pos3.pdf}
\caption{Estimated position by GPS unit from UAV 2, no data are avilable after 8th minute.}
\label{Fig:8.pos3}
\end{figure}

As it can be seen, the commercial drone shows very similar performance compared to the performance of the benchmark receiver in terms of the resistance to the jamming activities. Other parameters from the sensors have also been evaluated. However, no significant influence is monitored due to the presence of the jammer. This is expected due to the physical nature of the sensors and are not affetcted by RFI. However, compared to UAV 1, UAV 2 is more vulnerable to the jamming activities. UAV 2 is only capable to obtain the position in the first 7 minutes and when the attenuation is smaller than 45 dB, operations are interrupted and no data collection is available, as depicted in Figure \ref{Fig:8.pos3}.



\subsubsection{Under Spoofing}
\par The performance of UAV 1 and UAV 2 has been assessed in the spoofing scenario, and results are reported in Figure \ref{Fig:9.spoof1} and Figure \ref{Fig:10.spoof2} for the two UAVs respectively, for the entire experiment period. 

\begin{figure}[!h]
\centering
\includegraphics[width=0.85\textwidth]{9.spoof1.pdf}
\caption{Estimated position by GPS unit from UAV 1 under spoofing}
\label{Fig:9.spoof1}
\end{figure}

\begin{figure}[!h]
\centering
\includegraphics[width=0.85\textwidth]{10.spoof2.pdf}
\caption{Estimated position by GPS unit from UAV 2 under spoofing.}
\label{Fig:10.spoof2}
\end{figure}

\par It can be seen that starting from the 3rd minute, the spoofing signal started to affect the UAV 2 followed by a sudden change to the spoofed location. However, UAV 1 shows more resistance to the spoofing signals but still slightly drifting to the spoofed location in the end. Furthermore, after the 8th minute, even though the spoofer was switched off and only the clean simulated signal was transmitted, the coordinates of both UAV 1 and UAV 2 were still affected. This impact of the spoofed estimations continues because the previous erroneous estimation of the UAV status propagates in the possible Kalman filter (KF) of the Autopilots. The test scenario indicates that although the two drones have different resistance to the spoofing signal, they can still be easily spoofed.

%xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

\section{Spoofing Effects on Raw GNSS measurements}\label{Spoofing_Raw_GNSS_Measurements}

%%change the introduction a bit on introducing UAV/UGV comparisons
\par A comparative analysis of the resilience of Android\textsuperscript{\texttrademark} domain to intentional disturbances is performed in this section. The experimental work presented hereafter provides one of the first investigations on the use of a portable spoofer to threaten Android\textsuperscript{\texttrademark} smartphones. The portable low-cost spoofer has been developed, based on open source signal generator and low-cost electronics and radio-frequency equipment and then used to carry out spoofing attacks on different Android\textsuperscript{\texttrademark} smartphones \cite{rustamov2020assessment}.

\par Some demonstrations of spoofing against Google Android\textsuperscript{\texttrademark} OS are presented in \cite{zeng2017practical} with realistic spoofing and fake Google Maps\textsuperscript{\texttrademark} integration. This work demonstrated that spoofing might impact the device's navigation unit affecting in turn a popular Location Based Service (LBS). Since the version 7 onwards of Android\textsuperscript{\texttrademark} OS gives access to raw GNSS measurements, it can be exploited to study and detect the effect of spoofed signals in applicable smartphones. The raw GNSS measurements may include internal clock measurements like the time of signal reception, clock drift, clock discontinuities, etc. and the GNSS receiver measurements such as received GNSS satellite time, Doppler frequency, carrier phase measurements, constellation status, navigation messages, etc. \cite{developerandroid} . More recently, the Google Service Framework\textsuperscript{\texttrademark} also provides Automatic Gain Control (AGC) measurements in its Android\textsuperscript{\texttrademark} location modules with the release of Android\textsuperscript{\texttrademark} Android Application Program Interface (API) 9.0. However, not all the GNSS chipsets or software of the different Android\textsuperscript{\texttrademark} devices are compatible with such measurements and the quality of the raw GNSS measurements vary between device to device \cite{Gogoi_2018,sunkevic2017using}.

\subsection{Test Devices}

\par Following the direction of testing the chosen simplistic portable spoofing methodology on consumer GNSS devices, three different commercial smartphones were chosen among those equipped with Google Android\textsuperscript{\texttrademark} 8 Operating System (OS). These are detailed in Table \ref{tab:smartphones} and are referred to as S1, S2 and S3 respectively in the following analysis. In order to identify and procure GNSS raw measurements, the GNSS Logger Android application provided by Google\textsuperscript{\texttrademark} was installed in the android devices. The devices PVT solutions were logged through the Android application NMEA tools, which provides the GNSS raw position of the smartphone in standard NMEA format. Figure \ref{fig:labSetup} shows the set-up of different Android\textsuperscript{\texttrademark} devices and the transmitting antenna of the developed spoofer. Additionally, a commercial GNSS receiver was also used as a benchmark for data collection and PVT estimation.

%TABLE
\begin{table}[]
\centering
\caption{Devices under test.}
\begin{tabular}{@{}llll@{}}
\toprule
ID & Model    & System on cheap (SOC)   & GNSS chipset \\ \midrule
S1 & S 8     & Qualcomm Exynos 8890    & BCM 4774      \\
S2 & MI 8     & Qualcomm Snapdragon 845 & BCM 47755     \\
S3 & MI 8 PRO & Qualcomm Snapdragon 845 & BCM 47755     \\ \bottomrule
\end{tabular}
\label{tab:smartphones}
\end{table}



%FIGURE

\begin{figure}[h!]
\centering
\includegraphics[width=0.8\columnwidth,trim={0cm 0cm 0cm 0cm},clip]{setup_v2.jpg}
\caption{{Experimental setup consisting of a HackRF One, (1) equipped with an L1 stick antenna, (2), a Raspberry PI 4B, (3) a u-blox\textsuperscript{\texttrademark} Neo-M8N GNSS, (4) with an active GNSS antenna, (5) and a set of smartphones, (6) listed in Table \ref{tab:smartphones}.}}
\label{fig:labSetup}
\end{figure} 

\par The raw GNSS measurements of the smartphones were processed on the MATLAB\textsuperscript{\textregistered}\textsuperscript{\textregistered} GPS measurement-tools software\footnote{Apache Licence 2.0 (http://www.apache.org/licenses/LICENSE-2.0)} \cite{gCoGnss}. For the purpose of this paper, the following raw measurements are mainly analysed to test the effects of spoofing:


    \paragraph{Carrier-to-Noise Density Ratio ($C/N_0$)}:  It is a basic indicator of received satellite signal quality. Abrupt variations to it can indicate the presence of interference while an unnaturally high value could also indicate presence of a fake satellite signal.
    
    \paragraph{Automatic Gain Control (AGC)}: The AGC implementation in a smartphone acts as a variable gain amplifier adjusting the power of the incoming signal. Changes in the value are typically indicative of power fluctuations of the input signal in the frequency band foreseen this measurement \cite{developerandroid}. AGC is extremely useful in detecting spoofing attacks and has been used in the past to detect defective signals \cite{bastide2003automatic}.
    
    \paragraph{Time of Signal Transmission and Reception}: The GPS Time of signal Transmission, $t_{TX}$, is demodulated from the received signal and used to compute the pseudorange from the particular satellite along with The Time of signal Reception, $t_{RX}$, which is taken either from the cellular or Wi-Fi network in the smartphone. A remarkable difference in the two timestamps could indicate an altered $t_{TX}$ data coming from a spoofed signal or a faulty satellite. Generally, it is in the range of $60-100$ ms.


\subsection{Spoofing Scenario}\label{sub:scenario_phones}
\par A 15-minutes spoofing scenario was tested in a controlled outdoor environment with open sky conditions. By acting on the HackRF One transmitting power, the range of the spoofer antenna was kept to within 1-3 m to not provide any disturbance beyond the range of the controlled environment. The smartphones were positioned at a location with coordinates 45.064406 N, 7.661922 E (Turin, Italy) starting UTC time of February 11, 2020, 14.21.41  and for the first 5 minutes, they received live GNSS signals without any other interference. Then the portable spoofer was switched on, broadcasting spoofing signals over GPS L1 band with coordinates 45.470111 N, 9.179874 E (Milan, Italy) and UTC time February 10, 2020, 12.00.00 which was 144 km away from the test location. The spoofing signals were broadcasted for 5 minutes after which the spoofer was switched off. For the remaining duration, the smartphones received only live GNSS signals. The u-blox\textsuperscript{\texttrademark} Neo-M8N GNSS receiver was used for cross validation of the test measurements.

\begin{table}[]
\centering
\caption{Satellite Subsets}
\begin{tabular}{@{}ll@{}}
\toprule
Subset  & SV ID Number            \\ \midrule
Real    & 24,25,28,19,17,15,13,12 \\
Fake    & 8,16,27                 \\
Common  & 10,20,32                \\ \bottomrule
\end{tabular}
\label{Satellite_database}
\end{table}

\par 14 GPS satellites were considered in the overall scenario. As seen in Table \ref{Satellite_database}, the satellites could be divided into three different subsets. The first subset (Real) consists of the real in-view Satellite Vehicle Identifiers (SV IDs) which were received by each device and not part of the satellites transmitted by the spoofer. The second subset (Fake) consists of the SV IDs which were transmitted by the spoofer and visible to all the smartphones, but their real counterparts were not in view during the test period [8, 16, 27]. The third subset (Common) consists of the overlapping Satellite Vehicle (SV) IDs which were both in-view real time and transmitted by the spoofer as well [10, 20, 32]. The overall satellite skyplot during the test is shown in Figure \ref{fig:skyplot}.

\begin{figure}
\centering
\includegraphics[width=0.8\columnwidth,trim={3.5cm 1.1cm 2cm 1.2cm},clip]{Skyplot_v2.eps}
\caption{{Sky-plot showing real and spoofed satellite signals}.}
\label{fig:skyplot}
\end{figure} 

%xxxxxxxxxxxxxxxxx
\subsection{Results and Analysis}\label{sec:results}
\par The subsection is roughly divided based on the effect of the spoofing described in Section \ref{sub:scenario_phones} on GPS L1 GNSS raw measurements of the three different subset of satellites. The data analysed is from smartphone S3 but similar results were also achieved with S2. GNSS raw measurement could not be retrieved from S1 after the spoofer was turned on. The effect on position computation of the smartphone as retrieved from the Android location API was also analyzed, as reported in the following. The u-blox\textsuperscript{\texttrademark} Neo-M8N receiver position shifted to the coordinates provided by the spoofer within 1 minute from the start of the spoofing action, thus, validating the effectiveness of the attack.

\subsubsection{Effect on Real satellites}

\par Figure \ref{fig:Real_sat_2} compares the $C/N_0$ and pseudoranges of two real SV IDs during the entire test period with SV ID 24 and 25 being at high and low elevations respectively. Naturally this will affect their signal strength and pseudorange distance as seen in the Figure \ref{fig:skyplot}. It is clear that the spoofer acts as a source of interference over the L1 frequency band disturbing the healthy satellites during the spoofing timespan and tracking of low elevation satellites being lost. This effect is seen for the L1 signals of  constellations as well.

%FIGURE
\begin{figure}[h!]
\centering
\includegraphics[width=\columnwidth,trim={1.2cm 0.6cm 1cm 0cm},clip]{figure_4_new.eps}
\caption{{Effect on real satellites (SV ID 24 and 25) during the  test duration.}}
\label{fig:Real_sat_2}
\end{figure} 


%FIGURE 2
%\begin{figure}[h!]
%\centering
%\includegraphics[width=\columnwidth,trim={1cm 0.6cm 1cm 0cm},clip]{fig/Real_sat_1.eps}
%\caption{{\small Effect on real satellites (SV ID 24 and 25) during the  test duration }.}
%\label{fig:Real_sat_1}
%\end{figure} 

\subsubsection{Fake and Real satellites comparison}

\par Figure \ref{fig:fake_sat_1} plots the AGC dB values of the S3 GNSS receiver during the test period. It is observed that the effect of turning on the spoofer is similar to what in-band jamming or interference would do. Due to the presence of powerful spoofing signals, the receiver reduces the amplification of the incoming sign which, while disturbing real signals, allows fake signals to be easily acquired. This is clear when comparing the $C/N_0$ of a fake (SV ID 16) and real signal (SV ID 24) in Figure \ref{fig:fake_sat_2}. An important difference captured between the two satellite signals is the $t_{TX}$, whose values in a real signal was within the standard 100 ms of the $t_{RX}$ throughout the test, while fake signals had $t_{TX}$ and $t_{RX}$ difference values over $10^5$ seconds. This naturally gives a hugely and unrealistic pseudorange value for the fake satellite. Nevertheless, it has to be remarked that no effect is experienced on the time provided, since the connected device is kept synchronised to the communication network infrastructure (cellular or Wi-FI).

%FIGURE
\begin{figure}[h!]
\centering
\includegraphics[width=\columnwidth,trim={1cm 0cm 1cm 0.5cm},clip]{figure_5_new.eps}
\caption{{Effect of Spoofing on AGC}.}
\label{fig:fake_sat_1}
\end{figure} 

%FIGURE
\begin{figure}[h!]
\centering
\includegraphics[width=\columnwidth,trim={1cm 0cm 1cm 0.5cm},clip]{figure_6_new.eps}
\caption{{Comparison of Fake (SV ID 16) and Real (SV ID 24) satellite's $C/N_0$ }.}
\label{fig:fake_sat_2}
\end{figure} 

\subsubsection{Effect on Common satellites}

\par Figure \ref{fig:common_sat_2} plots the effect of spoofing on the $C/N_0$, Pseudorange and Carrier phase measurements of a Common satellite (SV ID 10) present among the live satellites and in the set of spoofed signals. It can be seen that the receiver does not acquire the fake satellite signal with the same SV ID during the spoofing timespan and only looses acquisition of the real signal. It reacquires the real satellite after spoofing stops as also seen by the carrier phase measurement.

%FIGURE
\begin{figure}[h!]
\centering
\includegraphics[width=\columnwidth,trim={1cm 1cm 1cm 1cm},clip]
{figure_7_new.eps}
\caption{{Common Satellite (SV ID 10) analysis}.}
\label{fig:common_sat_2}
\end{figure} 

\subsubsection{Effect on Smartphone GNSS Position Estimation}

\par Figure \ref{fig:position_plot} shows the error in position of the ECEF coordinates of the three different smartphones during the test. The spoofing time span is delayed compared to the previous plots as NMEA Tools app was initialised before GNSS Logger app. It can be seen that spoofing achieves only a few metres of deviation in the position output of the GNSS receiver which can be attributed to the loss of some satellites due to interference. It can be speculated that the smartphones maintain their true position with the help of multi-constellation, multi-frequency GNSS capabilities along with network positioning and other sensors. It is interesting to notice that S1 carries the Broadcom\textsuperscript{\texttrademark} BCM 4774 chipset without dual frequency GNSS capabilities and it is affected the most, comparatively.


%FIGURE
\begin{figure}[h!]
\includegraphics[width=\columnwidth,trim={1cm 0.5cm 1cm 0cm}, clip]
{figure_8_new2.eps}
\caption{{Effect on Smartphone GNSS Position}.}
\label{fig:position_plot}
\end{figure} 

\section{Cooperative Positioning as an Interference Defence}\label{Cooperative_Positioning_Anti_Spoofing}
%\par This research is directed by work on collaborative positioning and the framework already developed.............
%\subsection{Cooperative Positioning and Spoofing}
%\label{sub:coopFramework}
\subsection{Background and Scenarios}\label{sub:coopFramework}
\par CP framework can encapsulate additional monitoring to avoid current and  next-gen-type  attacks to the positioning and navigation units. The work presented in \cite{Gogoi_2019} opened the investigation to the DGNSS-CP based on the inter-device range from GNSS raw measurements between two Android devices within a communication framework. The availability of cooperative algorithms applied to the GNSS pushed researchers to design new framework to cope for the limitations of traditional PNT approaches. The DGNSS-CP framework investigated in this work ideally supports the exchange of raw GNSS measurements among multiple receivers interconnected by 4G LTE or Wi-Fi connectivity executed through an Android application. The measurements are hence synchronized through a Doppler compensation technique \cite{wang2018pedestrian} and the inter-agent distance is computed through a differential GNSS approach \cite{zeng2012gps}. 

\par The DGNSS-CP framework presented by the authors acts according to the following steps for each PVT epoch, $t_k$

\begin{enumerate}
\item Agent $\mathbf{A}$ sends to $\mathbf{T}$ its set of raw pseudorange measurements ${\bm{\rho}_{A}(t_k)}$ and the estimated position $\hat{\mathbf{x}}_A(t_k)$ with an associated timestamp $t_k$
\item Agent $\mathbf{A}$ aligns the external set of measurements retrived from $\mathbf{T}$  ${\bm{\rho}_{A}(t_k)}$, to the closest set of measurements locally dumped.
\item Agent $\mathbf{A}$ combines the local and external pseudorange measurements through differential method to determine the inter-agent distance between $\mathbf{A}$ and $\mathbf{T}$
\item Agent $\mathbf{A}$ integrates such $\mathbf{A}$-$\mathbf{T}$ inter-agent distance  w.r.t. the position of  $\mathbf{T}$ (consistent) along with local pseudorange measurements within its navigation algorithm (i.e. Extended Kalman Filter (EKF)) 
\item The position estimation of $\mathbf{A}$ is generally improved by the additional information carried by the set of pseudorange measurements shared by other receivers and it is not expected to show any particular drift \cite{8926529}.
\end{enumerate}

\par Technical details concerning the implementation of the framework can be found in \cite{8891571,minetto2018tight,Minetto:2019:GCP:3331054.3331552} and a proof-of-concept applied to Android smartphones was developed within the ESA project HANSEL.

\par The aforementioned DGNSS-CP framework is prone to be fooled by malicious attacks at different stages of the GNSS processing chain  
\begin{itemize}
    \item \textbf{Signal domain}: performed through the transmission of RF signals. %according to the description provided in \ref{sub:spoofignAttacks}. DEFINE THEM LATER
This approach induces the tracking of the fake signals to an aiding receivers, thus the computation of fake pseudorange measurements, and in turn, of a fooled PVT estimation of both aiding and aided receivers. A scheme of the attack is provided in Figure \ref{fig:attack_modes}.
    \item \textbf{Measurements domain} This approach acts by replacing the measurements transferred to the server of a CP client-server architecture, as in Figure \ref{fig:attack_modes}, or performing a man-in-the-middle attack, to ideally perform a "virtual" spoofing/meaconing attack as shown in Figure \ref{fig:attack_modes}.
\end{itemize}

\par An attack pursued in any of this domains induces similar effects on the final positioning estimation but a proper distinction is worth to distinguish the typology of attack between \textit{classical spoofing/meaconing} and \textit{cyber-attack}. The latter are indeed less related to the receiver architecture and mostly focused on the system/network.  With the control over sharing of specific information between the devices and availability of synchronization strategy, some strategies will be proposed to detect the presence of spoofing in one or multiple networked GNSS receivers devices. Therefore, the possibility to imprint such an algorithm to COTS GNSS receivers on other networked operating platforms can open several possibilities oriented to spoofing attacks such as in networked Unmanned Aerial Vehicles (UAVs) and Unmanned Ground Vehicles (UGVs).

\begin{figure*}[!htbp] 
    \centering
  \subfloat[\label{fig:attack_A}]{%
       \includegraphics[width=0.32\linewidth,trim={7cm 4cm 7cm 4cm},clip]{attack_A.pdf}}
  \subfloat[\label{fig:attack_B}]{%
        \includegraphics[width=0.32\linewidth,trim={7cm 4cm 7cm 4cm},clip]{attack_B.pdf}}
          \subfloat[\label{fig:attack_C}]{%
       \includegraphics[width=0.32\linewidth,trim={7cm 5.2cm 7cm 4cm},clip]{attack_C.pdf}}
  \caption{{Schemes of possible attacks performed through a GNSS-based CP framework. Filled squares represent fake measurements provided by $S$ while white squares are nominal measurements provided by $A$.}}
  \label{fig:attack_modes} 
\end{figure*}

\subsection{Experimental Tests}
\label{sec:Tests}

\par The following scenarios were defined to investigate potential countermeasures to the malicious attacks against GNSS. 

\subsubsection{Scenarios 1: Test on static Android Smartphones}
\label{sub:scenario1}
\par For the primary test, two different commercial smartphones (with Broadcom$^\text{\textregistered}$ BCM47755 GNSS chipsets) were chosen for testing the effect of a simplistic spoofing attack performed through the portable spoofer %described in Section \ref{Methodology} REMEMBER TO ADD THIS SPOOFER METHODOLOGY LATER%
on consumer GNSS receivers. Both of the devices, denoted as S1 and S2 respectively further in this work are equipped with Google Android\textsuperscript{\texttrademark} 9 Operating System (OS) and the GNSS Logger Android application provided by Google\textsuperscript{\texttrademark} was installed in them for identification and procurement of GNSS raw measurements. A 800 seconds spooﬁng scenario was tested in a controlled outdoor environment with open sky conditions. During the test, the devices were located at a distance of 10 meters apart, where S1 was places next to the spoofer to explore the effect of interference and S2 was kept 10 meters away to avoid the risk of spoofing under open sky conditions. The range of the spoofer was kept to around 2 meters and in order to prevent any radio-frequency interference (RFI) disturbances beyond the range of the controlled environment a 10 dB attenuator was used and inserted to the coaxial cable to reduce transmitting signal power levels. Both smartphones actual locations were around the coordinates 45.06 N, 7.66 E (Turin, Italy). During the ﬁrst 120 seconds of the test, both devices received live GNSS signals without any other interference. Then the portable spoofer was switched on, broadcasting spooﬁng signals over GPS L1 band with coordinates 45.755664 N, 4.831035 E (Lione, France) with S1 in its range. The spooﬁng signals were broadcasted for 500 seconds after which the spoofer was switched off. For the remaining duration, both devices received only live GNSS signals.
\par In general, 16 GPS satellites were considered during the test. The satellites could be divided into three different group. The first subgroup (Real) consists of real-time Satellite Vehicle Identifiers (SV IDs) received by each device and not part of the satellites transmitted by the spoofer. The second subgroup (Fake) consists of SV IDs that were broadcasted by the spoofer and available to all smartphones, but their real equivalents were not displayed during the test [15, 19, 24]. The third subgroup (Common) consists of concurrent Satellite Vehicle (SV) IDs which were both in-view in real time and transmitted by the spoofer [10, 14, 32].


%The PVT solutions of the devices were logged through the Android application NMEA tools, which provides the GNSS raw position of the smartphone in standard NMEA format.

\subsubsection{Scenarios 2: Simulated meaconing attack in multi-agent vehicular scenario}
\par This section presents a preliminary investigation of a simulated meaconing attack affecting one agent being part of a multi-agent network. The meaconing aims at forcing the computation of the inter-agent distance (a.k.a. baseline length) by using fake pseudorange measurements provided by a spoofer chosen among the available agents. 
The simplistic scenario is composed of 3 agents within a multi-agent network:

\begin{itemize}
\item	The target ($\mathbf{T}$) (the kinematic agent which is expected to benefit from cooperation)
\item	The aiding agent $\mathbf{A}$ (a further kinematic agent providing pseudorange measurements)
\item	The spoofer ($\mathbf{S}$) (an agent generating pseudorange measurements related to its own position but to be used to fake the contribution of $\mathbf{A}$ to $\mathbf{T}$).
\end{itemize}

\par According to the nominal steps recalled about the cooperative framework in Section \ref{sub:coopFramework}, the following considerations about this specific attack hold if $\mathbf{S}$ overwrites the pseudorange measurements transmitted by $\mathbf{T}$ but not its reference position. Formally

\begin{itemize}
\item Agent  $\mathbf{A}$ simply receives a packet composed by the position of $\mathbf{T}$ and the measurements of $\mathbf{S}$
\item Agent  $\mathbf{A}$ aligns the external set of measurements of $\mathbf{S}$ to the closest (in time) set of measurements dumped locally
\item Agent  $\mathbf{A}$ combines the local and external pseudorange measurements through some differential method (i.e. DD) to determine the inter-agent distance between  $\mathbf{A}$ and $\mathbf{S}$
\item Agent  $\mathbf{A}$ integrates this inter-agent distance A-$\mathbf{S}$ w.r.t. the position of $\mathbf{T}$ (inconsistent) along with local pseudorange measurements within its navigation algorithm 
\item The position estimation of $\mathbf{A}$ is “generally degraded” by the additional information and it diverges from the standalone GNSS solution
\end{itemize}


	 
	 
\subsection{Results and Analysis}\label{Results:Coop_Spoof}

\par After presenting a validation of the spoofing scenario at Section \ref{sub:scenario1}, the results and analysis section is roughly  split into following parts. The first part, Sections \ref{sub:Validation} and \ref{sub:ValidationAndroid} deals with the comparison of GNSS raw measurements between the two connected and synchronized devices in order to build up an effective anti-spoofing strategy. The second part, Section \ref{sub:AttacksCP} firstly presents the results of a meaconing test on the CP framework chosen for this work and then the advances to the framework which could be made to identify spoofing attacks.

\subsubsection{Validation of Spoofing Attack}
\label{sub:Validation}
\par The u-blox\textsuperscript{\texttrademark} Neo-M8N GNSS receiver was used for cross validation of the test measurements during the primary test. Figure \ref{PVTublox} shows the change in geodetic coordinates of the u-blox GNSS receiver during the test . It can be seen that the receiver has no defence against the simplistic spoofing attack with the latitude, longitude  and altitude changing to that of the spoofed coordinates hence validating the spoofing mechanism employed on a regular COTS device. 

\begin{figure} [h!]
\centering
\includegraphics[scale=0.4]{PVTublox.eps}
\caption{{Effect of spoofing interference on u-blox\textsuperscript{\texttrademark} Neo-M8N receiver.}}
\label{PVTublox}
\end{figure}

\par In another tertiary test replicating the same spoofing attack methodology on S1, S2 and an added smartphone S3, it was seen that the positions of the smartphones were not spoofed by the spoofer broadcasted signals. It has to be noted that the equipment and RF spoofing signal is identical in this test and could not be carried out along with the main tests due to logging problems of NMEA and GNSS raw measurements data simultaneously.There was a slight meter of deviation in the positions during the spoofing period, displayed on the left of Figure \ref{fig:ECEF} which shows the variation in the Earth-Centered Earth-Fixed (ECEF) Z coordinate from the reference chosen, as an example. These few metres of deviation in the position output of the Android devices can be attributed to the loss of some satellites due to interference as will be seen later and it can be roughly visualized on the right of the Figure \ref{fig:ECEF} which shows number of satellites acquired during the time period. The vertical doted line in the figure corresponds to the start of the spoofing period. It can be speculated that the smartphones maintain their true position with the help of multi-constellation, multi-frequency GNSS capabilities along with network positioning and other sensors. It is also interesting to notice that S3 carries the Broadcom\textsuperscript{\texttrademark} BCM 4774 chipset without dual frequency GNSS capabilities and it is affected the most, comparatively. This is seen to be due to the spoofing signals acting as an interference on the L1 band, hence hampering reception of low-quality signals. The smartphones hence inherently have a robustness to such simplistic spoofing attacks due to it being an accumulation of multiple sensors, connected networks and complicated positioning algorithms. This however does not mean that the spoofed signals aren't acquired, but only that the PVT computation of Android location API ignores the spoofed signal measurements. With a multitude of Android applications being developed in recent times utilizing GNSS raw measurements directly, the simplistically spoofed signals being acquired and tracked in Android devices pose a significant threat. Therefore, an analysis of the acquired Android Raw GNSS Measurements of smartphones under and without a spoofing attack simultaneously follows.  

 \begin{figure} [h!]
\centering
\includegraphics[scale=0.4]{ublxposition_plot.eps}
\caption{{Effect of spoofing on: a) Earth-Centered Earth-Fixed (ECEF) Z coordinate (left) and b) GNSS L1 satellite availability in Android smartphones (right).}}
\label{fig:ECEF}
\end{figure}

\subsection{Analysis of Android Raw GNSS Measurements of the two devices}
\label{sub:ValidationAndroid}

\subparagraph{Time and Ephemeris considerations:}

\par In Android Smartphones, the GNSS time of signal transmission of each satellite is demodulated from the received signal and presented as a raw measurement used to compute the pseudorange for that particular satellite along with the time of signal reception. However, the latter is taken either from the cellular or Wi-Fi network in the smartphone and hence it has not been possible to affect the reception time with GNSS spoofed signals. Considering the clock biases, since the general difference between the two time stamps falls in the range of 60 - 100 ms, a remarkable difference in the two timestamps could directly indicate the possibility of a spoofed signal. To generate real time spoofed signals consistent with GNSS time, the scope of the work goes beyond simplistic spoofing. A few of the current Android GNSS devices also support demodulation of the GPS navigation message and present them as a string of numbers to be converted into a binary form. Processing this message for the two different phones showed a clear distinction between satellites of the different subgroups in terms of GPS Time of Week (TOW) and this can be an alternate check to time inconsistency between two devices to detect a simplistic spoofing attack. The resistance of the spoofed device to not acquire the Common subgroup of spoofed satellites as presented in \cite{rustamov2020assessment} meant however that the same satellite ID could not be compared between two devices at the same time where one device tracks the spoofed satellite and the other tracks the real one. Further, the limitation of most commercial Android phones to not provide the navigation message and the inability to provide navigation messages of other constellations makes this approach very narrow and situational. 

\subparagraph{$C/N_0$ and $AGC$ comparisons:}

\par Figure \ref{fig:cn0_sat} compares the S1 (under spoofing attack) and S2 (without spoofing attack) GNSS receiver $C/N_0$  values of various SV IDs during the spoofing test duration. The SV IDs are represented by their PRN numbers on the plot. On the left side of the figure, looking at the $C/N_0$ time trend of the Real and Common subset of satellites over time (SV ID ), it can be seen that it is affected drastically during the spoofing period between 120-620 seconds. It is clear that the spoofer acts as a source of interference over the L1 frequency band disturbing healthy satellites during the spoofing time span with tracking of low elevation satellites being lost at times (PRN 27). This effect is seen for the L1 signals of other constellations as well. The Fake subgroup of satellites appear as expected when the spoofing starts and has a consistent high $C/N_0$ value corresponding to the static nature of both the spoofer and the Android device. In contrast, the right side of the figure presents the normal behavior of $C/N_0$ values in the Android device under no spoofing attack. This introduction of noise by the spoofer results in the disturbance of the PVT solution of the GNSS receiver in the device, as seen in the test of Figure \ref{fig:ECEF} regardless of the spoofed satellites not being included in the solution computation. Figure \ref{fig:agc_sat} plots the $AGC$ amplification/attenuation value (in dB) of the S1 (left) and S2 (right) devices during the test period. It is observed that the effect of turning on the spoofer is similar to what in-band jamming or interference would do. Due to the presence of powerful spoofing signals, the receiver reduces the amplification of the incoming sign which, while disturbing real signals, allows fake signals to be easily acquired. This is clear when comparing the S1 and S2 of a fake and real signal.

%FIGURE
\begin{figure}[h!]
\centering
\includegraphics[scale=0.5, clip=true,width=0.99\linewidth]{allCN0.eps}
\caption{{Effect spoofing on Signal-to-noise ratios with (left) and without (right) spoofing during the  test duration.}}
\label{fig:cn0_sat}
\end{figure} 

 

%FIGURE
\begin{figure}[h!]
\centering
\includegraphics[scale=0.5, clip=true,width=0.99\linewidth]{allAGC.eps}
\caption{{Effect spoofing on  $AGC$ with (left) and without (right) spoofing during the test duration.}}
\label{fig:agc_sat}
\end{figure} 



\subparagraph{$AGC$ to $C/N_0$ Ratio:}
\par In \cite{inproceedings2017Multipath} \cite{inproceedings2018Spoofing} analyzed correlation between various metrics such as power monitoring,  multiple-correlation tap, maximum-likelihood multipath estimator for distinguishing GNSS spoofing, jamming or multipath effects. To build towards a simpler anti-spoofing strategy an attempt is made to narrow the dimension of GNSS raw observations. For $AGC$, depending on the front-end quantization of a receiver it affects the $C/N_0$ with different sensitivities \cite{bastide2003automatic} and COTS receivers generally have lower bit quantizations. Hence building on the correlation, a parameter equating to the $AGC$ to  $C/N_0$ ratio of its absolute values is observed. Across different Android smartphones, slightly different levels of $AGC$ and $C/N_0$ are observed depending on the front-end and digital signal processing blocks on similar test conditions. Hence this parameter standardizes the power of a signal at the receiver to an extent taking into account the only variable available in Android devices currently to consider the front-end stage.  Identifying the $AGC$ to $C/N_0$ response of the receiver’s front-end to RFI events, we could be able to draw a threshold that will allow us to discriminate between jamming events and spoofing attacks.
While spoofing attack lead to a drop of the $AGC$ when they appear within the band, the way they are generated are different because of their respective nature. For a non-intentional RFI attack, the signal is not consistent with the satellite and noise is added to the targeted GPS band, which leads to a drop of the $C/N_0$ of the tracked signal. Conversely, during a spoofing attack the signal is generated to look like a GPS signal. Thus, it increases the power of the carrier signal and so, it leads to a raise of the $C/N_0$ value. Figure \ref{fig:AGC_CN0} displays this ratio  parameter in the phones S1 and S2 on the left and right respectively. The nature of this parameter can be seen to be similar during periods of non interference in both devices and upon the spoofing period, there is a stark contrast between spoofed and non spoofed PRNs. The parameter is put to test for different test datasets as well considering jamming and multipath conditions (on the left and right respectively) in Figure \ref{fig:JAM_MULT}. A threshold considering either the direct value or its change with respect to time between different PRNs is to be presented as future work. Considerations will have to be made for utlizing a wider range of Android devices as well as interference power levels.


\par There are further metrics to be explored as well which will be presented in future works. For example, GNSS signal authenticity verification technique using carrier phase double differences as presented in \cite{jahromi2016gnss} was considered but due to poor quality of results and limitation to experiment datasets, it could not be presented in this paper.


%FIGURE
\begin{figure}[h!]
\centering
\includegraphics[scale=0.5, clip=true,width=0.99\linewidth]{AGCtoCN0New.eps}
\caption{{$AGC$ to $C/N_0$ ratio values with (left) and without (right) spoofing during the test.}}
\label{fig:AGC_CN0}
\end{figure}

\begin{figure} [h!]
\centering
\includegraphics[scale=0.4]{jamMULTIPAT.eps}
\caption{{Effect of different RFIs: a) jamming effect (left) and b) multipath (right) in Android smartphones.}}
\label{fig:JAM_MULT}
\end{figure}


\subsubsection{Spoofing Attacks in a Cooperative Positioning Framework}
\label{sub:AttacksCP}

\subparagraph{Meaconing attack in multi-agent vehicular scenario:}

\par Spoofing Attacks in a CP Framework are referred to the spoofing scenario of Figures \ref{fig:attack_B} and \ref{fig:attack_C} discussed in Section \ref{sub:coopFramework}. This test is presented to highlight the potential effects of a meaconing attack and to propose potential countermeasures against this novel threats to positioning and navigation for next-gen networked receivers. A realistic simulation over a Bernoullian trajectory was performed through a MATLAB Software receiver named NavSAS SWRx on top of IFEN-generated signals. We can see that cooperative positioning of the meaconed solution, in Figure \ref{fig:fullAttack} is remarkably altered w.r.t. the GNSS standalone estimation, in Figure \ref{fig:noAttack}. It is worth noticing that the trajectory shape is roughly preserved when measurements are faked and additional measurements from exteroceptive or proprioceptive sensors are required to inform the user that a different trajectory is followed. By comparing GNSS standalone and cooperative solutions, the receiver of agent $\mathbf{A}$  can detect an anomaly in the navigation solution because the the collaborative PVT diverges w.r.t. to the GNSS standalone estimation, still preserving a considerable precision. The navigation system cannot trust the cooperative submodules and it can inhibit the use of auxiliary measurements.
 
\begin{figure*}[!htbp] 
    \centering
  \subfloat[\label{fig:noAttack}]{%
       \includegraphics[width=0.49\linewidth,trim={0cm 0cm 0cm 0cm},clip]{plainCoopNavigation_noSkyplot.eps}}
  \subfloat[\label{fig:fullAttack}]{%
        \includegraphics[width=0.49\linewidth,trim={0cm 0cm 0cm 0cm},clip]{meaconedCoopNavigation_noSkyplot.eps}}
  \caption{{Nominal cooperative PVT estimation \ref{fig:noAttack} and the distortion effect of a \textit{promiscuous cyber-attack} performed by inducing the overwriting the measurements of a generic aiding agent $A$, \ref{fig:fullAttack}}}
  \label{fig:CP_spoofingEffect} 
\end{figure*}


\par In order to design robust CP algorithm using ranging measurements the target $\mathbf{T}$ (or the server, if a client-server architecture is considered) has first to assess the consistency of reference position and pseudorange measurements to exclude the contribution of Agent T (which is faked by S) and inhibit the  $\mathbf{A}$-$\mathbf{T}$ cooperation which could limit the reliability of the solution.

\begin{figure}[h!]
\centering
\includegraphics[scale=0.5]{MeaconingDetectionByRawMeasDD.png}
\caption{{Meaconing detection By raw measurements}}
\label{fig:singleDiff}
\end{figure} 

\subparagraph{Attack and detection through collaborative measurements combination:}

\par An advanced detection method can be designed by looking through the processing chain of the collaborative measurements to look at the effect of combining a set of locally-estimated pseudorange with a set of “spoofed” measurements retrieved from a further receiver. In this case only inter-agent distances between the two receivers are computed by relying on their pseudorange measurements, thus the effects of attack on the positioning solution are not discussed. It is worth stressing that in the current CP framework, receivers cooperate at measurements level, Therefore, there is no control on earlier signal processing stages. $\mathcal{N}$ is the set of cardinality $N$ including the satellites being simulated by the IFEN NavX RFCS to be acquired, tracked and exploited for the PVT of all the receivers. $\mathcal{S}$ is instead the set of cardinality $S$ including faked measurements provided by the agent $\mathbf{S}$ to replace the measurements of agent $\mathbf{A}$. 

\par The test was conducted according to the following steps:

\begin{itemize}
    \item A set of receivers locally retrieves a set of $N=10$ pseudoranges and Doppler independently, in nominal conditions.
    \item Receiver $\mathbf{A}$ got $N-S$ nominal pseudorange and Doppler measurements and $S$ “spoofed” measurements (injected by an agent which is moving hundred meter ahead on the same path). 
    \item A set of receivers $\mathbf{T}$ uses the full measurements set provided by $\mathbf{A}$ to build inter-agent distances via WLS-DD. 
\end{itemize}

\par Three different combinations of possible attacks can be identified according to the cardinality of the satellite sets:

\begin{itemize}
\item{a)} $S \subseteq N$, and only agent $\mathbf{A}$ is under attack. All the other agents interacting with $\mathbf{A}$ are expected to be indirectly affected.
\item{b)} $S \subset N$ and also measurements of receivers $\mathbf{A}$ are spoofed such that $S_A \cup S_B = S_A$.
\item{c)} $S \subset N$ and also measurements of receivers $\mathbf{T}$ are spoofed $S_A \cap S_B=\emptyset$ (different subsets of satellites).
\end{itemize}

\par In the case $a$, the attack is performed against a single receiver, while in $b$ and $c$, the attack aims at damaging the whole cooperative network by acting on “cooperating pairs”. A full-set attack (all the visible satellites are actually spoofed) was covered in the previous section. 
\par The aforemention list is provided for the sake of completeness and the following results are referred to the preliminary investigation of mode $a$. Considering a scenario including kinematic car platooning composed of 9 vehicles moving on a round trajectory, a discontinuity in the range measurement is shown for all the agents collaborating with agent $\mathbf{A}$. In Figure \ref{fig:singleDiff} a relevant discontinuity in the computation of the inter-agent distance via DD is shown under a spoofing attack starting after a given amount of epochs  using $S=7$ such that the amount of visible satellites is high enough to find a non-empty set of common satellites to solve for DD). In this case, spoofing lasts up to the end of the simulation. Such a discontinuity is quite easy to be detected through any threshold-based edge-detection algorithms \cite{linty2018effects}. The identification of the most effective technique to identify the discontinuity is out of the scope of this paper and it will be addressed in future contributions.
A further test was performed by limiting the meaconing attack to 400 epochs, by approaching an ON/OFF attack to check whether anomalies in the measurements can be properly detected through differential measurements. 
In Figure \ref{fig:attack_4-6} and Figure \ref{fig:attack_4-9} two independent examples are provided. In the first case, agent 4 (agent $\mathbf{A}$) was meaconed by agent 5 (through the transmission of its own GNSS measurements) and this induced a sever discontinuity in the range measurements computed by agent 6 (agent $\mathbf{T}$). Similarly the computation of the inter-agent distance is altered in the pair 4-9. All the agents collaborating with agent 4 showed similar discontinuity.

\begin{figure*}[!htbp] 
    \centering
  \subfloat[\label{fig:attack_4-9}]{%
       \includegraphics[width=0.49\linewidth,trim={0cm 0cm 0cm 0cm},clip]{GoodFIgure_ShortSpoofingT_4-6.eps}}
  \subfloat[\label{fig:attack_4-6}]{%
        \includegraphics[width=0.49\linewidth,trim={0cm 0cm 0cm 0cm},clip]{GoodFIgure_ShortSpoofingT_4-9.eps}}
  \caption{{Time-limited meaconing attack to a cooperative network: effects of measurements inconsistency on the differential ranging. The upper plots show the behaviour expected in nominal conditions.}}
  \label{fig:limitedTimeSpoof} 
\end{figure*}

\par These findings provide an indirect strategy to detect measurement anomalies in a network of cooperating agents. Collaborating agents can rise alarms in the network to identify possible outliers due to malicious attacks. Potentials countermeasures to such a kind of cyber-attacks are strategical to make CP frameworks more reliable and robust.

\par A set of further points must be considered as guidelines for future works:

\begin{itemize}
    \item The observed behaviour in the DGNSS-CP framework is not related to a an actual RF spoofing, it discloses indeed potential weaknesses to the cooperative frameworks relying on the exchange of raw GNSS measurements.
    \item The measure of the divergency in the nominal and affected positioning solutions must be provided to properly  rise a potential flag when dangerous values are observed.
    \item A check of the consistency of the measurements and reference position of the aiding agent, agent A has to perform a PVT using the retrieved measurements when attack detection is implemented at PVT level. Alternatively, a strategy can be performed at measurements level at which the PVT of the aiding agent is not necessary.
\end{itemize}


\vspace{\baselineskip}


