Novel Replay Attacks Against Galileo Open Service Navigation Message Authentication

Abstract

Open Service Navigation Message Authentication (OSNMA) serves as a critical security mechanism for the Galileo global navigation satellite system. At the core of OSNMA is a Timed Efficient Stream Loss-tolerant Authentication (TESLA) scheme, which generates a tag for each navigation message using a secret key and later discloses the key to receivers for authenticating the message-tag pair. Despite its great effectiveness against spoofing attacks, OSNMA’s ability to resist replay attacks is questionable since the replayed signals containing authentic messages and tags may bypass the authentication under certain circumstances. This paper, for the first time, reveals two serious vulnerabilities of OSNMA: time synchronization (TS) and non-continuous message authentication (NCMA). TS is a mandatory requirement that specifies that the difference between a receiver’s local reference time and the Galileo System Time (GST) extracted from Galileo signals does not exceed a given threshold. Exploiting this vulnerability, we propose a pre-startup replay (PreRep) attack, where Galileo signals are continuously recorded and replayed to a victim receiver before it starts up such that the TS requirement is satisfied and the receiver is locked to the replayed signals. NCMA means that OSNMA temporarily suspends the authentication process probably due to the reception of a broken message, tag or key, and restores the authentication after receiving a later-disclosed valid message-tag-key pair. Based on this vulnerability, we propose a post-startup replay (PosRep) attack, which conducts the replay attack after the victim receiver starts up such that the replayed signals break the currently receiving message-tag-key pair, deliberately suspending the authentication process, while subsequently-replayed signals can pass the authentication successfully as the message-tag-key pairs inside are valid. Finally, we conducted extensive experiments based on real-world OSNMA-integrated receivers and two software-defined radio (SDR) devices to demonstrate the feasibility of the proposed attacks.