Sticky Fingers: Resilience of Satellite Fingerprinting against Jamming Attacks

TL;DR

The paper investigates the resilience of satellite radio fingerprinting against jamming in Iridium systems by leveraging a pre-trained fingerprinting model and a large real-world dataset augmented with Gaussian and tone interference. It compares the power required to disrupt fingerprinting with that needed to jam message contents and finds that disrupting the fingerprinting process demands similar or slightly more power, with tone jamming notably effective against fingerprinting. The results suggest that incorporating fingerprinting for transmitter authentication does not significantly increase vulnerability to denial-of-service attacks and can be viable for legacy satellites lacking cryptographic security. The study provides practical insights into hardware budgets, attack ranges, and methodological benchmarks for evaluating fingerprinting in space-based communications.

Abstract

In the wake of increasing numbers of attacks on radio communication systems, a range of techniques are being deployed to increase the security of these systems. One such technique is radio fingerprinting, in which the transmitter can be identified and authenticated by observing small hardware differences expressed in the signal. Fingerprinting has been explored in particular in the defense of satellite systems, many of which are insecure and cannot be retrofitted with cryptographic security. In this paper, we evaluate the effectiveness of radio fingerprinting techniques under interference and jamming attacks, usually intended to deny service. By taking a pre-trained fingerprinting model and gathering a new dataset in which different levels of Gaussian noise and tone jamming have been added to the legitimate signal, we assess the attacker power required in order to disrupt the transmitter fingerprint such that it can no longer be recognized. We compare this to Gaussian jamming on the data portion of the signal, obtaining the remarkable result that transmitter fingerprints are still recognizable even in the presence of moderate levels of noise. Through deeper analysis of the results, we conclude that it takes a similar amount of jamming power in order to disrupt the fingerprint as it does to jam the message contents itself, so it is safe to include a fingerprinting system to authenticate satellite communication without opening up the system to easier denial-of-service attacks.

Figures (12)

• Figure 1: An illustration of the hardware components involved in QPSK signal modulation. Each hardware component can introduce its own impairments upon the signal, which can be used to identify the transmitter through fingerprinting.
• Figure 2: The proportion of Iridium messages which fail to decode as the jammer power increases, with and without the use of Iridium's built-in error correcting codes. A dashed line represents the point at which half of all messages fail to decode.
• Figure 3: The received power of a noise jammer as distance to the victim antenna varies, under free space path loss. The dashed line represents the power required to cause a 50% loss rate of Iridium Ring Alert messages; the region where any message loss is caused is shaded. It can be seen that with either set of equipment, line-of-sight attackers deny service over long distances.
• Figure 4: Overview of the hardware used to collect Iridium signals with additional noise. The hardware that has been added to enable variable noise injection has been highlighted.
• Figure 5: Level of noise added to the collected data over time. This pattern loops every 8.0 hours.