Design and implementation of multiple authentication schemes on navigation messages

Unmanned aerial vehicles (UAVs) are widely used in commercial activities due to their low cost and high efficiency. However, many unscrupulous activities have taken advantage of the open nature of civil navigation messages to implement Global Navigation Satellite System (GNSS) spoofing attacks on UAVs, resulting in major security risks for UAVs. In order to cope with spoofing attacks, a navigation message authentication (NMA) scheme has been proposed to protect navigation messages. However, the mainstream NMA schemes have defects of a single authentication process and large time overhead. Furthermore, these schemes depend on digital certificates to update the key. In the event that the UAV is disconnected from the certificate authority, it will be unable to update the key in an appropriate manner, which will consequently affect subsequent authentication. To solve the above problems, this paper proposes a hybrid authentication scheme based on BeiDou-III navigation system (BDS-III), which combines Navigation Message Authentication (NMA) and timed efficient stream loss-tolerant authentication (TESLA) to achieve a triple authentication of signatures, TESLA keys, and message authentication code (MAC). Then, the SM2 signature algorithm is modified to reduce the authentication time overhead. Finally, the stability of the key update process is enhanced by storing the public key in the navigation message and broadcasting it by satellite. Experimental verification shows that the proposed scheme can effectively resist replay attacks and generative spoofing attacks, while guaranteeing the security. The authentication error rate of the proposed scheme can meet the demand of less than 10⁻³ when it is lower than the average carrier-to-noise ratio of 7dBHz. The time between authentications (TBA) is 15.11 seconds. The unpredictable symbol rate (USR) is 16.8% which is a better performance compared with same kind of scheme.