SATversary: Adversarial Attacks and Defenses for Satellite Fingerprinting

1. Problem Statement

Satellite systems, particularly legacy ones, lack robust cryptographic security and are increasingly vulnerable to attacks using off-the-shelf Software Defined Radio (SDR) hardware. Physical layer fingerprinting has emerged as a countermeasure, authenticating transmitters by analyzing unique hardware impairments in the radio signal. However, the security of these fingerprinting systems against targeted adversarial attacks is poorly understood. Existing evaluations rely on simple replay/jamming or prohibitively expensive Arbitrary Waveform Generators (AWGs). This paper addresses the gap by evaluating the vulnerability of satellite fingerprinting (specifically the SATIQ system for Iridium transmitters) against optimized, low-cost adversarial attacks and exploring novel defenses.

2. Methodology

The authors conducted an end-to-end evaluation using a realistic experimental setup:

• Hardware: Two SDRs (LimeSDR Mini 2.0) connected via a cable and a PROPSIM channel emulator to simulate realistic wireless conditions (multipath fading, attenuation) without violating broadcast regulations.
• Target System: The SATIQ model, a deep learning-based fingerprinting system that extracts features from Iridium message headers to authenticate transmitters.
• Attack Vectors: Three primary attack strategies were designed and optimized using gradient descent and Generative Adversarial Networks (GANs):
  1. Optimized Jamming: Crafting a signal to maximize the distance between a legitimate message's fingerprint and its reference, causing false rejections.
  2. Dataset Poisoning: Gradually injecting adversarial examples to update the stored reference fingerprints, causing the system to accept an attacker's transmitter as legitimate.
  3. Optimized Spoofing (Fingerprint Masking): Using a GAN to generate signals that counteract the attacker's own hardware fingerprint and channel effects, allowing replayed messages to appear legitimate.
• Defense Evaluation: The discriminator component of the trained spoofing GAN was repurposed to detect replay and spoofing attacks, even on unseen hardware.

3. Key Contributions

• Optimized Jamming: Demonstrated that optimized jamming signals can disrupt fingerprinting with attacker-to-victim power ratios as low as −30 dB to −40 dB (far below the noise floor), causing a 50% error rate. This is significantly more efficient than traditional Gaussian jamming.
• Dataset Poisoning: Proved that attackers can perform "inclusive" or "exclusive" poisoning attacks. By injecting a short sequence of carefully crafted messages, an attacker can shift the system's ground truth to accept their hardware as a legitimate transmitter.
• Optimized Spoofing: Showed that attackers can partially remove their own hardware fingerprint from replayed messages using GANs, successfully bypassing authentication in "best case" and "wired" channel conditions.
• Single-Transmitter Defense: Introduced a novel defense mechanism where a GAN trained to perform spoofing attacks is repurposed to detect them. Crucially, this defense works with data from only a single transmitter, enabling security for small constellations or individual satellites where previous multi-transmitter models failed.

4. Key Results

• Jamming Effectiveness:
  • Optimized jamming achieved a 50% False Rejection Rate (FRR) at −30 dB power ratio.
  • Traditional Gaussian jamming required roughly −3.0 dB to achieve similar disruption.
  • The optimized signals were largely message-agnostic and effective even without phase synchronization.
• Poisoning Success:
  • Attackers successfully poisoned the system to accept a new transmitter.
  • "Exclusive" poisoning (replacing the victim) was highly successful.
  • "Inclusive" poisoning (keeping both victim and attacker) was possible but more difficult, requiring higher acceptance thresholds.
• Spoofing Performance:
  • Simple gradient descent spoofing failed (False Acceptance Rate < 10%).
  • GAN-based spoofing significantly improved success. In "Best Case" channel models, the Equal Error Rate (EER) for spoofed messages dropped to 39.79% (compared to 26.43% for simple replay), indicating the GAN successfully masked the attacker's fingerprint.
  • The attack transferred well to new, unseen SDR hardware of the same type.
• Defense (GAN Discriminator):
  • The GAN discriminator could distinguish legitimate messages from SDR-replayed messages with an EER of 0.4% on the training hardware and 0.42% on unseen SDRs.
  • When tested against the SATIQ replay dataset, the GAN achieved an EER of 15.9% (vs. 7.7% for the original SATIQ model), demonstrating robustness despite never seeing the specific attacker hardware during training.

5. Significance and Implications

• Vulnerability of Fingerprinting: The study reveals that physical layer fingerprinting is not a silver bullet; it is highly susceptible to optimized, low-power adversarial attacks that are feasible with consumer-grade hardware.
• Low-Cost Threat: The ability to disrupt or spoof satellite communications with signals far below the noise floor (−30 dB) implies that current detection mechanisms may be insufficient.
• New Defense Paradigm: The paper proposes a paradigm shift from "training to identify transmitters" to "training to identify attacks." The Single-Transmitter Fingerprinting technique is a major breakthrough, allowing operators of small constellations or individual satellites to deploy effective anti-spoofing defenses without needing large datasets of diverse transmitters.
• Recommendations: The authors suggest combining fingerprinting with other signal intelligence (e.g., SNR monitoring), using rolling averages of multiple messages to resist poisoning, and employing "adversarial training" to harden models against these specific attack vectors.

In conclusion, while fingerprinting offers a promising layer of security for legacy satellites, this paper demonstrates that it must be deployed with robust, multi-layered countermeasures and potentially re-architected to focus on attack detection rather than just transmitter identification.