Sentinel fuses the sensors an attacker cannot reach into a physics truth, holds every GNSS, AIS and compass claim to it, and runs on an agent whose own integrity is attested before it judges. Behind this text, a fast attack craft is spoofing a destroyer right now.
Modern ship navigation and engine control run on implied trust. If GNSS reports a position, the chart plots it. If the engine bus reports idle, the display shows idle. Firewalls check that a packet is well-formed; nothing checks that it is physically true.
In a contested electromagnetic environment an adversary does not need to jam. Spoofing is quieter and more dangerous: a mathematically valid signal that describes a ship that does not exist, walking the real one onto a shoal while every display stays calm.
Sentinel answers one question without asking the sensors: is this data real? It fuses the sensors an attacker cannot reach into a physics truth, holds every RF-borne claim to it, and runs on an agent whose own integrity has been measured before it is allowed to judge.
The adversary can inject arbitrary NMEA, AIS and CAN traffic and can capture and replay the telemetry link. The adversary cannot make a 9,200-tonne hull accelerate without its accelerometers registering force, or turn without its gyro registering rate, or drive its shafts without the hull vibrating.
Cannot be reached over RF or bus. Used to build the dead-reckoned physics truth.
An attacker can write to it, but the value it claims must agree with what the hull is doing.
Every claim is held to the physics truth before the bridge sees it.
Every 100 ms a signed frame arrives. Each layer asks one question and can reject the frame outright; the soft layers also contribute evidence to a fused trust score that decays fast and recovers slowly.
HMAC-SHA256 over a canonical encoding of every frame, keyed per node. Forged frames die here.
Monotonic sequence numbers plus a 512-entry nonce ring. Captured-and-replayed frames die here.
Frame age against the receiver clock, ±2.5 s. Stale and future-dated frames die here.
IMU and hull-vibration dead-reckoning held against GNSS position, speed and compass heading, with a covariance clock that sets a 3σ bound.
RPM↔vibration, SOG↔RPM, fix-to-fix motion against the hull's maximum speed, AIS contacts against radar returns.
A six-feature residual vector scored by Mahalanobis distance against a baseline learned in the run's first 30 s, EWMA-smoothed.
The simulator's hostile platform carries an EW package. Each vector can be fired live from the console or scripted into a scenario. The last one is the point of the whole system.
Re-broadcast satellite signals with a growing delay so the fix walks off-track while speed and course still look sane. The anomaly model sees the steady innovation signature first; the residual bound confirms.
Capture the receiver and relocate the fix by ~800 m in one epoch. Blows the dead-reckoning residual bound instantly.
Fabricate a vessel on a collision course to force a course change. Radar sees nothing there.
Offset the magnetic heading feed by 25° so a steady course reads as a turn.
Inject idle RPM on the engine CAN bus while the shafts are actually at cruise.
Re-send previously captured, validly signed frames.
Inject frames signed with a guessed key.
GNSS drift, compass offset and an AIS identity spoofed onto the attacker's own radar return, all tuned to agree. Only the hull's own physics disagrees.
No completed runs yet. Finish a scenario in the console and its report appears here.
Before the agent is allowed to judge sensor data, its own components are measured: bootloader and kernel into PCR0, the container runtime into PCR7, the agent binary, detector thresholds and anomaly model into PCR8. A verifier requests a quote over a fresh nonce and compares against the golden manifest. If anything differs, the detector refuses to run and says so.
In this deployment the TPM is a software model and is labelled as such throughout. The measurement, extend and quote logic is the real sequence; a hardware TPM would sign the quote with its attestation key.
GET /api/attest
{
"simulated": true,
"golden": { "0": "…", "7": "…", "8": "…" },
"quote": {
"nonce": "f2a9…",
"pcrs": { "0": "…", "7": "…", "8": "…" },
"components": [
{ "name": "sentinel-agent", "pcr": 8, "digest": "…" },
…
],
"quoteSig": "hmac(AK, nonce || sha256(pcrs))"
},
"result": { "ok": true, "reasons": [] }
}
GET /api/attest?tamper=sentinel-agent
→ "PCR8 mismatch: measured [sentinel-agent, …]"The console runs the detector in a Web Worker. The identical TypeScript runs behind POST /api/verify, so an edge node, a bridge integrator or a test harness can submit signed frames and receive the six-layer verdict. Keys are per node; in deployment they are sealed to the node's TPM.
curl -X POST https://<host>/api/verify \
-H 'content-type: application/json' \
-d '{ "frame": { "seq": 1, "t": 1725500000000,
"nodeId": "DDG-51/NAV-01", "nonce": "…",
"trusted": { "imu": {…}, "vibration": 0.41 },
"bus": { "rpm": 112 },
"external": { "gnss": {…}, "compass": 40.2, "ais": [] },
"radar": { "contacts": [] } },
"sig": "<hex hmac-sha256>" }'
{ "verdict": { "accepted": true, "trust": 100,
"layers": [ { "id": "L1", "status": "pass", … } … ],
"residualM": 3, "boundM": 26, "drPos": {…} } }Sentinel Protocol began as a Cal Poly Computer Engineering senior project by Rudra Khakhar and Arnav Samdyan, advised by Dr. Zachary Peterson, on trusted, physics-based integrity verification for operational technology. The proposal named two success metrics, time-to-detect and false-positive rate, and this platform reports both on every run.
Version 4 replaces the original browser demo with a vessel dynamics model, an adversary with eight vectors, a six-layer detector shared between the console and a verification API, simulated TPM attestation, and a run archive. Next steps are documented in the repository: real MQTT ingestion from edge hardware, a hardware TPM, and a pretrained anomaly model.
Physics-consistency checks are published in the maritime cybersecurity literature. Nothing here helps an attacker beyond the well-known fact that consistent, slow spoofing is harder to detect than crude spoofing; the coordinated scenario exists to show that even a self-consistent spoof cannot be consistent with the hull.