The companies will combine their experience to guarantee robust and reliable navigation thanks to the Galileo constellation
The OSNMA scheme. (Image: ESA)
UAV Navigation is participating in the OSNMAplus project consortium led by Qascom, an Italian enterprise in the domain of GNSS authentication.
The OSNMAplus project aims to develop services and technologies that make use of novel services provided by Galileo, particularly use of OSNMA and I/NAV improvements.
The OSNMA service is a data authentication function for Galileo Open Service users worldwide, freely accessible to all. OSNMA provides receivers with the assurance that the received Galileo navigation message is coming from the system itself and has not been modified. The I/NAV improvements are part of a recently released update of the Galileo Interface Control Document, aiming at optimizing the navigation performance of Galileo even further.
“With the OSNMAplus project, we’re providing technological solutions that will facilitate the adoption of OSNMA in new and existing navigation systems,” said Carlo Sarto, OSNMAplus project manager. “We’re also providing cloud-based services and multiplatform SDK that can be used in consumer devices to improve the OSNMA experience and increase the robustness of the navigation solution.”
The OSNMAplus technologies will be subject to an extensive test campaign. The OSNMA-based navigation will be tested in a flying drone to assess effective resilience against potential malicious GNSS interference.
In our 11th annual Simulator Buyers Guide, we feature simulator tools, devices and software from 11 prominent companies that aid GNSS receiver manufacturers in product design.
Alternative RF Navigation Simulator (Photo: Spirent Federal Systems)
New Alternative RF Navigation Simulator. Authorized users of Spirent’s alternative PNT simulation system can generate alternative RF navigation signals individually or concurrently with GNSS signals.
GSS9000. The GSS9000 Series multi-frequency, multi-GNSS RF constellation simulator is Spirent’s most comprehensive simulation solution. It can simulate signals from all GNSS and regional navigation systems and has an unrivaled update rate of 2 kHz (0.5 ms), enabling ultra-high-dynamic simulations with accuracy and fidelity. The GSS9000 supports M-code, Y-code, alternative PNT and non-GNSS sensors, and comes with built-in jamming, spoofing and flex power.
SimMNSA. Spirent Federal has the first fully approved MNSA M-code simulator. Authorized users of the GSS9000 series of simulators will be able to utilize the advanced capabilities of SimMNSA to create robust military GPS user equipment (MGUE) solutions.
Spirent GSS9000 Series constellation simulator (Photo: Spirent Federal Systems)
CRPA Test System. The CRPA Test System is scalable, testing antennas from 4 to 16 elements and beyond. More than 1,000 independent GNSS, jamming and spoofing signals can be generated/simulated across a phase-calibrated precise wavefront.
SimINERTIAL. Supporting the leading embedded GPS/inertial systems (EGI) and inertial measurement units (IMU), SimINERTIAL enables the controllable generation of inertial sensor outputs, synchronous with simulated GNSS, to test integrated GPS/inertial systems in the lab.
Anechoic Chamber Testing. Spirent’s GSS9790 multi-output, multi-GNSS RF constellation wavefront simulator system can be used in both conducted (lab) and radiated (chamber) conditions.
Mid-Range Solutions. Spirent offers solutions for every application and price point. The GSS7000 multi-constellation simulator provides an easy-to-use solution for GNSS testing that can grow with users’ requirements. The GSS6450 RF record-and-playback system enables replay of real-world GNSS tests in the lab.
Based on the Skydel GNSS Simulation Engine, Orolia’s advanced and essential GNSS simulators offer a wide breadth and depth of tools to test mission-critical positioning, navigation and timing (PNT) applications and scenarios.
Skydel Simulation Engine. The highly flexible, high-performance Skydel Simulation Engine transmits GNSS signals in real time to many kinds of software-defined radios. Skydel uses graphics processing units (GPUs) to compute the digital GNSS signal of all simulated satellites, easily scaling from simple to complex use cases. Skydel simulates civil signals from global and regional navigation satellite systems with a 1000-Hz update rate, many kinds of GNSS receiver trajectories with high dynamics, and advanced jamming and spoofing. The Skydel ecosystem also includes features such as open-source plug-ins and API, and the ability to create custom signals. The custom-signal feature allows users to experiment with new signals, such as navigation from low-Earth-orbit satellite systems.
GSG-8. A scalable software-powered turnkey simulation solution, GSG-8 is configurable to meet virtually any testing requirements. It can support multi-constellation, multi-frequency and hundreds of signals with a 1000-Hz iteration rate. This advanced hardware platform is suitable for space trajectories, custom PNT signals, hardware-in-the-loop, multi-antenna simulation, and more. Encrypted EU signals will be available soon.
Skydel CRPA Testing. With self-calibration, integrated advanced jamming and spoofing, and the ability to generate thousands of signals, Skydel CRPA test systems provide everything needed to test CRPA systems, with a focus on ease of use and the testing experience from the user point of view. Two flexible configurations, Skydel Anechoic and Skydel Wavefront, have been carefully designed to provide the advanced simulation features required for CRPA testing in a well-thought-out package. Both provide COTS hardware benefits: configuration flexibility and cost-effectiveness.
GSG-5 and GSG-6. Orolia’s essential simulation platform is a proven, cost-effective simulation solution. Combined with the freely available StudioView software, these simulators provide high-end capabilities in a standalone, portable system that allows operation via a front panel interface. GSG-5 and GSG-6 are available with support for multi-frequency and multi-constellation GNSS signal simulation, pre-built scenarios and test packages, and the features neded to integrate it into ATE systems.
BroadSim 4U, Advanced NAVWAR simulations, MNSA and Y-Code (Photo: Orolia)
Advanced GNSS Simulation for Government & Defense
BroadSim
Powered by the Skydel Simulation Engine, BroadSim provides superior NAVWAR performance, sharing the same benefits and key features of its software-defined platform.
Key Applications
BroadSim Solo: Multi-GNSS simulations on the desktop. (Photo: Orolia)
MNSA M-Code. BroadSim offers a fully flexible implementation of the Modernized NavStar Security Algorithm, giving you full control over scenario settings with the real encryption used on the M-code signal. Any aspect of your scenario can be changed, such as time, date, location, constellation, downlink data, signal configuration, and visible satellites. It is security-approved by SMC Production Corps and shipping as soon as today.
CRPA Testing. BroadSim leverages Skydel’s CRPA testing solution to up the ante for demanding NAVWAR scenarios. BroadSim Anechoic allows you to test an entire system as-is. Skydel auto- calibrates the system, maps the antennas, and is designed to streamline chamber setup and reduce hardware. Broadsim Wavefront tests the antenna electronics, prioritizing the ability to have dynamic trajectories and allowing you to model any scenario with an unlimited number of interferences. The system is scalable from 4 to 16 elements, is phase coherent, performs real-time automated phase calibration, and has built-in jamming and spoofing.
BroadSim Wavefront: Phase-aligned NAVWAR simulator for CRPA (Photo: Orolia)
Advanced Jamming and Spoofing. With Advanced Jamming, users can add ground- and space-based emitters to scenarios, generate an unlimited number of jamming signals on 1 RF output, and simulate flight profiles where interference power levels at the UUT dynamically change depending on the scenario motion. With Advanced Spoofing, users can simulate multiple spoofers simultaneously. Each spoofer can generate any GNSS signal and has an independent trajectory and antenna pattern. Signal dynamics between each spoofer and receiver antenna are automatically determined so no time is wasted.
More Features. Inertial and alternative RF navigation, built-in Flex Power, real-time performance with ultra-low latency of 5ms, high dynamics, terrain modeling, and RMF STIG compliance.
Test Anywhere with LabSat 3 Wideband and SatGen Simulation Software
LabSat 3 Wideband. The LabSat 3 Wideband is a compact yet powerful multi-constellation and multi-frequency GNSS testing solution. The easy-to-use, one-touch record-and-replay function provides an efficient way to test and develop GNSS-based technology without the cost and limitations of live-sky signals.
It is lightweight and portable, enabling easy collaboration with colleagues by sharing scenario files over the internet, and making it a suitable test partner for remote working. Additionally, the removeable solid-state drive (SSD) of up to 7 terabytes and a two-hour runtime provided by an internal battery is ready for field testing in any environment.
LabSat 3 Wideband can record and replay up to three different channels at 56-MHz bandwidth across all major constellations and signals, including:
GPS: L1/L2/L5
Galileo: E1/E1a/E5a/E5b/E6
GLONASS: L1/L2/L3
BeiDou: B1/B2/B3
NavIC: L5/S-band
QZSS: L1/L2/L5
L-band correction services including SBAS
2x CAN and 4x digital input channels tightly synchronized with GNSS data
future signal launches are also supported, including L2C, L5 and L1C
SatGen Simulation Software. SatGen software allows users to quickly create bespoke, accurate scenarios with their own time, location and trajectory that can be replayed via a LabSat GNSS simulator.
The latest version of SatGen can be used to create a single scenario containing all the upper and lower L-band signals for GPS, Galileo, GLONASS, BeiDou and NavIC.
When getting the job done right the first time — and every time — matters, CAST Navigation’s suite of simulator solutions delivers precision, accuracy and repeatability. From simple integration testing to complex mission simulations, CAST Navigation solutions scale to meet user requirements.
Powered by multi-frequency, multi-constellation GNSS and interference signal-generation technology, CAST Navigation simulators provide coherent, highly accurate and fully programmable signals. Advanced, configurable vehicle trajectory capabilities meet project requirements ranging from antenna testing to simulations of squadrons maneuvering in contested environments.
Intuitive Graphical Interface. A comprehensive and intuitive graphical interface unifies all simulator capabilities so users can configure complex simulation scenarios quickly. For example, CAST Navigation simulators can model many vehicle types with static and dynamic motion profiles: airborne, terrestrial, aquatic or space-based. Using configured scenario profiles or vehicle truth data, CAST Navigation simulators create high-dynamic, 6-DOF real-time trajectories.
High-Fidelity Simulations of Real-World Conditions. CAST Navigation solutions can reproduce terrain, sea-state and atmospheric effects to simulate missions with high fidelity. Jamming capabilities recreate natural, urban and hostile interference to produce precisely controlled waveforms with high output power and exceptionally low intermodulation noise.
Multi-Frequency, Multi-Constellation Simulations. The GPS/GNSS simulators generate accurate, programmable signals to each antenna element with up to 16 satellites in view from as many as four constellation types. GPS simulations can generate any positioning signal (C/A-code, P-code, Y-code, SAASM, M-code AES and M-code MNSA).
Modular, Scalable Solutions. Proprietary synchronization technology lets CAST Navigation configure customer solutions with multiple simulator capabilities — GPS/GNSS, inertial, jamming, and CRPA — to meet specific project needs. As those needs evolve, these solutions do not become obsolete. Rather than replace a functioning system, customers can rely on modular architecture to meet their new requirements.
The NCS NOVA GNSS simulator is a high-end, powerful and easy-to-use satellite navigation testing and R&D device. It is fully capable of multi-constellation and multi-frequency simulations for a wide range of GNSS applications. It is one of the leading solutions on the market, providing multiple GNSS frequencies in one box.
Because of the modern and flexible software-defined radio (SDR) design of this simulator, testing requirements will be met with the minimum of equipment, facilitating logistics and reducing the cost of ownership. The innovative multi-constellation and multi-frequency simulation capability sets new standards in the field of GNSS simulation in terms of fidelity, performance, accuracy and reliability. Designed to deliver maximum flexibility, users are no longer faced with configuration limitations.
The NCS NOVA GNSS simulator is also able to coherently generate GNSS RF signals on two independent RF outputs simultaneously. The user may freely allocate GNSS signals and RF channels to each of the RF outputs. This feature allows simulation of GNSS signals at two antenna locations simultaneously (this could be two antennas on a vehicle, two separate vehicles maneuvering independently, or a static location plus a mobile unit).
A new key enhancement to the NCS NOVA GNSS simulator is comprehensive support of new Galileo OS signal message improvements on E1B. By enabling real-time simulation of the Galileo OS message improvements, the NCS NOVA expands a user’s Galileo signal capability.
In the future, the NCS NOVA also will fully support the new Galileo E1B OS Navigation Message Authentication (OS-NMA) and Galileo E6B High Accuracy Service (HAS) capabilities.
The NCS NOVA GNSS simulator is the first choice in signal simulation for a wide range of applications including space, aviation, automotive (including autonomous driving testing) and many others.
About IFEN. IFEN is a leading provider of GNSS navigation products and services. Its technology portfolio includes GNSS RF-signal simulators, GNSS software receivers, simulation and data processing tools. IFEN’s outstanding satellite navigation expertise is provided to customers for services including GNSS system studies, research and development of navigation and integrity algorithms, design and development of GNSS software and hardware, on up to engineering of turnkey facilities and systems.
The MGSE product family creates a versatile GNSS test and simulation environment that improves the development, qualification and certification process of GNSS receivers within development phases and for validation and certification in end-to-end tests.
MGSE enables mobile and stationary interference monitoring, for example, for protecting critical infrastructures. It can be used for interference mitigation if combined with TeleOrbit’s GNSSA-6E (six-element antenna array) or its GNSS DCP (dual circularly polarized)antenna.
With MGSE REC-REP 2.0 users can, among other tasks, record Galileo PRS signals in a real user environment and replay them for Galileo PRS receiver testing.
MGSE SIM-REP supports the development of software-defined radios/receivers or specialized algorithms by creating a simulation environment that provides the possibility and flexibility to use synthetically generated GNSS data and recorded real-world samples.
For jamming and spoofing test and evaluation, TeleOrbit offers a sophisticated solution based on the MGSE simulation, recording and replaying product family. For spoofing mitigation, the GOOSE-OSNMA receiver platform is available.
Technical Background
The multi-band RF front-end (MGSE REC) receives the GNSS RF signals in different frequency bands simultaneously to obtain digital IF data, which can be used for GNSS multi-system signal analysis and comparison. All GNSS L-band frequencies and the NavIC S-band are supported.
The MGSE Replay Unit includes a flexible multi-band RF replay device that streams simulated and recorded raw IF data to a digital baseband output or to an analog RF signal. Up to two independent RF channels and up to four GNSS signals (L1, E1, B1, G1) can be provided.
GOOSE is a powerful yet compact GNSS receiver lab and the rapid prototyping solution for leading-edge GNSS receiver development.
The GNSSA-DCP (dual circularly polarized antenna) receives RHCP and LHCP signals simultaneously (full L-band). It clearly detects signals which have been corrupted by diffraction and reflections.
WORK Microwave’s Xidus is well-known for meeting all requirements regarding multi-GNSS; for its multi-frequency and multi-RF signal generation; for its innovative Signal Extension and Enhancements (SEE) technology; for its advanced customization and configurability; and for world-class remote support with updates, training and even scenario execution.
Xidus Signal Module
Compact and powerful, the Xidus Signal Module provides new capabilities of signal generation. Users can perform rigorous and extensive testing of present and future positioning systems when conducting navigation research or developing products.
Possible applications: pseudolite generation, massive multipath or navigation signal generation on various orbits.
Extensive increase of supported channels: >250.
Unlimited number of multipath channels with delay >3,000km.
Interference signal generation on up to four independent frequencies.
Acts as a software-defined radio (SDR) to replay signals.
Xidus-648 (Photo: Work Microwave)
Xidus Hardware Series
Xidus-424 GNSS Simulator
Up to 4 signal modules
2 RF outputs
Wide dynamic power range
Xidus-648 GNSS Simulator
Up to 8 signal modules
4 RF outputs
1,000 Hz update rate
Xidus-Studio Client Software
Xidus-Studio provides a user-friendly graphical interface to configure any GNSS scenario. Its advanced and outstanding features include:
QA707 is the cutting-edge solution for global threat GNSS awareness and management. It is a GNSS simulator specifically designed to test cyber-attacks and authentication, and includes the simulation of GNSS interference, deception, jamming, spoofing and advanced cyber-threats such as data- and code-level attacks.
The high flexibility in the creation of the scenarios and the definition of the type of attacker allow cyber-threat and vulnerability testing for several applications,These applications may include, for example, autonomous driving and vehicle tracking, aeronautics and high dynamics applications, space GNSS receivers and timing.
OSNMA Support. The Galileo Open Service Navigation Message Authentication (OSNMA) simulation is an opportunity to test the new Galileo data protected service against several known vulnerabilities in GNSS applications. The OSNMA simulator is also available as a standalone tool, allowing the generation of OSNMA data that can be used with third party simulators.
PC-capable. QA707 runs on a standard PC. It is compatible with several third-party hardware RF up-converters, including National Instruments’ USRP. Additionally, it can support customer-specific hardware through the hardware API interface.
QA707 Main Features
Multi constellation (currently GPS L1, GALILEO E1, SBAS L1)
Galileo OSNMA
RF simulation, binary file dump, signal record and replay
Support to SDR platforms and open API for custom RF upconverters
Runtime streaming of scenario information over UDP (motion, channel data)
Data level cyber-attacks
Accurate spoofing signals control, trajectory spoofing, signal replay attacks
Narrow band, wide band, frequency modulated jamming
Integrity threats (on request): evil waveform, erroneous ephemerides, code/carrier divergence, low satellite signal power, excessive range acceleration
The StellaNGC all-in-one testing platform. (Photo: M3 Systems)
High-end multi-constellation and multi-frequency GNSS Simulator and Record & Playback
M3 Systems offers a fully integrated all-in-one testing solution for GNSS. Thanks to a versatile SDR approach, StellaNGC provides on a single HW platform GNSS simulation and GNSS record & playback functionalities. It answers user challenges from aerospace, defense, ground transportation and telecommunication fields when testing the PNT functions of their GNSS-based systems.
StellaNGC Plug & Play. This fully scalable and customizable simulator is based on a layered architecture to provide PNT data to the user at different levels (RF, IQ, GNSS raw data, trajectory).
Based on COTS platforms from National Instruments (NI), StellaNGC P&P allows the simulation of civil signals from GNSS as well as ground-based and satellite-based augmentation systems. It covers terrestrial, aerial and spatial trajectories (including high dynamics). It also enables assessment of GNSS solution robustness with jamming, meaconing and spoofing capacity.
Multi-antenna (CRPA applications) and multi-trajectories
Jamming and spoofing simulation
Cm-level positioning
Low latency HIL simulation
SBAS and RTK augmentation systems
3D multipath generation
IMU sensors modelization
Configuration of all scenario parameters
Signal control during run-time
Intuitive and easy to use GUI
StellaNGC Record & Playback. As a complement to simulation, StellaNGC RP allows test and validation of PNT functions through high-fidelity record-and-playback of GNSS signals. It allows recording by selection of a center frequency (65 MHz–6 GHz) or with a predefined list of GNSS frequencies for each of its 4 RF channelw, with a bandwidth of up to 120 MHz.
StellaNGC R&P Main Features
Multi-bands record & playback
Programmable center frequency and bandwidth
Single or multi-channel (up to 4) simultaneous records
The 18-channel miniature full-constellation CLAW GPS Simulator is a fully self-contained, low size, weight, power and cost (SWaP-C) miniature GPS simulator. It is very popular in manufacturing environments as well as R&D applications that require consistent and repeatable local GNSS signals at low price points.
The CLAW simulator does not require external computers for processing and control — it works fully self-contained by simply applying power, and storing location/time/date data in internal non-volatile memory, or by storing complex vector data to simulate highly dynamic scenarios. The CLAW also can be used to transcode NMEA or SCPI position/velocity/time (PVT) data into GPS RF signals. For 2022, JLT added driver support for a large number of additional GNSS front-end receivers when using the hardware-in-the-loop (transcoding) feature of the unit to, for instance, transcode from one GNSS system to another.
JLT offers an easy-to-use, highly configurable and cost-free SimCon Windows application program that is downloadable from the JLT website. SimCon allows random scenario generation and is thus usable to simulate leap-second events, Week 1023 rollover events, or any other GPS live-sky scenarios, including highly complex yet easy-to-create dynamic vector simulations.
For authorized U.S. government users, a version that does not have altitude and velocity limitations is popular for low-Earth-orbit (LEO) simulations. Multipath simulation allows use of the entire 18-channel simulator capability.
The unit can be field-upgraded with an easy-to-use in-field software upgrade feature. The CLAW is also very useful in GNSS receiver sensitivity testing for R&D or mass-production assembly lines as it allows accurate control of RF output power ranging from –100 dBm to less than –130 dBm with 0.1-dB resolution and typically better than 1-dB accuracy over the controllable power range.
The CLAW GPS Simulator also has a built-in RF signal generator with sweep, CW and random noise functions that are useful in simulating GNSS jamming scenarios, as well as GPS spoofing scenarios. The simulator comes in an FCC-certified metal desktop enclosure with numerous accessories.
The CLAW firmware has been updated to allow live-sky almanac and ephemerides to be automatically uploaded from various externally connected GNSS receivers. This makes simulations using real-time live-sky constellations (such as used in simulating spoofing attacks) an easy task. A free firmware update is available from JLT.
High-end GNSS simulation solutions for R&D, integration and product testing
Syntony GNSS specializes in GNSS/PNT software-defined receiver (SDR) technologies, operating from receivers to test and measurements solutions. Its products and solutions address multiple markets and use cases in the space, defense and transportation industries.
Constellator. (Photo: Syntony)
Constellator GNSS Simulator. Scalable, cost-effective, and high-fidelity SDR software-based platform supporting multi-constellation signals and frequencies (open, restricted and custom), hundreds of signals at 1-kHz iteration rate at zero effective latency, space trajectories and high dynamics. Multiple upgradable hardware configurations are available.
Constellator CRPA. Synchro-phase SDR by design, advanced jamming and spoofing, thousands of signals, 4 to 16 elements.
Echo. (Photo: Syntony)
Echo Recorder & Replayer. High-fidelity record-and-replay devices characterizing group-delay, scintillation, and jamming and spoofing interference, from space to ground market segments.
3 RF channels of 200Mhz sampling rate
16 bit I/Q
Up to 1.6 GB/s write/read speed.
SubWAVE manager. (Photo: Syntony)
SubWAVE GNSS/GPS Coverage Extension. Universal and seamless GPS/GNSS coverage extension for rail, road and mining infrastructures. SubWAVE signals are natively compatible with every GNSS-enabled device, and the solution uses existing telecom infrastructure to broadcast GNSS signals.
By Francesco Ardizzon, Nicola Laurenti, Carlo Sarto and Giovanni Gamba
To ensure the authenticity of the Galileo navigation messages, the Open Service navigation message authentication (OSNMA) mechanism requires a loose synchronization between the receiver clock and the system time.
To ensure the authenticity and the integrity of the transmitted messages, the Timed Efficient Stream Loss-tolerant Authentication (TESLA) protocol for broadcast authentication requires a loose time synchronization between the transmitter and the receiver — that is, an upper bound to the time offset between their clocks. In the context of the TESLA-based Open Service navigation message authentication (OSNMA) protocol, it is customary to assume that:
On the system side, the transmission is synchronous because the satellites are equipped with high-precision atomic clocks, the drift of which is assumed negligible with respect to those at the receiver side.
At the receiver side, commercial clocks can be found that are less accurate and less stable, which accounts for the substantial time mismatch between the transmitter and the receiver clocks accumulating over time.
To limit the impact of such mismatch on OSNMA operation, it is envisioned that clocks for authenticated tachographs onboard vehicles, such as the ones that will be employed for the position authenticated tachograph for OSNMA launch (PATROL) project, are reset and precisely realigned to system time in periodic workshop visits. However, the clock mismatch must satisfy the OSNMA constraint at all times between successive workshop resets, in the “holdover” period, and through all possible operating conditions, to ensure constant authenticity of the navigation message.
In other contexts, this task is performed by such means as network synchronization protocols.
However, we are considering a scenario where, during holdover, we cannot rely on other sources, such as an internet connection or other devices to synchronize with the reference time to assure the authenticity of our time reference and, consequently, of the PVT solution. We also cannot trust any signal received during the holdover period, thus we should not use the PVT solution to synchronize the clock.
Here, we have two goals. First, investigate the causes of the misalignment and frequency deviation in clock generators commonly found on the market for GNSS receivers. Second, relate the clock specification parameters, taken directly from the real-time clock (RTC) device datasheets, the holdover period, and the OSNMA misalignment constraints.
Atomic clocks at ESTEC’s Navigation Laboratory in The Netherlands independently validate Galileo timing performance. (Photo: ESA)
Frequency Accuracy and Stability
Two metrics are usually employed to evaluate the performance of an oscillator.
Clock frequency accuracy is the normalized difference between the frequency output and its nominal value, f0.
Clock frequency stability is the normalized instantaneous frequency deviation from its local mean.
Although devices are characterized in terms of their stability, we are interested in measuring their accuracy y(t)ΔF(t)⁄f0, where ΔF(t) is the instantaneous frequency deviation from f0 at time t. The calibration performed during each workshop reset brings the residual misalignment to a negligible value called phase calibration error. On the other hand, we will later discuss the residual frequency deviation, due to the frequency calibration error.
The loose time synchronization requirement TL states that the authenticity of the navigation message received at time t is guaranteed if |ΔT(t)|≤TL, at every t during the holdover period.
Finally, we can relate accuracy and misalignment using the bound
(1)
which allows us to upper bound the clock misalignment at any time t in terms of the frequency accuracy along the whole interval elapsed from the last calibration time t0.
Accuracy Loss for Receiver Clocks
Thanks to their affordable price and wide temperature operating conditions, quartz crystal oscillators are used for clock generation in GNSS receivers (see TABLE 1). We distinguish among simple, temperature-controlled crystal oscillators (TCXOs) and oven-controlled crystal oscillators (OCXOs). GNSS receivers typically employ TXCOs because they offer the best trade-off in terms of power consumption, price and typical accuracy.
Table 1. Summary of the main quartz crystal oscillator characteristics.
Sources of Frequency Accuracy Loss. Quartz crystals are piezoelectric materials, therefore any additional stresses and environmental changes generate an additional voltage, decreasing the clock stability. In the automotive scenario, the main sources of accuracy loss are temperature changes, long-term aging, and the residual calibration frequency offset, while the impact of accelerations, vibrations, gravity variation and supply voltage oscillation can safely be neglected as they result in changes of a few parts per billion.
Currently, no analytic relationship is known between frequency accuracy and temperature for TCXOs (or OCXOs). Therefore, as reported in datasheets, the inaccuracy induced by the temperature changes is bounded by a constant value Ytemp across the whole operating temperature range. This yields a bound on the clock misalignment that increases linearly with the time from the last calibration.
Long-term aging has significant impacts on the clock frequency accuracy and may affect the device even when it is not used for a long time (see Figure 1). A critical aspect of this effect is that it is time-variant, with the accuracy loss increasing over time.
Figure 1. Graphical representation of the model for aging accuracy loss: upper-bound (red) versus estimated model (blue). (Image: R. Filler and J. Vig)
However, datasheets typically report a single value, Yage (Tdata ), which bounds the accuracy at a fixed time Tdata.
The effect of long-term aging for both TCXOs and OCXOs was investigated in a 1993 study by R. Filler and J. Vig measuring the accuracies of oscillator models for several years. The study concluded that a logarithmic fit is better suited for long-term measurements, while a linear fit is better suited for initial measurements (t<30 days) and is a loose upper-bound for longer times. Because we are interested in establishing a prudential upper bound rather than a precise estimate, we use the constant upper bound Yage (Tdata) for all t<Tdata and a linear upper bound for t>Tdata. This leads to a linearly increasing bound on the time offset before Tdata, and a quadratically increasing bound after Tdata.
Finally, the misalignment due to the frequency calibration error accumulates over time. An off-the-shelf oscillator has an initial accuracy that depends on the frequency tolerance ftol. To improve this, a precise calibration is performed, trying to synchronize the RTC with the nominal frequency f0, such as by using PTP. The contribution to the accuracy loss given by calibration can be bounded by Ycalib, a value set a priori either by system design or during the calibration process itself, yielding again a linearly increasing bound on the clock misalignment.
Bound on the Total Misalignment. In general, the cross-correlation between the uncertainties is unknown; we can only consider the worst-case scenario where the total uncertainty is bounded by the sum of the single bounds. This choice represents a prudential and conservative approach that may yield a rather loose bound with very high probability.
Thus, considering that all terms in the clock error bound increase over time, we can bound the total misalignment as
(2)
Example Values from Datasheet Specifications
Based on the above result, we can deem a commercial oscillator suitable for OSNMA operation if B(TR )≤TL. We can then compare the requirements for different RTCs, focusing on TCXOs designed for GNSS receivers suitable for the automotive scenario, with f0=52 MHz and a target operating temperature range between –20° Celsius and +85° Celsius. We assume that devices are subject to a calibration process, such that YcalibYtemp; thus we have neglected the calibration accuracy loss. We report in Table 2 the values of the misalignment bound, B(TR ), for TR=2 years and the maximum reset period TR,max such that B(TR,max)≤TL, with a loose time synchronization requirement TL=165s, as computed form the specs found in the datasheets.
Table 2. Bound values B(TR) and TR,max computed using several RTCs’ datasheet specs with TL=165 s and TR=2 years.
Conclusions
To ensure the authenticity of the GNSS navigation message, the Galileo OSNMA protocol requires a loose synchronization between the transmitter and the receiver. The misalignment between transmitter and receiver clock needs to be lower than a threshold TL for the whole holdover period TR. In this article, we have investigated the causes of the misalignment and frequency deviation in clock generators commonly found on the market and defined a general relationship between TL ,TR and the specifications commonly found in datasheets. Finally, we examined several mass-market temperature-controlled crystal oscillator datasheets, evaluating their performance in terms of worst-case offset bound B(TR).
The bound represents a prudential conservative approach and may be rather loose. However, given the lack of a consistent statistical model, this is a reasonable solution. We conclude that most devices can satisfy the constraint B(TR)≤TL=165 s with a workshop reset period of TR = 2 years.
Acknowledgements
This study was conceived within the PATROL (Position Authenticated Tachograph foR OSNMA Launch) project, funded by the EU Agency for the Space Programme through the Fundamental Elements programme, under procurement No. GSA/OP/23/16 “Development, supply and testing of a Galileo open service authentication user terminal (OSNMA) for the GSA.”
The authors acknowledge the invaluable support provided by the PATROL technical team: Davide Marcantonio (Qascom), Fabio Pisoni, Giovanni Gogliettino and Domenico di Grazia (ST Microelectronics), Alexandre Allien and Francois Riou (FDC), Jacques Kunegel (ACTIA), Simón Cancela Díaz and Belén Villanueva Coello (GMV).
PATROL success was fostered by the commitment and support of Flavio Sbardellati (EUSPA Project Officer), Gonzalo Seco Granados and Alexander Rügamer (EUSPA external reviewers), Javier Simon (EUSPA reviewer), Ignacio Fernandez-Hernandez and Giovanni Vecchione (EC reviewers). The authors thank colleagues Giada Giorgi (UNIPD) and Lorenzo Dal Corso (Qascom) for reviewing this work.
The content of this publication does not reflect the official opinion of the European Union or of the EU Agency for the Space Programme. Responsibility for the information and views expressed therein lies entirely with the authors.
Francesco Ardizzon is a Ph.D. student and Nicola Laurenti an associate professor in the Department of Information Engineering of the University of Padova, Italy. Carlo Sarto is the head of the security engineering division and Giovanni Gamba the head of the SIGINT and EW division at Qascom S.r.l., in Bassano del Grappa, Italy.
REFERENCES
A. Perrig, R. Canetti, J. Tygar, and D. Song, “The TESLA broadcast authentication protocol,” RSA CryptoBytes, vol. 5, 11 2002.
I. Fernandez-Hernandez, T. Walter, A. Neish, and C. O’Driscoll, “Independent time synchronization for resilient GNSS receivers,” in 2020 International Technical Meeting of The Institute of Navigation, 02 2020, pp. 964–978.
I. Fernandez-Hernandez, V. Rijmen, G. Seco-Granados, J. Simon, I. Rodriguez, and J. D. Calle, “A Navigation Message Authentication proposal for the Galileo Open Service,” NAVIGATION, vol. 63, no. 1, pp. 85–102, 2016. [Online]. Available: https://onlinelibrary.wiley.com/doi/abs/10.1002/navi.125
L. Cucchi, S. Damy, M. Paonni, M. Nicola, M. Troglia Gamba, B. Motella, and I. Fernandez-Hernandez, “Assessing galileo OSNMA under different user environments by means of a multi-purpose test bench, including a software-defined GNSS receiver,” in 4th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2021), 9 2021.
“IEEE standard definitions of physical quantities for fundamental frequency and time metrology—random instabilities,” IEEE Std 1139-2008, pp. c1–35, 2009.
J. Vig, “Quartz crystal resonators and oscillators for frequency control and timing applications – a tutorial,” in IEEE International Frequency Control Symposium Tutorials, 2016.
M. Lombardi, “Fundamentals of time and frequency,” in The Mechatronics Handbook, CRC Press, 01 2002, ch. 17.
R. Filler and J. Vig, “Long-term aging of oscillators,” IEEE Transactions on Ultrasonics, Ferroelectrics, and Frequency Control, vol. 40, no. 4, pp. 387–394, 1993.
W. Riley and D. Howe, Handbook of Frequency and Stability Analysis. Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD, 2008-07-01 00:07:00 2008.
“Performance specification: oscillator, crystal controlled, general specification for,” MIL-PRF-55310F, 2018.
SimOSNMA provides vital test tools for Galileo’s emerging end-to-end security protocol
Spirent Communications plc and Qascom have announced a simulation test solution for the Galileo Open Service Navigation Message Authentication (OSNMA) mechanism.
SimOSNMA is designed to work with Spirent’s GNSS simulation platforms to test OSNMA signal conformance, which will bring new levels of robustness for both civilian and commercial GNSS uses.
The GSS9000 test system. (Photo: Spirent)
SimOSNMA provides developers with new simulation tools to test for OSNMA, the security protocol that enables GNSS receivers to verify the authenticity of signals distributed from the Galileo satellite constellation. Designed to combat spoofing, OSNMA ensures the data received is authentic and has not been modified in any way. It is now completing the test phase before its formal launch.
SimOSNMA enables developers to simulate and test OSNMA signals and features, allowing GNSS receiver manufacturers and application developers to accelerate and assure development programs.
Qascom has been a significant contributor to the development of Galileo OSNMA. The company helped create the main test vectors for early testing and led the Position Authenticated Tachograph for OSNMA Launch (PATROL) project, which is the European Union Agency for the Space Program (EUSPA) procurement looking at the implementation of OSNMA into automotive and mass-market GNSS receivers.
“During the development of the first OSNMA receiver prototype, we needed a tool that would allow us to run tests in a controlled and repeatable environment, generate reference data, test corner cases and system events that seldomly occur in reality,” said Carlo Sarto, head of Security Engineering Domain Area. Qascom. “SimOSNMA will allow industries and agencies to speed up the development and qualification of their systems.”
Since the inception of the Galileo project, Spirent has provided crucial simulation and test capabilities to many of the key organizations and projects responsible for development of the European Space Agency (ESA) program.
SimOSNMA is available now for Spirent GSS7000 and GSS9000 platforms.
A GNSS receiver is scheduled to land on the Moon in 2023, sent by NASA and the Italian Space Agency (ASI). The innovative GPS and Galileo receiver, provided by Qascom, will experiment with satellite-based positioning on the lunar surface.
The project, dubbed NEIL (Navigation Early Investigation on Lunar surface), is at the center of an agreement between ASI and NASA, linked to the CLPS 19-D mission (NASA’s Commercial Lunar Payload Service, Task Order 19).
The NEIL payload will be integrated into the Lunar GNSS Receiver Experiment (LuGRE), an ASI/NASA cooperation framework to develop activities in lunar and cislunar environments.
For the first time in history, GNSS positioning will be tested at almost 400,000 kilometers from Earth. The previous limit was a distance of 200,000 kilometers, tested in the Magnetospheric Multiscale (MMS) project.
NEIL will be integrated on the NASA’s Blue Ghost lunar lander in 2022. In addition to the NEIL payload, nine other experiments will land on the Moon. The mission is expected to be launched via a SpaceX Falcon 9, and the lander with aim for the Mare Crisium basin.
Image: NASA/Resse Patillo
Moon-Hardened Receiver
Under an ASI contract, Qascom will develop the dual-frequency GPS and Galileo receiver, as well as the entire radiofrequency chain (antenna, LNA, filters), all of which can withstand the extreme environmental conditions of the Moon.
The GPS and Galileo signals received from NEIL will be extremely weak due to the distance from Earth, and will be processed with specific algorithms allowing to calculate position and time, even if with reduced accuracy, both during the Moon transfer orbit and on its surface.
Image: NASA
“This experiment is of strategic importance for Italy, since it will bring our technology to the Moon surface,” stated the Italian Space Agency. “It contributes to strengthening the competitiveness of the Italian space sector and consolidates the strong collaboration between the Italian Space Agency and NASA in the satellite navigation segment as well as in the future Moon and Mars missions.”
NEIL provides also an important technical and scientific contribution to study how GPS and Galileo could be used for positioning and timing in future Moon missions, including for example the deployment of lunar satellite constellations, lunar rovers, the lunar space station Gateway and the infrastructures that are going to be developed in the frame of Artemis programs. The raw measurement collected will be used by the research community to study the lunar and cislunar environment and evaluate the future use of GNSS to support permanent missions.
In our 10th annual Simulator Buyers Guide, we feature simulator tools, devices and software from 10 prominent companies that aid GNSS receiver manufacturers in product design.
The GSS6450 RF record and playback system. (Photo: Spirent)
GSS9000, SimMNSA, CRPA test system, anechoic chamber testing, mid-range testing
Spirent Federal Systems provides PNT/GNSS test equipment that covers all applications, including research and development, integration/ verification, and production testing.
GSS9000. The GSS9000 Series Multi-Frequency, Multi-GNSS RF Constellation Simulator is Spirent’s most comprehensive simulation solution. It can simulate signals from all GNSS and regional navigation systems and has a recently-enhanced system iteration rate (SIR) of 2 kHz (0.5 ms), enabling higher dynamic simulations with more accuracy and fidelity. The GSS9000 supports restricted/classified signals, Alt RF, and other non-GNSS sensors. Users can evaluate the resilience of navigation systems to interference and spoofing attacks, and have the flexibility to reconfigure constellations, channels, and frequencies between test runs or test cases.
The GSS9000 Constellation Simulator. (Photo: Spirent)
SimMNSA. Spirent Federal has the first fully-approved MNSA M-code simulator. Authorized users of the GSS9000 series of simulators will be able to utilize the advanced capabilities of SimMNSA to create more robust solutions for their customers. SimMNSA has been granted security approval by the Global Positioning System Directorate.
CRPA Test System. Spirent’s Controlled Reception Pattern Antenna (CRPA) Test System generates both GNSS and interference signals. Users can control multiple antenna elements. Null-steering and space/ time adaptive CRPA testing are both supported by this comprehensive approach.
Anechoic Chamber Testing. Spirent’s GSS9790 Multi-Output, Multi-GNSS RF Constellation Wave-Front Simulator System is a development of the GSS9000. The GSS9790 provides the core element for GNSS applications that require a test system that can be used in both conducted (lab) and radiated (chamber) conditions.
Mid-Range Solutions. Spirent also offers solutions that cater to intermediate GPS/GNSS testing needs. The GSS7000 multi-constellation simulator provides an easy-to-use solution for GNSS testing that can grow with users’ requirements. The GSS6450 RF record and playback system enables repeated replay of a real-world GNSS/GPS test in the lab.
CAST-CRPA. The CAST-CRPA Simulation System produces a coherent wavefront of GPS RF signals to provide repeatable testing in the laboratory environment or anechoic chamber. The CAST CRPA system is configurable for any number of coherent outputs that users want.
With an intercard carrier-phase error of less than 1 millimeter, the CAST-CRPA Simulation System is extremely accurate.
The system generates a wavefront of GPS signals when its GPS RF generator cards are operated in a ganged configuration. Each generator card provides a set of GPS satellites coherent with the overall configuration. Several RF generator cards may be utilized together, ensuring phase coherence among the signal generator cards in each bank. The CRPA antenna, the antenna electronics and the GPS receiver can be tested as a unit with or without radiating signals.
CAST-CRPA features
Generates single coherent wavefront of GPS signals
Orolia advanced GNSS simulators offer a wide breadth and depth of simulation tools to test mission-critical positioning, navigation and timing (PNT) applications and scenarios. They are feature-rich and easy to use, providing a way to harden GPS/GNSS-based systems without the limitations of live-sky testing.
Skydel — Advanced Software-Defined Simulators
Skydel Simulation Engine. This flexible, high-performance simulator transmits GNSS digital signals in real time to many kinds of software-defined radios. Skydel uses graphics processing units (GPUs) to compute the digital GNSS signals of all simulated satellites, scaling from simple to complex use cases. Skydel simulates civil signals from global and regional navigation satellite systems, many kinds of GNSS receiver trajectories with high dynamics, and advanced jamming and spoofing. All Skydel models offer these features:
Easy configuration with intuitive UI and automation
Support for global constellations and frequencies
Support for jamming, spoofing and repeating, including jamming waveforms
Comprehensive API (Python, C#, C++, LabVIEW)
Advanced signal customization and scenario creation
Ability to integrate interference with no additional hardware
1000-Hz simulation iteration rate
IQ file generation and playback
Ability to record and export user interactions as Python script
GSG-8. This software-defined system GSG8 is a globally available hardware platform for aerospace and critical infrastructure applications. It will support future EU encrypted signals. The rack-mounted unit has the option of one to four RF outputs and is configurable.
BroadSim. Designed for military NAVWAR applications, the BroadSim software-defined simulator supports encrypted military codes (Y-code, M-AES and M-MNSA) and provides documentation and procedures for classified operations. BroadSim has two GPUs and four RF outputs. It runs on a custom Linux operating system, with RMF STIG support coming soon.
Skydel Anechoic. This simulator system for radiated over-the-air testing is designed for testing CRPA/multi-element antennas, antenna electronics and entire PNT systems in an anechoic chamber.
Skydel Wavefront. This GNSS simulator system for conducted wavefront testing is designed to test the jamming/spoofing resiliency of CRPA and multi-element antenna electronic systems, and for applications with high dynamics.
GSG 5/6 Scenario-Based Simulators. The GSG 5/6 enable testing of smart applications such as drones, the internet of things, connected cars and cellular. They provide a comprehensive set of pre-defined scenarios and the ability to create scenarios. They simulate all constellations and frequencies as well as movements and trajectories anywhere on or above Earth.
Application packages are available for real-time kinematic, eCall, high-velocity, jamming and sensors.
LabSat 3 Wideband. The LabSat 3 Wideband is a compact yet powerful multi-constellation and multi-frequency GNSS testing solution. The easy-to-use, one-touch record-and-replay function provides an efficient way to test and develop GNSS-based technology without the cost and limitations of live-sky signals.
It is lightweight and portable and makes it easy to collaborate with colleagues by sharing scenario files over the internet — making it a suitable testing partner for remote working. Additionally, the removeable solid-state drive (an SSD of up to 7 terabytes) and a two-hour runtime provided by an internal battery is ready for field testing in any environment.
LabSat 3 Wideband can record and replay up to three different channels at 56-MHz bandwidth across all major constellations and signals, including:
GPS: L1/L2/L5
Galileo: E1/E1a/E5a/E5b/E6
GLONASS: L1/L2/L3
BeiDou: B1/B2/B3
NavIC: L5/S-band
QZSS: L1/L2/L5
L-band correction services including SBAS
2x CAN and 4x digital input channels tightly synchronized with GNSS data
Future signal launches are also supported, including L2C, L5 and L1C
SatGen Simulation Software. SatGen software allows users to quickly create bespoke, accurate scenarios with their own time, location and trajectory that can be replayed via a LabSat GNSS simulator.
The latest version of SatGen can be used to create a single scenario containing all the upper and lower L-band signals for GPS, Galileo, GLONASS, BeiDou and NavIC.
High-end GNSS simulation solutions for R&D, integration and product testing
Constellator. Syntony’s GNSS simulator Constellator supports all constellation signals available and provides a high level of service in different ranges. It covers, in a single unit, a wide spectrum of use cases from entry-level with L1C/A up to very demanding configurations such as multifrequency and up to 660 L1C/A-equivalent signals. Extensively used in aeronautics, space and defense industries, Constellator answers complex requirements:
Standalone mode (on the ground and in space)
Multi-frequencies
All constellations and their signals, including BeiDou, Navic/IRNSS and QZSS
Hardware-in-the-loop (HIL) mode with zero effective latency and 1000-Hz update rate
CRPA generation capability
Capability to generate “Restricted Signals” through a dedicated interface, called PRN-Link
In the space industry, Constellator implements the advanced models (Earth gravity, drag, 3D ionospheric models, side lobes, etc.) needed to achieve accurate simulations for all kinds of orbits (from LEO to GEO and SSTO). Combined with other Syntony GNSS simulation products (interference generator, Echo recorder and player), Constellator can tackle challenging use cases such as testing of jamming, spoofing, multipath and multiple antennas. It is based on a software-defined radio, making it hardware-ready for future constellations, signals and codes. It is easily upgradeable and versatile.
GNSS Recorder and player. Echo is an ultra-high-fidelity GNSS record-and-playback solution that captures real-life signals and environments — for instance, from airplanes — and then replays them for R&D or production tests. Echo offers:
3 RF channels of 100-MHz bandwidth each (for the whole set of GNSS signals from all constellations)
16-bit resolution (I&Q)
From seven to more than 1,000 hours of record/replay capabilities depending on the configuration
The Echo platform allows full 16 bits of I/Q recording at 100 Mhz for three channels, simultaneously. As such, it provides the highest achievable record/replay fidelity. Echo-R can also record complex and very long realistic scenarios from a simulator. Echo-P can replay them with very high fidelity for long-run or production tests.
Please contact Remy Thellier (based in San Francisco) for North America at 415.599.9230, or contact the EMEA Sales team at: [email protected] syntony-gnss.com
+33.5.81.319.919
The advanced customization and configurability of Xidus enables users to perform rigorous and extensive testing of GNSS systems.
Test scenarios. Xidus meets all requirements regarding multi-GNSS, multi-frequency and multi-RF signal generation out of the box. Innovative Xidus signal extension and enhancement (SEE) technology allows users to integrate bespoke generation blocks into the signal generation path. In addition, Xidus’ advanced support capabilities allow remote support and updates, remote training and even remote scenario execution.
Easy hardware or software upgrades. Xidus has modular signal generation hardware that allows easy and robust field upgrades. New modules are automatically calibrated, allowing users to accomodate multiple concurrent navigation development projects.
Expert background. WORK Microwave has been designing and building GNSS simulators for more than 15 years. The Xidus hardware leverages WORK Microwave’s 35+ years of experience in the design and manufacturing of bespoke digital and analogue microwave products.
Xidus-Studio (Photo: Work Microwave)
Xidus-424 GNSS Simulator. The Xidus-424 has up to 128 LOS channels, 512 multipath channels and two RF outputs. It supports all GNSS frequencies and signals. It supports an update rate up to 100 Hz and has very wide dynamic power range configurability.
Xidus-648 GNSS Simulator. The Xidus-648 provides all the capabilities of the Xidus-424 plus additional features: up to 256 LOS channels, 1,024 multipath channels, four RF outputs and a 1000-Hz update rate.
Xidus-Studio client software. The software provides everything for testing GNSS systems: different vehicle models with 6DOF, multiple vehicle simulation, spoofing and meaconing, multiple TX antenna patterns, multiple RX antenna patterns, industry-standard error models and runtime distortions on individual channels. Xidus-Studio also allows the design of bespoke satellite orbits ranging from LEO to GEO. Available on Linux and Windows.
Xidus Series. Connect up to four Xidus units to produce a simulator capable of mega-constellation simulation, with precise phase synchronization across units.
GIPSIE-RTX (GNSS Multisystem Performance Simulation Environment – Real Time Extension)
GIPSIE-RTX is a fully featured GNSS signal generator with real-time streaming functionality, including real-time control of the simulation environment. It consists of a high-quality signal simulator as the hardware platform and a flexible and powerful GNSS simulation environment.
The multi-system and multifrequency-capable GIPSIE-RTX simulates arbitrary satellite orbits using a sophisticated orbit integrator. It is able to model all error sources, delays and propagation effects. These include various models for satellite clocks, ionosphere and troposphere, multipath, signal power, antenna patterns and noise. In addition, multiple types of signal interference, like jamming and spoofing, can be defined. Customized navigation message formats and contents can be used to simulate future GNSS signal features.
Besides generating RF signals, GIPSIE-RTX is also capable of directly simulating digital signals, taking into account user-defined modeling of a radio-frequency front end. Comprehensive data logging of all intermediate results is available for detailed analyses.
GIPSIE-RTX provides a real-time input interface and thus supports hardware-in-the-loop (HIL) testing, such as for automotive applications.
GIPSIE-RTX Features
GIPSIE-RTX is a new compact multi-channel high performance platform for complex and versatile GNSS testing. Features include:
Highly reproducible scenarios
Modeling of all error sources, delays and propagation effects
Interference (jamming and spoofing) simulation
HIL simulation
Synchronization of multiple simulators for advanced testing (e.g., array antenna)
QA707 is the cutting edge solution for global threat GNSS awareness and management. It is a GNSS simulator specifically designed to test cyber-attacks and authentication, and includes the simulation of GNSS interference, deception, jamming, spoofing and advanced cyber-threats such as data and code level attacks.
The high flexibility in the creation of the scenarios and the definition of the type of attacker allow cyber-threat and vulnerability testing for several applications,These applications may include, for example, autonomous driving and vehicle tracking, aeronautics and high dynamics applications, space GNSS receivers and timing.
OSNMA support. The Galileo Open Service Navigation Message Authentication (OSNMA) simulation is an opportunity to test the new Galileo data protected service against a number of known vulnerabilities in GNSS applications. The OSNMA simulator is also available as a standalone tool, allowing the generation of OSNMA data that can be used with third party simulators.
PC-capable. QA707 runs on a standard PC. It is compatible with several third-party hardware RF up-converters, including National Instruments’ USRP. Additionally, it can support customer-specific hardware through the hardware API interface.
QA707 main features
Multi constellation (currently GPS L1, GALILEO E1, SBAS L1).
Galileo OSNMA
RF simulation, binary file dump, signal record and replay
Support to SDR platforms and open API for custom RF upconverters
Runtime streaming of scenario information over UDP (motion, channel data)
Data level cyber-attacks
Accurate spoofing signals control, trajectory spoofing, signal replay attacks
Narrow band, wide band, frequency modulated jamming
Integrity threats (on request): evil waveform, erroneous ephemerides, code/carrier divergence, low satellite signal power, excessive range acceleration
The 18-channel miniature full-constellation CLAW GPS Simulator is a fully self-contained, low size, weight, power and cost (SWaP-C) miniature GPS simulator. It is very popular in manufacturing environments as well as R&D applications that require consistent and repeatable local GNSS signals at low price points.
The CLAW simulator does not require external computers for processing and control — it works fully self-contained by simply applying power, and storing location/time/date data in internal non-volatile (NV) memory, or by storing complex vector data to simulate highly dynamic scenarios.
The CLAW also can be used to transcode NMEA or SCPI position/velocity/time (PVT) data into GPS RF signals. JLT offers an easy to use, highly configurable and cost-free SimCon Windows application program that is downloadable from the JLT website.
The SimCon application allows random scenario generation and is thus usable to simulate leap-second events, week 1023 rollover events, or any other GPS live-sky scenarios, including highly complex yet easy-to-create dynamic vector simulations.
For authorized U.S. government users, a version that does not have altitude and velocity limitations is popular for low-Earth-orbit (LEO) simulations. Multipath simulation allows use of the entire 18-channel simulator capability.
The unit can be field-upgraded with an easy to use in-field software upgrade feature. The CLAW is also very useful in GNSS receiver sensitivity testing for R&D or mass-production assembly lines as it allows accurate control of RF output power ranging from –100 dBm to less than –130 dBm with 0.1-dB resolution and typically better than 1-dB accuracy over the controllable power range.
The CLAW GPS Simulator also has a built-in RF signal generator with sweep, CW and random noise functions that are useful in simulating GNSS jamming scenarios, as well as GPS spoofing scenarios. The simulator comes in an FCC-certified metal desktop enclosure with numerous accessories.
For 2021, the CLAW firmware has been updated to allow live-sky almanac and ephemerides to be automatically uploaded from various externally connected GNSS receivers. This makes simulations using real-time live-sky constellations (such as used in simulating spoofing attacks) an easy task. A free firmware update is available from JLT.
The MGSE product family creates a versatile GNSS test and simulation environment that improves the development, qualification and certification process of GNSS receivers within development phases and for the validation and certification in end-to-end tests.
MGSE enables mobile and stationary interference monitoring, such as for protecting critical infrastructures (based on MGSE REC), and can be used for interference mitigation if combined with TeleOrbit’s GNSSA-6E (six-element antenna array) or its GNSSA-DCP (dual circularly polarized antenna).
With MGSE REC-REP 2.0 users can, among other tasks, record Galileo PRS signals in a real user environment and replay them for Galileo PRS receiver testing. It is also possible to replay simulated GNSS signals.
MGSE SIM-REP supports the development of software-defined radios/receivers (SDR) or specialized algorithms by creating a simulation environment that provides the possibility and flexibility to use synthetically generated GNSS data and recorded real-world samples — both exactly reproducible.
For jamming and spoofing test and evaluation, TeleOrbit offers a sophisticated solution based on the MGSE simulation, recording and replaying product family.
Technical background. The multi-band RF front-end (MGSE REC) receives the GNSS RF signals in different frequency bands simultaneously to obtain digital IF data, which can be used for GNSS multi-system signal analysis and comparison.
MGSE REC also includes a reception board to receive and process the NavIC S-band signal in addition to other L-band frequencies.
The MGSE Replay Unit (MGSE REP) includes a flexible multi-band RF replay device that can stream simulated and recorded raw IF data to a digital baseband output or to an analog RF signal.
MGSE REP simultaneously supports up to two independent RF channels and up to four GNSS signals, such as L1, E1, B1, G1.
Architecture of the X-Survey antenna. (Image: Harxon)
Blocking interference
Interference can be blocked at the data-collection stage, using an advanced antenna.
Harxon’s X-Survey is a compact high-precision GNSS antenna. It provides superior navigation and communication performance in surveying applications. A frontal band-pass filter setting effectively rejects out-of-band signals before they enter the low-noise amplifier of the antenna for signal augmentation.
Meanwhile, the filter itself has insertion loss, making a low insertion loss filter a prerequisite for optimal system noise reduction. To avoid this situation, X-Survey employs ceramic filter with low signal loss and in-band flatness to significantly improve system anti-interference capability and ensure reliable signal receiving.
The mosaic module provides AIM+ mitigation technology. (Image: Septentrio)
Septentrio began to tackle the interference problem more than 20 years go, designing and manufacturing high-precision GNSS receiver technology with emphasis on reliability and robustness. The result is Advanced Interference Monitoring and Mitigation (AIM+) technology which secures the company’s GNSS receivers against jamming and spoofing interference. AIM+ has recently been upgraded with an extended anti-spoofing functionality.
Building on its existing spoofing detection, Septentrio has developed a new anti-spoofing algorithm for its commercial receivers. The algorithm leverages Galileo Open Service Navigation Message Authentication (OSNMA) for spoofing resistance. It was developed in the framework of the GSA FANTASTIC project with the goal of improving the security of timing in critical infrastructure.
Mobile devices and cloud applications increasingly rely on GNSS technology used by telecom companies. Having secure and robust GNSS receivers in telecom infrastructure is key to reliable mobile and positioning services.
Alternative signals
Prototype design of the PNT-5500. (Image: Jackson Labs)
A new reference receiver, Jackson Labs’ PNT-5500, includes a custom Satelles/Iridium (STL) and GPS receiver, and an optional Edge Grandmaster/PTP1588 capability.
Using STL signals received directly through a small antenna mounted on the device, the PNT-5500 provides nanosecond timing synchronization in GPS-challenged environments, including deep indoors (no rooftop antenna required). It provides secure timing during GPS jamming and spoofing events. The unit is designed for high-volume, low-cost telecom small-cell synchronization, and is optionally available with holdover oscillators such as DOCXO and CSAC atomic clocks.
While GPS is vulnerable to jamming and spoofing, the PNT-5500 uses the Iridium infrastructure to provide assured timing that is impervious to spoofing and provides 1,000X higher signal strength compared to GPS, producing jamming resilience and deep-indoor reception. The system is designed to be fully interoperable with legacy equipment, for a low-cost, fully-deployed Assured PNT capability alternative to GNSS today.
Assessing vulnerability
Image: Qascom
Qascom offers several robust PNT services and products, including vulnerability assessment, robust navigation and interference localization.
Vulnerability assessment is the key proactive measure, using cutting-edge signal generators to design and test tomorrow’s receivers. For example, Qascom’s QA707 GNSS simulator tests receivers against emerging jamming and spoofing threats, allowing OEMs to discover in advance any potential vulnerability that may affect the availability and the integrity of the signal.
Robust navigation is supported by advanced mitigation algorithms, equipped with pre and post-correlation algorithms, as well as the inclusion of sensor fusion and dead-reckoning features.
Qascom’s attack detection products include external monitoring networks that support GNSS receivers. These networks provide an accurate perception of the operational environment, allowing threat characterization, classification and forecast. For instance, Qascom’s QB100 enables the simultaneous threat detection and localization by means of a monitoring cluster that delivers 24/7 situational awareness to a set of target receivers within the protection area.
Reliable timing
Meinberg provides GNSS timing solutions for nearly every application type. Its reliable systems are based on firmware built from the ground up by an in-house team of expert engineers. All Meinberg firmware is constantly checked and updated to ensure it adapts to evolving industry standards.
The company’s synchronization systems use a built-in Meinberg GPS receiver or combined GPS/GLONASS clock. They also support a broad range of reference time sources, including 1 PPS, 10 MHz, inter-range instrumentation group time codes (both direct current level shift and amplitude modulated), or network time protocol (NTP) servers. This redundancy in synchronization sources means Meinberg’s systems are protected against a loss of signal. Furthermore, to ensure the correctness of the reference time and date, an intuitive Secure Hybrid System (SHS) feature includes an independent secondary clock for enhanced plausibility checks.
For superior holdover performance, the Meinberg XHERB (with one or two Rubidium modules from Stanford Research) can be added to the Meinberg Intelligent Modular Synchronization (IMS) time and frequency systems. If the reference clock loses its sync source, the XHE chassis will provide the sync reference for the IMS chassis based on its holdover performance.
