Orolia, a resilient positioning, navigation and timing (PNT) company, has entered into a definitive agreement to acquire Talen-X.
Talen-X is a U.S. technology innovator with the ability to characterize, enhance and implement advanced techniques and products to solve real-world GNSS vulnerability problems. It has expertise in GPS/GNSS performance, requirements, testing, integration and threat mitigation.
Orolia has completed 10 acquisitions since 2007, including Spectracom, Spectratime and McMurdo brands. The transaction is subject to customary closing conditions and approvals required by the U.S. Defense Security Service (DSS) and the Committee on Foreign Investment in the United States (CFIUS).
Through this acquisition, Orolia said it will significantly enhance Assured PNT capabilities across the global company’s portfolio to support mission-critical applications. The additional resources also strengthen Orolia’s commitment to serving the U.S. government, with further expansion of domestic capabilities and a greater U.S. footprint. Toward that end, the companies will reinforce their commercial cooperation to maximize market awareness and access.
“Military personnel know that accurate and trusted time and position information is a critical enabler for almost all warfighting functions and systems,” said Orolia CEO Jean-Yves Courtois. “Reliable PNT data are critical for communications, sensors, network synchronization, situational awareness, command and control or search and rescue missions. This acquisition reinforces Orolia’s position as a major supplier of Assured PNT technology and enhances our ability to offer unique end-to-end solutions.”
Talen-X has extensive technology integration and PNT engineering resources that will enable Orolia to rapidly develop and offer new, superior products and services to the U.S. market.
“Our culture of innovation, together with our demonstrated testing capabilities, will complement Orolia’s global technology expertise and significantly enhance the reliability, performance and safety of military operations,” said Tim Erbes, CTO of Talen-X.
Designed primarily for applications such as homeland security, Spectracom’s 8230AJ antenna provides protection in high-interference environments where additional resilience is needed, such as communications networks, financial systems and power grids, the company said.
Orolia, through its Spectracom brand, said the antenna, Model 8230AJ, is a drop-in replacement for the company’s Model 8230. Its conical antenna pattern rejects interference from the horizon and is simple to mount using the same pipe supports, without new cabling. All that is required is a new bracket.
“Model 8230AJ is a high gain (40 dB) GNSS outdoor antenna covering GPS L1, GLONASS L1, BeiDou B1, Galileo E1, and QZSS L1,” said David Sohn, product manager at Spectracom. “It uses a three-stage low noise amplifier, a mid-section SAW, and a tight pre-filter to protect against saturation by high level sub-harmonics and L-band signals. It is designed especially for harsh environments, is IP67 rated, and improves resilience and protects against jamming and spoofing.”
According to the company, the AJ antenna rejects signals for the lower elevation angles – where most interference comes from – and only receives signals from the higher elevation angles where the satellites are. While this reduces the number of satellites the receiver will see, for timing applications only a few satellites are needed. Moreover, with multi-constellation receivers, an increasing number of satellites are available.
With the increasing prevalence of jamming and spoofing, industries with critical infrastructure must take measures against interference. GPS and GNSS in general have well-known vulnerabilities and limitations that require protection and mitigation: the signals are easily disrupted by unintentional interference from radio transmitters, they are extremely weak, cannot penetrate buildings and can easily be jammed, and civilian signals are not encrypted and can easily be spoofed.
The new anti-jam outdoor antenna is appropriate for anyone who uses a time server, including Spectracom customers who own a SecureSync, VersaSync or Netclock, according to the company.
Tersus David RTK is a real-time kinematic solution for centimeter-level accuracy using a smartphone. By plugging into a smartphone with a USB cable, The Tersus David turns the phone into an RTK rover, geographic information system (GIS) collector and RTK base. It supports GPS L1/L2, BeiDou B1/B2 and GLONASS G1/G2 signals. The rugged design enables it to operate in harsh environments.
The Riegl VMX-2HA is a high-speed, high-performance dual-scanner mobile mapping system that provides dense, accurate and feature-rich data at highway speeds. With 2 million measurements and 500 scan lines per second, the turnkey solution is suitable for survey-grade mobile mapping applications. The powerful technology in the Riegl VMX-2HA is comprised of two Riegl VUX-1HA high-accuracy lidar sensors and a high-performance INS/GNSS unit housed in an aerodynamically shaped protective cover. A camera interface for up to nine optional cameras enables the lidar data to be complemented by precisely georeferenced images.
The ZEB-REVO RT is the next generation of the ZEB-REVO — GeoSLAM’s lightweight, handheld laser scanner that allows rapid, simple mapping of complex, indoor and multi-level spaces. The ZEB-REVO RT uses Wi-Fi technology to seamlessly connect the scanner to a mobile phone or tablet, allowing for real-time data visualization as the user walks and scans. The simultaneous scanning and processing of 3D data removes the need for post-processing, effectively slashing project survey times in half. The technology is so rapid, users can scan and process a three-story building in 30 minutes.
MapAnything Connector for ArcGIS gives users a map view of Esri ArcGIS Online data inside Salesforce with their organizational data for strategic planning and analysis. The add-on app serves as a bi-directional integration layer between the programs, enabling customers to access their ArcGIS mapping and location intelligence inside the MapAnything Platform. Once connected, the MapAnything user interface helps Salesforce users view and interact with Esri maps and data alongside their existing customer and business data, exposing new opportunities to drive revenue and increase efficiency; improve decision making by aligning two core systems of record, the GIS system and the customer relationship management (CRM); and make it easy for GIS professionals to share insights seamlessly with their counterparts. The application has uses across retail, commercial real estate, telecommunications and economic development.
Generates Realistic Test Scenarios for a wide variety of applications
The SMW200A GNSS simulator can be extended to up to four RF outputs and allows GNSS signals to be simulated simultaneously in multiple frequency bands for multiple antennas. It can internally simulate a complex interference environment in parallel with GNSS signals. To test multi-frequency and multi-antenna systems, users have access to 72 GNSS channels that can be assigned to up to four RF outputs. The SMW200A can generate QZSS and SBAS signals as well as GPS, GLONASS, Galileo and BeiDou signals, enabling users to quickly and easily verify the position accuracy of their receivers under realistic conditions. An internal noise generator can generate complex interference scenarios with multiple interferers.
Multi-frequency, four constellations for survey and GIS
The Altus NR3 is a multi-frequency, quad-constellation (GPS, GLONASS, BeiDou and Galileo) RTK receiver for survey and GIS applications. It features Septentrio’s AIM+ interference mitigation and monitoring system, allowing continued operation in the presence of both intentional and non-intentional interference. It combines advanced GNSS features with a robust communications suite in a compact, low-power and easy-to-use unit. The Altus NR3 is configurable as either a rover or a base station. It offers one-touch logging and Septentrio’s on-board web interface so users can monitor and configure the unit as well as collect data using any Wi-Fi-capable device.
VersaPNT provides virtually failsafe battlefield navigation, even in GPS-denied environments, to protect critical networks. The new, ground, air or sea vehicle-mounted unit is designed for military environments, with a ruggedized, compact, low-power and lightweight form factor. It provides continuous mission assurance and command, control, communications, computers, intelligence, surveillance and reconnaissance (C4ISR) support, even in hostile environments.
The SyncServer S650 SAASM server incorporates a Selective Availability Anti-Spoofing Module (SAASM). The SAASM capability provides a highly secure, accurate and flexible time and frequency platform for synchronizing mission-critical electronics systems and instrumentation applications in the defense market. The SAASM received the GPS Directorate security approval to incorporate a military-grade, GPS SAASM receiver module, enabling U.S. armed forces to deploy features of the commercial SyncServer S650 in a military-grade configuration and allowing for a migration path to GPS Military Code (M-code) support.
Superior multi-constellation tracking for uavs, survey vessels
The multi-constellation D-Helix Antenna is capable of superior tracking of signals from GPS L1/L2 L-Band, GLONASS L1/L2, BDS B1/B2/B3 and Galileo. The quadrifilar helix design of low wind-resistance makes it suitable for UAV positioning and navigation. The increased antenna gain and beamwidth ensure better signal receiving performance at low elevation angles; the low noise design also reduces interference and improves signal quality. The antenna can be used in UAV patrol, UAV plant protection and for unmanned patrol and survey vessels.
Helps enterprises efficiently manage their drone operations
FlightHub is a new software solution that helps enterprises and drone service providers efficiently manage their drone operations from a single platform. A web-based service, FlightHub enables the secure management of real-time drone operations, flight data, drone fleets and pilot teams to meet the needs of the expanding global commercial drone industry. Users can view their teams’ remote drone operations from one place in real time.FlightHub provides enterprises a clear, centralized view of their company’s drone operations to enable onsite pilots to more effectively collaborate with offsite teams. The Map View and Real-Time View features display telemetry, camera and sensor data for faster, more informed decision making.
The new MR6442AX IP 4MP dome camera is suitable for demanding outdoor installations in challenging lighting conditions, such as schools, parking lots and sports stadiums, as well as city and perimeter surveillance. It features brilliant video quality, a 2.8 to 12 mm Varifocal-Auto iris lens, 100-db high dynamic range (HDR) and built-in Sense up+ low light technology. Intelligent video surveillance (IVS) functionality is a cornerstone of LILIN IP M-aeries cameras. The MR6442AX IVS analytics include advanced motion detection, object counting and tripwire detection, allowing the camera to detect when an object or person has breached an area such as the entrance to a building or parking lot. The MR6442AX is outdoor-ready out-of-the-box with an IP66 rating for rain and dust resistance, suitable for perimeter protection where early detection of an intrusion attempt is critical.
The Parrot Bluegrass Agricultural Solution includes a powerful quadcopter equipped with a full high-definition front camera and embedded Parrot Sequoia advanced multispectral sensor; flight planning mobile application with Pix4Dcapture; data processing with AIRINOV FIRST+ cloud platform; and a long-range remote control, the Parrot Skycontroller 2. Parrot Bluegrass is easy to set up , fly and repair, with Pix4Dcapture autonomous flight capability. It can automatically cover up to 30 hectares at 70 meters / 230 feet flight altitude per battery (25 minutes per battery).
Automatically detects, locates, tracks and takes over UAS controls
The Airfence 5.0 UAS countermeasure platform, updated from Airfence One, provides new and improved directional finding along with detection, tracking and long-distance jamming capabilities. It is designed to protect militaries, airports, prisons and private companies from rogue drones in illegal and potentially life-threatening situations. Airfence 5.0 is certified rugged and offers compact out-of-the box setup and installation. The update incorporates lessons learned from key projects with the FAA, NASA, the U.S. Marine Corps and the European Commission. Airfence 5.0 includes updates focused on increasing the detection rate and level of data packets received, enabling for real-time actionable insights.
The HumX plug-in turns older model autos into smart cars. It equips the cars with features like using GPS for roadside assistance, Wi-Fi hotspot for up to 10 devices, maintenance reminders and auto health diagnostics. HumX uses safety features such as speeding and boundary alerts, vehicle diagnostics, driving history and emergency assistance (with crash detection capabilities). It allows travelers to stay safe with pinpoint roadside assistance, turn-by-turn navigation, live traffic updates and a mechanics hotline for certified, expert advice. HumX is sold with an equipment fee, a one-time activation fee and a monthly subscription.
Enables fleets to improve safety, productivity from a Samsung device
Omnitracs and Samsung Electronics America are partnering to help the transportation industry address the Federal Motor Carrier Safety Administration (FMCSA) Electronic Logging Device (ELD) Mandate. The solution combines Samsung smartphones, tablets and security solutions with Omnitracs’ XRS fleet management software to improve safety, data security and productivity for U.S.-based fleets. Drivers can use their mobile device to monitor hours of service (HOS) logs to comply with legal requirements during on- and off-duty management of vehicles. Electronic tracking of HOS increases speed and accuracy of reporting, because drivers can track their hours in real time instead of fixed increments, such as in manual entry methods. The solution provides fleets with key driver performance analytics, including fuel usage, drive time, speed, driving behavior, driver vehicle inspection reporting (DVIR) and trip data to improve driver safety, lower costs and increase productivity.
Virtually everyone in the industry agrees that threats to military positioning, navigation and timing (PNT) are real; the threats continue to be newly emerging, and they are growing in complexity.
“We value the idea of open architecture and universal communications buses to make it easier to incorporate the latest in technologies in a timely manner without system redesign,” said one webinar speaker, and the other three speakers agreed.
Though designed with military applications in mind, the webinar will provide multiple points of relevant reference for non-military users and applications as well.
Here’s an advance peek at the topics that participants will hear in detail at 1 p.m. Eastern (10 a.m. Pacific) in Thursday’s webinar.
Mikel Miller
Vice President for PNT Technologies at Integrated Solutions for Systems (IS4S); Former U.S. Air Force Research Laboratory
Introduction to the problem
Situation today
Situation in the future (where we want to be in ~5 years?)
Open architecture
Communications problem/solutions overview
Cybersecurity problem/solutions overview
PNT problem/solutions overview
NetAssure introduction and details
Excerpt from Miller’s presentation. (Credit: Mikel Miller)
Lisa Perdue
Product Manager and Applications Engineer, Spectracom
Introduce the categories of solutions – Protect, Detect, Mitigate, Test
Discuss several technologies in each category brief overviews
Protect – Antennas – AJAS and Horizon Blocking
Detect – receiver algorithms, multiple receiver integration, system level monitoring and alerting
Mitigate – Augmentations – STL and eLoran, system level mitigation
Test – just a reiteration that new threats are always emerging and we need to be able to test vulnerabilities to the latest emerging threats – in a timely matter
Discuss Layered approach that include not only the technologies, but also proper integration
System design to support easy addition of new technologies and advancements
Supporting the open architecture point that Mike made earlier
Victory bus
Mike Jones
Capability Lead for Array Processing, Roke Manor Research
Protect, Toughen, Augment strategy – related to the Protect, Detect, Mitigate, Test strategy introduced Lisa Perdue
Deeper dive and introduction into specific technologies
Augmented-Reality Jammer geolocation
Latest anti-jam antennas (I am only going to mention the fact that AJ antennas exist and their main purpose – feel free to provide more details in general or about specific antennas)
Anti-spoof (is this about M-Code, receiver algorithms, system algorithms, or all of these?)
Visual sensors
Inertial Sensors
Randy Villahermosa
Executive Director, iLAB, The Aerospace Corporation
Project SEXTANT: New Thinking on Alternative PNT
To Cope with increasing disruptiveness: Modify, Augment, Substitute, Reach a New Paradigm
Major Findings: GPS is vertically integrated, with no obvious ‘Drop-In’ replacement; Novel combinations of multiple approaches is fertile ground for PNT innovation. However, many experts have been working on GPS alternatives for some time with no clear consensus crystallizing on a path forward.
An independent body is needed to evaluate and coordinate Alternative PNT concepts for critical functions
Virtually all defense and security applications of GPS/GNSS require additional technology to protect assets and missions against signal interference, whether jamming or spoofing. The upcoming free webinar, Resilient PNT for Military Applications, gives a primer on several of these technology options. Mitigation in this context means that after isolating the unwanted signal, quickly rejecting and replacing it, causing minimal system degradation. In essence, this involves the use of augmentation technologies and diversification strategies to supplement GPS/GNSS, thus reducing the dependence on it.
Applications relevant to this approach include: Airborne: Observation payload (radar, optronics, electronic warfare), flying test bench, flight analysis, tactical UAV navigation;
Ground: Blue Force tracking, vehicle navigation, satcom on the move (SOTM), Anti IED jamming systems, mobile radios and C4ISR, robotics;
Marine/Naval: Sensor support (radars, sonars, optronics, electronic warfare), communication networks, offshore/DSO platform.
Possible sources of such additional technology include those shown in the accompanying figure:
Click to enlarge.
The webinar is targeted upon the needs of systems engineers, system integrators, communication engineers, information system security engineers, validation engineers, test engineers, defense engineers, contractors and consultants, application engineers, systems and requirements analysts and system administrators who wish to firm up their understanding of resilient PNT and expand upon the alternatives available to them. Speakers on the webinar will cover the topic from a range of perspectives.
Mike Jones has worked on a variety of UK and US military airborne platforms around the world. He specializes in the simulation, modeling and hardware implementation of advanced signal processing algorithms, and has led a number of FPGA and ASIC designs for radar, GPS and communications systems.
Mikel Miller began his career as a satellite systems engineer with the U.S. Air Force, holding numerous test, research and development, and program management positions. He retired with a Ph.D. and rank of lieutenant colonel. He worked until recently as chief scientist for PNT Technologies for the Air Force Research Lab Sensors Directorate, and is now a vice president at Integrated Solutions for Systems (IS4S).
Miller will broaden the discussion to encompass all three technologies that evolved military applications and platforms now require for synchronized, precision operations: resilient PNT, resilient communications, and resilient cyber. A system-of-systems architecture that integrates and optimizes these three technologies is required to provide trusted and resilient PNT information in GNSS denied/degraded environments.
Randy Villahermosa, executive director, iLAB, The Aerospace Corporation, will speak on research concepts in complementary PNT, including open-source frameworks and the potential role of signals-of-opportunity navigation. The iLab is a venue for “exploring, prototyping, and collaborating.”
Lisa Perdue, an expert in testing critical GPS and GNSS systems, has trained hundreds of engineers and technicians who are responsible for high-reliability positioning, navigation and timing (PNT) applications. Perdue is Spectracom product manager at Orolia, where she directs the organization’s GNSS simulation activities and contributes to its entire portfolio of resilient PNT solutions. She has more than 15 years of navigation and RF systems experience, including 10 years of service with the U.S. Navy, where she was a certified master training specialist.
Spectracom’s perspective on secure military systems is concisely set out in a whitepaper, “Making Military PNT Systems Resilient Against Threats: Recent Advances.” After an overview of the field in which many terms and concepts are carefully and helpfully defined, the whitepaper explains the advantages of the new Satellite Time and Location (STL) service. This is a paid option available on the company’s VersaPNT hardware unit, combining a GNSS receiver, inertial measurement technology and high-performance timing oscillators to provide assured PNT in GNSS-degraded and denied environments.
STL is a new technology available today to harden GNSS-based timing and frequency systems, and in some cases even to replace the GNSS reference; the adaptation of this technology to positioning and navigation applications on slow-moving mobile platforms is currently under development. The STL signal is broadcast by the Iridium constellation of satellites in low-Earth orbit.
VersaPNT reduces size, weight and power (SWaP) by combining the the PNT functions of multiple independent subsystems in one portable unit with a modular architecture. For improved resiliency, optional interference detection and mitigation (IDM) software can be added, as well as other services such as STL and BroadShield.
“Prepare for Tomorrow: Find Vulnerabilities Today” was the title of our wide-ranging webinar in July that focused on GNSS signal simulation for jamming and spoofing scenarios. We did not have time to address all the questions posed by the audience, so we return to them here.
Q: While testing receivers, realistic scenarios for jamming and spoofing are very important. What is the typical approach to set the number of interference sources, their type and main signal parameters?
Two different approaches are common, those involving the use of an anechoic chamber and those which are lab-based. Each approach has its limitations and merits. Each approach must address the number of significant interferers, their signal powers and the waveforms of the interference signals. Each must also consider the geometric arrangement of these interferers relative to the antenna under test and relative to the simulated constellations under test.
Changes in signal phase, signal Doppler and signal power are as important for the interference signals as they for the wanted GNSS signals. These changes are caused by the simulated motion of the vehicle and potentially the motion of the interferers. These changes should also include the impact of terrain surrounding the vehicle and the interferers, and also the gain and phase patterns of the receive antenna on the vehicle and the transmit antennas on the interferers. Some interferers might be discounted from the significant set due to their signals being masked from the vehicle by the terrain or antenna patterns or by them being too far from the vehicle to have an impact. These interference signals may become significant as the scenario progresses due to vehicle or interferer motion.
Simulator graphical user interface. (Image: Spirent Federal Systems)
Q: In GNSS navigation systems for commercial applications, what emphasis of design effort should be on anti-jamming/anti-spoofing over improving the navigation accuracy?
Commercial applications is a broad area, so it will depend on the particular application as to whether it needs more accuracy or more resiliency against AJ/AS, but in general, the accuracy of GNSS is fairly mature. Standard GNSS offers accuracies on the order of ~1 meter. Centimeter accuracy can be achieved with differential or real-time kinematic (RTK). Multi-constellation use can increase availability in areas with limited sky view such as urban canyons. Multi-frequency can aid in the reduction of multipath and improve accuracy. If the application needs accuracy, these features are readily available.
However, integrity and resiliency are growing needs in commercial applications, especially ones that are in critical operations. Much more can be done to detect jamming and spoofing than what is in standards GNSS receivers today. In our systems, we include an additional software layer called BroadShield, which monitors internal state variables of the receiver, and will alarm on detection. Additional sensors combined with the GNSS receiver such as an inertial measurement unit (IMU), magnetometer, odometer, or even the much stronger Satellite Time and Location (STL) signal offer augmentation during periods of GNSS denial, or in the case of spoofing, authentication of the navigation solution.
While both jamming and spoofing are intentional attacks, they are highly different in their set-up and serve very different purposes. Due to their simplicity, most jamming attacks can be mitigated thanks to adaptive filtering or pulse blanking. On the other hand, spoofing is a malicious attack, highly complicated, and requires knowledge of the GNSS signal structure as well as precise timing and positioning.
The question is thus whether one should emphasize navigation accuracy over the ability to output a position (jamming case) or the possibility to output a completely erroneous position (spoofing case). The answer lies, obviously, in the end application and the coupling of GNSS receivers with other systems. High-precision non-life-critical applications should emphasize navigation accuracy while implementing simple jammer filtering strategies. Life-critical applications, being often coupled with other systems, should ensure the reliability of the solution even if that means being unable to compute a position due potential threats.
Q: Do you have GPS/inertial navigation system (INS) test capabilities?
The CAST-3000 EGI integration system produces GPS RF signals commensurate with simulated IMU sensor data to provide repeatable testing in the integration laboratory for a wide range of military and government applications.
CAST GNSS/INS simulators generate high-fidelity signals required for emulating the legacy GPS signals as well as those used by next-generation navigation technologies. This is because our sole business focus is supplying GNSS simulators, GNSS/INS test equipment, and GNSS/INS support services to government and military avionics laboratories, prime contractors, and GNSS receiver manufacturers. For 35 years we have provided off-the-shelf products to both the government and U.S. major defense contractors.
CAST EGI integration tools are used by Northrop Grumman and Honeywell and are now also being used in integration laboratories worldwide. Our equipment supports system integration in major weapons platform labs and development at major military contractor labs. CAST simulators produce high-quality, accurate signals that are used in government, military and commercial labs around the globe.
Our NCS TITAN GNSS simulator is able to emulate the presence of IMUs and micro electro-mechanical systems (MEMS) sensors with the optional available real-time IMU/Sensor Emulation Package (SEP). The SEP upgrades the TITAN to support the simulation of inertial sensors, which nowadays are implemented as MEMS, among others, and of other common aiding sensors. To obtain more accurate positioning for location-based services and navigation, GNSS chipset and receiver manufacturers as well as system integrators combine more and more GNSS navigation with such sensor fusion or signals of opportunity.
The optional SEP enables controlled and progressive testing of sensor-fusion algorithms when used with NCS Control Center operating software. This software supplies the SEP with an internally- or externally-generated center-of-gravity (CoG) trajectory for the device under test.
The various sensor models to be emulated by the SEP run within the Control Center software. The device under test (vehicle) input trajectory at the CoG passes through the sensor model, which in turn generates the appropriate sensor output, by taking into account the corresponding error model for each sensor defined.
We have added the capability to emulate INS/IMU data in addition to GNSS signals to our Constellator simulator, to offer to the customers a complete testing platform. Constellator can simulate up to six gyrometers and six accelerometers. The attitude of each sensor is defined with respect to the vehicle axes. Deterministic errors can be configured to simulate the axis misalignment and scale factors, and biases can be defined in order to simulate realistic sensors. Stochastic error models are also available such as random walk or Gauss-Markov models for each sensor (gyrometer or accelerometer) to improve the sensor emulation fidelity.
Q: Do you have detailed scenarios for jamming and spoofing in timing use of GNSS receivers, that is, involving time synchronization for telecommunications companies?
The simulated jammer’s signal specification must be very flexible in order to faithfully simulate real-world jamming events. For example, the jammer’s spectral shape should be flexible enough to simulate a Blue Force electronic attack (BFEA) on a GNSS receiver.
Also, the simulator should be able to simulate dynamic scenarios by varying the power of the jammers as a function of their trajectories and as a function of different antenna patterns.
Sometimes when testing receivers, the simulated jammers should replicate pre-recorded waveforms from real world. The ability to play back the pre-recorded IQ-baseband signal in conjunction with GNSS signals is another powerful feature of a simulator. Simulation of spoofing attacks on a GNSS timing receiver is only possible when the GNSS simulator provides fine-grained control of transmitted signal. This includes controlling the offsets on the pseudoranges with additive ramps, as well as individual signal power levels at very precise points in time.
Also, the GNSS simulator must be able to synchronize itself with the live sky’s GNSS signal. Another way to achieve realistic spoofing is to use two simulators controlled independently (that is, full control on constellation, navigation message, propagation time offset, power and so on).
FIGURE 1. Real-world jamming simulation must take into account key factors such as varying jammer power, as a function of their trajectories and antenna patterns. (Image: Skydel)
Q: Please discuss how to simulate a smart spoofer that would generate a replica of a constellation (or all constellations) and then produces two full RF transissions: one that is the true signal, and a strong spoofed signal that pulls the receiver to a false location. Can you simulate the two full multi-band RF ensemble?
Two artificial synchronized scenarios could be created using SatGen signal generator software that can reproduce the GNSS signals from a number of constellations. The user could create two separate signal streams, both starting at exactly the same position and time and using the same constellations, chosen by the user.
The second scenario could then be set to diverge away in position from the first scenario, while staying perfectly synchronized in time. The signal-to-noise ratio of each scenario could be adjusted independently of each other to simulate a spoofing situation where the spoofing signal is much stronger than the real signal. A file containing this twin scenario can be replayed using a LabSat Wideband with two separate RF outputs, each synchronously replaying the two different scenarios. This would closely simulate the actions of a smart spoofer, but in a completely repeatable, and controllable manner.
This could be accomplished by either combining the output of two of our CLAW GPS simulators, or by combining the output of a single CLAW simulator with live-sky signals using passive industry-standard splitters/combiners. The CLAW is able to receive a custom ephemeris download in RINEX format to match either the spoofed live-sky constellation, or to generate a synthesized constellation in the case where two CLAW simulators are being used.
The simulator has a wide RF power adjustment range of over 45-dB, allowing the spoofing signal to be gradually introduced to the primary GPS constellation RF signal. This spoofing simulation could be accomplished with better than 0.5 meter peak-to-peak positioning accuracy and better than 5-ns real-mean-squared (rms) typical UTC (GPS) offset unit-to-unit, allowing the victim receiver to be pulled off of its true (live-sky) position with very high accuracy. Typically, GPS receivers are spoofed easily as long as the UTC timing synchronization is 500-ns or better between the live-sky and spoofed signals.
Timing synchronization to the spoofed victim GPS signal to within nanoseconds is achievable through the external 1PPS reference input, the simulator accepting a position, navigation and timing (PNT) fix in real time via its NMEA serial and 1PPS inputs. This allows capturing a moving victim receiver by estimating its momentary position, then ramping up the spoofer power, and then presenting the victim receiver with alternate position information as required (see Figures 2 and 3).
High position and timing accuracy between the spoofed and live-sky signal is important to prevent and mitigate spoofing detection via UTC phase or position jumps that could happen when the receiver gradually or quickly switches over to the spoofed satellite signals.
FIGURE 2. Spoofing attack on a GPS receiver using a CLAW simulator to spoof a live-sky antenna signal. Initially the spoofer was phase- and frequency-synchronized to UTC(GPS), then spoofer RF power is ramped up, and once the victim GPS receiver is captured, a frequency offset is added to UTC(Spoofer), which pulls the system off-phase. (Figure: Jackson Labs)FIGURE 3. Simulating a spoofing attack on a timing application where the spoofer does not know the exact victim antenna location with certainty. The resulting antenna position offset error (50 meters in this simulation) still allows the victim receiver to be captured, and then causes a time error as satellites move in and out of view even with the spoofer being synchronized to UTC(GPS) at all times. This error is clearly visible in the resulting UTC(Spoofer) output from the victim receiver equipment. (Figure: Jackson Labs)
Q: We want to correctly model and simulate effectiveness of various anti-jamming (AJ) and anti-spoofing (AS) solutions to make informed decisions about which AJ/AS solution is most effective for a specific mission and interference scenario. How can you help?
Live-sky testing on a jamming/spoofing range provides a wealth of data, and reassurance that the system under test does work as intended. Record and playback systems (RPS) under live-sky conditions can allow further evaluation back in the lab, after the live-sky tests are complete. Performance parameters of the RPS may degrade the validity of the signal when played back; signal bandwidth and bit-depth are absolutely key, for example. Recordings that use too few bits will degrade the dynamic range of the recorded signals, so significant care should be taken when selecting an RPS.
Either way, under live-sky or with recorded live-sky, you get what you get. It is extremely difficult to predict what the test parameters actually are. It is perilous to attempt to alter the test parameters after the event. Lab-based or anechoic chamber-based systems have their limitations, but they are repeatable, predictable and tweakable. Again, performance parameters of the simulation system play a key role in the validity of the testing. The ability to calibrate the simulation system to give a repeatable, predictable performance is as important as the realism of the simulation. Carrier-phase accuracy/repeatability among antenna elements and signal timing accuracy are important parameters when evaluating AJ and AS systems.
Q: We had a receiver where the time stamp for any location report would drift off progressively, up to an hour off of the known true location. What might contribute to this? We do not believe this was an intentional threat, but an artifact of nearby electronics or other system conditions. It actually occurred on a pivot irrigation arm in motion, with substantial vibration. The receiver was electrically isolated. The results were repeatable on the pivot arm, but not on our vibration table.
Interesting problem with no obvious answer. Even the worst oscillator will take many months to drift off by up to an hour with no GNSS, even under horrible vibration conditions, so this is an unlikely cause. Is it drift or a jump in error? Nearby electrical noise could cause GNSS denial (jamming), but not erroneous data. That requires spoofing. If you have no reason to believe that it is intentional, that makes spoofing unlikely, but still possible. Is a GNSS repeater or a record/playback GNSS tester operating in the area? These are spoofers, even if they are unintentional.
If this is a precision agriculture application, then an RTK reference station transmitting erroneous data could be the cause. What time-stamping format is used: local time or UTC? An unlikely but possible scenario is the unit is changing time zones so local time jumps an hour. Is there a processor/software app between your output and the actual GNSS receiver? This could introduce errors. What is the position output indicated when the time drift occurs? The best way to diagnose this is to record the time and position output as log files using a laptop PC connected to the serial data.
Q: Do your simulators work as well for testing handheld, consumer-grade GPS? Please discuss the differences in testing techniques or approaches for high-precision vs. mass-market receivers?
We have a range of simulators suitable for all levels of GNSS testing. If you don’t need the high fidelity and wide bandwidth of the LabSat Wideband, then the entry level LabSat 3 will also work with any GNSS device including handheld consumer-grade products.
To fully explore the performance of high-precision receivers, including multipath effects and P-code reception, a wider bandwidth and a greater number of bits would be required to capture and replay all of the available signals. For these applications, we recommend a bandwidth of 56 MHz and at least 4 bits of resolution.
For testing of consumer-grade, handheld devices with simpler RF front ends, we recommend a much reduced bandwidth of around 9 MHz and only 2 bits of resolution. This smaller bandwidth and fidelity will easily reproduce the majority of real-world conditions, and the resulting data files will be much easier to handle.
FIGURE 4. Simulator graphical user interface. (Image: Racelogic)
Q: How many GNSS signals can a software-defined radio produce?
The theoretical limits of a software-defined radio (SDR) are based on four distinct characteristics of the SDR: the digital-to-analog converter’s (DAC’s) bit resolution, the maximum sampling rate, the bandwidth and the number of RF outputs. With most SDRs, available bandwidth is defined by the sampling rate.
With a 16-bit DAC, there is enough dynamic range to generate up to 50 GNSS signals and hundreds of multipath echos (with more than 60 dB of range to accommodate different signal power levels) per RF output.
For example, with a sampling rate of 50 MSps, a 40-MHz wide signal — combining GNSS constellation signals such as GPS L1 C/A, Galileo E1, GLONASS G1 — can be generated. Nowadays, SDRs can have two or more RF outputs and are able to operate with sample rates of 100 MSps or higher. By distributing the GNSS signals across different RF outputs, the entire GNSS spectrum can be covered at a relatively low cost in terms of hardware.
A handful of SDRs can easily be synchronized to form multiple RF output systems. In such cases, the complete range of GNSS signals for all visible satellites can be generated at the same time.
Q: In a dual-frequency receiver would it be possible to still use L1 spoofed/jammed with L2 clean to get an accurate position? Is it possible to do a combination between the two signals in order to save the spoofed/jammed L1?
In principal, it is still possible to use L1 spoofed/jammed with L2 clean in a dual-frequency receiver to get an accurate position. Such receivers are available as off-the-shelf products. These receivers use a special algorithm to detect if a GNSS frequency band is spoofed/jammed and automatically switch over to the clean frequency band. However, this principle can only be applied if the entire GNSS spectrum is not completely jammed. Whether a dual-frequency receiver can still use L1 spoofed/jammed with L2 clean to get an accurate position is therefore finally basically dependent on the overall bandwidth of the interferer/jammer.
With IFEN’s TITAN simulator, it is possible to easily create the corresponding simulation scenarios for the real-time simulation of realistic test scenarios to test the robustness of GNSS receivers against interference/jamming and also spoofing. In doing so, various static and dynamic interference/jamming sources are supported by the simulator’s software.
It is possible to achieve a PNT solution using L2 signals only. This requires reception and decoding of either the military L2 P(Y) signal, or reception of the new but still pre-operational L2C commercial signal. Codeless or semi-codeless commercial L1/L2 receivers rely on tracking the carrier phase on L2 to be able to mitigate effects such as solar flares and ionospheric errors; however, they are not capable of generating a PNT solution with L2-only reception as would be the case under this spoofing/jamming scenario.
P(Y) signal reception on L2 typically requires reception of the coarse acquisition (C/A) signal on L1 prior to tracking P(Y) unless the receiver has its own internal (atomic) time-base synchronized to UTC to the sub-microsecond level.
On-Demand Webinars
Simulation against Jamming and Spoofing: With cyber attacks on the rise, it is more critical now than ever to thoroughly test GPS and GNSS systems against jamming and spoofing.
As a U.S. military system, GPS provides all the PNT capabilities they need for defense — until it doesn’t.
Though the accuracies are great and the encrypted signal is resistant to spoofing, its weak signal is very susceptible to jamming. GPS World will host a webinar Nov. 16 to examine ways to augment GPS/GNSS to add resiliency so critical military systems have assured PNT. Registration is free.
Speaker Mikel Miller — Air Force officer (ret.), chief scientist for PNT and instructor — said, “As military operations have evolved over time, three critical technologies have become foundational in synchronized, precision military operations: resilient PNT, resilient communications and resilient cyber. A system-of-systems architecture that integrates and optimizes these three technologies is required to provide trusted and resilient PNT information in GNSS denied/degraded environments.”
Sponsored by precision time company Spectracom, the webinar takes place Nov. 16 at 1 p.m. EST / 10 a.m. PST / 7 p.m. (1900h) Central European Time.
Read about the speakers and their topics below.
Lisa Perdue Product Manager and Applications Engineer, Spectracom
Perdue is an expert in testing critical GPS and GNSS systems. She has trained hundreds of engineers and technicians who are responsible for high-reliability positioning, navigation and timing (PNT) applications. She took a lead role in the development of the first GNSS Vulnerability Test System and speaks widely on the topic at many industry conferences. Perdue is Spectracom product manager at Orolia, where she directs the organization’s GNSS simulation activities and contributes to its entire portfolio of resilient PNT solutions. She has more than 15 years of navigation and RF systems experience, which includes 10 years of service with the U.S. Navy, where she was a certified master training specialist.
Mike Jones
GPS World contributing editor for Defense; Capability Lead for Array Processing, Roke Manor Research
Jones leads the Array Processing group at Roke Manor Research, where he is also a senior consultant engineer. He has an exceptionally broad skill base encompassing sensing, communications, navigation and electronic warfare, and has particular specialist interest in GNSS adaptive antenna systems and direction-finding technology. He has detailed technical knowledge of adaptive antenna GPS systems and was jointly responsible for the development of a number of navigation protection systems using interference cancellation, adaptive beamforming and direction finding. His work is in service on a variety of MoD and DoD airborne platforms around the world. He specializes in the simulation, modeling and hardware implementation of advanced signal processing algorithms, and has led a number of FPGA and ASIC designs for radar, GPS and communications systems. He is also a Fellow of the Royal Institute of Navigation.
Mikel Miller Vice President for PNT Technologies at Integrated Solutions for Systems (IS4S); Former U.S. Air Force Research Laboratory
Miller is building a broad, multi-disciplinary research and development group at IS4S, focused on aspects of PNT and autonomous system science and technology. He began his career as a satellite systems engineer assigned with the U.S. Air Force, holding numerous test, research and development, and program management positions. After earning his Ph.D., he served as an assistant professor of electrical engineering at the Air Force Institute of Technology until his retirement from the Air Force as a lieutenant colonel in 2003. Most recently, he served as the chief scientist for PNT Technologies for the Air Force Research Lab Sensors Directorate. He has authored/co-authored more than 65 journal articles, technical papers and documents, as well as a NATO handbook on navigation technologies. He is a Fellow and past president of the Institute of Navigation (ION) and a past chairman of the Joint Service Data Exchange.
Randy Villahermosa Executive Director, iLAB, The Aerospace Corporation
Villahermosa will speak on research concepts in complementary PNT, including open-source frameworks and the potential role of signals-of-opportunity navigation.
Alan Cameron, Moderator Editor-In-Chief and Publisher, GPS World
Alan Cameron is editor-in-chief and publisher of GPS World magazine, where he has worked since 2000. He also writes the monthly GNSS Design & Test newsletter.
Orolia, through its Spectracom brand, has launched VersaPNT. VersaPNT provides virtually failsafe battlefield navigation, even in GPS-denied environments, to protect critical networks with Assured PNT technology, the company said.
The new, ground, air or sea vehicle-mounted solution is designed for military environments, with a ruggedized, compact, low-power and lightweight form factor.
Today, military vehicles are portable networks, providing seamless connections with U.S. headquarters, regional command posts and individual soldiers. Remote areas are challenging environments for military networks, and enemy forces are jamming, spoofing and disrupting operations.
“VersaPNT provides continuous mission assurance and C4ISR support, even in hostile environments,” said Rohit Braggs, Orolia vice president, PNT networks and sources. “This innovative technology solution protects critical networks for complex military and homeland security land, air and sea operations.”
Every minute counts on the battlefield, and VersaPNT provides critical decision support with real-time situational awareness to facilitate a rapid response, according to the company. This lifesaving technology can also help keep soldiers and civilians out of harm’s way, while ensuring continuous tracking of friendly and enemy forces.
VersaPNT provides essential command and control, navigation, communication and electronic intelligence support for U.S. and allied military, homeland security, first responder, civilian agency, special operations and intelligence missions.
Demonstrations are available at the AUSA Annual Meeting, Orolia Booth #2944.
Q: How can the safety, security, and full utility of GNSS applications be ensured while evolving to the best and most efficient use of limited and extremely valuable electromagnetic spectrum?
Mitch Narins, principal consultant, Strategic Synergies, LLC
A: (1) Agree that “No electromagnetic spectrum use will be approved, now or in the future, that impacts GNSS PNT users.” – a common mission statement essential to establishing trust!
(2) Determine how best to migrate today’s GNSS PNT users to be more resilient to both interference and planned future adjacent band services.
(3) Provide detailed architectures, network layouts, and implementation plans for rollout of new adjacent band services compliant with (1) and supportive of (2).
A: We cannot ignore fielded legacy systems, but neither can we chain ourselves to old technology and hinder progress.
Spectrum usage cannot be solved by less regulation, but it can be with innovative regulatory ideas adhering to minimalist principles. For example, would a “cash for clunkers” program work to eliminate weak receivers from the field to enable more efficient spectrum use?
This is one of those situations where government involvement can spur an innovative solution.
Orolia, through its Spectracom brand, has introduced built-in scenarios for testing eCall In Vehicle Systems compliance to the GNSS requirements of the regulation as an option with its latest Spectracom GSG simulator products.
In an initiative to bring life-saving rapid assistance to motorists involved in a collision, European Union (EU) regulation 2015/758 requires new vehicle types of M1 and N1 anywhere in the EU to be equipped with eCall in-vehicle systems as of March 31, 2018.
Spectracom’s GSG-6 Simulator with monitor.
In case of a crash, eCall systems automatically call the nearest emergency centre while sending the exact location, dramatically reducing response times. EU member states that do not comply will be refused EC type-approval for new types of motor vehicles.
Spectracom is providing options to ensure that automotive manufacturers who plan to continue selling into this market are equipped with the right tools for testing the eCall regulatory compliance of their equipment.
The Spectracom GSG line of GNSS simulators efficiently simulate all the major GNSS constellations needed for testing compliance of critical signal receiving equipment in a variety of eCall scenarios including:
Positioning accuracy under different conditions
Time-to-first-fix
GNSS receiver sensitivity
Re-acquisition performance following signal outages
Playing specific static and dynamic trajectory scenarios
Changing RF transmit power level manually or remotely sequenced as required by standard
“The eCall regulations require significant effort on the part of the auto industry to comply, and we are pleased to be including standard eCall scenarios as an option for our popular line of Spectracom GSG simulators,” said Lisa Perdue, GSG product manager at Spectracom. “We work in partnership with our automotive industry clients and will continue evolving the simulation product line to meet their needs for compliance testing with life-saving regulations.”
MarketReports.biz has published a detailed market research study focused on the GNSS Market across the global, regional and country level.
The GNSS Market 2017 report provides a 360-degree analysis of the market from the point of view of manufacturers, regions, product types and end industries.
The research report analyses and provides the historical data along with current performance of the global GNSS industry, and estimates the future trend of GNSS market on the basis of this detailed study. The study shares “GNSS Market” performance both in terms of volume and revenue.
Companies mentioned include Harxon Corporation, NovAtel, Trimble, Tallysman, JAVAD GNSS, Stonex, Sokkia, Spectracom and Leica Geosystems.
Orolia has completed 10 acquisitions since 2007, including Spectracom, Spectratime and McMurdo brands. The transaction is subject to customary closing conditions and approvals required by the U.S. Defense Security Service (DSS) and the Committee on Foreign Investment in the United States (CFIUS).
Mike Jones
Mikel Miller
Randy Villahermosa
