An interview with Chuck Stoffer, director of business development and Eric Hughes, design engineer at UHU Technologies. Click here to read more from this cover story.
What is your company’s main differentiator in the market?
CS: Our big differentiator is our ability to detect and mitigate GPS spoofing. There are many products that perform jamming mitigation using multi-element antenna arrays, but they usually don’t operate below the noise floor on spoofers. Our big differentiator is the ability to go underneath the noise floor and locate the spoofing threat.
About 10 years ago, our founder, Jeff Sanders, got interested in the GPS spoofing problem. Jeff’s previous company, Eclipse Electronic Systems, was dedicated to building high-end signals intelligence (SIGINT) receivers and the entire design team here at UHU worked for Jeff there. We built high-end, multi-channel receivers, often used in direction finding applications. When we started UHU, Jeff’s idea was to use direction finding to validate the constellation using satellite position.
EH: Our system looks like an anti-jam system, which it is. However, it does a whole lot more than that. We use a controlled reception pattern antenna (CRPA) to do angle of arrival (AOA) measurements on each GPS satellite.
We know where each satellite is supposed to be, then we calculate where it actually is in the sky. If a satellite is in the right spot in the sky, then we know that we can trust it. If it’s not — and, especially, if multiple satellites are not in the right spot in the sky — then we know there’s a spoofer.
Once we’ve done that, we can take it a step further and perform non-adaptive spatial nulling, subtracting out the bad PRNs from the signals.
Often people look at our system and think, “Oh, it’s an anti-jam system.” Yes, we do anti-jam, just like any other vendor out there would do, and we do the traditional adaptive null steering techniques, so that if there’s a jammer in the environment, we will automatically null it spatially. However, those systems don’t handle spoofers, which, as Chuck was saying, are often below the noise floor. Anti-jam systems — which are using power minimization techniques — will not do anything for something that’s below the noise. In fact, they may inadvertently amplify the weak signal because they weren’t designed to process signals below the noise.
As far as outputs, we provide a spatially validated PNT solution, meaning that we only include satellites whose sky position has been validated. We also provide an RF output that can feed other GPS receivers, including M-Code. Our products have a built-in web-based GUI for visualization of the threat environment, and all system measurements can be sent over the network using multiple industry standard protocols.
To “precisely geo locate the source of GPS jamming or spoofing threats,” as one of your marketing materials says you can do, requires at least two bearings and the range.
EH: One of the nice things about our approach is that once we’ve identified a spoofer or a jammer, we can then tell you the line of bearing or the angle of arrival from the threat. Both of our products — the Northstar and the UHU1000 —also have a built-in event-based I/Q recorder and a GPS-disciplined oscillator that provides precision time. That gives us baseband data with precision timestamps anytime there’s a spoofing or jamming event. This is a standard feature that’s available right now.
You can take multiple systems, network them together, and, if they all have a common view of the interference event, use the provided lines of bearing and precision time-stamped I/Q data to perform geolocation based on AOA and/or time difference of arrival (TDOA). This is a separate appliance that’s in development.
In our next software release we are adding single-receiver, AOA-based geolocation. However, it requires motion. So, if you have a single UHH1000 in motion, you get a coarse geolocation automatically.
CS: We’ve already demonstrated our geolocation algorithms on real-world data and our geolocation appliance is on our roadmap. We’ve proven the technology, and now we’re productizing it.
This works very well for aerial platforms, because you get a lot of motion and many different looks at it. For ground-based applications, where the source could be many miles away and the AOA doesn’t really change much, it might not be as useful.
How it the threat evolving and how are you dealing with that?
EH: One of the advantages of our AOA-based approach is that it’s outside of the signal. It’s a physics thing that is very hard, if not impossible, to spoof. At government-sponsored events, every year they throw a new attack at the participants, often by modifying the signal in some novel way. Those are all great things that need to be tested, but we don’t care about any of that because all we’re doing is checking whether a satellite is in the right spot in the sky. If it’s in the right spot, we trust it. If it’s not, we don’t. Because of that, we’re well positioned to handle new threats.
CS: We individually track every GPS satellite signal that we detect, even the same repeating pseudorandom noise (PRN) code coming from a different AOA. Each PRN gets its own hardware-accelerated tracking loop with its own beamformer. Once we know which PRNs are valid satellites and which PRNs are spoofers, we group and demodulate them separately. We provide the spoofer PNT solutions to the user in real-time.
Are all your boxes multi-constellation?
EH: Today, we process L1 C/A and L2C. Since L1 C/A is the backbone of most GPS receivers, effective spoofing attacks always spoof L1 C/A, and that has been our focus area. Of course, we have a roadmap to do more.
To the extent that you are at liberty to tell me, who has your box? Who will have it?
CS: Army and Air Force customers have our boxes.
