Septentrio, part of Hexagon, launched a miniaturized timing module designed to bring nanosecond-precision timing to high-volume applications requiring strict size and weight (SWaP) constraints.
The mosaic-G5 T measures 23 mm x 16 mm and weighs 2.2 g, making it suitable for data centers, telecommunications networks, satellite communications, financial institutions and other critical infrastructure requiring precise time synchronization.
The module receives signals from multiple GNSS satellite constellations and includes anti-jamming and anti-spoofing technology to maintain service continuity. It features built-in cybersecurity capabilities and dual pulse-per-second outputs for high-resolution timing.
“For over 25 years, we have been producing world-recognized timing receivers, serving critical applications and major industry players,” said Yasmine Hunter, product manager at Septentrio. “With our next-generation technology, we are now bringing precise and resilient time in an ultra-compact form factor to high-volume applications.”
The receiver operates across multiple frequencies, enabling high precision even in areas with radio interference. It supports clock and frequency input for synchronization and is ready to support Galileo High Accuracy Service. The module remains compatible with other correction services that enhance timing accuracy.
Microchip Technology’s new SkyWire is a time measurement tool embedded in its BlueSky Firewall 2200. It’s designed to measure, align and verify time to within nanoseconds even when clocks are long distances apart. The technology enables highly scalable and precise time traceability to metrology labs to protect critical infrastructure systems.
Network clocks are the backbone of critical infrastructure operations, with the precise alignment of clocks becoming increasingly important for data centers, power utilities, wireless and wireline networks and financial institutions.
For critical infrastructure operators to deploy timing architectures with reliability and resiliency, their clocks and timing references must be measured and verified to an authoritative time source such as Coordinated Universal Time (UTC).
With the BlueSky GNSS Firewall 2200 and SkyWire technology, geographically dispersed timing systems can be compared to each other and compared to the time scale systems deployed at metrology labs within nanoseconds. Measurement of clock alignment and traceability to this level has typically only been done between metrology labs and scientific institutes.
With Microchip’s solution, critical timing networks for air traffic control, transportation, public utilities and financial services can achieve alignment within nanoseconds between its clocks to protect their infrastructure no matter where the clocks are located.
“To ensure timing systems are delivering to stringent accuracy requirements, it’s important to measure and verify in an independent manner relative to UTC as managed by national laboratories and traceable to the Bureau International Poids et Mesures (BIPM),” said Randy Brudzinski, corporate vice president of Microchip’s frequency and timing systems business unit. “With the new SkyWire technology solution, we’re making UTC more widely accessible so that large deployments of clocks can be independently measured and verified against each other across long distances.”
The concept originated as an extension to the National Institute of Standards and Technology’s (NIST’s) pre-existing service called Time Measurement and Analysis Service (TMAS), which is utilized by entities that are required to maintain an accurate local time standard. The BlueSky GNSS Firewall 2200 with SkyWire technology provides a commercial off-the-shelf (COTS) product to enable critical infrastructure operators to connect with the NIST TMAS Data Service for large-volume clock deployments.
“At NIST, our goal is to enable the most accurate time to support our country’s infrastructure,” said, Andrew Novick, NIST engineer. “Our TMAS Data Service, in conjunction with commercial hardware, provides a scalable solution for anyone who needs traceable and accurate timing.”
Nations around the globe can replicate this solution using Microchip’s SkyWire technology capabilities within its TimePictra software suite, which delivers similar features and functionality as that provided by the NIST TMAS Data Service. Metrology labs, government agencies and enterprises worldwide can deploy TimePictra software suite and the BlueSky GNSS Firewall 2200 with SkyWire technology and have their own end-to-end solution for traceable time measurement, alignment and verification.
The TimePictrasoftware suite provides customers with support to deploy BlueSky GNSS Firewalls at scale.
ProStar’s PointMan software will now be bundled with Bad Elf’s high-precision GNSS receivers for worldwide sales. PointMan Precision Mapping provides a powerful cloud and mobile precision mapping solution to surveyors and geospatial intelligence systems (GIS) professionals.
This strategic partnership expands the market reach of both companies and directly addresses the growing demand for a complete mapping solution in the utility and critical infrastructure industries.
By combining Bad Elf’s advanced GNSS receivers with ProStar’s patented precision mapping solution, utility owners, contractors, municipalities and engineering firms are able to capture, record and visualize the precise location of critical infrastructure at a low cost and with a complete solution.
Bad Elf delivers accurate, compact, lightweight and cost-effective GNSS solutions compatible with a broad range of third-party vendors. Together with PointMan, the bundled solution provides customers with a comprehensive, ready-to-deploy precision mapping solution designed to reduce costs, improve efficiency and accelerate industry adoption.
Drone-maker Orkid has unveiled a new variant of its Orkid 260 drone that incorporates four technologies to improve aerial data-capture technology.
According to the company, the Orkid 260VTOL represents a leap forward in the integration of advanced sensing and communication technologies, setting a new benchmark for multi-mission drone capability across commercial and industrial applications. The company said it is the “first vertical take-off and landing (VTOL) drone to bring all four of the most advanced aerial data capture technologies together — onboard, fully integrated, and operating simultaneously.”
The system combines lidar (YellowScan Surveyor Ultra), photogrammetry (Phase One P5 camera), GNSS/IMU (Trimble Applanix APX-RTX), and Starlink satellite communications integration in a single platform.
Built on a 100% electric, NDAA-compliant architecture, the aircraft delivers an estimated 1.5 hours of flight endurance with a range of up to 75 miles. Designed for mapping, surveying, utilities, oil and gas, defense, and critical infrastructure inspection, the new model expands the operational scope for high-precision, long-range missions.
On June 13, following reports of Israeli airstrikes on Iran, interference rates in the Strait of Hormuz spiked. GPSJam.org, a service that tracks satellite signal interference, now reports medium-level disruption (between 2% and 10%) across the Gulf region. This is no isolated blip, but part of a pattern: electronic warfare is increasing in global hotspots. It’s also a warning.
Modern warfare is no longer about guns and bombs. Jamming, spoofing and using ever-more sophisticated cybertricks to disrupt GNSS are now regular tactics used to sow disorder. They are cheap, deniable, and often highly effective. But they also expose a dangerous weakness in how we navigate, communicate, and coordinate. If GPS is the backbone of global positioning, we are learning just how brittle it can be.
Strait of Hormuz Under Threat
The Strait of Hormuz is a narrow channel through which around one-fifth of the world’s oil passes, and here, ships are now at risk not only from pirates and mines, but from corrupted satellite signals. Spoofers can broadcast false GPS positions to nearby vessels. In recent years, we have seen ships appear to sail across runways, airports, and deserts, thanks to malicious signal interference. In aviation, spoofed or jammed GNSS signals have led to aircraft turning around mid-air or being diverted. These are real and growing threats.
As someone who has worked in naval intelligence and the defense industry for decades, I have seen how quickly technology evolves, and how slow we can be to protect our own systems. But there are solutions to the problem I’ve described. One is laser-based optical communications.
The Need for Resilient PNT
Laser communication is very difficult to jam or spoof. Unlike the low-power radio frequencies used by GPS, a laser beam is narrow, focused, and nearly impossible to intercept without being detected. And because lasercom is optical, not radio, it isn’t vulnerable to the same types of interference. That makes laser communication ideal for high-security communications and low latency support in contested environments.
Optical ground station networks, when paired with optical satellite links, also offer vastly higher data transfer capacity than conventional RF systems. Optical links can now carry 1,000 times more data than their RF counterparts. At a time when threats are growing quickly and data needs are exploding, that kind of capacity is essential.
This will make you wonder why lasercom isn’t more widely used. The answer is that only in recent years has it become mature and able to be deployed rapidly. Systems that once seemed exotic or experimental are now proven, reliable, and ready to scale. Many space agencies and defense organizations, including the US Department of Defense and NATO, are investing in them.
To be clear, optical comms will not replace GPS or radio. But they can supplement and support it, especially in high-risk areas where GNSS is under attack. Just as militaries don’t rely on one radar or one radio channel, governments shouldn’t rely on a single source of truth for navigation and timing.
Escalating Threats to Critical Infrastructure
When you depend on precise location data for everything from logistics to drone strikes to the safe passage of oil tankers, the idea that one bad actor with a spoofer can throw you off course is a real concern. When the threat can be made a reality without firing a shot, you can be sure it will be used more and more often.
Just as satellites offer a way to monitor subsea cable sabotage, they also offer a chance to future-proof our navigation and communication networks. The same technology that is being used to track ships and sense underwater disruptions can be adapted to create robust, high-speed, interference-proof backup channels. Governments that invest in this infrastructure now will be in a far stronger position to deter attacks, respond quickly, and maintain operational clarity when others cannot. We wish it were otherwise, but the world is becoming more dangerous, and attacks will accordingly become more common.
If the last year has taught us anything, it’s that infrastructure is no longer neutral. It’s considered a legitimate target, particularly by those whose aim is to create confusion and disorder. GNSS isn’t immune to this trend. In fact, because of it’s importance, it’s a prime target. We have to stop assuming that what worked in peacetime will work at a time of conflict. That, sadly, is the reality of this moment.
Viavi Solutions has unveiled the PNT-6200 Series Assured Reference for resilient positioning, navigation and timing (PNT). Viavi acquired Jackson Labs Technologies in November 2022.
The PNT-6200 Series Assured Reference provides resiliency and robust cybersecurity for critical infrastructure.
The compact system can supplement or replace GPS signals based on connectivity to the broadcast range of timing sources in the market including other GNSS satellites, and commercial satellite, terrestrial, wireline, and atomic clock services. The PNT-6200 Series will draw the timing signal from the most reliable source and use it as a replacement for the GPS input, enabling continuous operation.
The PNT-6200 Series will be showcased at Mobile World Congress in Barcelona, Feb. 27-March 2.
NextNav Inc., a GPS and 3D geolocation company, has acquired Nestwave SAS, a privately held company specializing in low-power geolocation.
The acquisition was completed Oct. 31 for $18 million.
NextNav is based in McLean, Virginia, and Nestwave is located in based in Neuilly-sur-Seine, France. Nestwave provides advanced geolocation solutions to internet of things (I0T) modem and digital signal processor vendors and end IoT users.
Nestwave will adopt NextNav’s name and be integrated into existing TerraPoiNT engineering and technology efforts, with all Nestwave employees remaining with the company. Nestwave CEO Ambroise Popper will become NextNav’s vice president and general manager in France and is joining NextNav’s executive leadership team, while Nestwave CTO and Founder Rabih Chrabieh will serve as vice president of engineering.
The combination of NextNav’s technology with Nestwave’s LTE/5G capabilities will allow NextNav to intelligently combine signals from existing terrestrial LTE/5G networks with its own highly synchronized TerraPoiNT system to deliver near nationwide resilient 3D position, navigation and timing (PNT) capabilities that contribute to dramatically lower deployment costs.
The company serves markets including timing for critical infrastructure, aviation, automotive, IoT and other mass market applications sooner.
“The acquisition of Nestwave presents a unique opportunity for NextNav to optimize further the use of its existing spectrum bandwidth, while contributing to a drastic decrease of our TerraPoiNT system’s future capital and operating expenditures,” said Ganesh Pattabiraman, NextNav co-founder and CEO.
“By leveraging Nestwave’s unique technology and ambient LTE/5G waveform, NextNav can gain significant spectral efficiency, accelerate the availability of resilient PNT and release the underlying spectrum’s capacity for additional data-oriented services. An LTE/5G waveform also enables broader penetration of NextNav’s applications and technology across the handset and device ecosystem for all of its products and target markets,” Pattabiraman said.
Pattabiraman continued, “Nestwave brings not only a physical presence in Europe, but also a team of professionals who have established strong relationships with European Union representatives that will be beneficial as we continue active conversations with government officials in the United States, Europe and globally over GPS/GNSS resilience.
“The transaction is not expected to materially increase the company’s operational cash burn, and the lowered capital requirements will enable us to quickly scale our GPS resiliency capabilities in both the United States and global markets sooner than previously anticipated.”
Global corporation VIAVI Solutions Inc. has completed the acquisition of Jackson Labs Technologies, a leader in positioning, navigation and timing (PNT) solutions for critical infrastructure serving both military and civilian applications.
Jackson Labs develops and supplies modules, subsystems and box-level solutions that include front-end receivers, transcoders, rack-mounted equipment, and patented retrofit technology. Their broad customer base includes armed forces, defense contractors, energy distribution infrastructure, low-Earth-orbit (LEO) operators and 5G service providers.
Jackson Labs’ next-generation M-code solutions complement and advance VIAVI’s timing and synchronization portfolio at a time when PNT requirements for defense, space, commercial aviation, transportation and telecommunication networks are expanding and becoming increasingly critical.
“As telecommunications, avionics and mission-critical infrastructure adopt next-generation technology, legacy timing and synchronization protocols are no longer sufficient. Jackson Labs is a trusted provider of PNT solutions in these markets, and we look forward to addressing these opportunities together,” said Oleg Khaykin, president and CEO of VIAVI. “With this acquisition, we are continuing to drive operational scale via the addition of advanced technology and high-performance products that address market segments with strong growth and profitability.”
“Being a part of VIAVI will significantly expand Jackson Labs Technologies’ market reach worldwide, and allow us to further deliver world-class solutions for the rapidly developing PNT landscape as it enters a new era,” said Said Jackson, CEO of Jackson Labs Technologies.
DelMorgan & Co. acted as the exclusive financial advisor to Jackson Labs in connection with the transaction. Terms of the transaction are not being disclosed.
About VIAVI
VIAVI s a global provider of network test, monitoring and assurance solutions for communications service providers, enterprises, network equipment manufacturers, original equipment manufacturers, government and avionics. It helps customers harness the power of instruments, automation, intelligence and virtualization.
VIAVI is also a leader in light management solutions for the anti-counterfeiting, consumer electronics, industrial, government and automotive markets.
VIAVI operates offices throughout North, Central and South America, Europe, Africa, the Middle East, and the Asia-Pacific, including China and Japan.
Furuno Electric Co. has released a new generation of time-synchronization GNSS receiver modules compatible with all GNSS systems. The modules deliver nanosecond precision for 5G mobile systems, radio communications systems, smart power grids and grand master clocks.
GNSS receivers for time synchronization are used extensively in critical infrastructure such as mobile base stations and RAN equipment, commercial and defense radio communications, broadcasting, financial trading and smart power grids, where there are increasing needs for robustness, reliability and security.
Furuno is releasing three new products: GT-100, GT-9001 and GT-90. They are designed to suit different applications based on the frequency bands and output signals supported. All models have the world’s highest level of time stability of 4.5 ns (1 sigma).
The GT-100 is the company’s first timing multi-GNSS receiver module supporting concurrent L1 and L5 reception. This mitigates the effects of solar flares, which can lead to time errors, and strengthens measures against GNSS vulnerabilities such as jamming and spoofing.
The GT-100 delivers three outputs including 1 pulse per second (1 PPS) synchronized with UTC as well as user-programmable frequencies. The outputs can be set as required to 10 MHz, 2.048 MHz and 19.2 MHz, commonly used in a variety of wireless communications systems. This drastically reduces the time from development to market launch for these systems, as well as cost savings through reduced component needs. GT-100 is a full-featured highly robust model, supporting dual-frequency band reception (L1 and L5).
GT-9001 supports L1 and delivers high stability 1PPS and programmable clocks on three channels.
GT-90 supports L1 and provides a 1 PPS high stability output.
All models are equipped with the leading Dynamic Satellite Selection (DSS) multipath mitigation technology developed by Nippon Telegraph and Telephone Corporation (NTT) that minimizes degradation of time performance even when the antenna is installed in urban areas or near a window.
Furuno will showcase the new modules at EuMW’s European Microwave Exhibition, a trade and technology exhibition providing access to initiatives in the RF and microwave sector.
Evaluation kits for all three products are available now.
By Nino De Falcis, Senior Director of Business Development, ADVA
Today’s critical network infrastructure is heavily reliant on positioning, navigation and timing (PNT) services. Power grids, financial markets, transportation, data centers, communications — all have become more complex and interconnected, while the threats to the PNT on which they depend have grown in frequency and sophistication. PNT systems are so vulnerable to the activities of cybercriminals that attacks may soon become global in scale and significance, with potential costs of billions of dollars.
Utilities are a key example of infrastructure at risk. In the past, power networks were passive systems with everything simple and centralized, and with energy flowing in one direction only as AC power was provided to consumers. However, the growth in renewables and distributed energy resources has spurred diversification of the market, and a new paradigm of bidirectional AD and DC energy production and distribution has emerged: the smart grid.
Timing Challenges
Today, many smaller producers are generating power from multiple sources. The power grid has become a decentralized system and the flow of energy is now bidirectional. Energy from solar panels (microgrids), for example, can be generated by private individuals and either stored or fed back into the grid. Electric vehicles (EVs) are also becoming more common, and like all other nodes across the smart grid, charging points require precise timestamping of the massive amount of data they generate to balance power demand and supply.
Precise timing is also key to rerouting power flows away from transmission outages, to locating power line faults, and for synchronizing distributed control and protection systems. Without highly accurate timing and synchronization, power grids are vulnerable to partial outages and even complete blackouts.
That is why accuracy requirements of data timestamping are tighter than ever. In fact, they are shifting from legacy Network Timing Protocol (NTP) timestamping, which has millisecond accuracy needs, to Precision Timing Protocol (PTP) timestamping, requiring sub-microsecond accuracy. The syncrophaser now demands accuracy better than 1 microsecond.
For fault location, we’re now at 100 nanoseconds. The micro-phasor measurement unit (PMU) is at less than 1 microsecond and substation LAN communication protocols have to be time-stamped at as low as 100 microseconds for GOOSE IEC 61850 and at 1 microsecond for IEC 61850 sample values. This is a big change from just five years ago when accuracy in all these categories was firmly in the millisecond range, and it’s a high bar that needs to be maintained by next-generation redundant systems, should GPS or ground-based timing become compromised.
Guidelines for making PNT infrastructure fully redundant are being pushed by governments across the world. In the United States, regulations are being driven by Executive Order 13905 with the Department of Homeland Security (DHS) providing a framework for how assured PNT (aPNT) should operate. It states that PNT infrastructure must perform three core functions: prevent, respond and recover. Infrastructure must have the ability to prevent atypical PNT errors and corruption of PNT sources. If prevention fails, networks must be able to respond to detected errors or anomalies and then recover from those errors.
The DHS framework outlines four resiliency levels. Level 1 has only one source providing PNT, while level 4 is a next-generation system leveraging multiple sources to derive and distribute PNT data. At Level 4, systems need to be self-survivable. This means they must function for long periods in the absence of a GPS timing source, or when ground-based timing sources have been otherwise compromised. There is even an IEEE P1952 resilient PNT standard in progress that will use this DHS framework.
Rising Threats
There are two categories of threat to PNT: external and internal. External threats include jamming (equipment that can block GPS is available off the shelf for as little as $20) and spoofing, which is the act of transmitting false GPS signals that trick receivers into calculating an erroneous position. Sophisticated cyberattacks can be in the form of either of these and spoofing (especially synchronous) is the most complex to detect.
The two main internal PNT threats come from attacks on NTP and PTP network timing as well as active GPS receivers connected to the network.
Legacy power grids have traditionally used NTP to distribute timing to substations, including IRIG, and this has already shown itself to be vulnerable to attack because it can be hacked by a process called NTP amplification.
Today, power grids are increasingly migrating to PTP because it provides the sub-microsecond accuracy needed for modern applications. PTP also has not yet been hacked, but that does not mean it soon will not be. If an attack did occur on ill-prepared critical infrastructure, the results could be catastrophic.
Secure Smart Grid Timing Components
There are two components in the smart grid: telecom connectivity to transport data, and grid protection that has different level generation grid control, transmission and management. On the telecom side, there is the edge telecom network and sometimes there are data centers. There are either core or edge data centers and these are also equipped with very good timing. A key concept in the data center is time as a service and GPS backup as a service when GPS goes down. The smart grid can also leverage this service as it gives even more robust protection and security against threats to PNT. See Diagram 1.
Diagram 1. A key concept in the data center is time as a service. (Image: ADVA)
A Resilient and Assured PNT Solution
As with other aspects of cybersecurity strategy, smart grids must employ a zero-trust framework of PNT sources. This approach never assumes that any one PNT source can be trusted. Instead, it uses a multi-source approach, verifying sources and comparing them to each other in real time to get the most accurate timing possible.
To prevent and mitigate interruptions to GPS, smart grid operators should deploy a resilient and assured PNT solution. This means it’s based around three integrated technologies: multi-layer detection, multi-source backup and multi-level fault-tolerant mitigation.
Multi-layer detection is performed through timing devices – either single or redundant – that have jamming and spoofing detection and monitoring capabilities. GNSS devices are also capable of comparing sources such as network PTP timing and they can be equipped with standalone, GNSS-backup clocks that leverage rubidium or cesium oscillators to obtain the most reliable timing information from other timing sources in the network.
Multi-source backup comes in the form of a cesium or rubidium oscillator that can provide extended holdover. Backup can be further bolstered with other sources such as eLORAN, NIST and LEO.
A neural network management system is an intelligent platform that ties everything together, from self-actionable recovery and assurance software to alerting users of issues in the network-wide timing infrastructure. It provides visibility and control of all aspects of prevention, mitigation and backup. The management system gives detailed operational data on the smart grid, showing the locations of the faults, the types of faults, and how PTP backup assurance is performing. Through capabilities powered by artificial intelligence and machine learning, the management and control system provides the end-to-end control, visibility, and trusted, assured PNT. It has all the intelligence to reveal threats and also take action against them, quickly recovering the network’s timing distribution capability, while keeping the network timing self-survivable. See Diagram 2.
Mitigating Cyberattacks with a Defense-in-Depth Approach
So, let us imagine there is a major attack on a smart grid. A jamming device has been used to block GPS reception on an edge grandmaster being used at a substation, while at the core of the network an ePRTC’s ability to receive GNSS signals has also been compromised. GPS is no longer viable as a source for timing in the smart grid.
The intelligent software monitoring and management system is the first line of defense, detecting and alerting operators to the two or more attacks on GPS: one at the core of the network and one at the substation. The network timing capability of the whole smart grid has been compromised.
Upstream from the substation, the core enhanced PRTC (ePRTC) has become an unreliable source of timing. However, it is equipped with a cesium clock that steps in to propagate trusted PNT backup into the substation and throughout the rest of the network. The cesium clock has no antenna, no RH signal, and is a stratum 1 clock that can propagate highly accurate timing (accurate to 1 microsecond over four months) throughout the network. It has now become the trusted source of timing until GPS can be re-established.
The most crucial element of PNT is timing. Without timing there is no positioning or navigation — it is the enabler of both — and so the distribution of accurate timing must be our top concern when we build systems.
For smart grids and all other critical infrastructure dependent on PNT to function, the cornerstone for secure and self-survivable timing networks is the concept of zero-trust. A multi-source approach to building timing networks will allow operators of critical infrastructure to leverage a combination of intelligent management software and timing devices equipped with adequate PTP holdover to respond to all threats to PNT.
To see a real-world example of this approach in action, check out the DOE DarkNet program.
AS CAT STEVENS (yes, he’s back to using his old name) famously sang on “Wild World”:
“… take good care Hope you make a lot of nice friends out there But just remember there’s a lot of bad and beware Beware.”
While he was talking about a girlfriend leaving him, the warning can just as well apply to GNSS users — especially those relying on GNSS for safety-of-life navigation and the maintenance of critical public infrastructure systems.
GNSS signals are relatively weak and they are susceptible to unintentional and intentional jamming that can make reception of the signals difficult or impossible. The jamming of radio signals to hinder reception is nothing new. It’s been used by those wanting to interfere with the use of the radio spectrum ever since radio became an important tool for communication and navigation in the early 20th century. Jamming has been used in hot wars to try to defeat military communication as well as in cold wars to try to prevent a perceived enemy from broadcasting to a particular country’s citizens. Notably, the shortwave radio broadcasts from Western countries were jammed by the former Soviet Union. And even today, broadcasts directed at China, Cuba and some other countries are regularly jammed.
GNSS is also being intentionally jammed on a regular basis in some parts of the world for various purposes including the protection of politicians and civilian infrastructure and to foil GNSS-guided munitions. But while directed at supposed threats, the jamming affects all GNSS receivers in a certain radius of the jammer. Such jamming activities are being reported in the popular press with an increasing frequency.
While GNSS jamming is receiving increased attention in our troubled world, even more pernicious is GNSS spoofing. Spoofing is the attempt to mimic GNSS signals to try to trick a receiver into tracking them and thereby compute a wrong position and/or time at the receiver. This can have disastrous consequences if not detected immediately and the use of GNSS deactivated.
So, how do you detect GNSS signal jamming and spoofing? We have discussed this issue in several columns over the years, but in this month’s column, a team of researchers from Stanford University and the University of Colorado describe how they are using relatively inexpensive equipment and sophisticated software and analyses to detect and warn of GNSS jamming and spoofing. Clearly, they are heeding Cat Stevens’ warning.
By Leila Taleghani, Fabian Rothmaier, Yu-Hsuan Chen, Sherman Lo, Todd Walter, Dennis Akos and Benon Granite Gattis
GNSS signals are extremely low power by the time they reach users on Earth and are easily overwhelmed by nearby terrestrial signals. Such signals can interfere with a user’s ability to receive the desired GNSS signals or, even worse, replace them with simulated signals that cause the user to obtain the wrong position or time estimate. Two major types of radio-frequency interference (RFI) threats have been identified: jamming and spoofing. Jamming results from emissions that do not mimic GNSS signals, but interfere with the receiver’s ability to acquire and track GNSS signals. Spoofing is the emission of GNSS-like signals that may be acquired and tracked in combination with, or instead of, the intended signals.
Both threats have been studied at length by researchers, and their presence around the globe has been reported even in the popular press. Some research has been done into the prevalence of spoofing. Even so, there is no well-developed understanding of how widespread these threats are.
Terrestrial interfering signals may be fairly weak and only effective in a limited area. Complex environments with buildings or terrain may further limit their effective area of influence and hinder the ability of external interference detection. To create a better understanding of the presence and characteristics of jamming and even spoofing, we are developing a low-cost RFI detector based on a commercial, off-the-shelf GNSS receiver: the u-blox F9. We are pairing this receiver with a Raspberry Pi computer and are developing custom software to monitor the receiver outputs and store data surrounding interesting events.
We are developing a toolset in MATLAB and C/C++ with the intention of processing and analyzing the u-blox data. The toolset includes functionality to decode selected u-blox messages that contain parameters of interest. These metrics include automatic gain control (AGC), carrier-to-noise-density ratio (C/N0) and spectral power. They also include raw pseudoranges from multiple constellations and internal u-blox interference metrics. With the volume of data that can be gathered from continuous monitoring, we have begun characterizing nominal performance and developing approaches to spoofing and jamming detection. The publicly available code can be accessed through our Git Repository at https://github.com/stanford-gps-lab/navsu.
With the raw pseudoranges and downloaded broadcast ephemeris data, we compute navigation solutions using different combinations of constellations and frequencies. When the individual and multi-constellation position solutions are compared to each other, discrepancies can be flagged and investigated for possible interference. We have begun characterizing nominal power metrics such as AGC and C/N0. With the quantity of data that we can get from the RFI monitor, we are working to characterize other receiver-specific parameters such as the u-blox continuous wave (CW) jamming indicator. We leverage data collected under nominal and jammed conditions to understand and identify a threshold for what can be considered interference.
Many different methods have been proposed for GNSS interference detection and mitigation with large-scale data at multiple locations. In this article, we present our data-selection process, our development of thresholds for determining interference, and results from three u-blox receivers set up at different locations in the United States to glean information about nominal (non-spoofed) conditions. We inform our thresholds and analysis tools using datasets from nominal conditions, and then compare their performance to a dataset containing RFI events from a government-sanctioned jamming and spoofing test. Our results display how we leverage simple and powerful metrics informed by a low-cost receiver to understand nominal noise environments and successfully identify jamming and spoofing events.
Data and Metrics
We collect and analyze a variety of data types and metrics to help identify and characterize jamming and spoofing occurrences. The receiver model we started with, u-blox ZED-F9P-02B, can monitor two different RF bands and many signals, including GPS L1C/A, L2C; GLONASS L1OF, L2OF; Galileo E1B/C, E5b; BeiDou B1I, B2I; QZSS L1C/A, L1S, L2C; and SBAS L1C/A. It has 184 channels, which can be configured to sweep through an array of signals to be monitored. We are also developing monitors based on the recently released ZED-F9T-10B, which is capable of L1 and L5 signal reception. TABLE 1 describes which version of the u-blox receivers each dataset comes from.
TABLE 1. Locations of u-blox monitor for nominal noise environment characterization and jam/spoof test. (Data: Authors)
L1 and L5 are the primary frequencies used for aviation, hence a monitor for these frequencies would be more useful for protecting aviation than the F9P, which is only capable of L1 and L2 reception. The available data includes raw measurements such as code and carrier phase, position estimates, power level estimates including C/N0, AGC and spectral power. It also has active CW interference detection. These metrics are all necessary for the consistency checks and power monitoring methods we summarize in this article. Consult our conference proceedings paper for details (see Acknowledgments). By examining all of these signals and measurements, we can observe changes in the RF environment and detect inconsistencies in the received signals.
Data Logging. The u-blox receiver logs messages in a specific format. The message types important to log are selected based on the desired data. Due to limited bandwidth, we prioritized messages that efficiently include all desired parameters for the interference detection methods we describe in this article. We have used both the u-blox F9P and the u-blox F9T.
To characterize nominal noise environments, u-blox receivers were set up at three locations: Stanford University, the University of Colorado (CU) in Boulder, and at the Colorado Springs airport. All measurements from satellites below an elevation angle of 5 degrees were ignored. The results from these locations are summarized below. Results from a jamming/spoofing test sanctioned by the U.S. Department of Homeland Security are presented and labeled with the acronym “GET-CI” (GPS Testing for Critical Infrastructures) in the subsequent discussion. Table 1 describes the parameters of the u-blox receiver at each location.
Positioning Metrics Development.The nominal error of the single- and multi-constellation position solutions is made by noting the difference between the computed position and the known truth. The inter-constellation consistency check is defined as the difference between the positions computed from two constellations, with no reference to a known truth position. To analyze the nominal differences in the north, east and down (NED) directions, we use the position covariance matrix, R, computed in the least-squares solver, to set a covariance-bound threshold. The covariance for each constellation is assumed independent. We present our results using this threshold in our results sections.
Our results in FIGURE 1 show that the Galileo position solution variance is higher than the dual-constellation and GPS-only solution. This is attributed in part to the fact that Galileo, while operational, has not filled out all planned satellite slots and therefore has fewer satellites and worse geometry than GPS.
FIGURE 1a. Map visualization of the comparison among position solutions computed using only GPS, only Galileo and a combined GPS plus Galileo dual-constellation solution at Colorado Springs. (Image: Authors)
FIGURE 1b. Map visualization of the comparison among position solutions computed using only GPS, only Galileo and a combined GPS plus Galileo dual-constellation solution at CU Boulder. (Image: Authors)
FIGURE 1c. Map visualization of the comparison among position solutions computed using only GPS, only Galileo and a combined GPS plus Galileo dual-constellation solution at Stanford. (Image: Authors)
Nominal Noise Results
Here are some of our positioning and power monitoring results under nominal reception conditions.
Positioning. Based on the methods described earlier, we present a selection of our results from the positioning consistency checks. We present several informative visualizations of the error between the computed position solution and the known truth of each u-blox receiver and use the covariance threshold to bound the raw error. The error for dual-constellation, single-constellation and inter-constellation consistency checks are all displayed and compared to one another. The pseudorange residuals and their accompanying chi-squared (χ2) statistic are also evaluated and compared for the GPS and Galileo single-constellation position solutions.
Positioning Consistency Comparison Maps. From the maps in Figure 1, we observe that Galileo has the highest error, followed by GPS, and then the dual-constellation solution. The map also serves as a method to spatially visualize the tails of the error distribution.
NED Time Histories. We compare the time history of the dual-constellation, GPS and Galileo position solution error to the three sigma (3σ) covariance bound computed at each epoch (see FIGURE 2). We also compare the GPS vs. Galileo inter-constellation difference to the 3σ covariance bound. The covariance bound is never crossed, indicating that 3σ threshold is conservative for both the error and the inter-constellation difference between GPS and Galileo.
FIGURE 2a. Dual-constellation north-east-down error vs. known truth, bounded by a 3σ threshold, at Colorado Springs. (Image: Authors)
FIGURE 2b. Dual-constellation north-east-down error vs. known truth, bounded by a 3σ threshold, at CU Boulder. (Image: Authors)
FIGURE 2c. Dual-constellation north-east-down error vs. known truth, bounded by a 3σ threshold, at Stanford. (Image: Authors)
Pseudorange Residuals and χ2 Statistic Threshold. Pseudorange residuals have a long history of being used as a consistency check between range measurements. As an example, the pseudorange residuals for the GPS position solutions are shown in FIGURE 3, and their corresponding χ2 statistic is shown in FIGURE 4.
FIGURE 3a. GPS pseudorange residuals at Colorado Springs. (Image: Authors)
FIGURE 3b. GPS pseudorange residuals at CU Boulder. (Image: Authors)
FIGURE 3c. GPS pseudorange residuals at Stanford. (Image: Authors)
FIGURE 4a. GPS χ2 and probability of false alert (PFA) threshold for the nominal noise environments at Colorado Springs. (Image: Authors)
FIGURE 4b. GPS χ2 and probability of false alert (PFA) threshold for the nominal noise environments at CU Boulder. (Image: Authors)
FIGURE 4c. GPS χ2 and probability of false alert (PFA) threshold for the nominal noise environments at Stanford. (Image: Authors)
The χ2 statistic is computed using the finite pseudorange residuals at each epoch, where the degrees of freedom are n − 4, where n is the number of satellites used at that epoch and 4 is the number of variables solved for (x, y, z, and the receiver time offset) when using a single constellation. A p-value is computed using the cumulative distribution function (CDF) of the χ2 statistic, and indicates the probability that the χ2 statistic at each epoch would be greater than the observed value. The statistic is compared to a theoretical 10−9 probability of false alert (PFA) based on the theoretical χ2 and the actual degrees of freedom of each epoch. Very low values for the χ2 statistic, such as those obtained with Galileo, are attributed to regions where very few satellites are in view, thus decreasing the degrees of freedom. Any spikes in the pseudorange residuals are also reflected with a higher χ2 statistic and low p-value, though those residuals are de-weighted in the position solution and ultimately do not trigger the 10−9PFA threshold or the 3σ threshold, thus indicating that a 10−9PFA is a conservative threshold.
Power Monitoring. For each nominal location with a u-blox receiver, we analyze results from the power-monitoring metrics mentioned earlier. We also observe results from the internal u-blox jamming indicators in a region where a possible RFI event was observed.
For power monitoring, we analyze spectral power and programmable gain amplifier (PGA) results.
For the nominal noise environments, the spectral power, PGA and corresponding C/N0 results indicated no significant anomalies.
Threshold and Metric Validation Results
An examination of thresholds and other metrics are important for characterizing RFI.
GPS Testing for Critical Infrastructure. From a DHS-sanctioned RFI testing event, we identify five regions of interference or spoofing. To identify the interference, we use a combination of the power and positioning metrics as well as the thresholds we developed through the characterization of the nominal noise environments described in the previous sections of this article.
We use the thresholds and tests we’ve developed to identify regions of spoofing and RFI events (labeled C I1–C I5) in the GET-CI dataset. For ease of comparison, all regions are labeled on plots that display the full 5.5 hours of data collection. All details as to the truth location and time of the test have been removed. C I1 is identified through the power metrics. C I2–C I5 are identified as regions that the NED difference between GPS and Galileo clearly crossed the 3σ threshold in all three directions, as visualized in FIGURE 5.
FIGURE 5a. Map view of solutions using GPS, Galileo and GPS plus Galileo for the DHS-sanctioned RFI testing event (identifying coordinates and physical features removed). (Image: Authors)
FIGURE 5b. Corresponding log-scale visualization of the GPS vs. Galileo position solution difference in the north-east-down directions. (Image: Authors)
From our pseudorange residuals, it appears as though the most significant interference events happened on the GPS constellation, as indicated by the high pseudorange residuals that fall into the C I2 and C I5 regions. Using the GPS χ2 statistic and p-value computations, we determined that the regions that crossed the 10−9 PFA threshold line are consistent with the regions of interference identified in Figure 5. The Galileo χ2 statistic, p-values and pseudorange residuals all show signs of possible interference. These regions are explored more in the power monitoring discussion below.
Since the GPS pseudorange residuals and χ2 statistic results show more signs of spoofing than the Galileo ones, we explore the Galileo-only position solution. Because the truth position is unknown, we take a point during the non-C I regions and define this as the “truth,” that is, a point in the position solution we believe has not been subject to spoofing. Any references to a truth position are from a position recognized as “truth” through post-processing rather than from a pre-determined and known location.
The p-values dip in each of the C I regions, but are lowest in regions C I5. Combined with the fact that the pseudorange residuals and NED error are the highest in C I5, we identify this as the region that likely experienced a significant spoofing event. We determined from an outlier at the beginning of the C I5 region (see Figure 5) that even the Galileo constellation is not immune to the spoofing in this scenario.
To further check the accuracy of our determination that GPS was spoofed, we evaluated the histograms of the Galileo error. With the biggest outlier in C I5 removed, we saw that the error appears relatively Gaussian, with some outliers and possible multi-modal behavior that were also seen in the nominal locations. The variance was higher than was observed at nominal locations, which could be attributed both to the presence of known RFI events, the fact that the nominal noise environment at the RFI event test has not been characterized (that is, it is possible there is a noisier nominal environment at this location), and that the “truth” position was not a known truth but obtained through post-processing of a dataset with increased RFI. Normalized error indicates that the error does not cross the 3σ threshold in any NED direction, further supporting the assertion that 3σ is a conservative threshold.
Important to note is that the major outlier around T+3.5 hours is visible in the NED plot (Figure 5), but the corresponding histograms do not contain that outlier. This indicates that the covariance also increases at that point. It dictates a need to monitor the covariance bound itself, as well as the positioning error. The NED time history plot and the raw error histograms serve this purpose, since it is clear that if we were to be only looking at the error normalized by 3σ, we would not have found significant evidence of the outlier, since the normalized error barely passes the 3σ threshold. This further supports our methods of combining multiple metrics, thresholds and visualizations rather than relying on a single metric to identify jamming and spoofing.
From the Galileo solution analysis, we increase our confidence that we have identified the regions with interference. We removed those areas and looked at the GPS vs. Galileo inter-constellation consistency difference. The normalized differences were now mostly within the 3σ threshold, and the raw error displayed some Gaussian behavior and is no longer on the order of the 105-meter error we were seeing in Figure 5. While these regions still have a higher error than nominal conditions and thus still display signs of interference, we are able to use our spoofing analysis to identify epochs in which we should not trust the GNSS. Using times outside those regions, we are able to figure out a reasonable truth position within 20 meters rather than 200 kilometers.
Positioning analysis using the inter-constellation consistency check is a powerful tool for determining the reliability of a position solution, even when the truth location is unknown. With the power metrics, we can further corroborate the positioning results, as well as find events indicating interference that the positioning metrics were unable to track.
FIGURE 6a. GPS pseudo range residuals for position solutions computed using only the GPS constellation. (Image: Authors)
FIGURE 6b. Galileo pseudorange residuals for position solutions computed using only the Galileo constellation for the DHS-sanctioned RFI testing event. (Image: Authors)
Next Steps and Summary
Leveraging the raw data collected by u-blox receivers in multiple locations with different nominal noise environments, we have developed the toolsets to do inter- and intra-constellation consistency checks to monitor for jamming and spoofing. Many further observables usable for RFI detection are being recorded by the u-blox receivers. Several power monitoring metrics have been evaluated in a preliminary analysis. The next step is to further characterize metrics such as C/N0, AGC and u-blox internal jamming metrics under nominal conditions.
In summary, the tools we have developed so far show that the u-blox receiver will allow for many different consistency checks on a variety of parameters to be running simultaneously. It would be difficult for a spoofer to interfere with all the dimensions we have covered in our detector. Continuously monitoring a wide variety of parameters will increase the chance that we are able to detect interference, thus lowering the chance that a spoofer is able to evade detection.
Acknowledgments
We gratefully acknowledge the support of both the FAA Satellite Navigation Team and The Aerospace Corporation under their university partnership program. We especially wish to thank Steve Lewis of Aerospace for his support and guidance throughout the development of this project. This article is based on the paper “Low Cost RFI Monitor for Continuous Observation and Characterization of Localized Interference Sources” presented at ION ITM 2022, the 2022 International Technical Meeting of the Institute of Navigation, Jan. 25–27, 2022.
LEILA TALEGHANI recently graduated with her MS degree from Stanford University in aeronautics and astronautics and is now a navigation engineer at Trimble.
FABIAN ROTHMAIER is a navigation research and development engineer at Airbus Defence and Space in Munich, Germany, and a former a Ph.D. student at the Stanford GPS Laboratory.
YU-HSUAN CHEN is a research associate at the Stanford GPS Laboratory.
SHERMAN LO is a senior research engineer at the Stanford GPS Laboratory.
TODD WALTER is a research professor in the Department of Aeronautics and Astronautics at Stanford University.
DENNIS AKOS is a professor with the Aerospace Engineering Sciences Department at the University of Colorado, Boulder.
BENON GRANITE GATTIS is a laboratory assistant and undergraduate student in the Aerospace Engineering Sciences Department at the University of Colorado, Boulder.
Of the 60 exhibitors at the Institute of Navigation’s Joint Navigation Conference (JNC) in San Diego this year, 16 make inertial navigation systems (INS). Many of the other exhibitors integrate INS with GNSS receivers or make simulators to test those integrations. Several exhibitors make a variety of other navigation systems, using active and passive optical sensors, wheel encoders and RF systems that map beacons of opportunity. Only seven manufacturers of GNSS receivers were present.
That’s because the conference — which took place June 6-9 and focused on technical advances in positioning, navigation and timing (PNT) — was hosted by ION’s Military Division for the Departments of Defense (DOD) and Homeland Security. “From an operational perspective,” said the conference program, it focused on “advances in battlefield applications of GPS; critical strengths and weaknesses of field navigation devices; warfighter PNT requirements and solutions; and navigation warfare.” In other words, it was mostly on how to navigate in environments in which the use of GNSS is challenged or denied due to jamming.
The conference program told the story of the GNSS/PNT community’s interests and concerns. Several sessions were on complementary PNT using terrestrial RF signals of opportunity, IMUs, geophysical fields (including gravity and Earth’s magnetic field), celestial objects, ground vision and new commercial sources of space-based PNT, such as satellites in low Earth orbit (LEO).
Other environments in which reliance on GNSS is hard or impossible — such as urban canyons, deep inside buildings, underground and underwater — pose the same navigation challenges to both military and civilian applications. Likewise, jamming is a threat to both. Therefore, several sessions focused on critical infrastructure, demonstrating that the concerns about GNSS vulnerabilities are not just military ones.
Hence the presence among the exhibitors of three manufacturers of atomic clocks, which continue to shrink in size, weight, power and cost (SWaP-C) and are used to assure holdover — that is, the time period required to keep networks synchronized when their primary timing source, usually GNSS, is disrupted or temporarily unavailable. Networks affected include cellphone providers, radio and television broadcasters, financial networks, and the biggest network of all, the Internet.
The JNC “experienced record attendance in both conference participants and exhibitors, hosting more than 1,000 attendees,” Lisa Beaty, ION executive director, told me. She attributed the increase to “the importance of PNT in the nation’s critical infrastructure, current innovation, programmatic funding, and the desire by the DOD community to collaborate and reconvene.” She confidently anticipates additional growth next year.
I am equally confident that much of the cutting-edge technology on display at this conference will find its way into civilian applications in the next few years. Whether in war or in urban canyons, GNSS navigation faces some of the same challenges.
