Regulus Cyber, creator of what it calls “anti-virus” software to protect GPS navigation and timing across a wide range of applications, is collaborating with Harman, a connected-car company.
The software-based cybersecurity solution will be part of Harman Shield, the company’s risk-management offering for vehicle manufacturers and mobility companies.
“We are looking forward to joining forces with Harman, a Tier 1 supplier to the automotive industry, a trusted partner to more than 50 global vehicle manufacturers. Coming together with Harman is a great testament to the necessity of GPS protection measures in our industry,” said Yonatan Zur, CEO of Regulus Cyber.
“We’re seeing our OEM customers expand into the digital and mobility spaces, offering added-value services to consumers by leveraging connectivity and mobile applications,” said Asaf Atzmon, vice president and general manager, Automotive Cybersecurity at Harman. “Through Harman Shield, we offer full visibility, analytics and risk management capabilities into cyber threats, and Regulus Pyramid GNSS solution complements our offering with another layer of protection against GPS hacking. We’re excited about the possibilities of this new collaboration with Regulus.”
The Regulus Pyramid GNSS is a software solution that uses machine learning to detect spoofing and defend any GNSS receiver, device or chipset against it — ensuring the security and reliability that are essential to safe and accurate navigation. GPS spoofing attacks are becoming more common and are often difficult to detect and protect against.
Pyramid GNSS uses a combination of patented algorithms, developed over years of spoofing experiments to protect against attacks at the firmware, operating system, or application level. This deal is further proof of the market demand for resilient navigation and positioning at a time when GPS hacking is a growing concern.
TDKC has proven capabilities in microelectronics trust and assurance, space domain awareness, and advanced visualization for enhanced situational awareness. PreTalen’s core competencies are the related practices of cyber warfare, navigational warfare, and positioning, navigation and timing (PNT) techniques and technologies in support of defense and offensive operations to counter adversaries.
Both companies are headquartered in Dayton, Ohio.
The acquisitions more than double the number of Centauri employees in the region to more than 300, supporting customers across the space, cyber and intelligence markets.
In addition, to bringing TDKC and PreTalen’s capabilities to bear for Centauri’s broader customer base, Centauri is building additional research and development labs, and secure facilities in the Dayton region to expand innovation and cutting-edge solutions for Centauri’s customers.
“Both TDKC and PreTalen have exceptional talent and share a common culture of innovation in pioneering new capabilities for the warfighter” said Dave Dzaran, CEO of Centauri. “With TDKC, we are building world-class capability to help ensure trusted microelectronics in the supply chains for the defense and intelligence communities. Their expertise in space domain awareness brings additional AI and machine learning technology to further strengthen Centauri’s existing space-related mission capabilities focused on the next generation of solutions that will serve this rapidly-evolving domain.”
“Similarly to TDKC, PreTalen’s unique skill sets relating to all aspects of the PNT architecture serve as a true differentiator on their programs,” said Dennis Kelly, president and COO of Centauri. “PreTalen has built a critical mass of the most innovative employees in both PNT and cyber, and we are excited to facilitate collaboration not only with our Dayton operations but also across the rest of our company.”
Greg Gerten, CEO of PreTalen, and Dan Schiavone and Eric Loomis, founders of TDKC, as well as both of their leadership teams, including Bruce Hart, will become a part of Centauri’s growing operations in the region.
This investment in the Dayton region comes on the heels of Centauri’s hiring of Col. Elena Oberg, former vice commander of the Air Force Research Laboratory, headquartered just outside Dayton at Wright-Patterson Air Force Base.
With the addition of TDKC and PreTalen, Centauri now has more than $475 million of annual revenues and 1,650 employees, approximately 20% of which support customers located in the Dayton market.
“I speak for all of PreTalen when I say that we are extremely excited to be joining forces with Centauri,” Gerten said. “Our team is eager to apply our core capabilities to the space and Intelligence communities, and we look forward to replicating our past success for an ever-increasing number of customers. Furthermore, Centauri’s focus on innovation meshes well with what we’ve spent 12 years building here at PreTalen, and I’m thrilled to continue our journey with their support.”
By Jeremy Onyan, Director, TIme Sensitive Networks, Orolia
Cybersecurity is critical to all facets of the internet. Companies spend millions on cybersecurity every year. Still, often-overlooked areas degrade security. A key example of this is time.
Time plays an essential role in synchronizing core business and network systems. It supports authentication protocols as well as accurate log files critical for an audit trail — necessary for any cyber forensics program. As such, synchronization is often a requirement for network security standards.
A deployment of network time protocol (NTP) synchronizes a local system to a time server. The time source can come from within the network or outside of it.
NTP over the internet. NTP time servers are widely available on the internet. National authorities operate internet time servers based on extremely accurate atomic clocks, such as the National Institute of Standards and Technology (NIST) or the U.S. Naval Observatory.
But even with these sources, many factors impact traceability. According to ntp.org, “If business, organization or human life depends on having correct time or can be harmed by it being wrong, you shouldn’t ‘just get it off the internet’.”
One problem with time synchronization is the variability of network conditions. Network load, variable path delays and firewall settings can impact time quality on the local system. To illustrate this effect, we can use the time-quality monitoring feature of a time server with a built-in GPS receiver as its reference that is accurate to tens of nanoseconds. NTP can be used to compare it to another GPS time server on a local area network. The offset is around 15-20 microseconds (Figure 1).
Figure 1. The comparison between two GPS time servers on the same LAN using NTP results in 15–20 microseconds offset. (Chart: Orolia)
We connected the SecureSync time server to some of the most popular internet time servers. The variation result, shown in Figure 2, is as high as tens of milliseconds — 1,000 times worse than NTP across a local area network. If we assume all the time servers are accurate, then the difference is solely due to greater path delay and other dynamic conditions. This variation is enough to question the traceability of time from the internet.
Figure 2. The comparison of internet time servers as measured by NTP on a local GPS time server. The scale is 1,000 times greater than in Figure 1. (Chart: Orolia)
The internet obscures time traceability. Perhaps more important for a security-critical network is the validity of the source used by the time server that distributes time to your network. Time from GPS/GNSS signals is recognized as the most accurate, available and traceable time source.
GPS/GNSS-based time servers are easy and simple appliances to add to the local network. Even when different GPS/GNSS time servers are deployed in different locations, they will provide the same time regardless of geography. What’s more, GPS/GNSS as a local time source can be monitored, so its logs can become part of the audit trail.
Of the seven internet time servers monitored over a 24-hour period, 20 different time sources were identified. Less than half of the sources could be identified as coming directly from GPS/GNSS. In one case, GPS/GNSS time was distributed through three different time servers.
The best practice of using NTP server pools is one reason why there are more sources than time servers. Server pools rotate among various internet time servers, each with their own source of time, to reduce the chance of one bad or unavailable time server catastrophically affecting the synchronization. But this is a problem for traceability. The source of time is not known, nor can it even be determined.
Indeterminate source identification, indeterminate accuracy variation and the inability to log the resulting time synchronization calls into question the efficacy of getting time from the internet. Internet time servers are also subject to being spoofed (bad NTP data sent from a faked IP address) and to direct attacks, including NTP poisoning, replay and denial of service.
When there is a business-critical need to trace time to an accurate source, a GPS/GNSS-based time server should be deployed on the local network.
Mobilicom’s SkyHopper VU remote viewing terminal is specifically designed for commercial and industrial drones and robotics. (Photo: Mobilicom)
Mobilicom Ltd., a global mission-critical-communications solution provider, will present its SkyHopper end-to-end solutions for smart drones and robotics at the Association for Unmanned Vehicle Systems International’s Xponential 2019 trade show.
According to the company, SkyHopper brings all the key components that turn a drone into a smart drone. The SkyHopper product suite includes communication data links, cybersecurity and encryption that has been validated by the Israel Ministry of Defense and other government organizations; video processing; controllers and viewers.
The product line includes the SkyHopper PRO bi-directional data link, SkyHopper PRO V integrated video processing, SkyHopper ControlAir ruggedized controller and the SkyHopper VU remote viewing terminal.
According to the company, the SkyHopper PRO bi-directional data link delivers long range and non-line of sight communication that supports multiple transmission modes. The SkyHopper PRO V includes a dual-camera input, three camera interfaces, dual built-in video encoders and decoders, and local recording ability. The SkyHopper ControlAir allows users to control a drone or robot, as well as transmit or view a video and data while operating in air and ground missions. Finally, the SkyHopper VU offers a mobile HD video and telemetry receiver terminal for multiple viewers, specifically designed for commercial and industrial drones and robotics.
“We have done our homework in understanding what our customers need in order for their drones to successfully execute their missions,” said Oren Elkayam, CEO of Mobilicom. “As a result, while others focus on offerings for today, we offer solutions also essential for the future survival and scalability of commercial drones of robotics. With proprietary drone cybersecurity and radio technology and a highly experienced customer success team, SkyHopper has maintained a strong base of over 50 customers and counting.”
According to Mobilicom, its goal is to enable commercial drone and robotics manufacturers to increase their chances for success by focusing on their own business objectives, reducing time to market and minimizing resource expenditures.
Photo: U.S. Air Force / Staff Sgt. Scott H. Spitzer
Much development has been necessary to enable the new M-code capability on more than 700 weapon systems that require it. This article overviews M-code, the updates to antenna and receiver technology to make these varied platforms M-code ready, and perspectives from key stakeholders in the M-code community.
December 23, 2018, marked an important milestone for GPS. The successful launch of satellite USA-289 represented a key success in what has been a monumentally expensive government program, beset by delays and overspends.
The launch of the first GPS Block III satellite, the first that can provide the full military M-code capability, effectively commenced the physical roll-out of modern M-code hardware.
Ground Control. As far as the space segment is concerned, M-code is finally underway. What about the ground segment? The next-generation GPS operational control system, GPS OCX, is essential for use of the full capabilities of the new Block III satellites. It has been under development for some time.
OCX has drawn Congressional criticism and correlative media attention, but recent reports have been more positive. Since the Nunn-McCurdy breach of 2016, when the project’s future hung in the balance, accounts have grown gradually optimistic. Budget and schedule were re-baselined, and contractor Raytheon’s corrective actions generated results. In the fall of 2017 the Air Force took delivery of OCX Block 0, marking a significant milestone. Block 0, also known as the Launch and Checkout System (LCS), demonstrated compliance with contractual requirements and was accepted by the Air Force.
In spring 2018, Block 0 underwent a series of cybersecurity tests and passed, validating the security architecture of the system. All this puts Raytheon on track to deliver OCX Block 1 in 2021, providing full operational capability. Block 1 and Block 2 are intended to be delivered together, adding operational control of the modernized satellites and signals, including L1C and the modernized M-code.
“There have been no schedule slips with the GPS OCX program since 2017, and the GPS III launch last December was clear proof of our progress,” stated Dave Wajsgras, president of Raytheon’s Intelligence, Information and Services business. “We will continue to meet all of our commitments, and importantly, we will meet our June 2021 contractual deadline.”
Col. Steve Whitney of the GPS Directorate wrote in this magazine in December 2018 that “The journey over the past few years has been challenging, but we have emerged stronger, armed with better metrics, and a culture of integrated development (often called DevOps) which puts us on a path to success. There will be challenges and risks in the path ahead but rather than mountains to climb, I see these more as standard blocking and tackling of a software-intensive program.”
Meanwhile. The Air Force plans to deploy M-code capability in 2020, and OCX seems unlikely to be ready. For this reason, Lockheed Martin was awarded a contract to modernize the existing ground infrastructure as a “gap filler.”
The GPS Control Segment Sustainment II (GCS II) contract was awarded on Dec. 21, 2018, and is worth $462 million. GCS II will support operational capability of M-code in 2020, and continues until 2025, and so there will be a period of overlap between GCS II and OCX, essentially providing two options for controlling the new GPS III constellation. In one view, the Air Force is backing two horses to improve chance of winning: OCX the preferred solution, with GCS II almost like an insurance policy.
With the GPS III ground and space segments looking relatively healthy, attention turns again to the user segment.
WHY M-CODE?
Until now, the military has used the classic P(Y) signal: a binary phase shift keying (BPSK)-modulated encrypted wideband signal. It offers both greater accuracy and increased jamming resistance when compared to the civilian C/A code still employed by the vast majority of GPS receivers.
But the P(Y) code has its drawbacks in the modern world: its wide main lobe sits directly over the top of the C/A code signal (see Figure 1), essentially occupying the same spectrum. When the civilian C/A signal is jammed, the military P(Y) signal is at the very least degraded, if not also jammed itself. It also uses a relatively simple encryption scheme that does not meet today’s cyber security requirements.
Figure 1. C/A, P(Y), and M-Code signal power spectra. (Graphics: Mike Jones)
The M-code signal, on the other hand, is the first military GPS signal to use the BOC modulation scheme. BOC modulation gives signals their distinctive two-lobe appearance, spreading the signal’s energy away from the band center.
The wide spacing of the two sidebands separates the M-code signal from the civilian signals (the legacy C/A signal or the new L1C signal on the L1 frequency, and the L2C signal on the L2 frequency).
Amongst other things, this allows the military to jam the civilian codes without noticeably degrading the M-code signal. Often referred to as blue force electronic attack (BFEA), this is essentially a new facet to navigation warfare (NAVWAR), where enemy use of GPS can be denied whilst allowing friendly forces to continue using it.
The wider occupied bandwidth and increased signal power also help to make M-code more resistant to jamming. M-code also makes use of more modern and flexible encryption methods, ensuring it will be secure and safer from threats such as spoofing attacks.
Scepticism. Defense programs are known for their long procurement cycles, but even by these standards, M-code has taken an extremely long time to get where it is today. Given the enormous cost of the program, and the fact that there is still, as yet, no operational benefit to show from it, many people have questioned its worth. At the time it was conceived it represented a dramatic step forward in military capability but, because it has been so long in development, its operational benefit is becoming diluted.
When M-code was conceived, GPS was still the only operational GNSS in town: everybody had to use GPS — or nothing. Today, the picture differs greatly. During M-code’s insanely slow progress, other GNSS systems have come along, offering their own encrypted signals of a similar ilk. Looking at Figure 2, M-code no longer appears as special as it once was. Its BOC(10,5) signal sits inside the main lobes of Europe’s Galileo PRS signal, which uses a BOC(15,2.5) scheme, and China’s Beidou B1A signal using BOC(14,2).
Figure 2. GNSS encrypted signals around the L1 frequency. (Graphics: Mike Jones)
If you were China, you might consider jamming the central 24 MHz of the L1 band, taking out M-code, whilst still having an operational military service for yourself. Or if you were Russia, you might jam 34 MHz of bandwidth, taking out the US, Chinese, and European systems, whilst still having your GLONASS L1SC military service to use. The situation is more complex than that, of course: each service has the potential to increase signal power in times of conflict, and there is more than one frequency that can be used. But it does demonstrate the essence of the problem: The modern battlespace has moved on, and M-code hasn’t.
CHALLENGES OF RECEIVER DESIGN
Figure 3. C/A code ACF.
With complex signals come complex receivers, and there several headaches when it comes to M-code receiver design. The first is the nature of the BOC signal itself, which has a complex correlation function. Consider Figure 3, which shows the autocorrelation function (ACF) of the traditional civilian C/A code signal. The single peak of the function makes acquisition and tracking a simple process; traditionally early, prompt and late (E,P,L) correlator arms can be used in the tracking process.
Figure 4. L1Cd ACF.
The newer BOC-type signals have a more complex ACF. Figure 4 shows the ACF of the new L1Cd civilian GPS signal, which uses a form of BOS(1,1) modulation. In addition to the main lobe, there are now two side lobes. Receivers must be careful not to lock on to one of the side lobes instead of the main lobe: the receiver architecture starts to become a little more complex.
Figure 5. M-code ACF.
Now consider the ACF of the M-code signal, shown in Figure 5. Like other high-order BOC-type signals, M-code exhibits multiple lobes in the ACF, making robust acquisition and tracking a far more troublesome process. Furthermore, the high bandwidths require high sample rates, which lead to higher power consumption in the hardware.
Another major headache associated with M-code receivers is, of course, the encryption process. Not because encryption is difficult, but again because of the power consumption implications. Consider that each GPS receiver needs to run an encryption engine instance, for each satellite it might wish to receive. Running a high-grade encryption algorithm at a high chipping rate, for a dozen satellites, is a power-consuming process. For dismounted soldiers with limited battery capacity, this is a big deal.
Some people argue that the high-grade encryption process for M-code is too complex. Consider why we want to encrypt a GNSS signal in the first place: firstly to prevent someone from spoofing our signal, and secondly to prevent unauthorised users from using the service. Given that the encryption keys are rolled regularly, how much does it matter if an adversary manages to compromise the encryption? This isn’t a communications security problem: we are not talking about loss of classified information, so there’s an argument that a simpler, less power-hungry form of encryption might have been used instead.
ANTI-JAM ANTENNA COMPATIBILITY
Although M-code offers a certain level of jamming resistance, it is still vulnerable to attacks. As a signal it might have a bit more power, and a bit more bandwidth, than some other signals. But it is, after all, still a GNSS signal, and it can be jammed by an adversary. Where an operational threat analysis indicates that an increased level of jamming resistance is required, then M-code receivers need to be integrated with anti-jam antennas.
Anti-jam antennas, usually referred to in the GNSS community as controlled reception pattern antennas (CRPAs), have been the anti-jam tool of choice for several decades now. I overviewed these in an April 2017 newsletter column. CRPA manufacturers have had to ensure that their products are “M-code ready,” such that they can be seamlessly attached to M-code receivers as and when they appear.
This hasn’t been a recent process: as far back as 2002, the GAS-1 antenna (Raytheon) underwent a series of qualification tests to ensure compliance with M-code. Around 2005, the ADAP antenna (also Raytheon) was launched with a host of M-code features — again an illustration of just how slow the M-code program has moved, given that other technology has been “M-code ready” for 10 or 15 years already.
What’s involved in making a CRPA M-code compatible? Firstly the increased bandwidth: the antenna electronics must digitize the wider bandwidths. Along with the wider bandwidth comes new filtering shapes to ensure optimum performance.
Space-time adaptive processing (STAP) and space-frequency adaptive processing (SFAP) techniques potentially require more taps to ensure high null depths can be maintained across the full bandwidth. The increased power of the M-code signal, particularly if features like spot beam are used, presents another complication to CRPAs: they must not treat the high-power satellite signals as jammers, and try to remove them.
Testing CRPAs presents a challenge to manufacturers: how do you prove that your antenna doesn’t corrupt the M-code signal, when there’s no M-code signal to test it with? To work around this issue, pseudo M-code signals have been used for testing, where representative BOC(10,5) signals without the real encryption are passed through the CRPA and examined for distortion.
RECEIVER DEVELOPMENT STATUS
Due to the security considerations surrounding M-code, only three US organizations are authorized to produce modules: Collins Aerospace, Raytheon and L3. Here are the answers from Collins Aerospace and L3, the answers from Raytheon will appear in later issue.
What are the technical challenges associated with developing an M-code receiver?
Collins Aerospace. The Collins Aerospace Modernized GPS User Equipment (MGUE) Increment 1 development like the SAASM PPS receiver developments faced very challenging technical requirements to support our war fighter needs in an ever-evolving threat environment. Like other complex developments the challenges are initially technical and then transition to integration/test and certification. On the technical front optimizing receiver performance balanced against power consumption are always at the forefront. In addition, it is important to maximize backwards compatibility so as to minimize downstream integration costs while adding an entirely new signal that runs in parallel to the existing system. Collins Aerospace is pleased with the technical development and are actively supporting the integration with both receivers and technical support.
To date, we have delivered more than 770 MGUE receivers to the Air Force to support Air Force, lead platform and DoD-wide Integration and test. Soon the total will grow to nearly 1,100 receivers to support expanded integration and test following the completion of Collins Aerospace security certification.
L3. M-code GPS User Equipment (MGUE) technologies exist today.L3’s Ground Based GPS Receiver Application Module – Modernized (GB-GRAM-M) is a fully-functioning unit that is currently baselined and undergoing an independent Technical Requirements Verification (TRV) by the GPS Directorate.During TRV, each requirement from the Technical Requirements Document (TRD) is independently evaluated for compliance. Upon completion of the TRV, the design is baselined with complete documentation enabling platforms and prime equipment to integrate from a known baseline with low risk. Following integration, operational testing can start immediately to support fielding when M-Code Early Use (MCEU) becomes operational. The TRV of L3’s GB-GRAM-M is planned to be completed by the second quarter of 2019.
L3 resolved numerous technical challenges in developing M-code GPS technologies. The first and ever-present challenge is changing and evolving requirements. Most of these requirement changes are in response to evolving threats that have driven changes into the GPS receiver and/or to higher-level systems. Asan example, the U.S. Army’s Assured PNT (A-PNT) is implementing M- code GPS along with external sensors to establish and maintain an assured solution even in GPS-challenged environments. Other challenging requirements include meeting the security requirements, implementing and testing anti-spoofing algorithms, and ensuring backward compatibility with legacy receivers.
What are the intended platforms for your MGUE?
Collins Aerospace. The Collins Aerospace MGUE receivers are intended to support all warfighter domains: ground, airborne, maritime and munitions to support compliance with Public Law 111-383 SEC. 913 issued in Fiscal Year 2011. Per this directive, M-code is intended for all DoD applications with the exception of passenger vehicles or commercial vehicles with GPS installed. Now that the satellite and control segments of the capability are coming on line, we are working diligently to ensure that user equipment is available for all domains.
L3. L3 has products to meet current market demand. Under the MGUE program, L3 developed a GB-GRAM-M, which is a standard Modular Open Systems Architecture (MOSA) design. The GB-GRAM-M is designed to fulfill retrofit replacements of SAASM receivers, as well as being a primary component of A-PNT systems. L3’s M2GRAM ASIC is the core of our receiver, a GPS module that incorporates signal processing, cryptography, and positioning, velocity, and timing (PVT) processing. The M2GRAM ASIC is capable of being implemented in other form factors for applications beyond ground-based applications. As an example, the M2GRAM is implemented in a GPS receiver specifically designed for Precision Guided Munitions (PGM) applications and was used in a gun launched, guide-to-target demonstration operating as a PGM receiver.
L3 is also augmenting the GPS receiver through the integration of several other technologies, including controlled reception pattern antennas with digital antenna electronics, inertial systems and external sensors, and GPS-denied capabilities. M-code technologies are being implemented in Mounted A-PNT Systems (MAPS), Dismounted A-PNT Systems (DAPS), and handheld systems to bring capabilities to the warfighter.
What is the expected timeline for your MGUE development, acceptance testing, and delivery?
Defense Advanced GPs Receiver (DAGR) from Collins Aerospace, equipping infantry and other warfighters. (Photo: Collins Aerospace)
Collins Aerospace. The Collins Aerospace receivers are supporting ongoing DoD integration and test and our MGUE Increment 1 program is aligned with the Air Force GPS Enterprise roadmap. Ultimately, the Department of Defense (DoD) M-code programs will set the production delivery schedules.
We anticipate that the M-code production ramp-up and continued SAASM PPS receiver production will have a production overlap. Our Collins Aerospace in-house PPS GPS receiver manufacturing capability is ready to support the DoD demand for both M-code and SAASM. Collins Aerospace is fully committed to manufacturing Increment 1 M-code receivers to meet the warfighter’s needs across Airborne, Weapons and Ground, we know the transition from SAASM to M-code will take years. Therefore, Collins Aerospace will continue to manufacture SAASM receivers for years to come as the International MOD Policy for M-code use is still being formulated.
L3. L3’s GB-GRAM-M is now available. L3 received security certification and approval in 2016 and TRV is planned for completion in the second quarter of 2019. With TRV, L3 is receiving a new security certification and approval of the latest receiver update. Government agencies, prime contractors and laboratories can order GB-GRAM-M now with delivery in the fourth quarter of 2019.
What does testing and verification process involve?
Collins Aerospace. As with any Precise Positioning Service (PPS) GPS development, the testing involves functional verification of the receiver in a wide variety challenging of environmental, thermal, electromagnetic interference/ high-intensity radiated field (EMI/HIRF) environments. Collins Aerospace is leveraging proven test and verification approaches founded upon our long history of successful product introductions and field performance. As this is a PPS receiver it is also essential the receiver design comply with the government’s required Security Approval process.
L3. The testing and verification of L3’s GB-GRAM-M included internal testing and independent testing through the GPS Directorate’s TRV process. Further risk reduction testing within the MGUE program is planned as Phase IV testing where the GB-GRAM-M is integrated into a lead platform for the U.S. Army and a lead platform for the U. S. Marine Corps. An operational assessment is performed on both lead platforms to assure common problems associated with integration and operational testing are addressed prior to implementing M-Code GPS Receivers across all of the platforms.
Will the MGUE be compatible with CRPA anti-jam antennas; are there any special considerations for this?
Collins Aerospace. The Collins Aerospace product family includes our Digital Integrated Anti Jam Receiver (DIGAR) product family that leverages CRPA anti-jam antennas for enhanced anti-jam (AJ) performance. Our DIGAR AJ technology enhances the performance with fixed reception pattern antenna (FRPA), CRPA and is compatible with all PPS waveforms. Regarding the interfaces between the receiver and the anti-jam antenna electronics, a GPS receiver with a standard RF interface is compatible with a CRPA in nulling mode and FRPA antennas. Advanced capabilities such as beamforming/beamsteering require tight coordination and additional interface with the GPS receiver.
L3. The GB-GRAM-M is designed to operate with a fixed reception pattern antenna (FRPA). A CRPA antenna using digital antenna electronics to generate signals matching the characteristics of a FRPA is fully compatible with the GB-GRAM-M. With a higher level of integration of a GPS receiver and a CRPA, the system capabilities are greatly enhanced. L3 has performed this integration and can perform advanced capabilities such as angle of arrival and beamforming using M2GRAM, digital antenna electronics, and CRPA technologies. These capabilities can be found in L3’s Mounted Assured PNT System (MAPS) and Anti-Jam Antenna System (AJAS) products.
Army Stryker ground combat vehicle. (Photo: Karolis Kavolelis / Shutterstock.com)
OPERATIONAL DEPLOYMENT
The U.S. Air Force GPS Directorate provided answers to the following questions regarding MGUE.
Which platforms will be equipped with M-code-capable MGUE, and how many of each?
GPS Directorate. The Air Force is developing M-code-capable GPS receivers under the MGUE Increment 1 program. The receivers in development will be provided to four service-specific lead platforms for integration, developmental, and operational testing. Lead platforms are:
the Army Stryker ground combat vehicle,
the Air Force B-2 Spirit bomber,
the Marine Corps Joint Light Tactical Vehicle (JLTV),
and the Navy Arleigh-Burke class destroyer (DDG).
Following the lead platform efforts, procurement of M-code-capable GPS receivers will be decided by the Services and executed by individual platforms and programs.
What are the timelines for rolling out M-code on these platforms?
GPS Directorate. Early integration and test activities have already begun for each MGUE lead platform. Operational testing is expected to begin in 2020 and complete in 2021, which is a key activity to enable the fielding of M-code-capable systems.
B-2 Spirit multi-role bomber capable of delivering both conventional and nuclear munitions. In December 2017, the Air Force completed a series of successful flight tests of M-code GPS using a Raytheon Company receiver on board a B-2 Spirit at Edwards Air Force Base, California. (Photo: U.S. Air Force/Bobby Garcia)
What advantages will M-code bring, over existing military GPS receivers?
GPS Directorate. Modernized GPS receiver cards under development with the Air Force MGUE Increment 1 program will enable the use of M-code and provide U.S. forces with enhanced position, navigation, and timing capabilities, in addition to improving resistance to threats, such as jamming efforts by adversaries.
How will keys and key distribution be managed?
GPS Directorate. None of this is publically releasable.
Will M-code be made available to other friendly nations? If so, how is this managed?
GPS Directorate. The current policy allows for the sale of M-code equipment to all 57 authorized GPS PPS nations. The M-code technology will be made available to these nations through the Foreign Military Sales process.
USER PERSPECTIVE
The Department of Defense supplied answers to the following questions for users and warfighters.
What are the benefits you perceive will come from new M-code GPS equipment?
DoD. Provides U.S. forces with enhanced position, navigation, and timing capabilities, in addition to improving resistance to threats, such as jamming efforts by adversaries.
Will it change how you perform military operations, or enable any new ones?
DoD. Modernized GPS receivers provide the next-generation GPS capabilities to the warfighter. Operational testing will enable the services to determine operational utility of MGUE. It will ensure our soldiers, sailors, airmen, and marines have the ability to get in, accomplish their mission, and get home accurately.
How will M-code-based GPS receivers be brought into operational service? Will there be a mass upgrade of assets, or a phased introduction?
DoD. Procurement of M-code-capable GPS receivers will be decided by the Services and executed by individual platforms and programs.
Skyhook is partnering with Rivetz to integrate Skyhook’s global mobile location services to enhance the Rivetz platform.
Skyhook is the operator of a worldwide independent location services platform. The company’s technology provides the foundation for mobile location services in the global market for connected devices.
Skyhook’s hybrid positioning system locates devices using observed radio signals — including GNSS, Wi-Fi and cellular — ensuring that all devices can be located in all environments.
By enabling Skyhook’s advanced location capabilities on the Rivetz Network of cybersecurity tools, Rivetz users can take advantage of location service protection in any signal environment, regardless of GPS availability.
Accurate and accessible device location services are a critical component of all end-to-end security solutions, particularly in regulated environments or other markets where trusted and verifiable location is a requirement.
“We are pleased to partner and collaborate with Rivetz, a trusted leader in decentralized mobile security,” said Kipp Jones, Chief Technology Evangelist of Skyhook. “We share the values that our products must be built on the pillars of trust and respect for individual privacy. We look forward to providing Skyhook’s industry-leading location services to the Rivetz Network.”
“We are proud to join forces with Skyhook to enable powerful location services to the Rivetz Network,” said Steven Sprague, co-founder and CEO of Rivetz. “A simple and safe security model is our greatest priority, and precise device location is a cornerstone of protecting our cybersecurity solutions.”
Rivetz’s security solutions hinge upon access to the Trusted Execution Environment (TEE), which is an isolated, measured computer environment separate from the operating system. By provisioning all digital transactions through the TEE, Rivetz assures that users’ private keys cannot be altered or stolen if the operating system were tampered with or infected by malware.
System prevented broadcast of corrupt navigation, timing data.
The GPS Operational Control System’s launch and checkout system will control launch and early orbit operations and the on-orbit checkout of all GPS III satellites. (Image: Raytheon)
Raytheon Company’s GPS Next-Generation Operational Control System, known as GPS OCX, has completed several cybersecurity vulnerability assessments that tested the system’s ability to defend against both internal and external cyber threats, the company said.
GPS OCX, based at Schriever Air Force Base in Colorado Springs, Colorado, prevented the broadcast of corrupt navigation and timing data in all tests, bolstering the program’s readiness for the GPS III launch in December, the company added.
“We’ve built a layered defense and implemented all information assurance requirements for the program into this system,” said Dave Wajsgras, president of Raytheon Intelligence, Information and Services. “We’re cognizant that the cyber threat will always change, so we’ve built GPS OCX to evolve and to make sure it’s always operating at this level of protection.”
GPS OCX is the enhanced ground control segment of a U.S. Air Force-led effort to modernize America’s GPS system. The program has implemented 100 percent of the Department of Defense’s 8500.2 Defense in Depth information assurance standards without waivers, giving it the highest level of cybersecurity protections of any DoD space system.
The first tests took place April 2-13, and were led by a contracted “blue team” that aimed to breach the system from within its information assurance boundary.
The second round of tests took place May 16-20, and were led by an Air Force “red team” of cyber-penetration testers who tried to breach the system’s IA boundary from outside. The system worked as designed, validating it is secure.
The assessments took place on the launch and checkout system, GPS OCX Block 0, which was delivered to the U.S. Air Force in 2017 as a fully cyber-secure satellite ground system.
The signals transmitted from GPS and other GNSS constellations can be a threat vector that, if disrupted, could harm key critical infrastructure sectors including telecommunications, energy, transportation, emergency services and data centers.
The susceptibilities of the GPS signal to attack, whether intentional or not, are viewed similarly as a cybersecurity threat.
In recent months, there has been a dramatic increase in the number of reported GPS incidents, causing critical infrastructure providers to evaluate the security, reliability and resiliency of their GPS-based PNT dependency.
The new BlueSky GNSS Firewall from Microsemi Corporation, a wholly owned subsidiary of Microchip Technology Inc., enables critical infrastructure providers to harden the security of their operations from GPS threats and deliver a more reliable and secure service, the company said.
The security-hardened system provides protection against GPS threats such as jamming, spoofing and complete outage. It also supports a range of precision timing technologies, including atomic clocks, to enable continuous operation when GPS may be completely denied for extended periods.
In addition, Microsemi is expanding the GNSS portfolio with the introduction of a BlueSky option to its TimePictra software management suite, providing centralized control and visibility of GPS reception across regional, national and global geographic areas.
“At last year’s ION GNSS+ show we launched the BlueSky GPS Firewall Evaluation Kit to help customers understand GNSS vulnerabilities and how a firewall approach could provide protection,” said Randy Brudzinski, vice president and manager of Microsemi’s Frequency and Timing business unit. “We received valuable feedback from customers as a result of those evaluations and have incorporated new features in our second-generation BlueSky GNSS Firewall. In addition to expanded monitoring and reporting capabilities, this robust, future-proof platform is now equipped with atomic clock technology to provide security-hardened resiliency, including the ability to operate in a GNSS-denied environment for more than 30 days.”
Microsemi has applied the same principles of a firewall used for network security to defend against GPS threats coming from the sky. Within the new BlueSky GNSS Firewall, the incoming GPS signal is analyzed in real time to detect a wide range of threats before connected GPS receivers and related systems are affected.
The BlueSky GNSS Firewall incorporates an optional internal rubidium miniature atomic clock (MAC) enabling continuous output of the GPS signal to the downstream GPS receiver in case of complete loss of live-sky GPS reception.
Alternatively, Microsemi’s cesium clocks, such as the 5071A or TimeCesium 4400/4500, can be connected to the device, enabling UTC traceable time for more than 30 days.
BlueSky GPS Firewall platform features optional BlueSky software incorporated into its TimePictra management system.
To ensure the BlueSky GNSS Firewall is equipped to defend against an ever-evolving threat, Microsemi updates and continuously tracks GPS signal manipulation, spoofing threats, jamming attacks, multipath signal interference, atmospheric activity and many other issues which can create GPS signal anomalies, disruptions and outages.
These updates are available through a BlueSky subscription service. To learn more about Microsemi’s GPS threat protection and security solutions, including videos demonstrating how the product provides secure and resilient protection, visit the website.
A conference aimed at military and government agency decision-makers is scheduled for Feb. 6–8.
AUVSI Unmanned Systems – Defense. Protection. Security. (USDPS) will highlight what’s next for the defense, protection and security industries. The conference has been reimagined to include more opportunities to learn from industry and government thought-leaders and shop for the latest technology, said AUVSI.
Expanded focus beyond the military includes government agencies such as Homeland Security, Interior, Justice, Energy, the FBI and NOAA, as well as other public safety agencies.
Thought leaders and subject matter experts from the military, government agencies and public safety outlets will provide details and insight on investments, innovation and sustainment, including what’s next with artificial intelligence and cybersecurity.
More than 50 companies will be on site to provide military and government agencies with an inside view of new technologies and trends.
In addition, a public safety educational lineup defines how to best use unmanned systems for explosive ordinance disposal and HAZMAT applications, addresses the counter-UAS threat at home and abroad, and provides insight on how disaster and emergency responders are using unmanned systems.
The conference will take place at the Gaylord National Resort & Convention Center in National Harbor, Maryland. Those registering before Nov. 19 can take advantage of advanced rates.
Spirent Communications plc will demonstrate its expanded focus on security at the cybersecurity RSA Conference 2017, held in the Moscone Center in San Francisco Feb. 13–17. In a classroom session, Spirent positioning security technologist Guy Buesnel will discuss deliberate threats to GNSS.
Focusing on deliberate attacks against GNSS at the application layer and through RF channels, Buesnel will introduce session attendees to the vulnerabilities of satellite navigation and timing systems and how they have been exploited. Based on his experience in protecting GNSS receivers from emerging threats for nearly two decades, Buesnel’s session will address the evolution of deliberate GNSS threats and present the latest evidence of deliberate jammer use from a network of detector devices.
“There are compelling parallels between the manner in which IP threats have developed on the internet and the evolution of both jamming and spoofing attacks against GNSS,” said Buesnel. “Once people understand that the evolution of GNSS threats not only has clear parallels with the way in which IP threats have evolved, but also that GNSS share many of the features of a connected network, they will see that many of the lessons learned by the information security community apply equally well to the GNSS community.”
Part of the Mobile & IoT Security track, the Guy Buesnel classroom session (Session Code MBS-F01) will take place 9–9:45 a.m. on Friday, Feb. 17, on the second floor of the Moscone West hall, room 2002.
Spirent will also preview new Cyberflood performance and security validation software at RSA.
“With our expanded focus on security, Spirent is addressing the growing need in government, industry, health care and financial services for effective products and services to assess, validate and monitor the performance and security of their networks and applications,” said John Weinschenk, general manager of applications and security at Spirent. “We look forward to demonstrating at the RSA Conference how our industry-leading product and service offerings can meet today’s need for performance and security effectiveness under a wide range of real-world threat and attack scenarios.”
Spirent representatives in the company’s booth (S2015 in the Moscone South hall) will be available during the show to speak with attendees about the Cyberflood software and many of its upcoming ease-of-use features and real-world threat and attack emulation capabilities. The new features will include a flexible advanced testing component for customized testing needs and extended fuzzing techniques that enable users to find more issues faster and understand them better than any competing product in the industry.
Attendees will also be able to learn more about the scanning, penetration testing, monitoring and source-code-analysis security services available from Spirent Security Labs for networks, wireless infrastructures, websites, mobile applications and embedded devices.
Spirent Communications plc, provider of mobile network, application, services and device-test solutions, is warning of the increased likelihood of disruptions this year to a wide variety of civil and military applications relying on GNSS.
The prediction of greater risk from hacking and location spoofing attacks by criminal, state-sponsored, and other adversaries is part of Spirent’s annual security forecast for 2017. The forecast also highlights the continued risk of distributed denial of service (DDoS) attacks on Internet of things (IoT) devices and industries, including health care and automotive, that Spirent believes are the prime targets for security threats in the near future.
In 2016, Spirent’s predictions led off with a prescient warning about the increased risk of cyber espionage, which has since been borne out, most notably by news reports of suspected activities by the Russian government to influence the 2016 U.S. presidential election.
Also as predicted, in 2016 threats from ransomware, malicious insiders and compromised IoT devices increased, as did attacks on industrial control systems. For example, FBI sources reported on CNN that losses attributed to ransomware in the U.S. were set to exceed $1 billion by the end of 2016. That number is expected to grow in 2017.
In addition to an increased likelihood of GNSS interference, Spirent’s annual security forecast for 2017 predicts an expansion of risks from:
More frequent DDoS attacks against IoT devices, as evidenced in the last quarter of 2016, when multiple major DDoS attacks surfaced worldwide. The most disruptive attack employed Mirai malware covertly installed on a large number of IoT devices. A number of high-profile websites such as Netflix, AirBnB, Twitter, GitHub and others were rendered inaccessible. Spirent believes that perpetrators will continue to innovate and find new methods for improving and broadening these type of attacks.
Threats to IoT security, which are increasing as everything that is connected becomes a potential attack vector, including embedded devices, mobile devices, consumer electronics, connected medical devices, industrial control systems, smart home devices, and more.
Threats to medical applications, networks, and devices in the health care industry, both the back-office systems on which these facilities run and the medical instruments that provide care to patients. A ransomware infection or data breach could adversely affect patient health and privacy.
Threats to connected vehicles by malicious attackers, as a greater number of attack vectors are inadvertently created that enable remotely gaining control of critical operational components of the vehicle, including engine, steering, and braking functions in addition to other vehicle systems that communicate through the relatively insecure CAN bus infrastructure.
“With the greater drive towards use of autonomous vehicles, which rely heavily on precision GPS positioning and timing, threats posed by signal spoofing, jamming, time tinkering, and more could result in serious disruptions and worse,” said Sameer Dixit, senior director of security consulting at Spirent. “The transportation industry is taking this very seriously and already looking at various ways to protect against these threats. Because of this, we see momentum towards improving GNSS security in 2017.”
According to an article in Defense One, Timothy Bennett, a science-and-technology program manager at the Department of Homeland Security, has already reported the use of GPS spoofing and jamming equipment by Mexican drug cartels along the border to interfere with the U.S. Customs and Border Protection agency’s use of drones to patrol the area. Unlike the larger drones designed to military specifications, the smaller drones used for this purpose are more vulnerable to these kinds of attacks.
Spirent’s global network of GPS interference detectors has recorded more than 15,000 interference events since it was deployed in 2015, including a surprisingly high number of unintentional events caused by various forms of interference in the GPS L1 frequency band. A significant number of these unintentional events, which often correlate with transmissions from nearby RF transmitters and telecom equipment, have the potential to interfere with GPS signal reception.
Dixon noted one bright spot on the horizon: the increasing awareness up and down the technology food chain of the importance of security in these systems, and the entry of large, experienced, and security-conscious players into the IoT arena.
