A plane carrying British Defense Secretary Grant Shapps had its satellite signal jammed as it flew near Russian territory, the government reported on March 14.
The government said that the Royal Air Force jet carrying Shapps, officials and journalists “temporarily experienced GPS jamming when they flew close to Kaliningrad” on a flight from Poland to the UK.
The Times of London, whose reporter was onboard, said that for about 30 minutes mobile phones could not connect to the internet and the aircraft was forced to use alternative methods to determine its location.
Kaliningrad is a Russian enclave bordered by Poland and Lithuania, home to the Russian Navy’s Baltic Fleet. Prime Minister Rishi Sunak’s spokesman, Dave Pares, said “the jamming didn’t threaten the safety of the aircraft at any point.” He added that it is not unusual for aircraft to experience electronic jamming near Kaliningrad.
An approach for ground vehicles using carrier-phase and inertial measurement data
The combination of easily accessible low-cost GNSS spoofers and the emergence of increasingly automated GNSS-reliant ground vehicles prompts a need for fast and reliable GNSS spoofing detection. To underscore this point, Regulus Cyber, an Israeli cybersecurity company, recently spoofed a Tesla Model 3 on autopilot mode, causing the vehicle to suddenly slow and unexpectedly veer off the main road.
Among GNSS signal authentication techniques, signal-quality monitoring (SQM) and multi-antenna could be considered for implementation on ground vehicles. However, SQM tends to perform poorly on dynamic platforms in urban areas where strong multipath and in-band noise are common, and multi-antenna spoofing detection techniques, while effective, are disfavored by automotive manufacturers seeking to reduce vehicle cost and aerodynamic drag. Thus, there is a need for a single-antenna GNSS spoofing detection technique that performs well on ground vehicles, despite the adverse signal-propagation conditions in an urban environment.
In a concurrent trend, increasingly automated ground vehicles demand ever-stricter lateral positioning to ensure safety of operation. An influential study calls for lateral positioning better than 20 centimeters on freeways and better than 10 centimeters on local streets (both at a 95% probability level). Such stringent requirements can be met by referencing lidar and camera measurements to a local high-definition map, but poor weather (heavy rain, dense fog or snowy whiteout) can render this technique unavailable.
On the other hand, progress in precise (decimeter-level) GNSS-based ground vehicle positioning, which is impervious to poor weather, has demonstrated surprisingly high (above 97%) solution availability in urban areas. This technique is based on carrier-phase differential GNSS (CDGNSS) positioning, which exploits GNSS carrier-phase measurements having millimeter-level precision but integer-wavelength ambiguities.
Key to our promising results is the tight coupling of CDGNSS and inertial measurement unit (IMU) data, without which high-accuracy CDGNSS solution availability is significantly reduced due to pervasive signal blockage and multipath in urban areas. Tight coupling brings millimeter-precise GNSS carrier-phase measurements into correspondence with high-sensitivity and high-frequency inertial sensing. Our particular estimation architecture incorporates inertial sensing via model replacement, in which the estimator’s propagation step relies on bias-compensated acceleration and angular rate measurements from the IMU instead of a vehicle dynamics model.
As a consequence, at each measurement update, an a priori antenna position is available whose delta from the previous measurement update accounts for all vehicle motion sensed by the IMU, including small-amplitude high-frequency motion caused by road irregularities. Remarkably, when tracking authentic GNSS signals in a clean (open-sky) environment, the GNSS carrier-phase predicted by the a priori antenna position and the actual measured carrier phase agree to within millimeters.
The research described in this article pursues a novel GNSS spoofing-detection technique based on a simple but consequential observation: it is practically impossible for a spoofer to create a false ensemble of GNSS signals whose carrier-phase variations, when received through the antenna of a target ground vehicle, track the phase values predicted by inertial sensing. In other words, antenna motion caused by factors such as road irregularities or rapid braking or steering is sensed with high fidelity by an onboard IMU but is unpredictable at the sub-centimeter-level by a would-be spoofer.
Therefore, the differences between IMU-predicted and measured carrier-phase values offer the basis for an exquisitely sensitive GNSS spoofing-detection statistic. What is more, such carrier-phase fixed-ambiguity residual cost is generated as a byproduct of tightly coupled inertial-CDGNSS vehicle position estimation.
Two difficulties complicate the use of fixed-ambiguity residual cost for spoofing detection. First is the integer-ambiguous nature of the carrier-phase measurement, which causes the post-integer-fix residual cost to equal not the difference between the measured and predicted carrier phases (as would be the case for a typical residual), but rather modulo an integer number of carrier wavelengths. Such integer folding complicates development of a probability distribution for a detection test statistic based on carrier-phase fixed-ambiguity residual cost.
Second, the severe signal multipath conditions in urban areas create thick tails in any detection statistic based on carrier-phase measurements. Setting a detection threshold high enough to avoid false spoofing alarms caused by mere multipath could render the detection test insensitive to dangerous forms of spoofing. Reducing false alarms by accurately modeling the effect of a particular urban multipath environment on the detection statistic would be a Sisyphean undertaking, requiring exceptionally accurate up-to-date 3D models of the urban landscape, including materials properties.
Our work takes an empirical approach to these difficulties. It does not attempt to develop a theoretical model to delineate the effects of integer folding or multipath on its proposed carrier-phase fixed-ambiguity residual cost-based detection statistic. Rather, it develops null-hypothesis empirical distributions for the statistic in both shallow and deep urban areas, and uses these distributions to demonstrate that high-sensitivity spoofing detection is possible despite integer folding and urban multipath.
DIU accelerates commercial GEOINT and NAVWAR tools and capabilities to the warfighter
The U.S. Defense Innovation Unit (DIU) will be testing ways to mitigate disruptions to GNSS signals this fall.
Disruptions include those from intentional sources, such as spoofing, as well as intentional or unintentional jamming. Intentional tactics can be applied by adversarial nation states, criminal networks or privateers.
The shared interests between the government and private citizens alike for awareness of GPS disruptions make commercial solutions ideal; information and insight can be broadly shared not just within the U.S. Department of Defense (DOD), but across agencies, allied partners and the public as needed.
In the Fall of 2021, the DIU launched the Harmonious Rook prototype project to address the need for scalable, persistent awareness of positioning, navigation and timing (PNT) disruptions across the globe.
This September, the Harmonious Rook team will support the U.S. Army 1st Armored Division’s Command Post Exercise (CPX) at the National Training Center (NTC), Fort Irwin, California. The exercise is focused on large-scale combat operations (LSCO) and intended to stress the division headquarters’ ability to deploy to an austere location and command and control its units utilizing a synthetic training environment.
U.S. and multinational maritime forces participate in SEACAT 2021. (Photo: NTC)
Parallel to this training event is the 2nd Brigade, 1st Armored Division’s external validation exercise, also at NTC, in which the 2nd Brigade will be stressed and evaluated on its ability to deploy while contested and conduct LSCO exercises against a live opposing force.
Several DOD and civilian agencies are participating, including the National Air and Space Intelligence Center (NASIC) and the National Space Intelligence Center (NSIC). Multiple non-traditional vendors and non-governmental organizations are also supporting Harmonious Rook, from data delivery, to machine learning analytics, to visualization and contextualization.
Vendor Participation
Several Harmonious Rook vendors will participate in notable DOD and international exercises. In August 2022, prototyping companies will support the Southeast Asia Cooperation and Training (SEACAT) exercise, where more than 20 Indo-Pacific countries will train and collaborate on the common goal of maritime crises and illegal activities response.
During this multinational exercise, commercial firms will provide space-based geolocation reports and maritime analytical services, and integrate the insights into the U.S. Navy’s and Department of Transportation’s shared visualization platform, Seavision.
DIU is also working to explore the use of publicly available PNT data to draw insight from domestic GPS interference events.
“Mapping GPS disruptions and contextualizing patterns of behavior are key to mitigating the effects of degraded PNT as well as enabling safety of navigation under such conditions,” said Lt. Col. Nicholas Estep, Harmonious Rook program manager, USAF. “Instead of developing, building, and deploying hardware tailored for collection of navigation warfare operations, we are accessing currently available commercial data and analytics to address the need for PNT situational awareness. There are billions of GPS users and devices distributed across the world that may be adversely affected and turning the vulnerability into an advantage for discovery, classification and attribution of such malicious activity is a key aspect of this effort.”
“The Harmonious Rook project is a very promising new approach that complements traditional collection methodologies, as it will help our customers by sharing analysis due to the unclassified and commercial nature of the data,” said Scott Feairheller, senior analyst at NSIC.
“While the Army works diligently to acquire relevant equipment to assist in the real-time recognition and characterization of potential adversary interference, we must leverage non-organic, commercially available software and equipment, like Harmonious Rook, as a stopgap to increase awareness, seize digital key terrain and maximize lethality,” said Lt. Col. Patrick Jones of 1st Armored Division’s Space Support Element (SSE). During the exercise, capabilities will be tested to support intelligence, information operations, and command and control elements with commercial geospatial and navigation warfare awareness at the tactical level.
DIU’s Harmonious Rook program is not limited to the DOD and the malicious activity more commonly observed overseas and in combat environments. DIU is also working to explore the use of publicly available PNT data to draw insight from domestic GPS interference events, a mission with interest from the U.S. civil agencies.
With widespread users and subscribers that rely on PNT services, any intentional or unintentional disruption can lead to severe transportation, communication and financial implications. This highlights the importance of bringing both government and private-sector industries together to identify, attribute and mitigate GPS interference as quickly as possible.
IFEN GmbH has released a new version of its NCS Nova RF signal simulator, offering a full package of advanced simulation capabilities.
With its now-integrated interference generation capability (AWGN, CW, pulsed and chirp), NCS Nova version 2.8 can generate coherent interference signals with a signal power of up to –30 dBm.
The ability to assign two users to one RF output enables integrated spoofing scenarios with a single RF output (one user is the original simulated user; the other is the target spoofing user). Thus, spoofing is available even with an entry-level single RF Nova.
The key feature of this new release is the new navigation message authentication (NMA) simulation capability, compliant to User ICD 1.0 for the Galileo E1-B OSNMA. Beyond basic authentication-testing capability, specific OSNMA events can be simulated. Testing OSNMA-enabled receivers under these specific events is key to ensuring compliant receiver behavior. The supported events include both a public key renewal and revocation and TESLA keychain renewal and revocation. Also, GPS cross-authentication is fully supported.
Finally, the new release fully supports generation of Galileo E6-C encrypted codes. This enables users to take full advantage of the Galileo third-frequency pilot signal.
AS CAT STEVENS (yes, he’s back to using his old name) famously sang on “Wild World”:
“… take good care Hope you make a lot of nice friends out there But just remember there’s a lot of bad and beware Beware.”
While he was talking about a girlfriend leaving him, the warning can just as well apply to GNSS users — especially those relying on GNSS for safety-of-life navigation and the maintenance of critical public infrastructure systems.
GNSS signals are relatively weak and they are susceptible to unintentional and intentional jamming that can make reception of the signals difficult or impossible. The jamming of radio signals to hinder reception is nothing new. It’s been used by those wanting to interfere with the use of the radio spectrum ever since radio became an important tool for communication and navigation in the early 20th century. Jamming has been used in hot wars to try to defeat military communication as well as in cold wars to try to prevent a perceived enemy from broadcasting to a particular country’s citizens. Notably, the shortwave radio broadcasts from Western countries were jammed by the former Soviet Union. And even today, broadcasts directed at China, Cuba and some other countries are regularly jammed.
GNSS is also being intentionally jammed on a regular basis in some parts of the world for various purposes including the protection of politicians and civilian infrastructure and to foil GNSS-guided munitions. But while directed at supposed threats, the jamming affects all GNSS receivers in a certain radius of the jammer. Such jamming activities are being reported in the popular press with an increasing frequency.
While GNSS jamming is receiving increased attention in our troubled world, even more pernicious is GNSS spoofing. Spoofing is the attempt to mimic GNSS signals to try to trick a receiver into tracking them and thereby compute a wrong position and/or time at the receiver. This can have disastrous consequences if not detected immediately and the use of GNSS deactivated.
So, how do you detect GNSS signal jamming and spoofing? We have discussed this issue in several columns over the years, but in this month’s column, a team of researchers from Stanford University and the University of Colorado describe how they are using relatively inexpensive equipment and sophisticated software and analyses to detect and warn of GNSS jamming and spoofing. Clearly, they are heeding Cat Stevens’ warning.
By Leila Taleghani, Fabian Rothmaier, Yu-Hsuan Chen, Sherman Lo, Todd Walter, Dennis Akos and Benon Granite Gattis
GNSS signals are extremely low power by the time they reach users on Earth and are easily overwhelmed by nearby terrestrial signals. Such signals can interfere with a user’s ability to receive the desired GNSS signals or, even worse, replace them with simulated signals that cause the user to obtain the wrong position or time estimate. Two major types of radio-frequency interference (RFI) threats have been identified: jamming and spoofing. Jamming results from emissions that do not mimic GNSS signals, but interfere with the receiver’s ability to acquire and track GNSS signals. Spoofing is the emission of GNSS-like signals that may be acquired and tracked in combination with, or instead of, the intended signals.
Both threats have been studied at length by researchers, and their presence around the globe has been reported even in the popular press. Some research has been done into the prevalence of spoofing. Even so, there is no well-developed understanding of how widespread these threats are.
Terrestrial interfering signals may be fairly weak and only effective in a limited area. Complex environments with buildings or terrain may further limit their effective area of influence and hinder the ability of external interference detection. To create a better understanding of the presence and characteristics of jamming and even spoofing, we are developing a low-cost RFI detector based on a commercial, off-the-shelf GNSS receiver: the u-blox F9. We are pairing this receiver with a Raspberry Pi computer and are developing custom software to monitor the receiver outputs and store data surrounding interesting events.
We are developing a toolset in MATLAB and C/C++ with the intention of processing and analyzing the u-blox data. The toolset includes functionality to decode selected u-blox messages that contain parameters of interest. These metrics include automatic gain control (AGC), carrier-to-noise-density ratio (C/N0) and spectral power. They also include raw pseudoranges from multiple constellations and internal u-blox interference metrics. With the volume of data that can be gathered from continuous monitoring, we have begun characterizing nominal performance and developing approaches to spoofing and jamming detection. The publicly available code can be accessed through our Git Repository at https://github.com/stanford-gps-lab/navsu.
With the raw pseudoranges and downloaded broadcast ephemeris data, we compute navigation solutions using different combinations of constellations and frequencies. When the individual and multi-constellation position solutions are compared to each other, discrepancies can be flagged and investigated for possible interference. We have begun characterizing nominal power metrics such as AGC and C/N0. With the quantity of data that we can get from the RFI monitor, we are working to characterize other receiver-specific parameters such as the u-blox continuous wave (CW) jamming indicator. We leverage data collected under nominal and jammed conditions to understand and identify a threshold for what can be considered interference.
Many different methods have been proposed for GNSS interference detection and mitigation with large-scale data at multiple locations. In this article, we present our data-selection process, our development of thresholds for determining interference, and results from three u-blox receivers set up at different locations in the United States to glean information about nominal (non-spoofed) conditions. We inform our thresholds and analysis tools using datasets from nominal conditions, and then compare their performance to a dataset containing RFI events from a government-sanctioned jamming and spoofing test. Our results display how we leverage simple and powerful metrics informed by a low-cost receiver to understand nominal noise environments and successfully identify jamming and spoofing events.
Data and Metrics
We collect and analyze a variety of data types and metrics to help identify and characterize jamming and spoofing occurrences. The receiver model we started with, u-blox ZED-F9P-02B, can monitor two different RF bands and many signals, including GPS L1C/A, L2C; GLONASS L1OF, L2OF; Galileo E1B/C, E5b; BeiDou B1I, B2I; QZSS L1C/A, L1S, L2C; and SBAS L1C/A. It has 184 channels, which can be configured to sweep through an array of signals to be monitored. We are also developing monitors based on the recently released ZED-F9T-10B, which is capable of L1 and L5 signal reception. TABLE 1 describes which version of the u-blox receivers each dataset comes from.
TABLE 1. Locations of u-blox monitor for nominal noise environment characterization and jam/spoof test. (Data: Authors)
L1 and L5 are the primary frequencies used for aviation, hence a monitor for these frequencies would be more useful for protecting aviation than the F9P, which is only capable of L1 and L2 reception. The available data includes raw measurements such as code and carrier phase, position estimates, power level estimates including C/N0, AGC and spectral power. It also has active CW interference detection. These metrics are all necessary for the consistency checks and power monitoring methods we summarize in this article. Consult our conference proceedings paper for details (see Acknowledgments). By examining all of these signals and measurements, we can observe changes in the RF environment and detect inconsistencies in the received signals.
Data Logging. The u-blox receiver logs messages in a specific format. The message types important to log are selected based on the desired data. Due to limited bandwidth, we prioritized messages that efficiently include all desired parameters for the interference detection methods we describe in this article. We have used both the u-blox F9P and the u-blox F9T.
To characterize nominal noise environments, u-blox receivers were set up at three locations: Stanford University, the University of Colorado (CU) in Boulder, and at the Colorado Springs airport. All measurements from satellites below an elevation angle of 5 degrees were ignored. The results from these locations are summarized below. Results from a jamming/spoofing test sanctioned by the U.S. Department of Homeland Security are presented and labeled with the acronym “GET-CI” (GPS Testing for Critical Infrastructures) in the subsequent discussion. Table 1 describes the parameters of the u-blox receiver at each location.
Positioning Metrics Development.The nominal error of the single- and multi-constellation position solutions is made by noting the difference between the computed position and the known truth. The inter-constellation consistency check is defined as the difference between the positions computed from two constellations, with no reference to a known truth position. To analyze the nominal differences in the north, east and down (NED) directions, we use the position covariance matrix, R, computed in the least-squares solver, to set a covariance-bound threshold. The covariance for each constellation is assumed independent. We present our results using this threshold in our results sections.
Our results in FIGURE 1 show that the Galileo position solution variance is higher than the dual-constellation and GPS-only solution. This is attributed in part to the fact that Galileo, while operational, has not filled out all planned satellite slots and therefore has fewer satellites and worse geometry than GPS.
FIGURE 1a. Map visualization of the comparison among position solutions computed using only GPS, only Galileo and a combined GPS plus Galileo dual-constellation solution at Colorado Springs. (Image: Authors)FIGURE 1b. Map visualization of the comparison among position solutions computed using only GPS, only Galileo and a combined GPS plus Galileo dual-constellation solution at CU Boulder. (Image: Authors)FIGURE 1c. Map visualization of the comparison among position solutions computed using only GPS, only Galileo and a combined GPS plus Galileo dual-constellation solution at Stanford. (Image: Authors)
Nominal Noise Results
Here are some of our positioning and power monitoring results under nominal reception conditions.
Positioning. Based on the methods described earlier, we present a selection of our results from the positioning consistency checks. We present several informative visualizations of the error between the computed position solution and the known truth of each u-blox receiver and use the covariance threshold to bound the raw error. The error for dual-constellation, single-constellation and inter-constellation consistency checks are all displayed and compared to one another. The pseudorange residuals and their accompanying chi-squared (χ2) statistic are also evaluated and compared for the GPS and Galileo single-constellation position solutions.
Positioning Consistency Comparison Maps. From the maps in Figure 1, we observe that Galileo has the highest error, followed by GPS, and then the dual-constellation solution. The map also serves as a method to spatially visualize the tails of the error distribution.
NED Time Histories. We compare the time history of the dual-constellation, GPS and Galileo position solution error to the three sigma (3σ) covariance bound computed at each epoch (see FIGURE 2). We also compare the GPS vs. Galileo inter-constellation difference to the 3σ covariance bound. The covariance bound is never crossed, indicating that 3σ threshold is conservative for both the error and the inter-constellation difference between GPS and Galileo.
FIGURE 2a. Dual-constellation north-east-down error vs. known truth, bounded by a 3σ threshold, at Colorado Springs. (Image: Authors)FIGURE 2b. Dual-constellation north-east-down error vs. known truth, bounded by a 3σ threshold, at CU Boulder. (Image: Authors)FIGURE 2c. Dual-constellation north-east-down error vs. known truth, bounded by a 3σ threshold, at Stanford. (Image: Authors)
Pseudorange Residuals and χ2 Statistic Threshold. Pseudorange residuals have a long history of being used as a consistency check between range measurements. As an example, the pseudorange residuals for the GPS position solutions are shown in FIGURE 3, and their corresponding χ2 statistic is shown in FIGURE 4.
FIGURE 3a. GPS pseudorange residuals at Colorado Springs. (Image: Authors)FIGURE 3b. GPS pseudorange residuals at CU Boulder. (Image: Authors)FIGURE 3c. GPS pseudorange residuals at Stanford. (Image: Authors)FIGURE 4a. GPS χ2 and probability of false alert (PFA) threshold for the nominal noise environments at Colorado Springs. (Image: Authors)FIGURE 4b. GPS χ2 and probability of false alert (PFA) threshold for the nominal noise environments at CU Boulder. (Image: Authors)FIGURE 4c. GPS χ2 and probability of false alert (PFA) threshold for the nominal noise environments at Stanford. (Image: Authors)
The χ2 statistic is computed using the finite pseudorange residuals at each epoch, where the degrees of freedom are n − 4, where n is the number of satellites used at that epoch and 4 is the number of variables solved for (x, y, z, and the receiver time offset) when using a single constellation. A p-value is computed using the cumulative distribution function (CDF) of the χ2 statistic, and indicates the probability that the χ2 statistic at each epoch would be greater than the observed value. The statistic is compared to a theoretical 10−9 probability of false alert (PFA) based on the theoretical χ2 and the actual degrees of freedom of each epoch. Very low values for the χ2 statistic, such as those obtained with Galileo, are attributed to regions where very few satellites are in view, thus decreasing the degrees of freedom. Any spikes in the pseudorange residuals are also reflected with a higher χ2 statistic and low p-value, though those residuals are de-weighted in the position solution and ultimately do not trigger the 10−9PFA threshold or the 3σ threshold, thus indicating that a 10−9PFA is a conservative threshold.
Power Monitoring. For each nominal location with a u-blox receiver, we analyze results from the power-monitoring metrics mentioned earlier. We also observe results from the internal u-blox jamming indicators in a region where a possible RFI event was observed.
For power monitoring, we analyze spectral power and programmable gain amplifier (PGA) results.
For the nominal noise environments, the spectral power, PGA and corresponding C/N0 results indicated no significant anomalies.
Threshold and Metric Validation Results
An examination of thresholds and other metrics are important for characterizing RFI.
GPS Testing for Critical Infrastructure. From a DHS-sanctioned RFI testing event, we identify five regions of interference or spoofing. To identify the interference, we use a combination of the power and positioning metrics as well as the thresholds we developed through the characterization of the nominal noise environments described in the previous sections of this article.
We use the thresholds and tests we’ve developed to identify regions of spoofing and RFI events (labeled C I1–C I5) in the GET-CI dataset. For ease of comparison, all regions are labeled on plots that display the full 5.5 hours of data collection. All details as to the truth location and time of the test have been removed. C I1 is identified through the power metrics. C I2–C I5 are identified as regions that the NED difference between GPS and Galileo clearly crossed the 3σ threshold in all three directions, as visualized in FIGURE 5.
FIGURE 5a. Map view of solutions using GPS, Galileo and GPS plus Galileo for the DHS-sanctioned RFI testing event (identifying coordinates and physical features removed). (Image: Authors)FIGURE 5b. Corresponding log-scale visualization of the GPS vs. Galileo position solution difference in the north-east-down directions. (Image: Authors)
From our pseudorange residuals, it appears as though the most significant interference events happened on the GPS constellation, as indicated by the high pseudorange residuals that fall into the C I2 and C I5 regions. Using the GPS χ2 statistic and p-value computations, we determined that the regions that crossed the 10−9 PFA threshold line are consistent with the regions of interference identified in Figure 5. The Galileo χ2 statistic, p-values and pseudorange residuals all show signs of possible interference. These regions are explored more in the power monitoring discussion below.
Since the GPS pseudorange residuals and χ2 statistic results show more signs of spoofing than the Galileo ones, we explore the Galileo-only position solution. Because the truth position is unknown, we take a point during the non-C I regions and define this as the “truth,” that is, a point in the position solution we believe has not been subject to spoofing. Any references to a truth position are from a position recognized as “truth” through post-processing rather than from a pre-determined and known location.
The p-values dip in each of the C I regions, but are lowest in regions C I5. Combined with the fact that the pseudorange residuals and NED error are the highest in C I5, we identify this as the region that likely experienced a significant spoofing event. We determined from an outlier at the beginning of the C I5 region (see Figure 5) that even the Galileo constellation is not immune to the spoofing in this scenario.
To further check the accuracy of our determination that GPS was spoofed, we evaluated the histograms of the Galileo error. With the biggest outlier in C I5 removed, we saw that the error appears relatively Gaussian, with some outliers and possible multi-modal behavior that were also seen in the nominal locations. The variance was higher than was observed at nominal locations, which could be attributed both to the presence of known RFI events, the fact that the nominal noise environment at the RFI event test has not been characterized (that is, it is possible there is a noisier nominal environment at this location), and that the “truth” position was not a known truth but obtained through post-processing of a dataset with increased RFI. Normalized error indicates that the error does not cross the 3σ threshold in any NED direction, further supporting the assertion that 3σ is a conservative threshold.
Important to note is that the major outlier around T+3.5 hours is visible in the NED plot (Figure 5), but the corresponding histograms do not contain that outlier. This indicates that the covariance also increases at that point. It dictates a need to monitor the covariance bound itself, as well as the positioning error. The NED time history plot and the raw error histograms serve this purpose, since it is clear that if we were to be only looking at the error normalized by 3σ, we would not have found significant evidence of the outlier, since the normalized error barely passes the 3σ threshold. This further supports our methods of combining multiple metrics, thresholds and visualizations rather than relying on a single metric to identify jamming and spoofing.
From the Galileo solution analysis, we increase our confidence that we have identified the regions with interference. We removed those areas and looked at the GPS vs. Galileo inter-constellation consistency difference. The normalized differences were now mostly within the 3σ threshold, and the raw error displayed some Gaussian behavior and is no longer on the order of the 105-meter error we were seeing in Figure 5. While these regions still have a higher error than nominal conditions and thus still display signs of interference, we are able to use our spoofing analysis to identify epochs in which we should not trust the GNSS. Using times outside those regions, we are able to figure out a reasonable truth position within 20 meters rather than 200 kilometers.
Positioning analysis using the inter-constellation consistency check is a powerful tool for determining the reliability of a position solution, even when the truth location is unknown. With the power metrics, we can further corroborate the positioning results, as well as find events indicating interference that the positioning metrics were unable to track.
FIGURE 6a. GPS pseudo range residuals for position solutions computed using only the GPS constellation. (Image: Authors)FIGURE 6b. Galileo pseudorange residuals for position solutions computed using only the Galileo constellation for the DHS-sanctioned RFI testing event. (Image: Authors)
Next Steps and Summary
Leveraging the raw data collected by u-blox receivers in multiple locations with different nominal noise environments, we have developed the toolsets to do inter- and intra-constellation consistency checks to monitor for jamming and spoofing. Many further observables usable for RFI detection are being recorded by the u-blox receivers. Several power monitoring metrics have been evaluated in a preliminary analysis. The next step is to further characterize metrics such as C/N0, AGC and u-blox internal jamming metrics under nominal conditions.
In summary, the tools we have developed so far show that the u-blox receiver will allow for many different consistency checks on a variety of parameters to be running simultaneously. It would be difficult for a spoofer to interfere with all the dimensions we have covered in our detector. Continuously monitoring a wide variety of parameters will increase the chance that we are able to detect interference, thus lowering the chance that a spoofer is able to evade detection.
Acknowledgments
We gratefully acknowledge the support of both the FAA Satellite Navigation Team and The Aerospace Corporation under their university partnership program. We especially wish to thank Steve Lewis of Aerospace for his support and guidance throughout the development of this project. This article is based on the paper “Low Cost RFI Monitor for Continuous Observation and Characterization of Localized Interference Sources” presented at ION ITM 2022, the 2022 International Technical Meeting of the Institute of Navigation, Jan. 25–27, 2022.
LEILA TALEGHANI recently graduated with her MS degree from Stanford University in aeronautics and astronautics and is now a navigation engineer at Trimble.
FABIAN ROTHMAIER is a navigation research and development engineer at Airbus Defence and Space in Munich, Germany, and a former a Ph.D. student at the Stanford GPS Laboratory.
YU-HSUAN CHEN is a research associate at the Stanford GPS Laboratory.
SHERMAN LO is a senior research engineer at the Stanford GPS Laboratory.
TODD WALTER is a research professor in the Department of Aeronautics and Astronautics at Stanford University.
DENNIS AKOS is a professor with the Aerospace Engineering Sciences Department at the University of Colorado, Boulder.
BENON GRANITE GATTIS is a laboratory assistant and undergraduate student in the Aerospace Engineering Sciences Department at the University of Colorado, Boulder.
Russia’s brutal aggression on Ukraine changed the world in a few days. Devastation and displacement in Europe already are on a scale unseen since World War II, and the risk of a catastrophe greater by orders of magnitude has not been as high since the Cuban Missile Crisis of 1962, the year I was born. Given the long production timeline of a monthly magazine, I will not venture a guess as to what the headlines will be on the day you read this.
The Russian assault has sharply raised concerns about GNSS vulnerabilities. In a March 17 bulletin, the European Union Aviation Safety Agency (EASA) warned of a GNSS outage leading to the degradation of navigation and surveillance. Reports analyzed by EASA indicate that since Feb. 24, GNSS spoofing and jamming has intensified in the Baltic Sea, neighboring states, Eastern Finland, the Black Sea and the Eastern Mediterranean. “The effects of GNSS jamming and/or possible spoofing,” the bulletin stated, “were observed by aircraft in various phases of their flights, in certain cases leading to re-routing or even to change the destination due to the inability to perform a safe landing procedure.”
Russia already has aided in the proliferation of handheld GPS jammers, the deployment of road-mobile jammers, and even development and testing of space-based jammers. Now, it could turn its substantial cyberspace hacking capability against the ground-control segments of GPS and Galileo.
When Russia tested an anti-satellite weapon on Nov. 15, 2021, the Kremlin claimed on state television that this capability “means that if NATO crosses our red line, it risks losing all 32 of its GPS satellites at once.” This threat was particularly dangerous because GPS satellites carry, as a secondary payload, the U.S. nuclear detonation detection system.
At a panel discussion about resilient GPS that I moderated at the International Wireless Communications Expo in Las Vegas on March 24, Diana Furchtgott-Roth, an adjunct professor at George Washington University and former deputy assistant secretary for Research and Technology at the U.S. Department of Transportation (DOT), titled her presentation “Russia Proves America Needs Backup GPS.” She cited the National Defense Authorization Act of 2017, the National Defense Authorization Act of 2018, and the National Timing Resilience and Security Act of 2018, which instructed DOT to provide a complement and backup for civilian GPS. The legislation required the Secretary of Transportation to put in place a backup system for GPS by the end of 2020, subject to congressional appropriations. However, she pointed out, these funds have not yet materialized.
Multiple technologies can and should be used to complement GPS. Several of them are mature and commercially available, including signals from low Earth orbit satellites and terrestrial broadcast stations.
Meanwhile, the United States should accelerate the launch schedule for GPS III satellites already produced. They provide better accuracy, anti-jamming capabilities, and opportunities for civilian connectivity that could offer critical assistance to its European allies.
Septentrio has released Open Service Navigation Message Authentication (OSNMA) functionality on its mosaic GNSS receiver modules. OSNMA offers end-to-end authentication on Galileo’s civilian signals, protecting receivers from OSNMA attacks.
Spoofing is a malicious form of radio interference, where faulty positioning information is sent to a receiver. For the last two years Septentrio has been working closely with the European Space Agency (ESA) during the test phases of OSNMA deployment. The know-how gained during this period is what allowed Septentrio to be one of the first to market with this advanced security feature.
OSNMA’s anti-spoofing capability complements Septentrio’s Advanced Interference Mitigation technology, AIM+, and further strengthens the overall security of Septentrio GNSS receivers, making them suitable for assured PNT solutions as well as critical infrastructure, such as 5G network synchronization.
“We are excited to start offering the OSNMA anti-spoofing technology in our industrial GNSS receivers. Our close collaboration with ESA enabled us to get the expertise needed to implement and validate this functionality in a timely manner,” said François Freulon, head of Product Management at Septentrio. “The addition of OSNMA to Septentrio’s already strong anti-jamming and anti-spoofing technology takes our receivers to a new level as the market leader of resilient positioning and timing solutions for industrial applications and critical infrastructure.”
OSNMA is now supported by the complete mosaic receiver family including GNSS RTK positioning modules, timing modules and heading receiver modules. It will also be rolled out on Septentrio’s latest generation of OEM receiver boards, AsteRx-m3, and subsequently on the ruggedized boxed receivers. Read more here.
In the current context of the Russian invasion of Ukraine, the issue of GNSS jamming and/or possible spoofing has intensified in geographical areas surrounding the conflict zone and other areas, according to the European Union Aviation Safety Agency (EASA). The agency issued a safety information bulletin on March 17 warning of a GNSS outage leading to navigation / surveillance degradation. According to the bulletin, which was directed at national aviation authorities and airlines, reports analyzed by EASA indicate that since February 24 GNSS spoofing and/or jamming has intensified in four key geographical areas:
the Kaliningrad region, surrounding Baltic Sea and neighboring states
Eastern Finland
the Black Sea and
the Eastern Mediterranean area near Cyprus, Turkey, Lebanon, Syria and Israel, as well as Northern Iraq.
“The effects of GNSS jamming and/or possible spoofing,” the bulletin stated, “were observed by aircraft in various phases of their flights, in certain cases leading to re-routing or even to change the destination due to the inability to perform a safe landing procedure.” It pointed out that in the present conditions it is not possible to predict these outages and their effects. Potential issues include:
loss of ability to use GNSS for waypoint navigation
loss of area navigation (RNAV) approach capability
inability to conduct or maintain various operations
triggering of terrain warnings, possibly with pull-up command and
inconsistent aircraft position on the navigation display
loss of automatic dependent surveillance-broadcast (ADS-B), wind shear, terrain and surface functionalities
failure or degradation of ATM/ANS/CNS and aircraft systems that use GNSS as a time reference and
airspace infringements and/or route deviations due to GNSS degradation.
The bulletin also offers several recommendations to airlines for mitigating these issues.
The U.S. Department of Defense wants help making sense of commercially and publicly available information that could be used to detect GNSS disruptors, especially over large areas.
Obtaining the ability to detect and geolocate GNSS disruptions has been cited as an unmet need in a number of U.S. national policies and plans dealing with positioning, navigation and timing.
The recently posted solicitation calls the project “HARMONIOUS ROOK – Situational Awareness for Intentional Disruption of Global Navigation Satellite System (GNSS) Users.” The solicitation says:
“The Department of Defense (DoD) seeks commercial solutions leveraging machine-driven analytics and datasets derived from publicly/commercially available information (PAI/CAI) to provide a situational awareness capability for intentional global navigation satellite system (GNSS) disruptions. This solicitation is particularly focused on persistent, large-area coverage of falsified GNSS emitters that result in localized spoofing phenomenology.”
Studies and analyses by non-profit organizations and commercial entities have demonstrated the ability of non-governmental organizations to do this kind of work and produce remarkable results. In 2017, our Resilient Navigation and Timing Foundation detected and reported on widespread GPS spoofing in the Black Sea.
This acquisition is being led by the Defense Innovation Unit, or DIU. The unit was specifically created to accelerate the adoption of commercial technology and services by the defense and national security establishments. While letting a traditional DoD contract for a prototype can often take up to 18 months, DIU aims to award contracts within 60 to 90 days of identifying the problem.
To do this, DIU uses the government’s “commercial solutions opening” process, which is designed to be simple and quick.
Companies who provide analytic services and those who have unique data sets are both encouraged to apply. The deadline is August 23.
Dana A. Goward is president of the Resilient Navigation and Timing Foundation
An Interim Armored Vehicle “Stryker” and AH-64 Apache helicopters with Battle Group Poland move to secure an area during a lethality demonstration as part of Saber Strike 18 in June 2018. (Photo: U.S. Army/Spc. Hubert D. Delany III, 22nd Mobile Public Affairs Detachment)
A surveillance system is demonstrated during a Naval Information Warfare Systems Command (NAVWAR) exercise. (Photo: Rick Naystatt/U.S. Navy)
The U.S. Defense Innovation Unit (DIU) is asking for commercial solutions to fight GNSS disruptions, including jamming and spoofing.
DIU is particularly asking for “solutions leveraging machine-driven analytics and datasets derived from publicly/commercially available information to provide a situational awareness capability” against intentional disruptions.
Responses to “HARMONIOUS ROOK — Situational Awareness for Intentional Disruption of Global Navigation Satellite System (GNSS) Users” are due by Aug. 22.
DIU is a Department of Defense organization focused exclusively on fielding and scaling commercial technology across the U.S. military to help solve critical problems.
The solicitation is focused on “persistent, large-area coverage of falsified GNSS emitters that result in localized spoofing phenomenology.”
It cites intentional manipulation of GNSS signals as enabling “nefarious activities, to include narcotics trafficking, unapproved operation of autonomous vehicles, illegal fishing and sea-borne piracy.”
“Additionally, nation-state use of GNSS jamming or spoofing systems may extend beyond the area of conflict, causing deleterious effects on civilian populations,” the solicitation states. “Such activities degrade or deny critical geolocation capabilities and further introduce hazards to safety-of-life-navigation, critical infrastructure, and emergency response services. “
Map plot from live tests in London show the route of a vehicle driven through Canary Wharf. It shows the difference between the position provided by a standard smartphone GNSS chip (red line) and the same data run through Focal Point Positioning’s Supercorrelation software (blue line). (Image: u-blox)
U-blox has signed a deal with the award-winning U.K.-based technology company Focal Point Positioning to integrate technology that will improve the accuracy and reliability of GNSS devices. Focal Point’s Supercorrelation technology enhances positioning performance and security for applications such as smart cities, location-secure internet of things (IoT) and health and fitness wearables.
The patented Supercorrelation technology solves a critical weakness in GNSS caused by multipath interference. Multipath interference occurs when satellite signals bounce off buildings and landmarks, causing GNSS receivers to provide degraded positioning outputs.
The result for users is that the blue dot on their phone or device may be in the wrong place, moving in the wrong direction, or may have a large error ellipse. For autonomous vehicles it could lead to positioning errors that place the vehicle in the wrong lane or worse.
FocalPoint’s Supercorrelation technology uses software to detect and reject reflected signals, resulting in an improvement in the performance of GNSS devices without the need for additional hardware or applications. Supercorrelation also helps with the detection and rejection of GNSS spoofing signals — an increasing concern for autonomous vehicles, ships, and aviation.
“We are tremendously excited to be working alongside a market leader such as u-blox, our mission is to improve every positioning system on the planet and we have taken a giant step forward in that vision with this deal,” said Focal Point Positioning CEO Ramsey Faragher. “Positioning systems are so critical to our world, and we look forward to seeing the next generation of products and services that will be enabled by this higher level of accuracy, reliability and security.”
u-blox CEO Thomas Seiler commented, “The addition of Supercorrelation technology into our latest GNSS platforms is part of our continuing focus on low power consumption, higher accuracy and security for automotive, industrial, and wearable GNSS applications.”
Septentrio’s mosaic-T is built specifically for resilient and precise time and frequency synchronization under challenging conditions. (Photo: Septentrio)
Septentrio has launched the mosaic-T GPS/GNSS receiver module, built specifically for resilient and precise time and frequency synchronization under challenging conditions.
According to the company, its multi-frequency, multi-constellation GNSS technology — together with AIM+ Advanced Interference Mitigation algorithms — allows mosaic-T to achieve maximal availability even in the presence of GNSS jamming or spoofing. This compact surface-mount module is designed for automated assembly and high-volume production.
“We are excited to expand our mosaic GNSS module family with mosaic-T, which will provide critical infrastructure and mission-critical PNT applications with accurate, reliable and resilient timing solutions,” said Francois Freulon, head of product management at Septentrio.
Septentrio mosaic-T delivers timing with nanosecond-level accuracy and has additional inputs for an external high-accuracy clock, the company added.
Septentrio, headquartered in Leuven, Belgium, designs and manufactures multi-frequency multi-constellation GPS/GNSS positioning technology for demanding applications.
