Interference resistance in Modern GNSS receivers

Overview Introduction GNSS position/time determination Principle, implementation schemes Sensitivities to other signals Interference [un-]intentional jamming Spoofing Some real example scenarios The need for interference resistance versus other solutions to preserving "accurate" position/time estimate Requirements analysis Interference mitigation techniques Original techniques (e.g. jumping into trench) Modern techniques: use of security module, filtering, hardware, software (direct acquisition etc) and software defined architectures Summary and conclusions 2/21

GNSS (GPS) principle of operation Satellite unique Pseudo random noise (PRN) Satellite unique Pseudo random noise (PRN) Correlator: ranging User terminal generates replica PRN User terminal (receiver) Tracking; clock synchronization 3/21 3/23

GNSS interference types 1. Saturating the user terminal front end may preclude PRN detection Satellite PRN is a very weak signal Well inside noise 2. Transmitting a PRN at untrue phase Will cause the user terminal to correlate an untrue range 4/21 4/23

Anti jamming - principle Antenna with directional gain Interferer 5/21 5/23

Anti spoofing - principle Shared key privileged users 6/21 6/23

Interference vs Spoofing Interference (intentional, un-intentional) Affects the GNSS Receiver s ability to acquire and track a sufficient number of Satellites to provide a reliable navigation solution Jamming Spoofing Meaconing We are inclined to think such interference as intentional But un-intentional interference is probably predominant 1. Jamming Denotes the operation of drowning the navigational signals in high power signals to cause loss of lock and to prevent re-acquisition 2. Spoofing The operation of generating and emitting legitimate-appearing false signals to shift the computed position solution of a user. Meaconing Form of spoofing; the original signal is re-broadcast at untrue phase 7/21

Interference mitigation principles To mitigate effects of jamming Receiver electronics Controlled Reception Pattern Antenna (CRPA) in front of the receiver To mitigate effects of spoofing Render the original signal unique By adding an encryption function (requiring decryption key) Enabling privileged users to receive protection 8/21

Scenarios GNSS Receiver performance against jamming and spoofing What does it mean if someone tells you one receiver has better AJ than another? Or has better anti-spoofing than another receiver? Both meaningless statements in isolation Scenarios have to be well defined and realistic! Number of interfering source(s) Type of interference (broadband, CW, pulsed) Power of interferer(s) User environment Some scenarios can be more challenging than others. 9/21

Real Examples (1/3) FMG/14 noted information provided on a case of interference recently experienced in Germany by a GPS repeater operated in a hangar in Hannover. The interference resulted in an alert of the Enhanced Ground Proximity Warning System providing the messages "pull-up" and "FMS/GPS Position disagree" during taxing and departure. With an EIRP of the GPS repeater in the order of -60 dbm (to be confirmed) the interference range was several hundred meters. The operation of the GPS-repeater has been suspended until the end of the investigation. It was noted that it remains to be seen whether the EIRP limit of -77 dbm as stipulated in the draft ECC recommendation ECC/REC/(10)02 would have ensured sufficient protection ICAO Information Paper ACP-WGF23/IP-21 10/21

Real Examples (2/3) FAA investigation was sparked while the FAA was installing a new GPS-based landing system for aircraft at Newark International Airport. This new system uses GPS receivers on the ground to aid GPS receivers in the approaching aircraft. This technique allows the use of all runways during restricted visibility conditions. During system test, the FAA noticed that the GPS ground receivers suffered one or two breaks in reception on many days. PDDs (sic) were identified as the cause of the continuity breaks after an investigation that lasted several months. National PNT Advisory Board comments on Jamming the Global Positioning System - A National Security Threat Recent Events and Potential Cures, November 4, 2010 In July 2003, it was reported to the Federal Aviation Administration (FAA) that a cellular phone when turned on simultaneously interfered with three different aircraft GPS receivers, causing complete signal loss. The three GPS receivers were using three separate antennas, and were installed on a small aircraft. The phone was on, however, calls were not made during the incidents and subsequent tests. In an e-mail message to the FAA, the company who owned the airplane reported the subsequent tests taken to prove a clear and convincing direct relationship between the phone being in ON-mode, and interference with the three onboard GPS systems. NASA/TM-2004-213001, Evaluation of a Mobile Phone for Aircraft GPS Interference Truong X. Nguyen, Langley Research Center, Hampton, Virginia 11/21

Real Examples (3/3) S. Korea Blames North for GPS, Phone Jamming The local Munwha Broadcasting Corporation, or MBC, reported the General Bureau of Surveillance of the North Korean People's Army, blamed for the sinking of South Korea's Cheonan warship last year, was behind the latest attempt to block South Korean communication devices. Col. Yoon Won-shik at the public affairs office of South Korea's Ministry of National Defense declined to comment on the report, and whether or not the GPS-jamming signals were sent by the North. Yoon said, however, his ministry "has already recognized the North's intent to develop its technology used in blocking GPS signals in the South. - Defense News, 6 Mar 2011 War scenario - Deliberate interference 12/21

Need for protection (1/3) What sort of threat? What sort of protection? One technique: to shield the receiver antenna from the jammer physically in a trench It can really can work to an extent... Antenna Electronics added to system Null-steering Beamforming Build robustness into GNSS Receiver Software and Hardware techniques Redundancy Multi-constellation/multi-frequency Non-satellite based positioning systems Aircraft can use DME, IRS, other Detect and eliminate jammers quickly Military can use weapons to take out jammers if necessary 13/21

Need for protection (2/3) GNSS Receivers may be critical in several applications Accurate position/time information is vital 4 combinations of resilience are possible Interference Protection No No Yes Yes Anti-Spoofing No Yes No Yes Most modern GNSS receivers have a degree of interference protection built in 14/21

Need for protection (3/3) Having identified a real need to improve receiver resistance how can we make GNSS receivers more robust? Scenario-driven approach to setting requirements needed Users Knowledge of environment and threats need to have CONOPS Scenarios defined System Requirements GNSS receiver requirements defined what measures are needed? User Requirements Including threshold and other requirements for jamming/ spoofing resistance Product technology (or upgrade) 15/21

Anti-Interference techniques - Rockwell Collins Digital anti-jam electronics GPS AJ GNSS receiver Adaptive Filtering Antennabased AJ Receiver signal processing Frequency domain Spatial techniques Lengthened Pre-detection Time Domain Polarization techniques Lengthened Post-detection Amplitude Domain Aiding-based techniques 16/21

Example Mitigation Techniques (1/4) 17/21

Example Mitigation Techniques (2/4) Stand-alone GPS AJ System (Integrated Architecture) GEM VI AJ Accessory (Federated Architecture) GPS Receiver 16 Beam Interface GEM VI Standard AE-1 / GAS-1 / ADAP Form Factor Low power consumption (<45 W) 24-channel GPS Can operate with Embedded SAASM or Digital Beam Interface to GEM VI-D GPS Receiver Full dual frequency operation 7 element CRPA interface 14 RF Channels (7xL1, 7xL2) for true dual-frequency operation 16 Simultaneous Steered Beams Uses existing Antenna Electronics wiring 18/21

Example Mitigation Techniques (3/4) NavStorm+ 19/21

Example Mitigation Techniques (4/4) 20/21

Conclusions Can t talk about GPS jamming or spoofing in general terms Need to talk about particular scenarios Integrated anti-spoof and anti-jam in receiver Can either put receiver into AJ Electronics box the receiver is small enough Miniaturize the AJ electronics and the receiver onto 1-2 chips Multi-constellation Receivers are a big advantage More satellites that the receiver can see make it harder for interferers Including advantages of potemtially un-equal spectrum New frequencies GPS L5 signal more powerful signal than current GPS L1/L2 Selective Availability/Anti Spoofing (SAASM) continues to have a role SA may not be practiced today but in wartime L1 C/A code will be the first to be jammed (NAVWAR) GPS M-Code for military applications on the horizon 21/21