The GPS Assimilator: a Method for Upgrading Existing GPS User Equipment to Improve Accuracy, Robustness, and Resistance to Spoofing

Preprint of the 2010 ION GNSS Conference Portland, OR, September 21–24, 2010A conceptual method is presented for upgrading existing GPS user equipment, without requiring hardware or software modifications to the equipment, to improve the equipment’s position, velocity, and time (PVT) accuracy, to increase its PVT robustness in weak-signal or jammed environments, and to protect the equipment from counterfeit GPS signals (GPS spoofing). The method is embodied in a device called the GPS Assimilator that couples to the radio frequency (RF) input of an existing GPS receiver. The Assimilator extracts navigation and timing information from RF signals in its environment—including non-GNSS signals—and from direct baseband aiding provided, for example, by an inertial navigation system, a frequency reference, or the GPS user. The Assimilator optimally fuses the collective navigation and timing information to produce a PVT solution which, by virtue of the diverse navigation and timing sources on which it is based, is highly accurate and inherently robust to GPS signal obstruction and jamming. The Assimilator embeds the PVT solution in a synthesized set of GPS signals and injects these into the RF input of a target GPS receiver for which an accurate and robust PVT solution is desired. A prototype software-defined Assimilator device is presented with three example applications.Aerospace Engineerin

Development and Demonstration of a TDOA-Based GNSS Interference Signal Localization System

Background theory, a reference design, and demonstration results are given for a Global Navigation Satellite System (GNSS) interference localization system comprising a distributed radio-frequency sensor network that simultaneously locates multiple interference sources by measuring their signals’ time difference of arrival (TDOA) between pairs of nodes in the network. The end-to-end solution offered here draws from previous work in single-emitter group delay estimation, very long baseline interferometry, subspace-based estimation, radar, and passive geolocation. Synchronization and automatic localization of sensor nodes is achieved through a tightly-coupled receiver architecture that enables phase-coherent and synchronous sampling of the interference signals and so-called reference signals which carry timing and positioning information. Signal and crosscorrelation models are developed and implemented in a simulator. Multiple-emitter subspace-based TDOA estimation techniques are developed as well as emitter identification and localization algorithms. Simulator performance is compared to the CramérRao lower bound for single-emitter TDOA precision. Results are given for a test exercise in which the system accurately locates emitters broadcasting in the amateur radio band in Austin, TX.Aerospace Engineering and Engineering Mechanic

A Testbed for Developing and Evaluating GNSS Signal Authentication Techniques

An experimental testbed has been created for developing and evaluating Global Navigation Satellite System (GNSS) signal authentication techniques. The testbed advances the state of the art in GNSS signal authentication by subjecting candidate techniques to the strongest publicly-acknowledged GNSS spoofing attacks. The testbed consists of a real-time phase-coherent GNSS signal simulator that acts as spoofer, a real-time softwaredefined GNSS receiver that plays the role of defender, and post-processing versions of both the spoofer and defender. Two recently-proposed authentication techniques are analytically and experimentally evaluated: (1) a defense based on anomalous received power in a GNSS band, and (2) a cryptographic defense against estimation-and-replay-type spoofing attacks. The evaluation reveals weaknesses in both techniques; nonetheless, both significantly complicate a successful GNSS spoofing attackAerospace Engineering and Engineering Mechanic

The Texas Spoofing Test Battery: Toward a Standard for Evaluating GPS Signal Authentication Techniques

A battery of recorded spoofing scenarios has been compiled for evaluating civil Global Positioning System (GPS) signal authentication techniques. The battery can be considered the data component of an evolving standard meant to define the notion of spoof resistance for commercial GPS receivers. The setup used to record the scenarios is described. A detailed description of each scenario reveals readily detectable anomalies that spoofing detectors could target to improve GPS securityAerospace Engineering and Engineering Mechanic

A Graphical Approach to GPS Software-Defined Receiver Implementation

Global positioning system (GPS) software-defined receivers (SDRs) offer many advantages over their hardwarebased counterparts, such as flexibility, modularity, and upgradability. A typical GPS receiver is readily expressible as a block diagram, making a graphical approach a natural choice for implementing GPS SDRs. This paper presents a real-time, graphical implementation of a GPS SDR, consisting of two modes: acquisition and tracking. The acquisition mode performs a twodimensional fast Fourier transform (FFT)-based search over code offsets and Doppler frequencies. The carrier-aided code tracking mode consists of the following main building blocks: correlators, code and carrier phase detectors, code and carrier phase filters, a code generator, and a numerically-controlled oscillator. The presented GPS SDR provides an abstraction level that enables future research endeavors.Aerospace Engineering and Engineering Mechanic

Tightly-Coupled Opportunistic Navigation for Deep Urban and Indoor Positioning

A strategy is presented for exploiting the frequency stability, transmit location, and timing information of ambient radio-frequency “signals of opportunity” for the purpose of navigating in deep urban and indoor environments. The strategy, referred to as tightly-coupled opportunistic navigation (TCON), involves a receiver continually searching for signals from which to extract navigation and timing information. The receiver begins by characterizing these signals, whether downloading characterizations from a collaborative online database or performing characterizations on-the-fly. Signal observables are subsequently combined within a central estimator to produce an optimal estimate of position and time. A simple demonstration of the TCON strategy focused on timing shows that a TCONenabled receiver can characterize and use CDMA cellular signals to correct its local clock variations, allowing it to coherently integrate GNSS signals beyond 100 seconds.Aerospace Engineering and Engineering Mechanic

CASES: A Smart, Compact GPS Software Receiver for Space Weather Monitoring

A real-time software-defined GPS receiver for the L1 C/A and L2C codes has been developed as a low-cost space weather instrument for monitoring ionospheric scintillation and total electron content. The so-called CASES receiver implements several novel processing techniques not previously published that make it well suited for space weather monitoring: (A) a differencing technique for eliminating local clock effects, (B) an advanced triggering mechanism for determining the onset of scintillation, (C) data buffering to permit observation of the prelude to scintillation, and (D) data-bit prediction and wipe-off for robust tracking. The receiver has been tested in a variety of benign and adverse signal conditions (e.g., severe ionospheric scintillation, both real and simulated); the results are presented here. The custom hardware platform on which the software runs is compact while remaining flexible and extensible. The CASES platform consists of a digital signal processor, an ARM microcontroller, and a custom-built narrow-band dualfrequency front end. Because the receiver is softwaredefined, it can be remotely reprogrammed via the internet or another communications link.Aerospace Engineering and Engineering Mechanic

Sensor deception detection and radio-frequency emitter localization

The Global Positioning System (GPS) is an invisible utility that has had enormous impact in areas such as navigation, telecommunications, and power grids. However, malicious so-called "field" attacks such as jamming and spoofing threaten to disrupt and damage an infrastructure that has become so dependent on an always available and trustworthy GPS. This dissertation provides solutions that, if deployed as part of a layered defense, can significantly mitigate the effects of these emerging threats. The first type of attack considered in this dissertation is GPS spoofing. An attacker's ability to covertly control a maritime surface vessel by broadcasting counterfeit civil GPS signals is analyzed and demonstrated. It is shown that, despite access to a variety of high-quality navigation and surveillance sensors, modern maritime navigation depends crucially on satellite-based navigation. A simple innovations-based detection framework for GPS deception is developed, and given real-world environmental and attack parameters, the probability of hazardously misleading information (HMI) or integrity risk is minimized within the framework. A covert attack is designed to have a high integrity risk and is possible because attacker-induced deviations in the vessel's dynamics can be disguised as the effects of slowly-changing ocean currents and wind. A field experiment confirms the analysis by demonstrating covert control of a 65-m yacht in the Mediterranean Sea. The second type of attack considered in this dissertation is GPS jamming. A system for passively locating radio-frequency emitters is developed and demonstrated. The system was originally motivated by the proliferation of GPS jammers, but has broad applicability to any emitter of unknown waveform. A model for the cross-correlation of the emitter signal captured by spatially distributed receivers with an independent local oscillator and an efficient digital cross-correlation implementation is presented. Algorithms based on grid search and the particle filter are developed to estimate the emitter state directly from the cross-correlation, avoiding the inefficiency of an intermediate time and frequency difference of arrival estimate. The system is proven in several field experiments with the emitter on stationary or vehicular platforms and with one experiment using a receiver on an airborne platform.Aerospace Engineerin

Indoor GPS: Tightly Coupled Opportunistic Navigation

Aerospace Engineering and Engineering Mechanic

Receding Horizon Trajectory Optimization for Simultaneous Signal Landscape Mapping and Receiver Localization

A receiver with no a priori knowledge about its own states is dropped in an unknown environment comprising multiple signals of opportunity (SOPs) transmitters. Assuming that the receiver could control its maneuvers in the form of acceleration commands, two problems are considered. First, the minimal conditions under which such environment is completely observable are established. It is shown that receiver-controlled maneuvers reduce the minimal required a priori information about the environment for complete observability. Second, the trajectories that the receiver should traverse in order to build a highfidelity signal landscape map of the environment, while simultaneously localizing itself within this map in space and time with high accuracy are prescribed. To this end, the one-step look-ahead (greedy) strategy is compared to the multi-step look-ahead (receding horizon) strategy. The limitations and achieved improvements in the map quality and localization accuracy due to the receding horizon strategy are quantified, and the associated computational burden is discussed.Aerospace Engineering and Engineering Mechanic