English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Zendy Plus

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Zendy Tools

Zendy Open

Global Navigation Satellite Systems (GNSS) are well known to be accurate providers of position, navigation, and time (PNT) information across the globe. With capable receivers and well-populated satellite constellations, GNSS users typically believe that the position and time information provided by their GNSS receiver is perfectly accurate. More sophisticated users look beyond accuracy and are also concerned with the integrity of the GNSS information. Advances in electronics technology have enabled the creation of malicious RF interference of GNSS signals. Inexpensive jamming devices overpower or distort the GNSS receivers input so as to completely deny the GNSS user of PNT information. A second threat to GNSS integrity is spoofing, the creation of counterfeit GNSS signals. This type of attack is considered more dangerous than a jamming attack since an erroneous PNT solution is often worse than no solution at all. The detection of spoofing is the subject of this paper. A variety of approaches have been proposed in the literature to recognize spoofing; many of these are based on the RF signal alone, including multi-antenna and multi-receiver methods. Another class of spoof detection algorithm is to compare the GNSS result to data from another, non-GNSS (hence, non-spoofed) sensor. In this paper we imagine that the trusted signal is the output of an Alternative PNT (APNT) receiver. APNT refers to stand alone, non-GNSS systems that are intended to provide PNT information during periods in which GNSS is unavailable The wide recognition of the vulnerabilities of the GPS in the Volpe report spurred the search for APNT systems; examples include the development of eLoran in the U.S. and Europe, general work on signals of opportunity ranging, DME-DME positioning, and, quite recently, R-Mode in Europe (we note that none of these systems is currently operational). The intent is that an integrated receiver, either loosely or tightly coupled, would merge the two systems’ observables to yield the best PNT information possible; in practice, since the APNTs’ solutions are typically of lower accuracy than the GNSS solutions, the combined result is nearly equal to the GNSS-alone solution. The goal of this paper is to show that these APNT solutions should be used at ALL times; as a substitute for GNSS PNT when GNSS is unavailable and as an integrity check (e.g. spoof detector) when GNSS is available. At a cursory level spoof detection using APNT appears simple; just compare the two position outputs to see if they are close. This paper looks deeper, considering the questions: How can we use the time estimates to detect position spoofing? How close is close enough in this context? What is the probability of error in the decision? How do the geometries of both systems impact the test itself and its resulting performance? What happens if the receivers are providing different information? INTRODUCTION Global Navigation Satellite Systems (GNSS) are well known to be accurate providers of position, navigation, and time (PNT) information across the globe; as such, they are commonly used to locate and navigate craft in various transportation modes. Because of high signal availabilities, capable receivers, and well-populated satellite constellations, GNSS users typically believe that the position and time information provided by their GNSS receiver is perfectly accurate. More sophisticated users look beyond accuracy and are also concerned with the integrity of the GNSS information; for example, RAIM algorithms were developed to ensure users that the provided information is resistant to several possible satellite failure modes. Advances in electronics technology have enabled the creation of malicious RF interference of GNSS signals. Inexpensive jamming devices overpower or distort the GNSS receivers input so as to completely deny the GNSS user of PNT information. While a serious concern when we expect PNT at all times, current generation GNSS receivers warn the user when PNT is unavailable; some of the more sophisticated receiver designs can also battle jamming. A second threat to GNSS integrity is spoofing, the creation of counterfeit GNSS signals. This type of attack is considered more dangerous than a jamming attack since an erroneous PNT solution is often worse than no solution at all. A variety of approaches have been proposed in the literature to recognize spoofing; many of these are based on the RF signal alone (for example, examining the power levels of the signals, looking for vestigial peaks in the correlator outputs, etc.), including multi-antenna and multi-receiver methods. Another class of spoof detection algorithm compares the GNSS result to data from another, non-GNSS (hence, non-spoofed) sensor. One obvious choice is an inertial unit recognizing that the spoofer might be unable to match the random motion in the vehicle; examples include monitoring the roll/pitch of a Coast Guard vessel due to waves [1] and the effect of wind gusts on an aircraft [2]. A second sensor choice is radar, exploiting the relative position vector available from the radar returns between vehicles in a convoy [3]. Yet another possibility is to employ ranges [4] or pseudoranges [5] from fixed beacons, comparing the GNSS derived ranges to those measurements. These last two efforts are of particular relevance to the work presented herein. The examinations in [4,5] characterized the binary hypothesis test of spoofing/no spoofing, developed the generalized likelihood test statistic, and solved for the tests’ probabilities of false alarm and detection. The formulation in these papers was for any number of range/pseudorange measurements and involved solving the data fusion problem of combining the GNSS position with the additional range/pseudorange measurements. The examples considered one or two such measurements; it was observed that two measurements could be quite effective at detecting spoofing. If more range/pseudorange measurements were available, enough to compute an separate position solution (often referred to as Alternative PNT or APNT), one might ask “How do we implement a spoof detector based on only the GNSS and APNT solutions?” This question is relevant if one does not have access to the actual measurements used by the APNT system or might just be preferred as a simpler system to implement. By the data processing theorem we expect that a detector based on the APNT solution would experience worse detection performance than that of [4,5] (as the conversion from ranges/pseudoranges to position is non-invertible), but wonder how much loss there really is. In this paper, then, we explore spoofing detection using a trusted signal and envision that that trusted signal is the output of an Alternative PNT (APNT) receiver. As developed in the navigation literature APNT usually refers to separate, non-GNSS systems that could provide PNT during periods in which GNSS is unavailable. The wide recognition of the vulnerabilities of the GPS [6] spurred the search for APNT systems; examples include the development of eLoran in the U.S. and Europe [7], general work on signals of opportunity ranging [8], DME-DME positioning [9], and, quite recently, R-Mode in Europe [10] (we note that none of these systems is currently operational). The intent is that an integrated receiver, either loosely or tightly coupled, would merge the two systems’ observables to yield the best PNT information possible; in practice, since the APNT estimates are typically of lower accuracy than the GNSS positions, the combined solution is nearly equal to the GNSS-alone solution. The point of this paper is to show that these signals should be used at ALL times; as a substitute for GNSS PNT when GNSS is unavailable and as an integrity check (e.g. spoof detector) when GNSS is available. At a cursory level spoof detection using APNT appears to be quite simple; just compare the two position outputs to see if they are close. Going deeper, various question emerge: • Since time is probably provided by both receivers, how do we use these measurements to detect position spoofing? How do we use position information to detect time spoofing? • How close is “close enough” in this context? What is the probability of error of the decision? • How do the geometries of both systems (essentially the Geometric Dilution of Precision, GDOP) impact the test itself and its resulting performance? • What happens if the receivers are providing different information, for example, 3-dimensional position versus latitude-longitude? This paper develops the hypothesis test and analyzes the performance of such an spoofing detector assuming the use of a stand alone APNT receiver. Specifically, we assume that the APNT and GNSS receivers are not coupled, do not share pseudoranges, and base the integrity test on the position and time outputs of the two receivers. The next section characterizes the binary hypothesis test of spoofing/no spoofing for the combination of GNSS and APNT receiver outputs and develops the generalized likelihood test statistic. This is followed by examples, both position and time spoofing, with a Monte Carlo simulation of detector performance. The detector results are then extended to the case in which the APNT receiver provides a reduced set of information; examples of a APNT without time or vertical position is considered.

proceedings of the institute of navigation ... international technical meeting/proceedings of the ... international technical meeting of the institute of navigation

APNT for GNSS Spoof Detection