Recent trends in Interference Mitigation and Spoofing Detection ! - - PowerPoint PPT Presentation
Recent trends in Interference Mitigation and Spoofing Detection ! Fabio Dovis ! Electronics Dept., Politecnico di Torino, Italy ! !"#$%&''()*++,(-./0121,(3*4*54)*++( Outline ! GNSS vulnerabilities ! Classification of interfering
!"#$%&''()*++,(-./0121,(3*4*54)*++(
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
GPS modernization !!
Innovative M-Code for military applications
!!
New carrier L5 for civil user (SoL)
!!
New civil L2CS code on L2
Galileo signal structure: !!
Composite BOC (CBOC) modulation on E1
!!
AltBOC on E5a/E5b
GPS signal structure !!
two radio frequency (RF) links: L1, 1575.42 MHz, and L2, 1227.60 MHz.
!!
Direct Sequence Spread Spectrum (DSSS) based on PRN codes:
!!
C/A code (1023 bits repeated each ms, chipping rate equal to 1.023 MHz)
!!
P code (repeated after one week, chipping rate equal to 10.23 MHz)
!!
Navigation data (50 bps, bit duration of 20 ms) Ranging code
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
The receivers operations can be grouped in four main functions:
RF stage IF Filters/ Amp ADC/AGC Local
r Acquisition stage Tracking stage NAV Unit
Position Velocity Time
Tracking stage Tracking stage Tracking stage Tracking stage Acquisition stage Acquisition stage Acquisition stage Acquisition stage
Digital conversion Carrier & Code correlator
Carrier & Code tracking
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
The performance in terms of position estimation accuracy, reliability and service continuity depend on the ability of the receiver to acquire the GNSS Signal in Space (SIS) and to keep it tracked.
! ! d direct signal reflected signal Excess path (red) of the reflected signal
! ! d direct signal reflected signal
Excess path (red) of the reflected signal
1 T. E. Humphreys, B. M. Levina, B. W. O’Hanlon, P. M. Kintner,
“Assessing the spoofing threat”, GPS World, January 2009
High level spoofing attack classification1 Potential Interference sources in GPS and Galileo bands
6172.8.9:;(:<(=>1(;.?@7.9:;(A@7;.B( (
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
Received signal power extremely low:
GPS L1 C/A code: -158.5 dBW
Galileo E1: -157dBW
No visible signal using conventional antennas and receiving hardware
The lobe in the spectrum results from the combined signal power received by all the satellites in view
transmitted signal (Direct Sequence Spread Spectrum);
interfering signals, that might prevent the correct signal processing.
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
RECEIVER INPUT SIGNAL
f
Bs Bss INTERFERING SIGNAL SS SIGNAL
No
SIGNAL AFTER THE DESPREADING
INTERFERING SIGNAL USEFUL SIGNAL
f
No
Bs Bss
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
erroneous position estimation); !;=1;9:;.B(CD!(
!! &:=(:;BE(21B.=18(=:(.(/@B@=.2E( F:;=1G=H( !! &1I(.J1;9:;(<:2(F://12F@.B( .;8(A1FK2@=E(:2@1;=18(%&''( .00B@F.9:;AH(( Intentional RFI can be used to inhibit the tracking stage in
status in the re-acquisition mode Spoofing attacks are facilitated
L;@;=1;9:;.B(CD!(
!! MK=(:<(N.;84@;(N.;8(( >.2/:;@FAH(
GNSS Jammer
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
GNSS I
GNSS I
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
Interference Type Telecommunication Systems GNSS Bands
Aeronautical Communication Systems
Distance Measuring Equipment (DME) Tactical Air Navigation (TACAN) Secondary Surveillance Radar (SSR) Multifunction Information Distribution System (MIDS) Joint Tactical Information Distribution System (JTDS) Traffic Collision and Avoidance System (TCAS) Identity Friend and Foe (IFF) Automatic Dependent Surveillance-Broadcast (ADS-B)
Galileo E5a E5b GPS L5 Radar
Air Traffic Control radar Solid State radar
Galileo E6 GPS L2 Satellite Communication Systems
Mobile Satellite Service (MSS)
close to GPS L1 Secondary harmonics
TV Channels Digital Video Broadcasting – Terrestrial (DVB-T) Digital Video Broadcasting (DAB)
Galileo E1 GPS L1 Others
Personal Electronic Device (PED) VHF Omni-direction Range (VOR) and Instrument Landing System (ILS) harmonics Ultra Wide Band (UWB) Systems
all
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
Real Case: secondary harmonics from
DVB-T might fall in the bands of interest: Torino Eremo:
DVB-T Channel 28 and 66;
modulation: 16 QAM for Ch 28 and 64 QAM for Ch 66;
ERP: 200 W for Ch 28 and 3000 W for Ch (66);
Central frequency: 530 MHz for Ch 28 and 834 MHz for Ch 66
In the broadcast TV signal, VHF and UHF bands are used. Both bands, in their sub channels, could represent interferences sources for a GNSS receiver
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
1.58 Km!
Other transmitting antennas
3.88 Km! 350 m! 1.3 Km!
Pecetto
GPS L1 Galileo E1
1.557 GHz
3.95 Km!
Murazzi
GPS L1 Galileo E1
1.557 GHz 1.602 GHz
6.54 Km! 6.32 Km!
NavSAS Lab
GPS L1 Galileo E1
1.557 GHz 1.602 GHz
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
assess the impact of intentional interference on commercial receivers
Monitoring Vehicle Unit (MVU)
!
PSA/ESA Spectrum Analyzer (E4402B)
1,54E+ 09 1,55E+ 09 1,56E+ 09 1,57E+ 09 1,58E+ 09 1,59E+ 09 1,60E+ 09 1,61E+ 09 Frequency (Hz) dBm
!
PSA/ESA Spectrum Analyzer (E4402B)
1,54E+ 09 1,55E+ 09 1,56E+ 09 1,57E+ 09 1,58E+ 09 1,59E+ 09 1,60E+ 09 1,61E+ 09 Frequency (Hz) dBm
!
PSA/ESA Spectrum Analyzer (E4402B)
1,54E+ 09 1,55E+ 09 1,56E+ 09 1,57E+ 09 1,58E+ 09 1,59E+ 09 1,60E+ 09 1,61E+ 09 Frequency (Hz) dBm
!
PSA/ESA Spectrum Analyzer (E4402B)
1,54E+ 09 1,55E+ 09 1,56E+ 09 1,57E+ 09 1,58E+ 09 1,59E+ 09 1,60E+ 09 1,61E+ 09 Frequency (Hz) dBm
1 2 3 4
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
Distance Measuring Equipment Airborne interrogator Ground beacon Pulse width=3.5 !s Inter Pulse Period=12 !s
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
Jamming’s objective is denial of navigation service by masking GPS signals with noise. Under jamming attack the victim receiver is unable to acquire and process navigation signals.
Signal radiation on the GNSS bands is not legal, jamming attacks are detectable, but... low cost jammers can be easily purchased on the web
Severe threat for liability-critical mass-market applications, such as GNSS-based road tolling or fleet management
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
'0::O;7(.J.FPA(.21(.(/.Q:2(=>21.=(<:2(<K=K21(F@?@B@.;(%&''(.00B@F.9:;AR( '0::O;7(.J.FPA(F.;(N1(021?1;=18(@;=2:8KF@;7(.K=>1;9F.=18(A@7;.BA( Spoofing refers to the transmission of fraudulent GNSS-like signals, that force the victim receiver to compute erroneous positions. Spoofing is more malicious than intentional interference, because victim receivers are fooled without any notice.
%S'(/:812;@T.9:;(8:1A(;:=(0B.;(=:(N2:.8F.A=(.K=>1;9F.=18(F@?@B@.;(A@7;.BAH( %.B@B1:(/@7>=(N2:.8F.A=(.K=>1;9F.=18(A@7;.BA(:;(=>1(%.B@B1:(U5,(V"://12F@.B('12?@F1WR(&:(81F@A@:;A(>.?1(N11; ( =.P1;(E1=R(
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
The scope of the Interference monitoring, and in general, of quality monitoring is to assure the trustworthiness of the PVT solution provided by the receiver
Monitoring can be based on observables at different level: !! PVT/receiver outputs level !! Raw observable level !! Signal samples level
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
1." Metric definition: defined in order to highlight an unexpected behavior
2." Assessment of the metric statistic: defined metrics statistically characterized in order to describe the behavior in nominal operative conditions and in presence of signal distortions. They can be defined: 1.! theoretically 2.! By Monte-Carlo simulation 3.! test campaigns and data modeling 3." Threshold definition: based on the statistical behavior of the metric and defined on a desired level of false alarm probability 4." Countermeasure: set of actions to implement if the anomaly is detected (from simple warning to full mitigation)
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
ADC level technique based on AGC monitoring
Receiver outputs observation
Time domain techniques based on statistical tests on useful measurements (power, jitter variance, etc.) at the output of correlation block unit
Frequency domain techniques based on spectral estimation, and a threshold determination on the estimated PSD
Transformed domain techniques in order to represent the received signal in a different domain where the useful part can be split from the interference
!! Time-Frequency domain !! Time-Scale domain
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
RF Filters/Amp Local Oscillator ADC/AGC IF Filters/Amp GNSS antenna
) (t x
] [k x
PVT computation Tracking Acquisition
) ) ( 2 cos( ] [ ] [ 2 ] [
, l l d IF l l l l l l
k f f k b k c C k d ! " # # + + $ $ =
" =
+ + = =
1
] [ ] [ ] [ ) ( ] [
s
N l l s
k k i k d kT s k s #
!!
Ts sampling time
!!
i[k] interference signal
!!
![k] additive Gaussian noise with flat PSD N0/2 over the receiver band
!!
r[k] = dl[k]+![k] Discrete time signal:
Acquisition
Performance evaluation by ROC
Signal Acquisition:: Search over a three parameters space: satellite PRN, code phase and carrier frequency.
With interference Without interference
) (t s ] [k s
RF Filters/Amp Local Oscillator ADC/AGC IF Filters/Amp GNSS antenna
) (t s ] [k s
) ˆ , ˆ , (
, ! l d s f
kT y
PVT computation Tracking
code generator
90°
( )
k Fd ! 2 cos ] [k x
Frequency generator
"
# =
$
1
) ( 1
T T
N n T
N
( )
2
$
( )
k F
d
! 2 sin
) ($
"
# =
$
1
) ( 1
T T
N n T
N
( )
2
$
( )
d c F
S , %
c
%
] [
c
k c % #
code generator
90°
( )
k Fd ! 2 cos ] [k x
Frequency generator
"
# =
$
1
) ( 1
T T
N n T
N
( )
2
$
( )
k F
d
! 2 sin
) ($
"
# =
$
1
) ( 1
T T
N n T
N
( )
2
$
( )
d c F
S , %
c
%
] [
c
k c % #
] [k s
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
P L E
RF Filters/Amp Local Oscillator ADC/AGC IF Filters/Amp GNSS antenna
) (t x
] [k x
PVT computation Tracking Acquisition
) (
s EL nT
R
) (
s E nT
c ) ˆ , ˆ , ( !
d s f
nT y
Early Late
) (
s L nT
c
Code generator
(
s E nT
R ) (
s L nT
R
) (
s
nT c
"
#
$
1
) ( 1
NL
NL
"
#
$
1
) ( 1
NL
NL Open Delay Locked Loop
RF Filters/Amp ADC/AGC IF Filters/Amp GNSS antenna GNSS antenna
) (t x
] [k x
Acquisition Local Oscillator PVT computation
Signal Tracking:
phase and tracks changed into the future;
a Phase Lock Loop (PLL) and a Delay Lock Loop (DLL);
) ˆ , ˆ , (
, ! l d s f
kT y
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
The Spectral Separation Coefficients (SSC) are obtained assessing the overlap between the power spectrum of the GNSS signal (Gs(f)) and the power spectrum of the interference (Gl(f))
They assess the maximum achievable level of interference:
!! Envelope of the GNSS signal is considered !! They do not take into account the possible orthogonality of the signals !! They cannot be used for CW and pulsed signals !! Useful for the intersystem and intrasystem interference evaluation
"# /2 # /2
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
The bias is the distance between the lock point (x0,y0) of the ideal discrimation function and the first zero of the DDF
2 ) ( ) ( ! " " # = " =
c i
T c x DDF f b $ $
spacing tor discrimina period chip light
speed : : : !
c
T c
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
A way to assess the effect
account the receiver architecture is to use IEE and IRA
IEE and IRA are obtained evaluating the distortion of the discrimination function due to the interference signal
Simulation Parameters
GPS L1C, PRN 1 Data & Pilot channels CW interf. (C/I = 0 dB) Coherent Early-Late Spacing Tint = 4 ms BW = " (no filter)
Special thanks to Davide Margaria for the animation
chip 1 0. !=
XR(Y:=1BB.,('R('.?.A=.,(6R(Y.27.2@.,(DR(6:?@A,(Z[(Y:81B(<:2([AA1AA@;7(=>1(!;=12<121;F1(!/0.F=(:;(%&''( C1F1@?12A\,(!"""#$%&'(&)*+'(#+'#,-%+(.&)-#&'/#"0-)1%+'2)#34(1-5(,([02@B()*++(
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
1 2 3 4 5 6 7 8 9 10
5 10 15 20 CW carrier frequency [MHz] Error envelope [m]
Interference Error Envelope (IEE) – measure of the discriminator function distortion with respect to one (or more) parameters of the interfering signal. It is obtained considering the maximum and the minimum values (over all the possible phases) of the ranging errors in the 3D IEE.
1 2 3 4 5 6 7 8 9 10 1 2 3 4 5 6 7 CW carrier frequency [MHz] Running average of error envelope [m]
Interference Running Average (IRA) – Obtained by integrating the IEE, it represents for each interference (CW or WB) frequency shift
30!
+ =
B
df f IEE f IEE B B IRA
min max
2 ) ( ) ( 1 ) (
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
Several factors impact the shape of the IEE
) ( 1 ) ( ) ( ) (
i i
f f P A f I if WB f f A f I if CW ! " = ! " =
#
# $
Interference model
df f f C f W f I NL f b
i
+" " #
$ % = ) sin( ) ( ) ( ) ( 2 ) (
max
& '
Maximum bias
{ }
) ( ) (
s
nT i DTFT f I =
DTFT of dicrete impulse response modeling the front-end DTFT of code elementary function Line spectrum contribution
! !
= "
# # $ % & & ' ( " ) =
L k kT f j k i c c
c
e LT i f f R LT f C
1 2
) ( 1 ) (
*
+ ,
) 1 , 1 ( : : ! + length code
i
" L
spacing
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
CW IEE can be used to predict the behavior of the receiver in presence of different interfering sources;
The trend of the WB IEE resembles the curve obtained applying the moving average on the CW IEE:
df f f P f f C f W NL A df f b f f P df f b df f f f b f M f b M
i f f CW i CW M i M i k M i M i k k CW k CW
i i
) ( ) sin( ) ( ) ( 2 ) ( ) ( 1 ) ( 1 ) ( 1 ) ( 1
2 2 max max 2 / 2 / 2 / 2 / max max
! " = = ! = # " " " =
& + & ! + ! & + & ! + ! = + ! = ' ' ' '
( ' ) ' ' : step shift frequency
) (
max i WB
f b
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
2 4 6 8 10
5 10 15 20 Frequency shift [MHz] Error envelope [m] GPS L1 - BPSK(1) GPS L1C - TMBOC(6,1,4/33) BOC(1,1) modulation Galileo E1 - CBOC(6,1,1/11) 2 4 6 8 10 1 2 3 4 5 6 7 Frequency shift [MHz] Running average of error envelope [m] GPS L1 - BPSK(1) GPS L1C - TMBOC(6,1,4/33) BOC(1,1) modulation Galileo E1 - CBOC(6,1,1/11)
The effect of CW and WB interference, depends both on the GNSS signals and
10
10 15 20 Frequency shift [MHz] Error envelope [m] GPS L1 - BPSK(1) BOC(1,1) modulation Galileo E1 - CBOC(6,1,1/11) 10 Frequency shift [MHz] Running average of error envelope [m] GPS L1 - BPSK(1) BOC(1,1) modulation Galileo E1 - CBOC(6,1,1/11)
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
ADC level technique based on AGC monitoring
Receiver outputs observation
Time domain techniques based on statistical tests on useful measurements (power, jitter variance, etc.) at the output of correlation block unit
Frequency domain techniques based on spectral estimation, and a threshold determination on the estimated PSD
Transformed domain techniques in order to represent the received signal in a different domain where the useful part can be split from the interference
!! Time-Frequency domain !! Time-Scale domain
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
INTERFERENCE NO INTERFERENCE
Time [sec] Gain Spectrum Mean [dBW] Time [sec] Gain Spectrum Mean [dBW]
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
as an additional contribution to the noise variance N0
The receiver assumes that the only degrading source is uncorrelated thermal noise
The observation of the C/N0 in nominal and interfered scenario might allow to define a statistical threshold
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
A bank of correlators is used to estimate samples of the shape of the correlation function
Comparison with expected shapes
Test metrics
!! Parity and symmetry !! Regularity !! !
Failure detection
!! Threshold definition !! Statistical tests !! !.
GPS C/A code ICL-GNSS 2011
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
Type of Periodogram estimation method:
"! Sample spectrum "! Bartlet "! Welch
Type of windowing
"! Rectangular "! Hamming "! Hanning "! !
Number of overlapped windows estimator variance
Number of samples per segment frequency resolution
Thermal noise
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
Key points of the frequency domain detection algorithm
Number of overlapped windows determines the estimator variance; a noisy estimated PSD can cause false detection
Number of samples per segment determines the frequency resolution which is crucial to avoid the miss detection
Thermal noise plays an important role in the threshold determination
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
] [k sIF
Signal may be transformed in new domains in which useful component and interference are separated (e.g. Gabor transformed)
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
1
3D Threshold Binary mask
P XF(k,f )>ThFinterference absent
( )
Threshold:
( )
) log( , 2 ) log( 2
2 2 , t k R F t X F h
P f k X P T
F
=
! = ! =
"
# #
XF(k,f )= discrete time STFT of signal r[k]
! " # > = $
if 1
, hF d n m
T C
Variance of the two Gaussian components of the complex function XF(k,f)
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
!"#$%&$%$"'$ ('$")%*+,
/)01$ 2-3,')%%*$%,&%$41$"'5,)"6, '+6$ !"#$%&#'()*#+,-.#"/ 7+.*")0 897: 01#)2345 !"#$%&$%$"'$,;)"6<*6#= 677#845 !"#$%&$%$"'$,>+<$% ?@A:9##3"619 3"01#:)2;< !"#$%&$%$"'$ ')%%*$%,+&&($# :9#6779#=77#:845<
Interfered received signal Wavelet decomposition and detection Interference excision
7B$"$,(+&#<)%$,%$'$*C$% ($#1>
/)01$ 8+=$%$"#,*"#$B%)#*+" #*.$ "#>? D++>,E)"6<*6#=( @!!A#B 45 ,!!A#B7#45 FG,&%+"#?$"6,;)"6<*6#= 0C7DB#E45
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
Blanker Threshold Before blanking After Blanking FILTER
Digital Pulse Blanking AGC
IF signal
DIGITAL PULSE BLANKING ICL-GNSS 2011
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
Blanker Gain Blanker loss
dB
ICL-GNSS 2011! Navigation, Signal Analysis and Simulation Group!
23' 1-0)&&%4' !3' !%5%.0%4' /3' 1%(#%("%4' 63' /-5".4' 78' 1-9)&' :-(' 8..).."$#' 0;)' <$0)(:)()$*)' <=+%*0' -$' >?!!' @)*)"5)(.A4' !"""# $%&'(&)*+'(# +'# ,-%+(.&)-# &'/#"0-)1%+'2)#34(1-5(4'8+("&'BCDD'
/3' 2-("-4' E3' F%=-("%$-4' !3' !%5%.0%4' E3' E-' G().,4' 6$25-78%-9:-')4# ";)2(2+'# <+%# =>33# ,..02)&*+'(?4' <HHH'!I.0)='J-K($%&4'L-&3'B4''<..K)'D4'BCCM' '
23'1-0)&&%4'13'G"$"'%$9'63'/-5".'7<$5).,#%,-$'-$' 0;)')N)*0'-:'.0(-$#'-K0O-:OP%$9'."#$%&.'-$'#&-P%&' $%5"#%,-$'.%0)&&"0)'.I.0)=.'()*)"5)(.4'=.(#3+0:*+'(@# L-&K=)'DB4'?K=P)('B3'
E3'1K.K=)*"4'63'/-5".'7Q.)'-:'R%5)&)0'0(%$.:-(=':-(' <$0)(:)()$*)'1",#%,-$A4'<FEO>?!!'BCDD4'S%=+)()4' JK$)'BTOUC4'BCDD3'
".BF.7;:,(D.T@:,('.?.A=.,(6:?@A((]([;(!;=12<121;F1(61=1F9:;([B7:2@=>/(<:2("M-'(%&''(C1F1@?12A(( ( (
Fabio Dovis: fabio.dovis@polito.it