Brady W. O'Hanlon

Assessing the Spoofing Threat: Development of a Portable GPS Civilian Spoofer

A portable civilian GPS spoofer is implemented on a digital signal processor and used to characterize spoofing effects and develop defenses against civilian spoofing. This work is intended to equip GNSS users and receiver manufacturers with authentication methods that are effective against unsophisticated spoofing attacks. The work also serves to refine the civilian spoofing threat assessment by demonstrating the challenges involved in mounting a spoofing attack.

Simulating Ionosphere-Induced Scintillation for Testing GPS Receiver Phase Tracking Loops

A simple model is proposed for simulating equatorial transionospheric radio wave scintillation. The model can be used to test Global Positioning System phase tracking loops for scintillation robustness because it captures the scintillation properties that affect such loops. In the model, scintillation amplitude is assumed to follow a Rice distribution, and the spectrum of the rapidly-varying component of complex scintillation is assumed to follow that of a low-pass second-order Butterworth filter. These assumptions are justified, and the model validated, by comparison with phase-screen-generated and empirical scintillation data in realistic tracking loop tests. The model can be mechanized as a scintillation simulator that expects only two input parameters: the scintillation index S 4 and the decorrelation time tau0. Hardware-in-the-loop tests show how the model can be used to test the scintillation robustness of any compatible GPS receiver.

Signal Characteristics of Civil GPS Jammers

This paper surveys the signal properties of 18 commercially available GPS jammers based on experimental data. The paper is divided into two distinct tests. The first characterizes the jamming signals, and the second test determines the effective range of 4 of the jammers. The first test uses power spectra from discrete Fourier transforms (DFTs) of the time series data to show that all the jammers employ approximately Copyright ©2011 by Ryan H. Mitch, Ryan C. Dougherty, Mark L. Psiaki, Steven P. Powell, and Brady W. O’Hanlon, Jahshan A. Bhatti and Todd E. Humphreys. All rights reserved. Preprint from ION GNSS 2011 the same jamming method, i.e. linear frequency modulation of a single tone. The spectra also show that there are significant jammer-to-jammer variations, including between jammers of the same model, and that a given jammer’s signal may vary over time. The first test also includes measurements of signal power within frequency bands centered at the L1 and L2 frequencies, along with the sweep periods and the sweep range at both frequencies. The second test presents measurements of the attenuation of the jamming signal necessary to allow a commercially available GPS receiver to acquire and track signals from a GPS simulator. From the attenuation levels and some assumptions about the antennas used, upper limits on the effective jamming ranges are calculated for 4 of the jammers, with a resulting maximum range of 6–9 km.

GPS Spoofing Detection via Dual-Receiver Correlation of Military Signals

Cross-correlation of unknown encrypted signals between two Global Navigation Satellite System (GNSS) receivers is used for spoofing detection of publicly-known signals. This detection technique is one of the strongest known defenses against sophisticated spoofing attacks if the defended receiver has only one antenna. The attack strategy of concern overlays false GNSS radio-navigation signals on top of the true signals. The false signals increase in power, lift the receiver tracking loops off of the true signals, and drag the loops and the navigation solution to erroneous but consistent results. Hypothesis testing theory is used to develop a codeless cross-correlation detection method for use in inexpensive, narrowband civilian GNSS receivers. The detection method is instantiated by using the encrypted military Global Positioning System (GPS) P(Y) code on the L1 frequency in order to defend the publicly-known civilian GPS C/A code. Successful detection of spoofing attacks is demonstrated by off-line processing of recorded RF data from narrowband 2.5 MHz RF front-ends, which attenuate the wideband P(Y) code by 5.5 dB. The new technique can detect attacks using correlation intervals of 1.2 s or less.

Civilian GPS Spoofing Detection based on Dual- Receiver Correlation of Military Signals

Cross-correlations of unknown encrypted signals between two civilian GNSS receivers are used to detect spoofing of known open-source signals. This type of detection algorithm is the strongest known defense against sophisticated spoofing attacks if the defended receiver has only one antenna. The attack strategy of concern starts by overlaying false GNSS radio-navigation signals exactly on top of the true signals. The false signals increase in power, lift the receiver tracking loops off of the true signals, and then drag the tracking loops and the navigation solution to erroneous, but consistent results. This paper develops codeless and semi-codeless spoofing detection methods for use in inexpensive, narrow-band civilian GNSS receivers. Detailed algorithms and analyses are developed that use the encrypted military P(Y) code on the L1 GPS frequency in order to defend the open-source civilian C/A code. The new detection techniques are similar to methods used in civilian dualfrequency GPS receivers to track the P(Y) code on L2 by cross-correlating it with P(Y) on L1. Successful detection of actual spoofing attacks is demonstrated by off-line processing of digitally recorded RF data. The codeless technique can detect attacks using 1.2 sec of correlation, and the semi-codeless technique requires correlation intervals of 0.2 sec or less. This technique has been demonstrated in a narrow-band receiver with a 2.5 MHz bandwidth RF front-end that attenuates the P(Y) code by 5.5 dB.

CASES: A Smart, Compact GPS Software Receiver for Space Weather Monitoring

A real-time software-defined GPS receiver for the L1 C/A and L2C codes has been developed as a low-cost space weather instrument for monitoring ionospheric scintillation and total electron content. The so-called CASES receiver implements several novel processing techniques not previously published that make it well suited for space weather monitoring: (A) a differencing technique for eliminating local clock effects, (B) an advanced triggering mechanism for determining the onset

Development and Field Testing of a DSP-Based Dual-Frequency Software GPS Receiver

A real-time software GPS receiver for the L1 C/A and L2 C codes has been implemented on a Digital Signal Processor (DSP) and tested in both scintillating and nonscintillating environments. This receiver is being developed as a low-cost space weather instrument with improved tracking robustness in comparison to a traditional semi-codeless dual-frequency receiver and with flexibility in its choices of signal tracking algorithms and data outputs. The receiver is capable of continuous background signal acquisition and utilizes the L1 C/A code to assist in acquisition of the L2 C signal. Efficient on-the-fly generation of oversampled PRN code replicas for the L2 CM and CL codes, which are required for real-time software radio signal processing, has been implemented to ensure a manageable requirement for memory. Bit-wise parallel correlation techniques have been implemented to reduce the number of operations needed for correlation. The receiver currently tracks both the L2 CL and CM codes for the purpose of calculating TEC. Results are presented based on data generated by a signal simulator, on real data taken in Ithaca, NY (42.44 N, 76.48W), and on real data taken during ionospheric scintillation in Natal, Brazil (5.8S, 35.2W) in January 2009. Position and velocity solution accuracy is evaluated using both real and simulated data.

CASES: A Novel Low-Cost Ground-based Dual-Frequency GPS Software Receiver and Space Weather Monitor

GPS receivers can be used for monitoring space weather events such as TEC variations and scintillation. This paper describes the new GPS sensor developed by ASTRA, Cornell and UT Austin. The receiver is called “Connected Autonomous Space Environment Sensor (CASE)”, and represents a revolutionary advance in dual frequency GPS space-weather monitoring. CASES is a paperback-novel-sized dual-frequency GPS software receiver with robust dual-frequency tracking performance, stand-alone capability, and complete software upgradability. The receiver tracks L1 and L2 civilian signals (specifically L1 C/A, L2 CL and L2 CM). The sensor measures and calculates TEC with a relative accuracy of a few 0.01 TECU at a cadence of up to 1 Hz (post-processing up to 100 Hz). It measures amplitude and phase at up to 100 Hz on both L1 and L2-C, for up to 14 satellites in view. It calculates the standard scintillation severity indicators S4, τ0, and σΦ, and a new index, the Scintillation Power Ration (SPR), all at a cadence that is user defined. It is able to track through scintillation with {S4, τ0, amplitude} combinations as severe as {0.8, 0.8 seconds, 43 dB-Hz (nominal)} (i.e., commensurate with vigorous post-sunset equatorial scintillation) with a mean time between cycle slips of 480 seconds and with a mean time between frequency-unlock greater than 1 hour. Other capabilities and options include: Various data interface solutions; In-receiver and network-wide calibration of biases, and detection and mitigation of multipath; Network-wide automated remote configuration of receivers, quality control, re-processing, archiving and redistribution of data in real-time; Software products for data-processing and visualization. CASES has been designed and developed by the ionosphere community rather than adapting a commercial receiver. The low price of the sensor means that many more instruments can be purchased on a fixed budget, which will lead to new kinds of opportunities for monitoring and scientific study, including networked applications. Other potential uses for CASES receivers include geodetic and seismic monitoring, measurement of precipitable water vapor in the troposphere at meso-scale resolution, and educational outreach.

GPS-based attitude determination for a spinning rocket

An algorithm is developed for determining the attitude of a spinning sounding rocket. This algorithm is able to track global positioning system (GPS) signals with intermittent availability but with enough accuracy to yield phase observables for the precise, three-axis attitude determination of a nutating rocket. Raw, single-frequency GPS RF front-end data are processed by several filters to accomplish this task. First, a Levenberg-Marquardt algorithm (LMA) estimates GPS observables for multiple satellites by performing a least-squares fit to the accumulation outputs of a bank of correlators. These observables are then used as measurements in a Rauch-Tung-Striebel smoother that optimizes estimates of carrier phase, Doppler shift, and code phase. Finally, attitude determination is carried out by another batch filter that uses the single-differenced optimized carrier phase estimates between two antennas and an Euler dynamics model for the torque-free attitude motion of the spinning rocket. This second batch filter implements a combination of a substantially modified form of the LMA and the least-squares ambiguity decorrelation adjustment (LAMBDA) method. This design enables it to deal with integer ambiguities that change over long data gaps between times of carrier phase availability. The algorithm presented in this paper is applied to recorded RF data from a spinning sounding rocket mission to produce attitude quaternion and spin-rate estimates using a pair of antennas separated by a 0.3-m baseline. These results are confirmed by another set of quaternions and spin-rate vectors independently estimated from magnetometer and horizon crossing indicator data. Attitude precision on the order of several degrees has been demonstrated.