Jahshan A. Bhatti

Unmanned Aircraft Capture and Control Via GPS Spoofing

The theory and practice of unmanned aerial vehicle UAV capture and control via Global Positioning System GPS signal spoofing are analyzed and demonstrated. The goal of this work is to explore UAV vulnerability to deceptive GPS signals. Specifically, this paper 1 establishes the necessary conditions for UAV capture via GPS spoofing, and 2 explores the spoofers range of possible post-capture control over the UAV. A UAV is considered captured when a spoofer gains the ability to eventually specify the UAVs position and velocity estimates. During post-capture control, the spoofer manipulates the true state of the UAV, potentially resulting in the UAV flying far from its flight plan without raising alarms. Both overt and covert spoofing strategies are considered, as distinguished by the spoofers attempts to evade detection by the target GPS receiver and by the target navigation systems state estimator, which is presumed to have access to non-GPS navigation sensor data. GPS receiver tracking loops are analyzed and tested to assess the spoofers capability for covert capture of a mobile target. The coupled dynamics of a UAV and spoofer are analyzed and simulated to explore practical post-capture control scenarios. A field test demonstrates capture and rudimentary control of a rotorcraft UAV, which results in unrecoverable navigation errors that cause the UAV to crash.

Signal Characteristics of Civil GPS Jammers

This paper surveys the signal properties of 18 commercially available GPS jammers based on experimental data. The paper is divided into two distinct tests. The first characterizes the jamming signals, and the second test determines the effective range of 4 of the jammers. The first test uses power spectra from discrete Fourier transforms (DFTs) of the time series data to show that all the jammers employ approximately Copyright ©2011 by Ryan H. Mitch, Ryan C. Dougherty, Mark L. Psiaki, Steven P. Powell, and Brady W. O’Hanlon, Jahshan A. Bhatti and Todd E. Humphreys. All rights reserved. Preprint from ION GNSS 2011 the same jamming method, i.e. linear frequency modulation of a single tone. The spectra also show that there are significant jammer-to-jammer variations, including between jammers of the same model, and that a given jammer’s signal may vary over time. The first test also includes measurements of signal power within frequency bands centered at the L1 and L2 frequencies, along with the sweep periods and the sweep range at both frequencies. The second test presents measurements of the attenuation of the jamming signal necessary to allow a commercially available GPS receiver to acquire and track signals from a GPS simulator. From the attenuation levels and some assumptions about the antennas used, upper limits on the effective jamming ranges are calculated for 4 of the jammers, with a resulting maximum range of 6–9 km.

GPS Spoofing Detection via Dual-Receiver Correlation of Military Signals

Cross-correlation of unknown encrypted signals between two Global Navigation Satellite System (GNSS) receivers is used for spoofing detection of publicly-known signals. This detection technique is one of the strongest known defenses against sophisticated spoofing attacks if the defended receiver has only one antenna. The attack strategy of concern overlays false GNSS radio-navigation signals on top of the true signals. The false signals increase in power, lift the receiver tracking loops off of the true signals, and drag the loops and the navigation solution to erroneous but consistent results. Hypothesis testing theory is used to develop a codeless cross-correlation detection method for use in inexpensive, narrowband civilian GNSS receivers. The detection method is instantiated by using the encrypted military Global Positioning System (GPS) P(Y) code on the L1 frequency in order to defend the publicly-known civilian GPS C/A code. Successful detection of spoofing attacks is demonstrated by off-line processing of recorded RF data from narrowband 2.5 MHz RF front-ends, which attenuate the wideband P(Y) code by 5.5 dB. The new technique can detect attacks using correlation intervals of 1.2 s or less.

Evaluation of Smart Grid and Civilian UAV Vulnerability to GPS Spoofing Attacks

Todd E. Humphreys is an assistant professor in the department of Aerospace Engineering and Engineering Mechanics at the University of Texas at Austin, and Director of the UT Radionavigation Laboratory. He received a B.S. and M.S. in Electrical and Computer Engineering from Utah State University and a Ph.D. in Aerospace Engineering from Cornell University. He specializes in applying optimal estimation and signal processing techniques to problems in radionavigation. His recent focus is on radionavigation robustness and security.

An Evaluation of the Vestigial Signal Defense for Civil GPS Anti-Spoofing

A receiver-autonomous non-cryptographic civil GPS antispoofing technique called the vestigial signal defense (VSD) is defined and evaluated. This technique monitors distortions in the complex correlation domain to detect spoofing attacks. Multipath and spoofing interference models are developed to illustrate the challenge of distinguishing the two phenomena in the VSD. A campaign to collect spoofing and multipath data is described, which specific candidate VSD techniques can be tested against. Test results indicate that the presence of multipath complicated the setting of an appropriate spoofing detection threshold.

Civilian GPS Spoofing Detection based on Dual- Receiver Correlation of Military Signals

Cross-correlations of unknown encrypted signals between two civilian GNSS receivers are used to detect spoofing of known open-source signals. This type of detection algorithm is the strongest known defense against sophisticated spoofing attacks if the defended receiver has only one antenna. The attack strategy of concern starts by overlaying false GNSS radio-navigation signals exactly on top of the true signals. The false signals increase in power, lift the receiver tracking loops off of the true signals, and then drag the tracking loops and the navigation solution to erroneous, but consistent results. This paper develops codeless and semi-codeless spoofing detection methods for use in inexpensive, narrow-band civilian GNSS receivers. Detailed algorithms and analyses are developed that use the encrypted military P(Y) code on the L1 GPS frequency in order to defend the open-source civilian C/A code. The new detection techniques are similar to methods used in civilian dualfrequency GPS receivers to track the P(Y) code on L2 by cross-correlating it with P(Y) on L1. Successful detection of actual spoofing attacks is demonstrated by off-line processing of digitally recorded RF data. The codeless technique can detect attacks using 1.2 sec of correlation, and the semi-codeless technique requires correlation intervals of 0.2 sec or less. This technique has been demonstrated in a narrow-band receiver with a 2.5 MHz bandwidth RF front-end that attenuates the P(Y) code by 5.5 dB.

Tightly-Coupled Opportunistic Navigation for Deep Urban and Indoor Positioning

A strategy is presented for exploiting the frequency stability, transmit location, and timing information of ambient radio-frequency “signals of opportunity” for the purpose of navigating in deep urban and indoor environments. The strategy, referred to as tightly-coupled opportunistic navigation (TCON), involves a receiver continually searching for signals from which to extract navigation and timing information. The receiver begins by characterizing these signals, whether downloading characterizations from a collaborative online database or performing characterizations on-the-fly. Signal observables are subsequently combined within a central estimator to produce an optimal estimate of position and time. A simple demonstration of the TCON strategy focused on timing shows that a TCONenabled receiver can characterize and use CDMA cellular signals to correct its local clock variations, allowing it to coherently integrate GNSS signals beyond 100 seconds.

CASES: A Smart, Compact GPS Software Receiver for Space Weather Monitoring

A real-time software-defined GPS receiver for the L1 C/A and L2C codes has been developed as a low-cost space weather instrument for monitoring ionospheric scintillation and total electron content. The so-called CASES receiver implements several novel processing techniques not previously published that make it well suited for space weather monitoring: (A) a differencing technique for eliminating local clock effects, (B) an advanced triggering mechanism for determining the onset

The Texas Spoofing Test Battery: Toward a Standard for Evaluating GPS Signal Authentication Techniques

A battery of recorded spoofing scenarios has been compiled for evaluating civil Global Positioning System (GPS) signal authentication techniques. The battery can be considered the data component of an evolving standard meant to define the notion of spoof resistance for commercial GPS receivers. The setup used to record the scenarios is described. A detailed description of each scenario reveals readily detectable anomalies that spoofing detectors could target to improve GPS security.

Opportunistic Frequency Stability Transfer for Extending the Coherence Time of GNSS Receiver Clocks

A framework is presented for exploiting the frequency stability of non-GNSS signals to extend the coherence time of inexpensive GNSS receiver clocks. This is accomplished by leveraging stable ambient radio frequency signals, called “signals of opportunity,” to compensate for the frequency instability of the reference oscillators typically used in inexpensive handheld GNSS receivers. Adequate compensation for this frequency instability permits the long coherent integration intervals required to acquire and track GNSS signals with low carrier-to-noise ratios. The goal of this work is to push the use of GNSS deeper indoors or into environments where GNSS may be subject to interference.