Session A3a: GNSS Security: Interference, Jamming, and Spoofing 2

Detection and Identification of Inauthentic Signals Based on the Frequency Drift of the GNSS Receiver Clock
Zhen Zhu, East Carolina University; Sanjeev Gunawardena, Air Force Institute of Technology; Eric Vinande, and Jason Pontious, Air Force Research Laboratory
Location: Beacon A

Inauthentic GNSS signals can be generated with an RF simulator. An advanced simulator will create pseudorange, carrier phase and satellite position that are consistent with each other within every channel and across multiple channels [1]. When the simulated signals are received simultaneously with authentic ones, it would be difficult for most existing GNSS receivers to identify them. It has been recognized that the clock solution and drift rate from a GNSS receiver could be used to detect and identify the presence of these inauthentic signals [2].
If all of the simulated channels are driven by a single local oscillator, the inauthentic GNSS signal would carry the characteristics of this oscillator. Since the performance and behavior of the simulator’s oscillator is expected to be different from those of the satellite clocks, it may be observed as part of the receiver clock solution. The detection of inauthentic signals via a combination of receiver motion and clock solution was first explored in [3]. More recently, it was demonstrated in [4] and [5] that receiver clock drift can be monitored using the time differenced carrier phase (TDCP) from a single satellite.
Typically, low-cost GNSS receivers use Temperature Controlled Crystal Oscillators (TCXOs). Even low-cost TCXOs may have frequency stability over several seconds, which may be sufficient to detect the existence of the inauthentic signals [2][6]. In fact, detection of inauthentic signals based on receiver clock bias and drift has been demonstrated with low-cost receivers in [7].
Our previous work in [6] considered the feasibility of detecting and potentially identifying the simulator clock, based on clock frequency drift estimated with TDCP from multiple GNSS constellations. As expected, the detectability is dependent on the relative quality of the receiver and simulator clocks. More specifically, if the receiver clock is an Oven Controlled Crystal Oscillator (OCXO), it would be feasible to detect and even identify the simulator clock that is a TXCO. On the contrary, it would be unlikely to identify a simulator clock with a receiver using TCXO, if the simulator uses an OCXO. Recently, it was proposed in [8] that clock anomalies can be detected based on the known random walk model of the frequency drift.
In this work, a more comprehensive study of clock-based detection and identification algorithms will be presented. The detection algorithms will be based on a moving window of the receiver-estimated clock frequency drift, which is similar to the approach described in [8]. The phase noise and frequency stability of the potential simulator clock will also be considered, especially for the identification algorithm. A variety of receiver and simulator oscillator combinations, including TCXO, OCXO and Chip-Scale Atomic clock (CSAC) will be considered. The proposed algorithms will be designed based on a priori stochastic models of these types of clocks, and will be tested with simulated and live GNSS data.
This work was supported by Air Force Research Laboratory, FA8650-22-C-1017. This document has been approved for public release, distribution unlimited. Case Number: AFRL-2024-5234.
[1] Psiaki, M. L. & Humphreys, T. E. (2016). GNSS spoofing and detection. Proc. IEEE, vol. 104, no. 6, pp. 1258-1270.
[2] Blum, Ronny, Dütsch, Nikolas, Dampf, Jürgen, Pany, Thomas, "Time Synchronized Signal Generator GNSS Spoofing Attacks against COTS Receivers in over the Air Tests," Proceedings of the 2021 International Technical Meeting of The Institute of Navigation, January 2021, pp. 125-148. https://doi.org/10.33012/2021.17814
[3] P. Y. Hwang and G. A. McGraw, "Receiver Autonomous Signal Authentication (RASA) based on clock stability analysis," 2014 IEEE/ION Position, Location and Navigation Symposium - PLANS 2014, Monterey, CA, USA, 2014, pp. 270-281, doi: 10.1109/PLANS.2014.6851386.
[4] Shang, Shunshun, Li, Hong, Wei, Yimin, Lu, Mingquan, "GNSS Spoofing Detection and Identification Based on Clock Drift Monitoring Using Only One Signal," Proceedings of the 2020 International Technical Meeting of The Institute of Navigation, San Diego, California, January 2020, pp. 331-340. https://doi.org/10.33012/2020.17147
[5] Wood, Joshua, “Detection of GNSS Faults Using Receiver Clock Drift Estimates” Thesis, Auburn University, 2021. https://etd.auburn.edu//handle/10415/7749
[6] Zhu, Zhen, Gunawardena, Sanjeev, Vinande, Eric, Pontious, Jason, "Charactering Receiver Clocks for the Detection and Identification of Inauthentic GNSS Signals," Proceedings of the 2024 International Technical Meeting of The Institute of Navigation, Long Beach, California, January 2024, pp. 505-511. https://doi.org/10.33012/2024.19556
[7] Truong, V., Vervisch-Picois, A., Rubio Hernan, J., Samama, N. (2023). Characterization of the Ability of Low-Cost GNSS Receiver to Detect Spoofing Using Clock Bias. Sensors. 23(5):2735. https://doi.org/10.3390/s23052735
[8] Langel, Steven E., Quartararo, John David, Cisneros, Joseph, Greco, Kevin, "Wiener Disorder Detection Method for Anti-Spoofing in GNSS Navigation Kalman Filters," Proceedings of the 34th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2021), St. Louis, Missouri, September 2021, pp. 3730-3739. https://doi.org/10.33012/2021.17978