GNSS Spoofing Detection Based on a Sequence of RSS Measurements

V. Dehghanian, J. Nielsen

Abstract:	There is an emerging interest in utilizing unmanned vehicles and aircraft for various civilian and military applications which rely on GNSS signals for general navigation. A perceived emerging threat to such applications is posed by a standoff transmitter source that maliciously denies the GNSS receiver of retrieving valid satellite sourced signals from which an accurate navigation solution can be derived. The signal power at the output of a GNSS receiver based on a low gain antenna at ground level is approximately -130 dBm [1]. This makes GNSS receivers susceptible to simple noise jammers that can easily overpower the miniscule satellite signal [2]. Nevertheless, such a noise jammer is relatively easy to detect as its spectral power density is significantly larger than the anticipated ambient noise [3, 4]. Hence while the GNSS service is denied by the jammer, the GNSS receiver is aware of this and can engage other observables to facilitate navigation. A more insidious threat is the spoofer that broadcasts a set of replicas of the authentic satellite vehicle (SV) signals but with counterfeit navigation information[3, 5]. The victim GNSS receiver computes the navigation solution based on these counterfeit signals which are subsequently passed on as being reliable with potentially damaging consequences. The particular spoofer transmitter that is considered in this paper is the Standoff Spoofer (SS) that is intended to disrupt GNSS signalling over a limited geographical target area by eschewing counterfeit GNSS signal emissions that closely match the anticipated spectral power, Doppler offset and code phase of the replicated SV sourced GNSS signals commensurate with that area. Hence the mismatch between the SS and the SV sourced signals is sufficient to deny the GNSS receivers of valid navigation but small enough that the SS signals are not easily identifiable as being counterfeit. As such, receiver-autonomous integrity monitoring (RAIM) and fault detection and exclusion (FDE) are ineffective in discriminating signals sourced from the SS [6]. Previously, it was shown that a relatively unsophisticated SS can effectively disrupt a large physical area[2, 5, 7]. However, processing based on estimating the Carrier to Noise Ratio (CNR) of the spoofer and the authentic received signals and applying a rudimentary threshold criteria can significantly reduce the effectiveness of the SS [2]. A spoofer detection technique which based on signal power measurements was introduced by [5, 7] and was shown to effectively discriminate the spoofer from the authentic signals. The detection processing methods developed were further manipulated to exploit incidental antenna motion arising from user interaction with a GNSS handheld receiver which further enhanced the spoofer detection such that the average probability of false detection can be reduced to less than 20% in a typical urban environment[7]. Also, GNSS receivers tethered to a wireless data service provider will typically provide the user with an Aided-GNSS (AGNSS) service, significantly reducing the code-Doppler-space (CDS) corresponding to a physical area of several square kilometres [8]. Based on these easily implementable countermeasures there is a diminishing gain for the spoofer attempting to affect a larger target area which reduces the potential effectiveness of a given spoofer. As a more extensive network of spoofers is then required to deny GNSS service in a given area, the cost effectiveness of the spoofer is reduced. A limitation of the previous spoofer detection techniques (e.g. [5, 7]) is that the received signal strength (RSS) is subject to the uncertainty due to multipath fading, shadowing, and receiver antenna orientation mismatch losses. Hence the spoofer detection based on RSS is a statistical Bayesian problem with an outcome of the confidence that a GNSS signal passed to the navigation solution is authentic. To enhance the robustness of the Bayesian discriminator of the SS, other statistical differences between the SV and SS must be utilized. One obvious attribute is that as the GNSS receiver is moved via an autonomous vehicle (AV) platform, the averaged SS RSS will change due to notable changes in the radial distance between the SS and the GNSS receiver. However, given that the SVs are approximately 20,000 Km away, the short term averaged SV RSS is invariant to such receiver motion. This paper contains results where this attribute is effectively exploited in SS detection. As shown, average AV movement of several hundred meters results in a highly effective means of discriminating between an SS and SV source. In this work, existing cellular radio network signals are utilized to provide an accurate (and legal) emulation of a network of SS’s that could plausibly be utilized for denying reliable GNSS based navigation in an urban area. A two channel RF frontend and sampler is used to simultaneously downconvert and sample authentic SV and SS (cellular) signals. As the frontend-and-sampler unit is moved through various urban and suburban terrains, the digitized signal samples are stored in a computer. The stored signal is divided to multiple time snapshots each corresponding to trajectory lengths of 100, 200, and 500 meters. A least squares estimator is then utilized to estimate the gradient of the of SS and SV RSS with change in receiver position for each sequence of signal samples. Finally a likelihood ratio test is formulated to discriminate SS from SV signals based on comparing the estimated slopes of SS and SV RSS to a predetermined threshold. It is shown that the proposed technique is effective in discriminating SS signals with the robustness of the detection algorithm increasing with increasing the length of observable trajectory. In conclusion, an RSS sequence corresponding to a displacement change of the receiver of about 200 meters provides a sufficient observable for reliably detecting the SS. Furthermore, a longer record allows for a rough estimate as to the location of the SS. References [1] E. D. Kaplan and C. J. Hegarty, Understanding GPS: principles and applications. Norwood, MA: Artech House, Inc., 2006. [2] J. Nielsen, V. Dehghanian, and G. Lachapelle, "Effectiveness of GNSS Spoofing Countermeasure Based on Receiver CNR Measurements," International Journal of Navigation and Observation, vol. 2012, 2012. [3] B. M. Ledvina, et al., "An In-Line Anti-Spoofing Device for Legacy Civil, GPS Receivers," presented at the Institute of Navigation, ITM, San Diego, CA, 2010. [4] T. E. Humphreys, et al., "Assessing the Spoofing Threat: Development of a Portable GPS Civilian Spoofer," presented at the ION GNSS Savanna, CA, 2008. [5] V. Dehghanian, J. Nielsen, and G. Lachapelle, "GNSS Spoofing Detection Based on Signal Power Measurements: Statistical Analysis," International Journal of Navigation and Observation, vol. 2012, 2012. [6] L. Scott, "Location Assurance," GPS World, vol. 18, 2007. [7] V. Dehghanian, J. Nielsen, and G. Lachapelle, "GNSS Spoofing Detection based on Receiver C/No Estimates," in GNSS 2012, Nashville, USA, 2012. [8] F. S. T. V. Diggele, A-GPS: assisted GPS, GNSS, and SBAS Artech House, Inc., 2009.
Published in:	Proceedings of the 26th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2013) September 16 - 20, 2013 Nashville Convention Center, Nashville, Tennessee Nashville, TN
Pages:	2931 - 2936
Cite this article:	Dehghanian, V., Nielsen, J., "GNSS Spoofing Detection Based on a Sequence of RSS Measurements," Proceedings of the 26th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2013), Nashville, TN, September 2013, pp. 2931-2936.
Full Paper:	ION Members/Non-Members: 1 Download Credit Sign In