By Dr. Paul McBurney
In the past, mass market loss of navigation capability was relatively miniscule, so as to be considered a “snowflake” use case: meaning the frequency of occurrence didn’t warrant special treatment. One might argue that the world has crossed a precipice; incidences of jamming and spoofing have resulted in larger consumer segments lacking the GNSS availability they have grown accustomed to. oneNav’s L5-direct™ Technology enables defense and location services to overcome GPS recent jamming and spoofing. The US Position Navigation, and Timing Advisory Board (PNTAB) has argued for the need to Protect, Toughen, and Augment (PTA) our PNT capabilities. Most consumer device manufacturers have not heeded the call to PTA, and consumers are now often being denied GNSS-based services.
“Smart” devices may be losing that moniker in terms of location resilience because they lack the ability to handle even relatively simple cases of spoofing. Such spoofing is appearing now both offensively and defensively. Nations wishing to protect assets may defensively spoof near their own country’s critical infrastructure. “Bad actors” are offensively spoofing their neighbor’s infrastructure. A recent study, on July 19, 2024, of spoofing near Haifa Israel using the latest consumer devices has shown un-satisfactory results: these devices ignored their own sensor data; received spoofed location assistance from the cellular infrastructure; and worse, their GNSS devices didn’t use all the available signals in a manner that would have easily defeated the spoofing.
The Spoofing Snowflake has Melted and is Turning into Light Rain
The calls from the PNTAB need to be heeded not only by governmental infrastructure providers, but also consumer device manufactures. Mass market GNSS receivers should handle spoofing when first detected, first by reporting that position is not available, and second by finding the non-spoofed signals and continuing to operate. oneNav’s L5-direct™ receiver provided correct location during the Haifa spoofing tests by independently acquiring and fixing with all possible L5 signals. The independent acquisition means a spoofer on one system cannot corrupt the measurements from another system. In the study, the latest devices tested all had L5 tracking capability but failed to use the L5 after being captured by the L1 spoofer, mainly because they lack the ability to independently acquire L5. Mass market receivers can integrate oneNav technology in their own silicon with an IP License, or add oneNav’s future silicon solutions, to augment their current L1 based products.
Currently L1 C/A code is still the dominant acquisition signal for nearly all mass market GNSS receivers. Spoofers take easy advantage of this single point of failure: they only need to spoof a single system to capture the receiver. Measurement data was captured as the test vehicle moved from an area without spoofing to an area with strong spoofing. All devices, three smartphones, a smart watch, and an in-car navigation receiver all showed similar behavior. Before the spoofing, this receiver tracked and fixed with multiple GNSS systems: GPS L1, GAL E5a, BDS B1, GLO L1, and GAL E5a. Figure 1 below shows the CNo for all satellites in each system throughout the test. At about ¼ into the run, the spoofing strength increases and the GPS CNo’s grows from the mid 30’s up to an average of the mid 40’s, with some signals higher than 50dBHz.
Figure 1. Time series of all L1 signal strengths during Haifa test
Continued high signal-to-noise ratio (SNR) can be a sufficient detector to declare spoofing is present, as the smart device should know that high SNRs are impossible in normal operation based on observed signal strengths for the device’s antenna, which are generally in the mid 30’s as shown below in the open sky test. Notice the other systems are tracking okay until about halfway through the run when all signals are lost. This is likely from a spoofing accomplice; a blast of radio frequency interference (RFI) that caused the receiver to lose lock and open its search window for re-acquisition: the position reported from the L5-direct receiver showed no outage.
The remainder of the run after the RFI induced outage shows the GPS L1 remains spoofed and the other systems are completely lost. The brief measurements for the remaining systems are false because they never participate in the fix enough to cause the reported position to exit the spoofed location. The map below illustrates the experiment in the position domain. The vehicle drove the small blue path produced with the oneNav L5-direct™ demo kit (indicated in the lower circle), which indicates the correct position throughout the run. All devices tracked and fixed normally at the start of the experiment, as shown by one phone’s example in green, but later produced spoofed locations of the Beirut airport (indicated in the upper circle) when the vehicle moved in range of the spoofer.
Figure 2. Haifa true course in blue and spoofed location in green
Remedies
One remedy for this situation is for the L1 based receiver to re-search the complete primary codephase for the remaining systems to obtain correct codephase measurements and then vote out the L1 C/A. This action can be triggered from a number of clues that spoofing is present. For more details on how this is accomplished please see technical papers oneNav presented at ION GNSS+ 2024 papers.
A receiver in anti-spoofing mode breaks the common practice that one master system can be used to simplify acquisitions into another system. Whereas the benefit of this practice is a reduced correlator search window, it does not lead to finding the correct primary code-phase when the master search window is not correct. The proposed Quasi-pilot on E5a, a kind of L1 C/A code substitute proposed by the European Galileo GNSS in the E5 band, would have a similar fate as a master acquisition system in the L5 band: it would render a single-point of failure for L5 acquisition.
The L5 Solution
What is required is the ability to do full primary code-phase acquisition on each signal in each system. The oneNav L5 Direct™ receiver provides this capability: For example, in case Galileo E5a is spoofed, an independent full primary code-phase acquisition of L5, B2b, or E5b can acquire the un-spoofed signals. An independent cross check of position, velocity, and time (PVT) from each system along with voting or validation against a sensor-derived PVT trajectory enables fault detection and exclusion (FDE). The frequency diversity in the E5 and B2 bands means spoofers or interferers require more power and complexity to spoof and jam all the signals. oneNav technology can operate when either band is jammed or spoofed.
Furthermore, all signals in the L5/E5/B2 band have a common physical layer with 10.23MHz primary and 1kH secondary chipping rates with a data and pilot channel and can provide up to 15dB superior RFI immunity based on combinations of its signal advantages: 10dB of J/S advantage for narrow band interference compared to L1 C/A, and up to 5dB of additional resilience based on additional signal components, stronger satellite transmit power per component, and a true pilot component for tracking robustness.
oneNav technology is available for a new class of GNSS receiver that can overcome spoofing by independently acquiring each system and sideband with competitive key performance indicators on acquisition time, sensitivity, power consumption and cost.
Read in ION Newsletter