Search

GNSS is nowadays used as a primarily timing source for the synchronization of various types of networks and has been defined as the backbone of the connected world and the invisible utility to highlight its pervasive presence in digital infrastructures. Despite this growing dependency on GNSS, network operators rarely perceive the vulnerability of GNSS receivers to interference or jamming as a real problem. The awareness about GNSS spoofing, namely the transmission of false signals with the intent to fool receivers, is low, while in most cases users and stakeholders continue to consider GNSS a non-critical commodity. A stationary GNSS receiver used for timing and synchronization is an ideal target for malevolent attacks because the antenna is static and often sited in a visible location. As an addition to advanced signal processing and use of backup technologies, the proposition of authenticated GNSS signals is seen as a powerful way to increase the resilience of satellite-based time synchronization. Recognizing this fact, the European Galileo program is gradually implementing the OSNMA authentication service, with a test signal already available from some satellites. Today most of the GNSS-based time synchronization systems on the market are built upon low-cost GPS-only, single-frequency modules, which provide PPS accuracy in the range 20 to 100 ns. Under open sky conditions, those modules do provide a stable time reference, but are very sensitive to degradations. With no doubts, the majority of timing receivers are relatively easy to jam and spoof given the low signal level handled at the antenna. Those degradations range from an increase of the PPS jitter due to a reduced number of satellites in view, to a complete loss of the PPS synchronization in the case of jamming of the single GPS L1 C/A signal. Septentrio is introducing the high-end mosaic-T module, a highly secure, resilient, and accurate GNSS timing module for critical infrastructure and mission-critical timing applications. The use of high-end GNSS receiver as source for synchronization first allows decreasing the noise/jitter on the PPS signal thanks to the use of more satellites and signals in the time solution. The multi-frequency multi-constellation positioning also brings an immediate increase of resilience and robustness in case of unintentional interference knocking out a band or a constellation. On top of its AIM+ interference monitoring and mitigation technology, Septentrio is deploying Galileo’s OSNMA support on its product portfolio and network timing synchronisation was identified as critical market for an increased robustness to jamming/spoofing attacks. The presentation reports on jamming and spoofing tests performed in the framework of the ROOT project. We start by a risk assessment of different interference/jamming/spoofing scenarios for network timing synchronization. We will prioritize the different GNSS threats for this industry, with a special attention on the added value of Galileo OSNMA, which is expected to set a new standard on the industry. We then present different test scenarios selected to measure the actual resilience of the receiver. Initial results from this test campaign are already presented, showing the benefit of OSNMA for time synchronisation of networks. Acknowledgment: This work was developed within the ROOT project (www.gnss-root.eu) funded by the European GNSS Agency under the European Union’s Horizon 2020–G.A. n. 101004261.

This paper presents a method to detect and mitigate a spoofing attack by means of a dual polarized antenna. It exploits the similarity in polarization of spoofed satellites to identify spoofed satellites and copes with three major challenges. A first challenge is to avoid false alarms, which could be triggered by occasional polarization alignment of authentic satellites. The second challenge is the detection of spoofed signals out of a mix of spoofed and non-spoofed signals, as is the case in most practical spoofing attacks. The final challenge is to be able to work with spoofed signals from RHCP spoofing antennas operating from a higher elevation. The technique was developed based on analysis of a large amount of experimental signal data recorded in spoofed and non-spoofed environments. The paper first describes the recording system, which uses a high-performance dual polarized antenna, optimized for low axial ratio. This connects to a multi-frequency multi-constellation receiver, supporting concurrent coherent tracking of the RHCP and LHCP signal components provided by the antenna. We subsequently discuss the measurement campaign. It is rather straightforward to collect data in a variety of non-spoofed environments to build a database of scenarios which are supposed to yield a negative spoofing indication. This doesn’t hold for spoofing scenarios, because of regulatory constraints. Therefore, the spoofing tests were done in a special anechoic chamber which can simulate both polarization and angle of arrival of satellite signals. This wave field synthesis (WFS) testbed was configured to create a mix of satellite signals, some of them emulating authentic signals and the other ones representing the spoofer. The WFS testbed was used to simulate an advanced matched power timing attack. Finally, the paper discusses a new spoofing detection algorithm, based on the experimental data. We present an analysis of the spoofing classification performance, analyzing metrics for probability of false alarm and probability of detection.

The introduction of the unencrypted global positioning system (GPS) L2 civil (L2C) signal has the potential to improve measurements made with the L2 frequency, an important observable in GPS-based ionospheric research and monitoring. Recent work has shown significant differences between the legacy L2P(Y) and L2C-derived total electron content rate of change index (ROTI). This difference is observed between L2P(Y) and L2C-derived ROTI with certain receiver models and between zero-baseline receiver pairs. We discuss the likely cause for these differences: L1-aided tracking used to track both the L2P(Y) and L2C signals. We also present L2C data that are confirmed to be from tracking independent of L1. Using the ionospheric-free linear combination, we show that the independently tracked carrier phase dynamics are significantly more accurate than the L1-aided observables. This result is confirmed by comparing the behavior of the L2C and L2P(Y) carrier phase observables upon a sudden antenna rotation.

Altres ajuts: European GNSS Agency (GSA) under the FANTASTIC project GSA/GRANT/01/2016 Global Navigation Satellite Systems (GNSSs) have become a ubiquitous tool for our modern society to carry out vital tasks such as transportation, civil engineering or precision agriculture. This breath has reached the realm of safety-critical applications such as time management of critical infrastructures or autonomous vehicles, in which GNSS is an essential tool nowadays. Unfortunately, current GNSS performance is not enough to fulfill the requirements of these professional and critical applications. For this reason, the FANTASTIC project was launched to boost the adoption of these applications. The project was funded by the European GNSS agency (GSA) in order to enhance the robustness and accuracy of GNSS in harsh environments. This paper presents the part related to the development of a weighting and exclusion function with a dual circularly polarized antenna. The idea is to reduce the effects of multipath by weighting and/or excluding those measurements affected by multipath. The observables and other metrics obtained from a dual polarized antenna will be exploited to define an exclusion threshold and to provide the weights. Real-world experiments will show the improvement in the positioning solution, using all available constellations, obtained with the developed technique.

The last decade GPS was introduced into numerous applications for tracking of persons, vehicles and goods. This came along with the commercial availability of jamming devices. The chirp signals generated by these basic devices could affect GPS reception in large areas. The last few years many publications described effective methods to mitigate chirp jammers and commercial receivers became available which are resilient against this type of interference. While jammers simply block positioning, GPS spoofers attempt to take control of the positioning output, deceiving the end user. This is accomplished by sending counterfeit GPS signals into the GPS antenna. Spoofers can alter the tracks recorded by vehicle monitors and break geofences, which are commonly applied to restrict the area in which devices or people can operate. One example of this is the electronic monitoring of criminals. Spoofers also pose a risk to critical infrastructure, including power centrals, telecommunication networks and transportation systems, as they rely on GPS for precise timing. Counterfeiting GPS signals is a rather complex task. It involves the generation of multiple CDMA-modulated radio signals, which are delayed and Doppler shifted to represent the signal at the desired (artificial) user position. Until just a few years ago, GPS signal simulators were expensive devices designed for rack mounting. Hence, the use of spoofers by individuals or criminal organisations was not a realistic threat. This changed with the advent of compact software defined radio's (SDR), which build on the latest advancements in RF semiconductor technology. These affordable credit-card sized radios generate fully configurable RF signals. They receive digital samples from a laptop over a high-speed USB connection. Many SDR developments are driven by the open source community and since 2015, open source software can be downloaded from the internet for generating digital GPS signals. The software repository includes instructions to use it with the most common SDR's and its compilation is a trivial task for anyone with some programming background. We were able to set up the system in short time, spoofing the location reported by cell phones. The paper will first analyse the GPS signal produced by a common SDR. This includes power measurements and range predictions as well as clock stability and consistency of the imitated code and phase ranges. Subsequently the paper describes the impact of these well-accessible spoofers on various receiver types. We tested the spoofer on cell phones, on automotive grade receiver modules and on several high-accuracy receivers. The PolaRx5 receiver participating in the test offers a wide variety of signal quality outputs and a graphical user interface to display them in real time or during post-processing. This provides full visibility on the spoofer’s behaviour. The tests cover a number of spoofing scenarios. In many vehicle tracking and geofencing attacks, the user has access to the GPS antenna. Authentic GNSS signals can be blocked and replaced with imitated signals. This is a first scenario in which receiver behaviour will be analysed, along with the impact of power levels and time offsets. If the antenna cannot be accessed, the spoofing signal needs to be superimposed on the genuine GNSS signal. As a first, crude approach, this can be achieved by simply connecting a transmit antenna to an SDR and overpowering the signal from space, with only coarse time synchronization. Note that, in principle, this attack could be detected by observing an unusual antenna referenced power spectral density. After analysing the receiver behaviour when affected by this basic spoofing approach, we will study a more sophisticated spoofing attack, in which the spoofer synchronises to GPS and gradually pulls the tracking channels away from the authentic signal. Once a receiver is tracking the spoofer signal, the transmit power could be lowered making the spoofer almost undetectable. This attack will be simulated using a commercial RF constellation simulator, which is capable to simulate this form of spoofing. Spoofing robustness of receivers depend on their ability to discriminate between an authentic signal and a counterfeit signal. This in turn depends on the quality of the counterfeiting. It will be pointed out that the cost and complexity of a spoofer rapidly increases with the number of signal features it is able to simulate. Septentrio receiver modules monitor many parameters, which could be used for authenticity assessment of the signal. They have grip on multiple components of the signal broadcasted by the satellite, clock behaviour and on signal propagation effects like multipath and ionospheric delay. Besides, they can also detect and mitigate complementary jammers. This enables the construction of a spoofing indication flag, which correctly reacts on any spoofing scenario of the earlier tests, including the sophisticated scenario.

Using global navigation satellite system (GNSS) signals for accurate timing and time transfer requires the knowledge of all electric delays of the signals inside the receiving system. GNSS stations dedicated to timing or time transfer are classically calibrated only for Global Positioning System (GPS) signals. This paper proposes a procedure to determine the hardware delays of a GNSS receiving station for Galileo signals, once the delays of the GPS signals are known. This approach makes use of the broadcast satellite inter-signal biases, and is based on the ionospheric delay measured from dual-frequency combinations of GPS and Galileo signals. The uncertainty on the so-determined hardware delays is estimated to 3.7 ns for each isolated code in the L5 frequency band, and 4.2 ns for the ionosphere-free combination of E1 with a code of the L5 frequency band. For the calibration of a time transfer link between two stations, another approach can be used, based on the difference between the common-view time transfer results obtained with calibrated GPS data and with uncalibrated Galileo data. It is shown that the results obtained with this approach or with the ionospheric method are equivalent.

The inter-satellite-type bias (ISTB) is a receiver-dependent hardware delay/bias between different satellite types. Our recent research revealed the existence of nonzero mixed-receiver phase ISTBs for the Chinese BeiDou system. Triggered by this finding, global navigation satellite system receiver manufactures, who are in the early stage of BeiDou-enabled receiver developments, are working toward a mutually consistent measurement extraction procedure. We analyze the long-term stability and current status of the mixed-receiver ISTBs, as well as study their impact on BeiDou stand-alone real-time kinematic (RTK) positioning. Our results confirm that a recent update in one of the receiver types has aligned it with one of the other receiver types. However, since not all receiver types are aligned yet, nonzero mixed-receiver ISTBs are shown to be still present. Analyses of BeiDou stand-alone RTK positioning using mixed-receiver types demonstrate that ISTBs could seriously affect the integer ambiguity resolution performance and that a priori correction for these biases will dramatically improve the success rate. Our analyses using real data from three different receiver types also demonstrate the long-term stability of the ISTBs, thus showing that such a priori calibration is indeed possible.

An analysis of observations from China’s first medium earth orbit satellite Compass M-1 is presented, with main focus on the first orbit and clock solution for this satellite. The orbit is computed from laser ranging measurements. Based on this orbit solution, the apparent clock offset is estimated using measurements from two GNSS receivers, which allow Compass tracking. The analysis of the clock solutions reveals unexpectedly high dynamics in the pseudorange and carrier-phase observations. Furthermore, carrier-to-noise density ratio, pseudorange noise, and multipath are analyzed and compared to GPS and GIOVE. The results of the clock analysis motivate further research on the signals of the geostationary satellites of the Compass constellation.

Analysis of GIOVE-A signals is an important part of the in-orbit validation phase of the Galileo program. GIOVE-A transmits the ranging signals using all the code modulations currently foreseen for the future Galileo and provides a foretaste of their performance in real-life applications. Due to the use of advanced code modulations, the ranging signals of Galileo provide significant improvement of the multipath performance as compared to current GPS. In this paper, we summarize the results of about 1.5 years of observations using the data from four antenna sites. The analysis of the elevation dependence of averaged multipath errors and the multipath time series for static data indicate significant suppression of long-range multipath by the best Galileo codes. The E5AltBOC signal is confirmed to be a multipath suppression champion for all the data sets. According to the results of the observations, the Galileo signals can be classified into 3 groups: high-performance (E5AltBOC, L1A, E6A), medium-performance (E6BC, E5a, E5b) and an L1BC signal, which has the lowest performance among Galileo signals, but is still better than GPS-CA. The car tests have demonstrated that for kinematic multipath the intersignal differences are a lot less pronounced. The phase multipath performance is also discussed.

Precise point positioning (PPP) is a zero-difference single-station technique that has proved to be very effective for time and frequency transfer, enabling the comparison of atomic clocks with a precision of a hundred picoseconds and a one-day stability below the $1e-15$ level. It was, however, noted that for some receivers, a frequency difference is observed between the clock solution based on the code measurements and the clock solution based on the carrier-phase measurements. These observations reveal some inconsistency either between the code and carrier phases measured by the receiver or between the data analysis strategy of codes and carrier phases. One explanation for this discrepancy is the time offset that can exist for some receivers between the code and the carrier-phase latching. This paper explains how a code-phase bias in the receiver hardware can induce a frequency difference between the code and the carrier-phase clock solutions. The impact on PPP is then quantified. Finally, the possibility to determine this code-phase bias in the PPP modeling is investigated, and the first results are shown to be inappropriate due to the high level of code noise.

Precise Point Positioning (PPP) is a zero-difference single-station technique that has proved to be very effective for time and frequency transfer, enabling the comparison of atomic clocks with a precision of a hundred picoseconds and a one day stability below the 1e-15 level. It was however noted that for some receivers, a frequency difference is observed between the clock solution based on the code measurements and the clock solution based on the carrier phase measurements. These observations reveal some inconsistency between the code and carrier phases measured by the receiver. One explanation of this discrepancy is the time offset that can exist for some receivers between the code and carrier phase latching. This paper explains how a code-phase bias in the receiver hardware can induce a frequency difference between the code and the carrier phase clock solutions. The impact on PPP is then quantified. Finally, the possibility to determine this code-phase bias in the PPP modeling is investigated, and the first results are presented.

This chapter provides a review of existing experimental and professional Galileo receivers, related application projects and selected design topics, such as generic tracking channels, fast acquisition algorithms and AltBOC tracking. Although at the time of writing Galileo as a GNSS system is not yet fully deployed, quite a number of Galileo receivers have already been created with the help of Galileo simulators, mainly in the context of European projects, the most significant being the Galileo Test User Receiver project (TUR). Some Galileo receivers have also been developed to test the signals of experimental Galileo satellites GIOVE-A/B.

Recent studies have shown the capabilities of Global Positioning System (GPS) carrier phases for frequency transfer based on the observations from geodetic GPS receivers driven by stable atomic clocks. This kind of receiver configuration is the kind primarily used within the framework of the International GPS Service (IGS). The International GPS Service/Bureau International des Poids et Mesures (IGS/BIPM) pilot project aims at taking advantage of these GPS receivers to enlarge the network of Time Laboratories contributing to the realization of the International Atomic Time (TAI). In this article, we outline the theory necessary to describe the abilities and limitations of time and frequency transfer using the GPS code and carrier phase observations. We report on several onsite tests and evaluate the present setup of our 12-channel IGS receiver (BRUS), which uses a hydrogen maser as an external frequency reference, to contribute to the IGS/BIPM pilot project. In the initial experimental setup, the receivers had a common external frequency reference; in the second setup, separate external frequency references were used. Independent external clock monitoring provided the necessary information to validate the results. Using two receivers with a common frequency reference and connected to the same antenna, a zero baseline, we were able to use the carrier phase data to derive a frequency stability of 6 × 10−16 for averaging times of one day. The main limitation in the technique originates from small ambient temperature variations of a few degrees Celsius. While these temperature variations have no effect on the functioning of the GPS receiver within the IGS network, they reduce the capacities of the frequency transfer results based on the carrier phase data. We demonstrate that the synchronization offset at the initial measurement epoch can be estimated from a combined use of the code and carrier phase observations. In our test, the discontinuity between two consecutive days was about 140 ps. © 1999 John Wiley & Sons, Inc.

Made available in DSpace on 2015-03-18T15:54:19Z (GMT). No. of bitstreams: 0 Previous issue date: 2011-01-01Bitstream added on 2015-03-18T16:29:05Z : No. of bitstreams: 1 WOS000208781200006.pdf: 1659501 bytes, checksum: 3508622c0729174831d4ef2e850440da (MD5) EC Seventh Framework Program EC FP7 Marie Curie Intra- European Fellowship Scintillations are rapid fluctuations in the phase and amplitude of transionospheric radio signals which are caused by small-scale plasma density irregularities in the ionosphere. In the case of the Global Navigation Satellite System (GNSS) receivers, scintillation can cause cycle slips, degrade the positioning accuracy and, when severe enough, can even lead to a complete loss of signal lock. Thus, the required levels of availability, accuracy, integrity and reliability for the GNSS applications may not be met during scintillation occurrence; this poses a major threat to a large number of modern-day GNSS-based applications. The whole of Latin America, Brazil in particular, is located in one of the regions most affected by scintillations. These effects will be exacerbated during solar maxima, the next predicted for 2013. This paper presents initial results from a research work aimed to tackle ionospheric scintillation effects for GNSS users in Latin America. This research is a part of the CIGALA (Concept for Ionospheric Scintillation Mitigation for Professional GNSS in Latin America) project, co-funded by the EC Seventh Framework Program and supervised by the GNSS Supervisory Authority (GSA), which aims to develop and test ionospheric scintillation countermeasures to be implemented in multi-frequency, multi-constellation GNSS receivers. Univ Nottingham, Inst Engn Surveying & Space Geodesy, Nottingham NG7 2RD, England Ist Nazl Geofis & Vulcanol, I-00143 Rome, Italy Septentrio NV, B-3001 Louvain, Belgium Univ Estadual Paulista, Fac Ciencias & Tecnol, Dept Cartog, Presidente Prudente, SP, Brazil Polish Acad Sci, Space Res Ctr, PL-00716 Warsaw, Poland Univ Nova Gorica, Ctr Atmospher Res, SI-5000 Nova Gorica, Slovenia Pildo Consulting SL, Barcelona 08042, Spain Consultgel Consultoria Geomat Ltda, BR-19060370 Presidente Prudente, SP, Brazil Univ Estadual Paulista, Fac Ciencias & Tecnol, Dept Cartog, Presidente Prudente, SP, Brazil

The paper contains first results of the noise assessment of the new L2C signal, transmitted by PRN 17 and tracked by the PolaRx2C receiver. The tracking noise and multipath characteristics of L2C and CA codes are compared. In agreement with expectations, average amplitudes of multipath and tracking noise for the CA code and L2C are about equal. Assessment of signal power for the L2C signal is also presented.

International audience; We present a new procedure to describe the one-dimensional thermodynamical stateand mineralogy of any Earth-like planetary mantle, with Mars as an example. The modelparameters are directly related to expected results from a geophysical network mission, inthis case electromagnetic, geodetic, and seismological processed observationssupplemented with laboratory measurements. We describe the internal structure of theplanet in terms of a one-dimensional model depending on a set of eight parameters: for thecrust, the thickness and the mean density, for the mantle, the bulk volume fraction of iron,the olivine volume fraction, the pressure gradient, and the temperature profile, and for thecore, its mass and radius. Currently, available geophysical and geochemical knowledgeconstrains the range of the parameter values. In the present paper, we develop the forwardproblem and present the governing equations from which synthetic data are computedusing a set of parameter values. Among all Martian models fitting the currently availableknowledge, we select eight candidate models for which we compute synthetic networkscience data sets. The synergy between the three geophysical experiments ofelectromagnetic sounding, geodesy, and seismology is emphasized. The stochasticinversion of the synthetic data sets will be presented in a companion paper.