GRIDES. GSM-R Integrity Detection System

Transcription

1 GRIDES GSM-R Integrity Detection System

2 The Partners RFI, the Italian Infrastructure manager User Requirement definition and support for the track side test validation WISER Intecs SpA, a high tech company for the railway sector Sw and Hw GRIDES architecture definition, design and validation test WISER srl, a high-tech SME for COM/NAV technologies Software Defined Radio architecture, implementation, and testing, Univ. Pisa, Dipartimento di Ingegneria dell Informazione SDR detection algorithms 2

3 What is GRIDES? GRIDES is a research project funded by the EPCIP Programme of the European Commission - Directorate General Freedom, Security and Justice to demonstrate the feasibility of a network of a lowcost trackside and train borne sensors based on a technology called Software-Defined Radio (SDR). Those sensors analyze in real-time the entire GSM- R spectrum, to detect and classify interferences, and to provide early warnings alarms to the railway signalling system in case of (malicious) network disruptive radio attacks. 3

4 GRIDES - Field of application (ERTMS/ETCS) ERTMS Radio in tunnels Trackside-train radio GSM-R Train Running Control GSM-R Network Yard radio Works and maintenance Auxiliary services ERTMS L1 + R I ETCS ERTMS 2nd level Balise Track-circuits 4

5 GRIDES - Field of application (ERTMS/ETCS) ERTMS (European Railway Traffic Management System) is the new European railway signalling and management system, enabling interoperability throughout the European Rail Network. ERTMS is based on ETCS (European Train Control System), the new control and command system, and on GSM-R (GSM for Railway), the new radio system for voice and data communication ( MHz uplink, MHz downlink). On ERTMS Level 2 lines trackside signals are no more required and all train movement authorities are sent to the train by the command and control centres through the GSM-R radio channels. 5

6 GSMR SYSTEM GSMR is the wireless communication system adopted for ERTMS standard signaling system GSM-R frequencies MHz (Uplink) MHz (Downlink) 19 carrier frequencies NETWORK ARCHITECTURE SIMILAR to public GSM 6

7 WHY GRIDES? (1) The GSM-R network is a potential vulnerable access point for terrorist attacks being subject to interferences from external electro-magnetic sources and even if it is commonly assumed that a successful attack would cause few, if any, casualties, an attack to GSM-R network might result in loss of infrastructure service while control was wrested from the attacker and damage repaired (from a temporary loss of service to catastrophic infrastructure failure affecting multiple areas for an extended duration) GSM-R radio island in the Rome-Naples HS/HC line 7

8 WHY GRIDES? (2) GSM-R Risk ASSessment (GRASS) Risk assessment of potentially harmful intentional or accidental electromagnetic interference within the GSM-R band 1. Analysis of existing documentation and testing outputs 2. Localization (Public Database) and modeling of potential interferers: Public GSM, TV/Radio broadcast station, Radar Installations, 3. Verification via a GIS-based procedure of the Carrier/Interference ratio (C/I) along the track 4. Possible countermeasure: continuous monitoring of bands and/or receiver re-design GRIDES 5. Definition and Execution of Testing Plan (coming up) 8

9 GRIDES objective The main aim of the GRIDES system is basically to perform acquisition, processing and analysis of the radio signals in the GSM-R frequency bands and in proximity of one HS railway line. Both in uplink and downlink directions, the GRIDES surveillance network performs the functions of: acquiring signals within the GSM-R frequency bands; performing spectral analysis of the signals within the 200 KHzspaced 19 channels of the GSM-R system; detecting via digital signal processing (DSP) techniques the presence of GSM-R signal by scanning each occupied GSM-R channel; detecting via DSP techniques incidental radio interference sources transmitting within the GSM-R channels; for each channel, measuring via DSP techniques the SNIR (Signal to Noise+Interference) ratio. 9

10 The System GRIDES system is architected into two main elements: GSMR_REC, that is an SDR-based (Software Defined Radio) GSM-R receiver; GSMR_MOC, i.e. a remote monitoring centre. In its turn, the GSMR_REC will be implemented in two different configurations: GSMR_REC_OB - to be installed on board an HS train; BTS GSM-R conbts GSMR_REC_TS GSMR_REC_TS HS/HCTrain with GSMR_REC_OB GSMR_MOC GSMR_REC_TS GSM-R BTS BTS GSM-R con BTS BTS GSMR_REC_TS GSMR_REC_TS -tobe installed in proximity of an HS railway track. 10

11 Software-Defined Radio From Wikipedia: A Software-Defined Radio (SDR) system is a radio communication system where components that have typically been implemented in hardware (i.e. mixers, filters, amplifiers, modulators/demodulators, detectors. etc.) are instead implemented using software on a personal computer or other embedded computing devices. GPS GSM-R Antenna RF to IF and Digitization Real-Time Processing: demodulation, GSM-R PC detection, spectral anaylsis RF Analog/Digital Front-End USB 11

12 Features of an SDR Totally reconfigurable with no HW changes: upgrades and add-ons very easily implemented Can implement very complicated and advanced signal processing algorithms (only limited by phantasy) Ideal for special functions, very short development time Limited by the PC processing power Not suited for low-power, miniaturized devices Not suited to mass-market 12

13 The GSMR_REC can Monitor the entire spectral band assigned to GSM-R communications Provide 2 fully independent analysis chains for UPLINK and DOWNLINK spectra Process the acquired signal fully in real time. Which means: avoiding any snapshot + post process approach: GRIDES never stops watching the spectrum it is meant to oversee. Detect the presence of ANY UNAUTHORIZED SIGNAL within the GSM-R bands as well as identifying good authorized GSM-R signals Extract a complete report about the status and the relevant parameters of all the 38 GSM-R channels in less than one second. Instantly deliver Alarms to a remote monitoring centre via a TCP connection over IP network. with very low equipment cost. 13

14 Additional features of GSMR_REC Burst-by-burst SINR (Signal to Noise + Interference Ratio) estimation on valid GSM-R channels. Chrono referencing with millisecond precision GPS-based Geo referencing (for on-board version) Local and remote storage of human-readable and machinereadable reports (remote storage provided by MOC) Remote Sentinel administration and dynamic software loading possible through any (even low-bitrate) network connection via SSH ENCRYPTED session Linux-based SW with Open Source license Being developed: demodulation of data bursts 14

15 GSM-R Monitoring Center GSMR_MOC can store in a permanent way information received from a GSMR_REC_TS. monitor the GSM-R radio links with all configured GSMR_REC_TSs. highlight abnormal condition detected by at least one GSMR_REC_TS. 15

16 GSMR_REC CPU load and stability CPUs are never overloaded and parallel computation is exploited whenever possible Work RAM occupancy is constant. NO MEMORY LEAKS Network usage is regular and minimal: 532 Bytes per second (peak) 16

17 TEST SCENARIO Two prototypes were developed and tested for Track-Side (TS) and one for the On Board (OB) operating scenarios. The GRIDES software has been developed as a single bundle of integrated tools that are automatically enabled or disabled in order to fit the correct operating scenario whether it is On Board (OB) or Track-Side (TS). No Configuration Effort is required to the system user. The GSMR_MOC (i.e. the centralized monitoring centre) was developed and tested during OnField Test Session 17

18 Testing Outcomes (GSMR_REC) Page 18 A valid GSM-R Base Station Signal is visible at f khz and it is detected by the system as ACTIVE GSM- R on channel 5 DOWNLINK. Train Speed during this test was above 250 Km/h 18

19 Testing Outcomes (GSMR_REC) Page 19 Two valid GSM-R Signals are visible at f khz, f khz and correctly detected by the system as ACTIVE GSM-R on channels 14, 16 DOWNLINK. Train Speed during this test was 300 Km/h 19

20 Testing Outcomes (GSMR_MOC) GSMR_MOC highlights (in red) alarm received from active GSMR_REC_TS (in green) 20

21 Testing Outcomes (GSMR_MOC) GSMR_MOC shows (in red) GSMR_REC_TS links are broken 21

22 Results The GRIDES system has demostrated its capability to: capture the entire spectral band assigned to GSM-R communications; process the signal resulting from such acquisition by using two separated processing chains; process the acquired signal fully in real time; determine whether any of the GSM-R channels is correctly active, empty, acceptably interfered, or critically interfered; detect the presence of discontinuous, impulsive interferers; accurately estimate the SNIR of the signal that, from any of the receivable base stations, reaches the train; raise an early alarm for the local user in case potential dangers for communication on GSM-R channels are detected; instantly deliver Alarms to a remote monitornig center via a TCP/IP network; recognize even very weak and/or doppler/multipath-degraded GSM- R signals (e.g. from far away terminals or base stations); bear a low implementation cost. 22

23 Development and Perspectives 1/4: GRIDES on every train GRIDES is Time proof: as EM scenario changes over time, GRIDES keeps patrolling the GSM-R spectrum and reports anomalies as soon as an interfering transmitter is switched on... Switch ON DVB-T2 DVB-H DVB-NGH LTE GRIDES on-board USRP GPS t0 t1 t2 t3 time 23

24 Development and Perspectives 2/4: From GRIDES to GRID-NET A Wide-scale deployment hypothesis: Monitoring possible PHY-layer threats To RBC handover along 20 Km of Milano-Bologna HS/HC line Along the MI-BO line there are 2 RBC handover regions For any region is known RBC Handover region centre or RBC Handover point 5 GSM_REC_OB Sentinels, 4 Km spaced, placed along the line, equipped with active directional aerials 24

25 Development and Perspectives 3/4: Localization of Interference Challenging the Interferer: extend current GRIDES system by adding Interferer Signature Recognition, an interference classification algorithm that will enable sentinels to communicate to the MOC a unique identifier for each interferer received. RSS (Received Signal Strength) techniques will then enable the MOC to estimate the position of the actual interference source ((( INTERFERENCE SOURCE ))) Railroad Sentinel #1 Covered Area (Directive along track) Sentinel #2 Covered Area (Directive along track) 25

26 Development and Perspectives 4/4: ERTMS level3? Complete OnBoard Communication Integrity: Extend GRIDES system by adding GPS/GALILEO Signal Integrity monitoring capabilities Trackside monitoring GPS Signal Integrity 26

27 Future issues It is proposed that the Platform, via the GSM-R experts make a survey on the subject and reports at the next platform meeting how this matter is dealt with by railway administration in Europe 27

28 ... thanks for your attention. 28