armasuisse Science and Technology Electronic Attacks against FM, DAB Wissenschaft + Technologie and DVB-T based Passive Radar Systems Christof Schüpbach, D. W. O Hagan, S. Paine
Agenda Overview FM DAB DVB-T FM Noise jamming Tone jamming Role of direct signal cancellation Digital waveforms Attacking DAB using PRS Attacking DVB-T using pilots Conclusions 2
Work Overview Noise Jamming of an FM Band Commensal Radar M. Inggs, C. Tong, D. O Hagan, U. Böniger, U Siegenthaler, Ch. Schüpbach, and H Pratisto. In Radar Conference, 2015 IEEE, pages 493 498, Oct 2015. Jamming of DAB-based Passive Radar Systems Ch. Schüpbach, U. Böniger, 2016,, 2016 European Radar conference (EuRAD) Electronic Attacks on DVB-T-based Passive Radar Systems Ch. Schüpbach, D.W. O Hagan, S. Paine, 2018,, to be published in 2018 IEEE Radar Conference Ongoing work on FM and DVB-T2 counter measures 3
Work on FM based Systems Simulations using FERS for a typical scenario in Cape Town with real recorded signal of 3 min duration Jammer power ranging from 1 W to 10 W Different jamming waveforms Noise Tone on carrier Assessing detection rate from CFAR output Investigation of role of direct signal cancellation Measurement with UCT system and jammer close to receiver 4
Simulation Geometry Google Map overview of the system geometry and simulation geometry. This geometry corresponds with a receiver site that has been used for field measurements. 5
Simulation Parameters Item Antenna Azimuth Beam Pattern Antenna Gain Antenna Altitude (AMSL) ERP Carrier Frequency Waveform Antenna Azimuth Beam Pattern Transmitter Parameter Omnidirectional 2.15 dbi (Dipole) 400 m 10 kw 89 MHz Real recorded FM signal, 204.8 ksps complex sampled Receiver Sinc Antenna Gain Antenna HPBW Antenna Altitude (AMSL) LO Error Noise Figure Digitisation 7.2 dbi (Yagi) 60 degrees 240 m 50 ppd (std. dev. of 0.01 Hz @ 204.8 ksps) 4 db 204.8 ksps complex, 16 bit quantisation 6
Simulation Parameters Item Initial Altitude Final Altitude Velocity RCS @ 89 MHz Swerling Antenna Azimuth Beam Pattern Antenna Gain Transmit Power Carrier Frequency Waveform Target Jammer Parameter 10 000 m 5 000 m Constant 200 m/s 23 dbsqm (200 m 2, a large airliner) 0 (Non-fluctuating) Sinc 7.2 dbi (Yagi) 1 W to 10 W before antenna gain 89 MHz Gaussian Noise, Single Tone 7
Used Waveforms No jamming 5W noise 5 W tone 8
Direct signal cancellation effects No Jamming Jamming Reference Clean Surveillance Jamming Surveillance Clean Reference (Pd = 29%) Jamming in Reference & Surveillance (Pd = 44%) 9
Tone Jamming CFAR Output Accumulative CFAR output of the single tone jamming simulation. When the CFAR is applied in the Doppler dimension, no target is detected. Accumulative CFAR output with the CFAR applied in the range dimension rather than the conventional Doppler dimension. The target is now detected 14 times (31% detection). 10
Work on DAB and DVB-T Idea: use deterministic parts of signal for attack DAB: phase reference symbol DVB-T: pilot tones Advantages Processing gain Localized effects in range Doppler map Various attack strategies possible Jamming Spoofing Overloading Knowledge of receiver position not necessary for selfprotection jamming 11
Methodology Recorded signals Construct perfect reference by de- and re-modulation Inject (add) jamming signal into surveillance channel Calculate range Doppler map using inverse filtering Assess effect on range Doppler map Synthesize jamming signal 12
DAB 13
DAB frame and symbol structure Frame duration: 96 ms / 76 OFDM symbols (excl. null symbol) PRS PRS Data Symbols null symbol: 1.3ms phase reference symbol (PRS): 1.25ms 75 data symbols: 95 ms 14
Effect on the ARD map Slow Time Delay Slow Time Doppler ST-DFT Delay Slow Time ST-DFT Doppler Doppler Amplitude Amplitude Amplitude Amplitude 15
Results Continuous noise PRS same delay PRS different delays 16
Results with real data Real data (no jamming) Real data with PRS jamming (same delay) 17
DVB-T 18
DVB-T Pilot Structure Synchronization & channel equalization: 701 pilot tones Division into 177 continual and 524 scattered pilots Pre-defined temporal pattern and modulation value 19
Pilot Self-Ambiguity Periodic pattern of pilots lead to strong auto-correlation Periodic patterns in delay and Doppler Main idea: Exploit this for electronic attacks 20
Undisturbed Range-Doppler Map SFN at 562 MHz Dynamic range: 85 db 21
Full Pilot Attack Jamming signal contains all pilots (continual and scattered) Doppler shift: 160 Hz Delay: 65 µs JSR = 0 db 22
Full Pilot Attack II Peaks: -10 db Ridges: - 40 db At JSR= -45 db: JNR = 30 db 23
Pulse Pilot Jamming General principle: Pulsing in frequency pulsing in range Pulsing in time pulsing in Doppler «Pulsing» in frequency is given by choice of pilot carriers BUT: pulsing in time can easily be done by an attacker Options: Turn off every k-th symbol Only turn on every k-th symbol 24
Pulse Jamming I JSR = 0 db Off every 13th symbol Multiplication of pulse period and pilot period (4x13 = 52) 25
Pulse Jamming II Extreme case: only one symbol is jammed per CPI One spike in slow-time ridges in Doppler domain 26
Pulse Jamming III JSR = 0 db Ridges for targeted delay at -65 db Attractive for self-protection jamming 27
Counter Counter Measures? Do not use deterministic parts of signal for radar processing loss in processing gain Look for patterns in range Doppler map to discard false targets Spatially notch jammer (once detected) Use direct signal cancellation stage to suppress jammer Localize jammer by its own transmission But: Before any of these you have to become aware of the attack! 28
Summary and Conclusion FM jamming simulations for different waveforms Role of direct signal canellation Deterministic parts of digital signals offer attack points to Jam Spoof Overload Even if PR location is unknown self-protection jamming can be achieved Once aware, the PR system can counteract Most important from PR perspective: secrecy of location 29
Thank you! 30