Resilient Position, Navigation and Timing Ignacio Fernández Hernández ITSNT Toulouse, 17 Nov 2017 ESA/CNES/ARIANESPACE-Service Optique CSG, S. Martin
RESILIENT POSITION, NAVIGATION AND TIMING GNSS Interference Threats Nomenclature and Framework Countermeasures 2
RESILIENT POSITION, NAVIGATION AND TIMING 3 Recent example of "collateral jamming": someone parked his car in an airport and took a flight. He left an L1 jammer switched on in the car.
RESILIENT POSITION, NAVIGATION AND TIMING GNSS Interference Threats Threat Nomenclature and Framework Countermeasures 4
GNSS RFI THREATS STRIKE3: GSA H2020 project to measure RFI threats worldwide. It has deployed an extensive monitoring network and has developed an extensive database of RF interference information. Infrastructures Major City Centres City-ring roads National timing labs Motorways/Road network Airports GNSS infrastructures Power stations Railway EU Borders Ports Countries involved United Kingdom Sweden Finland Germany France Poland Czech Republic Spain Slovakia Slovenia Netherlands Belgium Croatia Latvia New Zealand Canada US (in discussions) India Vietnam Thailand Malaysia Singapore (in discussions) Japan (in discussions)
GNSS RFI THREATS Monitoring during 21 months (Feb'16 to Oct'17) found 247.000 events Most were low power, short duration, wideband interference events. No impact. However, around 30.000 were chirp interference from PPD/jammers. Pattern follows working week/hours. No doubt that man-made interference! 6
GNSS RFI THREATS Most are short, low-power events 7
GNSS RFI THREATS Some waveforms can be matched to jammer type/models 8
GNSS RFI THREATS New Jammers are emerging 9 Simple Rules to support validation It has a structure (it is deliberate, purposeful) It is mobile (exhibits same power profile as a jammer) It is seen multiple times (avoids being a one-off rogue signal ) It is seen at multiple sites (demonstrates a distributed product)
JAMMING IMPACT IN POSITION 10
More information at www.gnssstrike3.eu 11
OTHER RFI THREATS Sophisticated jammers 12
OTHER RFI THREATS Repeaters (potential) Errant Signals Spoofers: simulators/reradiators? 13 13
RFI THREATS: ADJACENT BAND COMPATIBILITY ASSESSMENT (US DOT) GNSS threats can come from adjacent bands Effort Led By DOT/OST-R/Volpe Center, to identify adjacent band transmit power levels that can be tolerated by civil GNSS receivers GNSS Receiver and Antenna Testing, with 1 db Interference Tolerance Masks (ITMs) 80 receivers were tested representing six categories of GPS/GNSS receivers: General Aviation (non certified), General Location/Navigation, High Precision & Networks, Timing, Space Based, and Cellular 14
RFI THREATS: ADJACENT BAND COMPATIBILITY ASSESSMENT Summary of 1&10 MHz and in-band with certified aviation bounding masks GPS L1 C/A 15 GAV = Gral. Aviation; GLN = Gral. Location; HPR= High Precision; TIM = Timing; SPB = space-based; CEL = Cell Phone 10
RESILIENT POSITION, NAVIGATION AND TIMING GNSS Interference Threats Nomenclature and framework Countermeasures 16
NOMENCLATURE AND FRAMEWORK: THE PROBLEM How to harmonize countermeasures, and against what? Currently no uniform nomenclature and threat classification. Many references propose different nomenclature and classification. Some examples: Wideband vs. Narrowband. P. Ward et al, "Understanding GPS/GNSS Principles and Applications "- Kaplan, Hegarty (eds) 3ed: T. Statistical dependency vs. independence from GNSS, T. Humphreys, "Handbood of Global Navigation Satellite Systems", P. Teunissen, O. Montenbruck (eds)". Other classifications and definitions: intentional vs. non-intentional; jamming vs. spoofing; spoofing vs. meaconing, "smart jamming" 17 Recent EU-US cooperation to propose Nomenclature, Threat classification, Treatment and Countermeasures, in the frame of aviation but extrapolated to terrestrial apps,
NOMENCLATURE AND FRAMEWORK The International Telecommunication Union (ITU) Radio Regulations (Art I, Sect VII) [24] define interference as "The effect of unwanted energy due to one or a combination of emissions, radiations, or inductions upon reception in a radiocommunication system, manifested by any performance degradation, misinterpretation, or loss of information which could be extracted in the absence of such unwanted energy". Intentional vs. unintentional division unclear. E.g.: PPDs: e.g. intentional interference but no intention to jam aircraft GPS repeater, errant signal: no intention to spoof, but same effect. 18 Proposed terms Collateral: Protected receiver is not the intended victim of the signal Targeted: Protected receiver is being specifically attacked
NOMENCLATURE AND FRAMEWORK Harmful Interference Threat Types (Jamming, Spoofing) and Categories (J1-J4, S1-S7) Jamming denotes in-band emissions that do not mimic GNSS signals, and therefore interfere only with the ability to acquire and track GNSS signals. Spoofing denotes in-band emissions of GNSS-like signals that may be acquired and tracked instead of the intended signals. jamming threats will a priori lead to a denial of service, and therefore affect only continuity/availability, while spoofing threats can lead to an integrity failure. but only after countermeasures are implemented. Jamming J1 - Collateral Jammers J2 - High Power Interferers J3 - Targeted Jammers J4 - Targeted Sophisticated Jammers Spoofing S1 Repeaters S2 Errant signals S3 - Collateral Spoofers Simulators S4 - Collateral Spoofers Re-radiators S5 -Targeted Spoofers Simulators S6 -Targeted Spoofers Re-radiators S7 - Targeted Sophisticated Spoofers 19
RESILIENT POSITION, NAVIGATION AND TIMING GNSS Interference Threats Nomenclature and framework Countermeasures 20
COUNTERMEASURES Preliminary list of countermeasures, based on U.S. GIIST and other references Several examples proposed in yesterday 's resilient PNT session: VLLs, IMU, SQM, multiantenna Multi-Antenna Masking AGC Filtering CN0 P. Blanking Notch filter Peak Mon. Rover Ch. Antireplay (SCER Det. SCA/SSSC ) Consistency Checks: measmt, PVTF, RAIM/FDE NMA INS Indep. Clock Operational procs. Other systems 21
GALILEO SIGNAL-LEVEL COUNTERMEASURES Widest band GNSS signal Spreading Code Encryption, E6(C), CS Navigation Message Authentication (E1, OS) Spreading Code Encryption (PRS, Governmental) 22
GALILEO NMA PRELIMINARY TEST RESULTS - URBAN 23
COUNTERMEASURES Possible combination of several RFFE, SP and navigation protection measures (conceptual figure) Assumption: receiver already tracks a valid signal AGC&CN0 NMA Data Signal Antireplay Peak Mon. Meas. Consistency Measurements Rover channel PVT PVTF checks RAIM, FDE 24
CONCLUSIONS More RFI than expected or reported (1/4 mln over 30 stations, <2 years, STRIKE3). Most are low-power, wideband (white noise-like) short events. GNSS tolerate them. More jamming events than expected (30000!), and more types than expected: bandwidths, centre frequencies, chirp rates, power levels, waveforms. Jamming can result in no loss, total loss, or degradation of PVT. Other less frequent or emerging or threats to be taken into account: sophisticated jammers, adjacent band transmission, GNSS repeaters, "errant signals", spoofers 25
CONCLUSIONS A threat framework under development (for aviation and beyond), primarily based on the effect in the receiver, and dividing threats into jamming/spoofing, and introducing terms as "collateral"/"targeted". Countermeasures possible and under study at all levels: GNSS signal, antenna, RFFE, SP, PVT, platform, and operation. 26
GNSS RFI THREATS 27
GNSS RFI THREATS Jamming event: Nantes Airport (FR), 21st April 2017 Flight departures perturbed. Delays >1h Civil Aviation complains to ANFR (France's National Spectrum Agency) A team of ANFR, accompanied by Air and Border Police officers, identifies the source of interference and deactivates the jammer, within a few hours. 28
GNSS RFI THREATS The offender is summoned to Court in Aug'17, in front of Civil Aviation (complainant) and ANFR (expert). Offender condemned to 2000 EUR fine+ 450 EUR administrative tax, on top of fees (and jammer confiscation). French law punishes up to 30.000 EUR and 6-month imprisonment.
THANK YOU 30 Thanksto:STRIKE3-M.Dumville(NSL),C.Gabay(ANFR),M.Pölöskey(ARIC),J.Reyes(GSA); AALECS project; T. Walter, S. Lo, K. van Dyke