GNSS Threats at Airports and detecting them Guy Buesnel, Romain Zimmermann, October 2017
Overview of Spirent Positioning and Timing Mobile Devices Military Applications Commercial Air Travel Automotive Space Rail Survey PROPRIETARY AND CONFIDENTIAL 2
Real world threats to GNSS Impacting Time and Position Image courtesy Quora 3
The spread of GNSS jamming
GNSS jamming Real world reports Commercial Aviation Over 100 incidents of GPS jamming reported by pilots through NASA s Aviation Safety Reporting System (ASRS) since 2013 Unknown location, USA; The GPS signal briefly went away..within 30 seconds everything was normal again..gps loss seemed an illusion. ATC said no one else has reported an outage so I wondered if I had encountered a trucker with a GPS jammer on a highway or similar. So I continued - into the rain, clouds and turbulence Then all hell broke loose; GPS signal failure, ADSB failure, multiple cascading messages on the GTN. Fresno Yosemite airport; The aircraft appeared to turn toward the waypoint however ATC asked us if we were turning toward FRAME yet. At that point it appeared the GPS had lost position and we declared a lost signal to ATC and asked for vectors. We were not able to regain accuracy with the GPS and navigated on vectors and VOR tracking for the remainder of the trip. RPLL (Manila). Complete GPS loss of signal as we crossed the coast in point to RPLL (Manila). Signal was lost for remainder of flight. Also on takeoff from RPLL we had a complete loss of GPS signal until coast out. No notice on NOTAMs viewed. No notices on RPLL ATIS. Moscow FIR, Russia;, South of Moscow and a few minutes south of AMUTI both GPS dropped offline. It took the jet a few minutes for us to see "unable RNP" Oct 2017 Reports of GPS jamming in Norway: Widerøe says to NRK that their aircraft experienced the GPS signal falling out between Kirkenes and Berlevåg from 7 September. According to Avinor, disturbances are reported to West west to Alta Telecoms Complaint from a cell provider in Florida that its cell phone tower sites had been experiencing interference: Forfeiture Order affirms proposed $48,000 forfeiture against a man for using a cell phone signal jammer in his car while commuting to and from work on a Florida highway over a 16-24 month period (Source COPUOS Scientific 5 and Technical Subcommittee Meeting presentation, Feb 2017)
GNSS jamming Detection in the real world Spirent Paignton, UK German Airport Spirent San Jose, US JAPAN Spirent has seen over 15000 GPS L1 interference events since fielding sensors in 2015 Our interest is in the characterization and replay of threat waveforms in a simulated environment (impact assessment)
Intentional Jamming RFI Event #2.2 Location Time Duration (sec) Near a motorway in CA, USA 00:56, 5 Apr. 2016 16 Classification Pulsed Chirp Saw Tooth Up Potential Source Intentional Jammer 7
Airport in Europe. Detected GPS interference event Correlation with ICAO Mask breach 8
Interference detection use case GNSS interference in port Unsure there is significant RFI close to port infrastructure and whether there is potential for it to disrupt normal operation Need to build up quantifiable evidence/database of events 9
Interferences in GNSS How can we protect systems from interference? Understanding your RF environment is fundamental Monitoring the GNSS signal environment is the first step Directional detectors may not be the best solution: For Law enforcement, can be used to catch offenders (with right resources) Jammer localisation will never eliminate GNSS jammers understanding your exposure to them is more likely to yield results Understanding the resilience of a GPS-based system to interference is essential Testing is not easy - OTA testing very difficult ( permissions, logistics ) Needs real-world threat scenarios tested in controlled environment Quantitative data is required to make decisions 10
A GNSS interference detector architecture System Overview Standalone operation Automatic Detection Automatic Upload to PT Cloud RF Cable Antenna Spirent GSS200D Probe RFI data does not have to be shared with cloud data could be collected and stored locally Effective antenna range normally about 500m for small cigarette lighter type jammers USB Peripherals Configuration and calibration Enterprise LAN Real time alerts Comprehensive statistical analysis of events Characterisation Jammer fingerprinting Private data server (Provided by Spirent) 11
GNSS interference data analysis Event view: Spectrum Spectrogram Type of interference Priority UTC timestamp and duration Power info Analytics for trend analysis 12
Evaluating robustness a top level approach Risk Assessment Implement mitigation strategy Characterisation of environment derive requirements for operation in degraded/denied GNSS (Real world threat test of systems and devices) Notifications/Alerts Identification problem areas Monitoring assurance Provision of real time threat info to operators and regulators 13
Spirent Insights We are noting the trend of increasing GNSS-related incidents that are causing significant impact Spirent believe that there is a need to responsibly create awareness in many application segments We are concerned at the lack of improved robustness in devices and systems (manufacturers and integrators) We are working with Cranfield University (Aviation Security) and University of Warwick Manufacturing Group (looking at ground based connected autonomous vehicles) Spirent are happy to work with industry to promote improved awareness and understanding of the relevant risks 14
Trust but Verify.. guy.buesnel@spirent.com http://www.spirent.com/solutions/robust-pnt Join the GNSS Vulnerabilities group on LinkedIn to find out more about GNSS jamming and spoofing the discussion