Why secure GPS receivers are crucial for GNSS/INS systems?

With the growth of automation and robotization in many industries, from agriculture and delivery drones to self-driving cars, the demand for accurate and affordable navigation is on the rise. When selecting a GPS/GNSS* positioning receiver it is crucial to understand vulnerabilities of these sensors and the effect they could have on the navigation system. For robots and autonomous devices availability is key to ensuring continuous and reliable service. Safety also needs to be considered for robots and drones operating close to people. GNSS jamming or spoofing needs to be detected and flagged immediately so that other sensors can take over.  

For more information, please visit our website.

Most autonomous navigation technologies include an Inertial Navigation System (INS), which consists of a GNSS receiver and an IMU sensor. While the GNSS receiver provides absolute positioning in terms of geographic global coordinates, the IMU (Inertial Measurement Unit) measures heading, pitch and roll angles which give orientation information of a moving system.  

Spoofing is a real threat to GNSS-based INS systems, which is mitigated most effectively by incorporating security mechanisms into all system sub-components. However, since spoofing takes place on the level of the GNSS signal, a number of sophisticated methods can be employed within the receiver to detect and mitigate spoofing. Receivers which are designed with security and robustness in mind, are resilient to GNSS vulnerabilities such as jamming and spoofing. Taking advantage of such robust GNSS technology is also cost effective, allowing companies to focus their development on sensor fusion and navigation.  

Jamming and spoofing are real  

Jamming is a kind of radio interference, which overpowers weak GNSS signals, causing accuracy degradation and possibly even loss of positioning. Unintentional jamming sources include radio amateurs, maritime and aeronautical radiolocation systems as well as electronic devices located close to the GNSS receiver. There are also intentional jamming devices called “jammers”, which are sometimes found on board of vehicles trying to avoid road tolling.  

Spoofing is an intelligent form of interference which makes the receiver believe it is at a false location. Spoofing has appeared in the news in a spectacular experiment where a Tesla car was “misled” to take an exit from a highway rather than following the highway as it was supposed to [1]. Consequently, both jamming and spoofing can have an adverse effect on INS systems, which make use of GNSS positioning. For more information on spoofing see OSNMA: the latest in GNSS anti-spoofing security. 

How can INS get jammed and spoofed? 

While GNSS provides absolute positioning, the IMU measures relative movement, which is subject to cumulative error called drift and needs regular “recalibration”. In a GNSS/INS system both sensors are fused in such a way that the GNSS provides regular IMU “calibration” and the IMU provides angles and extrapolation or “smoothing” of GNSS.  

Jamming, which results in loss of positioning, means that the GNSS receiver can no longer be used as part of the INS solution. This can lead to longer INS initialization times or a switch to dead-reckoning mode (IMU solution only), where the position would start to drift. Jamming can also result in measurement outliers, which impact GNSS/INS algorithms (ie. deep or tight coupling). However, it is spoofing which poses the highest security risk for GNSS/INS systems. During a spoofing attack an INS solution could be “hijacked” if the spoofer uses small increments in positioning, which can go undetected by common anti-spoofing methods.  

Vulnerability of the common INS anti-spoofing method  

Using sensors other than GNSS such as an IMU or odometry can help flag spoofing by detecting inconsistencies between GNSS and the other sensors. While such sensors help reduce spoofing risks, they are not sufficient to provide full protection because they only output relative positioning which is subject to drift. For example, the GNSS/INS systems can have a drift of a meter or more when visibility of GNSS satellites is lost for longer periods.  Spoofers can exploit this drift phenomenon to hijack positioning gradually, in increments comparable to the expected drift.  

The diagram below demonstrates a common mechanism used by GNSS/INS systems to detect spoofing. The system is initialized and starts receiving new GNSS, IMU and/or odometry data, which is continuously checked for consistency.  

Protection against GNSS spoofing

Introduction:

With the introduction of Maxwell™ 7 technology, Trimble has added several technical innovations that improve the performance of its receivers. This technical bulletin provides an overview of how Trimble receivers provide protection from the increasing threat of false GNSS signals. These false or spoofed signals could potentially result in a receiver calculating positions in error by many kilometers. This is not to be confused with jamming, which also disrupts positioning by transmitting strong undesired signals that overload the GNSS receiver’s RF or signal processing. However in the jamming scenario, while the receiver has difficulty calculating a position, it will generally not be in the wrong location. A separate technical bulletin will describe how Trimble Maxwell™ 7 technology helps overcome GNSS jamming signals.

What is GNSS spoofing?

GNSS receivers track low-power signals transmitted from satellites. With the availability of low- cost programmable radios, it is now possible to develop a transmitter that will broadcast a spoofing signal that a receiver will use instead of the true signal. Depending on the sophistication of the spoofer, this can cause various positioning and timing errors. Although Trimble is not seeing spoofing in its high-precision applications today, such activities may increase in the coming years.

Goto California Triangle to know more.

What is Trimble doing about GNSS spoofing?

Trimble receivers that incorporate Maxwell™ 7 technology include a number of features to protect from spoofing. Maxwell 7 technology is based around Trimble’s next-generation ASIC, RF and processor developments. The technology provides robust precision positioning by fusing all GNSS constellation signals with additional sensor data. The defense against spoofing is currently handled at the following levels:

Rejection of spoofed signals in the Digital Signal Processing (DSP)

Advanced tracking algorithms detect if multiple signals are received for each satellite and ensure only the true signal is tracked. The spoofed signal generally shows as a stronger secondary correlation peak, which the tracking channel isolates and rejects from reaching the positioning algorithm.

Satellite data checking

By keeping a historical record of the orbital parameters transmitted by each satellite, Trimble can detect if these change unexpectedly or fall outside reasonable bounds. Trimble Maxwell™ 7 Technology can also cross-check orbital data from multiple sources (e.g for GPS L1 LNAV is compared to L2C and L5 CNAV).

Receiver autonomous integrity monitoring (RAIM)

With more measurements than unknowns, the receiver has the ability to detect measurements that do not fit into the positioning solution. Newly tracked satellites that fail this test are put through additional tests before inclusion while existing satellites are immediately removed from the solution. RAIM is also calculated between GNSS constellations with complete systems being rejected, if necessary. This assumes a simplistic spoofing event where a subset of constellations are affected. For example, if only GPS is spoofed, then by calculating multiple position solutions from subsets of measurements from GLONASS, BeiDou, Galileo, QZSS, NavIC and SBAS, the GNSS receiver can determine confidence that the GPS measurements need to be removed.

Position sanity checks

If the receiver detects positions have jumped by an unrealistic amount since the last computed position, this is also a valuable indicator of spoofing.

Limiting satellite search window

Utilizing recent tracking information, the GNSS receiver will limit the search window for reacquiring satellites.

Conclusions:

For more information, please visit GNSS jamming and spoofing probe.