GNSS Spoofer Localization for Vehicles Based on Doppler and Clock Drift Double Difference

During the past few decades, the presence of global navigation satellite systems (GNSSs) such as GPS, GLONASS, Beidou and Galileo has facilitated positioning, navigation and timing (PNT) for various outdoor applications. With the rapid increase in the number of orbiting satellites per GNSS, enhancements in the satellite-based augmentation systems (SBASs) such as EGNOS and WAAS, as well as commissioning new GNSS constellations, the PNT capabilities are maximized to reach new frontiers. Additionally, the recent developments in precise point positioning (PPP) and real time kinematic (RTK) algorithms have provided more feasibility to carrier-phase precision positioning solutions up to the third-dimensional localization. With the rapid growth of internet of things (IoT) applications, seamless navigation becomes very crucial for numerous PNT dependent applications especially in sensitive fields such as safety and industrial applications. Throughout the years, GNSSs have maintained sufficiently acceptable performance in PNT, in RTK and PPP applications however GNSS experienced major challenges in some complicated signal environments. In many scenarios, GNSS signal suffers deterioration due to multipath fading and attenuation in densely obscured environments that comprise stout obstructions. Recently, there has been a growing demand e.g. in the autonomous-things domain in adopting reliable systems that accurately estimate position, velocity and time (PVT) observables. Such demand in many applications also facilitates the retrieval of information about the six degrees of freedom (6-DOF - x, y, z, roll, pitch, and heading) movements of the target anchors. Numerous modern applications are regarded as beneficiaries of precise PNT solutions such as the unmanned aerial vehicles (UAV), the automatic guided vehicles (AGV) and the intelligent transportation system (ITS). Hence, multi-sensor fusion technology has become very vital in seamless navigation systems owing to its complementary capabilities to GNSSs. Fusion-based positioning in multi-sensor technology comprises the use of multiple sensors measurements for further refinement in addition to the primary GNSS, which results in high precision and less erroneous localization. Inertial navigation systems (INSs) and their inertial measurement units (IMUs) are the most commonly used technologies for augmenting GNSS in multi-sensor integrated systems. In this article, we survey the most recent literature on multi-sensor GNSS technology for seamless navigation. We provide an overall perspective for the advantages, the challenges and the recent developments of the fusion-based GNSS navigation realm as well as analyze the gap between scientific advances and commercial offerings. INS/GNSS and IMU/GNSS systems have proven to be very reliable in GNSS-denied environments where satellite signal degradation is at its peak, that is why both integrated systems are very abundant in the relevant literature. In addition, the light detection and ranging (LiDAR) systems are widely adopted in the literature for its capability to provide 6-DOF to mobile vehicles and autonomous robots. LiDARs are very accurate systems however they are not suitable for low-cost positioning due to the expensive initial costs. Moreover, several other techniques from the radio frequency (RF) spectrum are utilized as multi-sensor systems such as cellular networks, WiFi, ultra-wideband (UWB) and Bluetooth. The cellular-based systems are very suitable for outdoor navigation applications while WiFi-based, UWB-based and Bluetooth-based systems are efficient in indoor positioning systems (IPS). However, to achieve reliable PVT estimations in multi-sensor GNSS navigation, optimal algorithms should be developed to mitigate the estimation errors resulting from non-line-of-sight (NLOS) GNSS situations. Examples of the most commonly used algorithms for trilateration-based positioning are Kalman filters, weighted least square (WLS), particle filters (PF) and many other hybrid algorithms by mixing one or more algorithms together. In this paper, the reviewed articles under study and comparison are presented by highlighting their motivation, the methodology of implementation, the modelling utilized and the performed experiments. Then they are assessed with respect to the published results focusing on achieved accuracy, robustness and overall implementation cost-benefits as performance metrics. Our summarizing survey assesses the most promising, highly ranked and recent articles that comprise insights into the future of GNSS technology with multi-sensor fusion technique.

Currently Global Navigation Satellite Systems (GNSS) are the primary source for the determination of absolute position, velocity and time (PVT) for merchant vessel navigation. On a ship bridge a number of systems like Electronic Chart and Information Systems (ECDIS), automatic track control systems and the Automatic Identification System (AIS) are relying on that PVT provision. Nevertheless it is well known that GNSS performance can strongly degrade due to space weather events, jamming and spoofing. Especially the availability and usage of low cost jammers, so called personal privacy devices (PPD), lead to the question on how a continuous onboard provision of PVT data can be realized in the presence of such a PPD jammer. Generally three possible solutions for that challenge are contemplated: i) the usage of a terrestrial backup system, ii) a jamming resistant GNSS receiver or iii) the integration of GNSS with other onboard self-contained navigation sensors like, e.g. speed log, gyrocompass and inertial sensors (Inertial Measurement Unit - IMU). The paper will focus on option (iii) and addresses the question whether it is possible to bridge real maritime GNSS Jamming attacks by a Kalman Filter (KF) using GNSS, inertial and Doppler velocity log (DVL). The main challenge for the KF here is, that a free inertial integration needs to be performed after a time period with already degraded GNSS signal reception. As KF are known to be optimum estimators only under the assumption of known statistics of the measurements, the question arises, whether the pseudoranges under the influence of jamming still follow a certain statistics. In order answer this question an additional lab experiment was performed and analyzed. Concretely the sensor fusion was realized by using both loosely and tightly coupled architectures which have been implemented using an Unscented Kalman Filter (UKF). The fusion algorithm is formulated in ECEF coordinate frame with quaternion attitude parameterization, where the heading observability is addressed by fusing the baseline measurements from the GNSS compass. In order to evaluate the performance of the proposed sensor fusion scheme under the influence of a real maritime jamming attack we performed an experiment in our civilian maritime jamming testbed in the Baltic, which has been established together with the German Federal Network Agency approximately 6 nmi north of the peninsula Dars. Here a PPD jammer was mounted on the monkey deck of an anchored vessel. A test vessel was maneuvering around the jammer. As a test vessel the multipurpose research and diving vessel Baltic Diver II (length 29 m, beam 6.7 m and draught 2.8 m) was used, which was equipped with three dual frequency GNSS receivers, a fiber-optic gyroscope IMU and a Doppler velocity log. The obtained results confirm that real maritime jamming attacks using PPD Jammers can be bridged by the proposed tightly coupled GNSS-IMU-DVL integration scheme resulting in horizontal position errors of less than 10m only.

The Global Navigation Satellite Systems (GNSS) applications are growing and more pervasive in the modern society. The presence of multi-constellation GNSS receivers able to use signals coming from different systems like the american Global Positioning System (GPS), the european Galileo, the Chinese Beidou and the russian GLONASS, permits to have more accuracy in position solution. All the receivers provide always more reliable solution but it is important to monitor the possible presence of problems in the position computation. These problems could be caused by the presence of impairments given by unintentional sources like multipath generated by the environment or intentional sources like spoofing attacks. In this thesis we focus on design algorithms at signal processing level used to assist Integrity operations in terms of Fault Detection and Exclusion (FDE). These are standalone algorithms all implemented in a software receiver without using external information. The first step was the creation of a detector for correlation distortion due to the multipath with his limitations. Once the detection is performed a quality index for the signal is computed and a decision about the exclusion of a specific Satellite Vehicle (SV) is taken. The exclusion could be not feasible so an alternative approach could be the inflation of the variance of the error models used in the position computation. The quality signal can be even used for spoofinng applications and a novel mitigation technique is developed and presented. In addition, the mitigation of the multipath can be reached at pseudoranges level by using new method to compute the position solution. The main contributions of this thesis are: the development of a multipath, or more in general, impairments detector at signal processing level; the creation of an index to measure the quality of a signal based on the detector's output; the description of a novel signal processing method for detection and mitigation of spoofing effects, based on the use of linear regression algorithms; An alternative method to compute the Position Velocity and Time (PVT) solution by using different well known algorithms in order to mitigate the effects of the multipath on the position domain.

Aiming at fabricating a false positioning solution towards the victim user, spoofing attacks are nowadays challenging the security of Global Navigation Satellite Systems (GNSS). Due to the relative motion between the spoofer and victim user, the potential inconsistency involved in the measurement of Doppler shift could be an efficient basis to reveal the attacks. Although several researches on anti-spoofing techniques via measured Doppler have been developed, weaknesses in terms of implementation complexity and strict assumptions such as single-antenna spoofing still remain. To this end, Doppler Residual Monitoring (DRM) is proposed and investigated in this paper as a novel anti-spoofing scheme. Firstly, caused by the presence of the spoofing attacks, abnormal bias within the measured Doppler shifts is demonstrated based on the modeling of GNSS spoofing. Due to the difficulty in directly observing the Doppler bias concealed in the counterfeit signal, Doppler positioning technique is exploited to reveal this part of the variation in an indirect way. In particular, Doppler residual provided by Doppler positioning equations is proposed and the relationship between Doppler bias and Doppler residual is illustrated. More specifically, Sum of Squares of Errors (SSE), which denotes the sum of squares of Doppler residual, is utilized as the test statistics for spoofing detection. To further distinguish all the counterfeit signals, a random traversal technique is investigated in this paper. Moreover, Doppler Shift Difference (DSD) is proposed to match the spoofing signals with its transmitting antenna based on the discrimination results, which could be an essential basis for the anti-spoofing techniques towards multi-antenna spoofing scenario. Also provided is the analysis of the theoretical performance along with the simulation results. Finally, the validity of our method is demonstrated through field tests with two spoofing scenarios, where the spoofing attacks are respectively achieved by one antenna and two antennas. Without external facilities assistance, our DRM-based scheme could be a significant complement to the GNSS anti-spoofing techniques as a novel spoofing discrimination method.

The spoofing attack is a well known threat for global navigation satellite systems (GNSSs), where a malicious entity forges fake GNSS signals in order to trick a victim receiver into computing the desired false position and time. Only in recent years the interest in anti-spoofing techniques has been extended to mobile-device applications. As location-based services (LBS) are now deeply integrated in billions of people’s everyday life, the security of positioning in mobile phones has become a concern. Indeed, it has been proven that even modern smartphones are vulnerable to position and time spoofing attacks. Previous studies have shown that current smartphones perform little or no cross-check on GNSS positioning, about the navigation message correctness, or the consistency of the obtained position estimate with data from other sensors that may be available on the same device. In this paper, as a response to the spoofing threat, we develop a novel technique that checks the consistency between the position estimates obtained by GNSS and data relative to the neighbouring cell. For the latter estimate we propose two solutions: one is based on the position of the base stations and the other directly on the smartphone position estimated from the cellular network. We also implement the proposed techniques in an Android application and test its effectiveness in detecting spoofing attacks and giving a warning to the user.

Global Navigation Satellite Systems (GNSS) rely on one-way signal travel time measurements from satellites to receivers. To ensure accurate ranging, GNSS must estimate and compensate for clock offsets on at least one end of the transmitter-receiver system. Consequently, clock offsets are highly correlated with GNSS-derived parameters such as station coordinates, tropospheric delay estimates, satellite radial orbit parameters, and apparent geocenter coordinates. Improper handling of clock offsets can lead to their absorption into these parameters, degrading geodetic product accuracy. Traditionally, clocks have been handled within individual techniques without being specially addressed. However, some research efforts and experimental trials have explored using VLBI to synchronize clocks for GNSS and refining clock models to reduce correlations with other estimated parameters in GNSS, thereby improving overall precision.With recent advancements, high-precision optical clocks and fiber-optic time transfer technologies provide new possibilities for enhancing clock synchronization in GNSS. Optical fiber offers a stable, interference-free medium for time and frequency transfer, eliminating atmospheric effects such as ionospheric and tropospheric delays that impact GNSS-based synchronization. Moreover, fiber-optic time transfer is inherently two-way, removing the need for external clock offset estimation. Thus, fiber-optic clock synchronization represents the most precise timing technique currently available. Establishing a common clock by connecting multiple GNSS receivers via optical fiber could significantly reduce the number of estimated clock parameters in GNSS solutions, leading to improved geodetic measurement precision and a more accurate geodetic reference frame.Despite its potential, the approach of implementing a common clock with optical fiber for GNSS receivers remains largely untested. Although optical fiber links have been successfully used in clock synchronization, their integration into GNSS receiver clocking is still in an experimental stage. Notable existing efforts include: (1) the Geodetic Observatory Wettzell, where multiple receivers are connected to a single clock via optical fiber, representing a local baseline setup, and (2) the GFZ experiment, where a receiver is linked to the ultra-stable clock of PTB, representing a regional baseline approach.This study characterizes existing fiber-optic connections among GNSS receivers to identify practical challenges and evaluate their impact on GNSS parameter estimation. We process data from receivers sharing a common clock using Bernese GNSS Software. Initially, PPP will be performed to compare GNSS-derived clock parameters across receivers sharing a common clock, verifying the effectiveness of fiber-optic clock synchronization. Following this validation, we will leverage GNSS-derived clock parameters to evaluate inter-receiver clock differences measured via optical fiber. Subsequently, we will implement a strategy in which only one receiver’s clock parameters are estimated, using fiber-measured clock differences as a priori constraints for other receivers in the PPP solution. This approach reduces the number of estimated clock parameters and serves as a preliminary test of the feasibility of a GNSS common clock framework.Future developments will focus on refining our analysis framework to enable simultaneous estimation of GNSS receivers operating under a common clock. This research contributes to the broader goal of integrating ultra-stable clocks into global GNSS networks, ultimately enhancing the stability of geodetic reference frames and improving GNSS-derived geodetic products.

Global Navigation Satellite System (GNSS) has been widely used in people’s life. Generally, GNSS signals suffer from severe attenuation in urban canyon environments. the 5th generation wireless systems (5G) and GNSS hybrid positioning technique is a promising localization technique because 5G base stations are able to help GNSS relieve the problem of lacking visible satellites in urban environments. However, 5G-GNSS hybrid positioning faces the time synchronization problem. The conventional methods based on time of arrival (TOA) or time difference of arrival (TDOA) require that the time synchronization accuracy between two base stations should at least be 30-nanosecond level to make sure the range error is below 10 m, which is difficult to achieve in real applications. This work proposes a 5G-GNSS hybrid positioning scheme basing on AOA-TOA measurements. We combine the angle of arrival (AOA) estimates from 5G base stations and TOA measurements from GNSS satellites to perform hybrid localization. Moving averaging operation is then performed on the raw position estimates to further reduce the effect of noise. The principle of the proposed algorithm is explained detailedly. Numerical results demonstrate that the proposed method can be free from the influence of the time synchronization error, thus it improves the accuracy and robustness of hybrid positioning system in comparison with conventional methods.

Precise timing and precise location information are provided by Global Navigation Satellite Systems (GNSS) and play a crucial role in the positioning, navigation and data acquisition of most Unmanned Aerial Vehicles (UAV). GNSS functions include the following applications in UAVs: time-stamping and geo-referencing of collected data and images, synchronization of swarm flying and follow-me flights, determination of position and attitude in-flight, flight trajectory by following a pre-defined number of waypoints, mission planning, return home automatically without external control, avoidance of obstacles and geo-fencing. 
 Some of these critical operations have implications for the safety of the UAV, the surrounding environment and health and safety of people, for example UAVs threatening to bring down aircrafts at airports, which are no-fly zones for UAVs. The appropriate GNSS based function to avoid this is geo-fencing. Another example is obstacle avoidance to prevent collisions and damages both for the UAV and the obstacle, e.g. anything from a window pane, tree, human being, to a power line.
 In order to ensure health and safety it is thus important to ensure correct function of the navigation and the timing, under a wide variety of circumstances, and in different signal environments. There can be signal disturbances, such as obscurations by buildings or reflected GNSS signals, called multipath. The performance of timing and navigation based on GPS/GNSS can be tested and verified in a controlled and repeatable way in the laboratory with different types of test equipment. We will give an introduction to a wide range of potential threats to GNSS Positioning, navigation and timing and an overview of different test methods. In addition, we are presenting a method for time synchronization of drones to enable safe swarm and follow flights in UAVs.

Since the widespread existence of interference and spoofing, the authentication of position, velocity, and timing (PVT) solution is necessary for a Global Navigation Satellite System (GNSS) receiver. Single-antenna spoofing attack that transmits all the counterfeit signals by a single antenna is a common one. In this case, all the counterfeit signals would experience a common propagation channel which causes the same fading and delay from the spoofer to a receiver. Inspired by the characteristic of such spoofing attack, we propose a PVT solution authentication method based on monitoring the combination of clock bias and drift for moving receivers in the paper. The basic principle of the method is based on the consistency check of clock bias and drift variations between local clock and GNSS timing solution. It can verify the authenticity of PVT solution using not only the clock bias but also the clock drift variations. This allows the Commercial off-the-shelf (COTS) GNSS receivers to obtain better performance.

Intermediate spoofing, identified as an efficient spoofing attack method, can launch a spoofing attack without interrupting the regular functioning of Global Navigation Satellite System (GNSS) receivers. GNSS is vulnerable and easily interfered by spoofing because of its opening signal structure and low signal power, and this threatens the security and integrity of GNSS, especially for the safety critical applications such as maritime and aviation. Signal Quality Monitoring (SQM) techniques, originally designed for multipath detection, are recently found to be useful to identify the deformation on the correlation function of a GNSS signal due to an intermediate spoofing attack. Conventional SQM-based methods directly employ the values of the SQM metric to detect spoofing attacks. In this paper, we develop an enhanced SQM technique for spoofing detection. It is known that the value of SQM metric fluctuates significantly during the interaction between the counterfeit signal and authentic signal. As the variance of metric can better reflect this fluctuation of metric, we choose the moving variance (MV) of the SQM metric as a new “metric” to detect the occurrence of spoofing. The basic principle of the proposed method is well introduced and tested on four different SQM metrics. Its ability to detect spoofing has been validated using the dataset collected using our SPIRENT simulators. The results show that the proposed moving variance-based SQM method is advantageous in the detection of spoofing attacks.

Global Navigation Satellite Systems (GNSS) has been the primary positioning solution for Unmanned Aerial Vehicles (UAVs) due to their worldwide coverage, high precision and lightweight receivers. However, GNSS is prone to electromagnetic interference and malicious assaults, including jamming or spoofing because of its low signal-to-noise ratio (SNR). To ensure the continuity and protection of UAV operations, using redundant navigation systems is essential. In recent years, the phased array radio system (PARS) has established itself as a local navigation solution. PARS is robust towards malicious assaults because of an much higher SNR than GNSS regarding directed and encrypted transmission. An essential factor of PARS is that the orientation of the radio antenna at a ground station needs to be precisely determined to obtain the correct positioning of UAVs. This paper presents a method for extending a previously proposed calibration algorithm to estimate the ground antenna orientation with an inertial navigation system (INS) aided by redundant positioning sensors (GNSS, PARS or barometer) using a multiplicative extended Kalman filter (MEKF) so that the calibration can be activated during flights whenever GNSS is available. In other words, the proposed navigation system is essentially an aided-INS which switches between two modes depending on the availability of GNSS: calibration and GNSS aiding mode when GNSS is available (Mode 1) and PARS and barometer aiding mode when GNSS is unavailable (Mode 2). Considering that the navigation system needs to include the effect of Earth’s curvature for a long-distance flight, PARS horizontal measurement and the barometer measurement were treated independently, and the navigation equations were propagated in Earth Centred Earth Fixed (ECEF) frame. The independent treatment of barometer measurement, and the propagation in ECEF frame were also beneficial when using multiple ground antennas to have a common reference point and reference frame. The proposed method was validated using data (Inertial Measurement Unit (IMU), GNSS, PARS, Pixhawk autopilot (including barometer) measurements) collected during a field test. In the validation, GNSS was made available at the middle of the flight and the calibration mode was activated for 200s. The proposed navigation system successfully estimated the precise orientation of multiple ground antennas and the navigation solutions were verified using GNSS and Pixhawk autopilot solutions as ground truth.

Pose information is of great importance for control and navigation. For outdoor applications, Global Navigation Satellite System (GNSS) is a preferable choice because of its ability to supply global consistent positioning results. GNSS has been utilized in a mass of applications such as aviation and autonomous driving. On the other hand, a GNSS receiver is prone to interferences like multipath or spoofing attack. Therefore, a GNSS measurement should pass the authentication before incorporating into the pose estimation. Recently graph optimization based SLAM (Simultaneous Localization and Mapping) system that is tightly coupled with GNSS measurements has been developed to achieve a better positioning performance. However, little existing GNSS fault detection method can be directly adapted to such scheme. In this article we propose an innovation based GNSS fault detector. The proposed detector exploits the prior information derived from the marginalization process of the graph optimization, and can detect abnormalities such as drifts or jumps in GNSS positioning results. Moreover, the theoretically performance of the detector is evaluated in terms of the protection level, and several experiments over public datasets are conducted for performance validation.

Ionospheric scintillation is a challenging issue for the Global Navigation Satellite System (GNSS). Data collected by the globally distributed GNSS receivers provide abundant information about the ionosphere. S4 is one of the most important parameters of the scintillation, which can be measured by the GNSS receivers. We established a simplified probability model for S4 measured by the GNSS receiver. This model fully considers the correlation of the signal intensity and the ambient noise introduced by the receiver. A factor that reveals the correlation feature of scintillated intensity was proposed. Based on this model, the Cramer–Rao bound (CRB) and the minimum-variance unbiased estimator for S4 were deduced and analyzed. The CRB shows that the uncertainty of S4 increases as the scintillation becomes severe and the decorrelation time becomes longer. Then an approximate probability model was established to describe the statistics of the common estimator of S4. Simulation tests were carried out to validate the proposed model. Based on the approximate model, the statistics of the common estimator was analyzed. We found that, apart from ambient noise, the variation of signal intensity leads to a minus bias for S4 measurements, which seems to have been neglected in the past. A method to correct this bias was proposed. We also found that the increase in the carrier-to-noise ratio decreases the bias but helps little in reducing the variance of the measurements. Considering the accuracy of S4 measurements and the robustness of the tracking loop, we found that for weak scintillation, the value 0.02 s is an ideal coherent time. For moderate scintillation, a relatively ideal coherent time is 0.004 s and for severe scintillation, 0.001 s is an ideal coherent time. Based on this analysis, suggestions for GNSS receiver configurations were proposed.

As part of our recent research to assess the potential of low-cost navigation sensors for Unmanned Aerial Vehicle (UAV) applications, we investigated the potential of carrier-phase Global Navigation Satellite System (GNSS) for attitude determination and control of small size UAVs. Recursive optimal estimation algorithms were developed for combining multiple attitude measurements obtained from different observation points (i.e., antenna locations), and their efficiencies were tested in various dynamic conditions. The proposed algorithms converged rapidly and produced the required output even during high dynamics manoeuvres. Results of theoretical performance analysis and simulation activities are presented in this paper, with emphasis on the advantages of the GNSS interferometric approach in UAV applications (i.e., low cost, high data-rate, low volume/weight, low signal processing requirements, etc.). The simulation activities focussed on the AEROSONDE UAV platform and considered the possible augmentation provided by interferometric GNSS techniques to a low-cost and low-weight/volume integrated navigation system (presented in the first part of this series) which employed a Vision-Based Navigation (VBN) system, a Micro- Electro-Mechanical Sensor (MEMS) based Inertial Measurement Unit (IMU) and code-range GNSS (i.e., GPS and GALILEO) for position and velocity computations. The integrated VBN-IMU-GNSS (VIG) system was augmented using the inteferometric GNSS Attitude Determination (GAD)sensor data and a comparison of the performance achieved with the VIG and VIG/GAD integrated Navigation and Guidance Systems (NGS) is presented in this paper. Finally, the data provided by these NGS are used to optimise the design of a hybrid controller employing Fuzzy Logic and Proportional-Integral-Derivative (PID) techniques for the AEROSONDE UAV.

Technical solutions for the creation of fundamentally new universal multifunctional autonomous navigation system of radar operating principle are proposed. Currently, navigation systems of unmanned aerial vehicles (UAV) are based on global navigation satellite systems (GNSS) receivers, combined with a block of inertial sensors of spatial orientation. GNSS are based on the use of coordinated by motion and radiation signals of Earth artificial navigation satellites network. GNSS provide continuous and almost immediate determination of the position (location) and speed of the UAV almost over the globe. Such a system provides a fairly accurate determination of the UAV position and parameters of its movement subject to a good GNSS signal. At the same time, the GNSS is a radio-technical navigation system and, like any such system, is subject to the influence of external radio interference, both natural and artificial. One of the ways to solve the problem of performing UAV flights in conditions of natural and artificial interference, when information from external sources is not available to estimate the position of the UAV, is the use of path reckoning method. The most important component of the autonomous navigation system implementing the course-Doppler mode of path calculation is the Doppler velocity sensor and hover drift. The R&D of Doppler velocity sensor & hover drift for the UAV (small size and weight) is a complex scientific, technical and design task, the implementation of which became possible due to the use of modern technical (design, schematic, technological, etc.) solutions.