GNSS Spoofing Detection Techniques by Cellular Network Cross-check in Smartphones

A wide-range utilisation of Global Navigation Satellite Systems (GNSS) across technology and socioeconomic domains renders the satellite navigation one of the pillars of the modern civilisation. Tackling and overcoming The inherent shortcomings and emerging threats to provision of robust and resilient GNSS Positioning, Navigation and Timing (PNT) services have become a research subject of the utmost importance. An open access to the GNSS positioning estimation process is fundamental for development of advanced methods for robust and resilient GNSS position estimation. Recent introduction of Google Android 7.0 revision allows for direct access to raw GNSS pseudoranges observed by smartphones. Here we address the opportunities for GNSS positioning estimation improvements, given through exploitation of Google Android Location API, in creation of bespoke GNSS position estimation process in navigation application domain of a GNSS Software-Defined Radio (SDR) receivers in smartphones. We present and validate opportunities for improvement of GNSS position estimation process through utilisation of distributed computing architectures, trusted sources of GNSS augmentation data and utilisation of GNSS positioning methods suitable for targeted classes of GNSS applications Authors are members of European GNSS Agency's GNSS Raw Measurements Task Force, and co-authored the white-paper on GNSS-related Google Android Location API applications.

Intermediate spoofing, identified as an efficient spoofing attack method, can launch a spoofing attack without interrupting the regular functioning of Global Navigation Satellite System (GNSS) receivers. GNSS is vulnerable and easily interfered by spoofing because of its opening signal structure and low signal power, and this threatens the security and integrity of GNSS, especially for the safety critical applications such as maritime and aviation. Signal Quality Monitoring (SQM) techniques, originally designed for multipath detection, are recently found to be useful to identify the deformation on the correlation function of a GNSS signal due to an intermediate spoofing attack. Conventional SQM-based methods directly employ the values of the SQM metric to detect spoofing attacks. In this paper, we develop an enhanced SQM technique for spoofing detection. It is known that the value of SQM metric fluctuates significantly during the interaction between the counterfeit signal and authentic signal. As the variance of metric can better reflect this fluctuation of metric, we choose the moving variance (MV) of the SQM metric as a new “metric” to detect the occurrence of spoofing. The basic principle of the proposed method is well introduced and tested on four different SQM metrics. Its ability to detect spoofing has been validated using the dataset collected using our SPIRENT simulators. The results show that the proposed moving variance-based SQM method is advantageous in the detection of spoofing attacks.

Tropospheric delay is an important error source in Global Navigation Satellite System (GNSS) positioning and can also be used in water vapor monitoring. Many models have been built to correct tropospheric delays or to convert zenith wet delays to precipitable water vapor. However, these models suffer from limited resolutions (spatial resolution lower than 1° and temporal resolution lower than 6 hr), which affects their performance. The release of European Centre for Medium‐Range Weather Forecasts ReAnalysis 5 (ERA5) provides the opportunity to lift this limit. In this study, we use the ERA5 hourly 0.5° × 0.5° data to build a new model over China, which integrates tropospheric delay correction for GNSS positioning and weighted mean temperature calculation for GNSS meteorology. By modeling the diurnal variations of zenith hydrostatic delay, zenith wet delay, and weighted mean temperature and the seasonal variations in their lapse rates, this model has the state‐of‐the‐art spatial resolution of 0.5° × 0.5° and temporal resolution of 1 hr. We validate this new model by the ERA5 data, the radiosonde data, and the GNSS data in comparison with the canonical GPT2w model. The results show that the new model has better accuracies in terms of root‐mean‐square than the GPT2w model in all parameters. Especially, the new model well captures the diurnal variations in tropospheric delay and weighted mean temperature. This new model provides accurate tropospheric delays and weighted mean temperature simultaneously, which enables GNSS receivers to measure precipitable water vapor directly and also benefits GNSS positioning.

This study evaluates the suitability of compact, lowcost Global Navigation Satellite System (GNSS) receiver module in estimating the effects of tropospheric delay on accuracy of GNSS position solution at GNSS laboratory, the University of Burdwan, West Bengal, India with geographical coordinate of 23.2545°N, 87.8467°E, −11.402 m, using compact, low-cost uBlox F9P GNSS module and high cost Leica GR 50 geodetic receiver in March 2023. GNSS observation data were logged by the two receivers for 24 hours at 1Hz dual-frequency and converted into Rinex observation files in GPS-only, GLONASS-only, and GPS+GLONASS hybrid modes. The converted Rinex observation data were uploaded to the Natural Resources of Canada (NRCan) online service to obtain the user fixed values of latitude, longitude and attitude, and the wet and dry tropospheric delay files via email. The converted Rinex observation files were post-processed using GNSS positioning analysis tool that estimate the GNSS positioning accuracy parameters namely Distance Root Mean Square (2DRMS), Circle of Error Probable (CEP), Spherical Error Probable (SEP), and Mean Radian Spherical Error (MRSE) from the users defined known fixed values of latitude, longitude and altitude. The total delay obtained from the two GNSS receivers were compared with their positioning accuracy parameters. The results showed better position solution on observation days with the least total zenith delay in all the constellations considered. The Leica GR 50 shows an average total zenith delay of 2.476 m in GPS mode, 2.486 m in GLONASS mode and 2.4680 m in GPS+GLONASS hybrid mode while the uBlox F9P shows 2.477 m in GPS mode, 2.494 m in GLONASS mode and 2.4684 m in GPS+GLONASS hybrid mode of operation. The GPS+GLONASS hybrid mode of operation reduces the total zenith delay and enhanced the position solution. Hence, there is no distinct difference between the two GNSS receivers, suggesting that compact, low-cost, GNSS receiver modules can be used for tropospheric study.

This paper investigates the effectiveness of multipath-decorrelating antenna motion in reducing the initialization time of global navigation satellite system (GNSS) receivers employing low-cost single-frequency antennas for carrier-phase differential GNSS (CDGNSS) positioning. Fast initialization times with low-cost antennas will encourage the expansion of CDGNSS into the mass market, bringing the benefits of globally referenced centimeter-accurate positioning to many consumer applications, such as augmented reality and autonomous vehicles, that have so far been hampered by the several-meter-level errors of traditional GNSS positioning. Poor multipath suppression common to low-cost antennas results in large and strongly time-correlated phase errors when a receiver is static. Such errors can result in the CDGNSS initialization time, the so-called time to ambiguity resolution (TAR), extending to hundreds of seconds—many times longer than for higher cost survey-grade antennas, which have substantially better multipath suppression. This paper demonstrates that TAR can be significantly reduced through antenna motion, particularly gentle wavelength-scale random antenna motion. Such motion acts to decrease the correlation time of the multipath-induced phase errors. A priori knowledge of the motion profile is shown to further reduce TAR, with the reduction shown to be more pronounced as the initialization scenario is more challenging.

Aiming at fabricating a false positioning solution towards the victim user, spoofing attacks are nowadays challenging the security of Global Navigation Satellite Systems (GNSS). Due to the relative motion between the spoofer and victim user, the potential inconsistency involved in the measurement of Doppler shift could be an efficient basis to reveal the attacks. Although several researches on anti-spoofing techniques via measured Doppler have been developed, weaknesses in terms of implementation complexity and strict assumptions such as single-antenna spoofing still remain. To this end, Doppler Residual Monitoring (DRM) is proposed and investigated in this paper as a novel anti-spoofing scheme. Firstly, caused by the presence of the spoofing attacks, abnormal bias within the measured Doppler shifts is demonstrated based on the modeling of GNSS spoofing. Due to the difficulty in directly observing the Doppler bias concealed in the counterfeit signal, Doppler positioning technique is exploited to reveal this part of the variation in an indirect way. In particular, Doppler residual provided by Doppler positioning equations is proposed and the relationship between Doppler bias and Doppler residual is illustrated. More specifically, Sum of Squares of Errors (SSE), which denotes the sum of squares of Doppler residual, is utilized as the test statistics for spoofing detection. To further distinguish all the counterfeit signals, a random traversal technique is investigated in this paper. Moreover, Doppler Shift Difference (DSD) is proposed to match the spoofing signals with its transmitting antenna based on the discrimination results, which could be an essential basis for the anti-spoofing techniques towards multi-antenna spoofing scenario. Also provided is the analysis of the theoretical performance along with the simulation results. Finally, the validity of our method is demonstrated through field tests with two spoofing scenarios, where the spoofing attacks are respectively achieved by one antenna and two antennas. Without external facilities assistance, our DRM-based scheme could be a significant complement to the GNSS anti-spoofing techniques as a novel spoofing discrimination method.

Global navigation satellite systems (GNSS) have been widely used in our daily lives. Meanwhile, GNSS are facing a severe threat of spoofing attacks, which can mislead users by false position, velocity and time (PVT) solutions, resulting in serious consequences. Especially, with the development of vehicle navigation, autonomous driving and unmanned aerial vehicles (UAV), increasing spoofing attacks have emerged towards vehicles, where anti-spoofing techniques are desperately needed. Among these techniques, spoofer localization is a necessary step to fundamentally address the spoofing attacks. Most of the conventional spoofer localization methods are based on time of arrival (TOA) or time difference of arrival (TDOA). These methods require measurements observed by multiple receivers at the same time, where time synchronization is indispensable. However, it is hard to apply these methods to the existing vehicles equipped with independent commercial receivers. To cope with this problem, in this paper we develop a flexible method for vehicles to locate a stationary spoofer based on Doppler and clock drift double difference (DCDD). DCDD is calculated using Doppler measurements and clock drift solutions of one vehicular receiver and another reference receiver. Generally, Doppler frequency of GNSS signals changes slowly with time, which releases the restriction for high-precision time synchronization. DCDD represents the Doppler frequency caused by the vehicle motion, from which the spoofer position can be estimated. In addition, with the elimination of irrelevant components in Doppler measurements, DCDD minimizes the user complexity required for localization, where at least two receivers and one vehicle is needed. Utilizing DCDD, an iterative weighted least squares (WLS) algorithm is used to solve the spoofer position, and a closed-form initial value is given to improve the convergence rate. We evaluate the localization performance by the derived Cramér-Rao lower bound (CRLB) in the presence of vehicle position and velocity errors. Simulations and field vehicle experiments are conducted to verify the feasibility and effective of the proposed method. The experimental results show that with an average vehicle velocity of 8 m/s, the horizontal localization error can be less than 40 m and 20 m, using DCDD observations of 4 epochs and 8 epochs respectively.

To achieve an accurate and robust localization result under Global Navigation Satellite System (GNSS) denied environment, coupling GNSS with other sensors tends to be a promising solution, also known as the sensor fusion system. One of the most challenging scenarios in sensor fusion is to couple vision navigation system with GNSS, especially the tightly-coupled fusion. Compared with those loosely coupled ones, it performs the information fusion on a more intrinsic level, which can benefit the accuracy and robustness of the system. However, the major barrier lying in front of tightly coupling method is the way to unify the heterogeneous and asynchronous GNSS observations with vision observations. To solve this problem, we start from the Vison Simultaneous Localization and Mapping (V-SLAM) method, which has already become the mainstream in vision navigation domain. By utilizing existing attempts on graph-optimization-based GNSS data processing, we propose a joint graph optimization combining vision-SLAM with GNSS pseudorange. It is a tightly coupled fusion of GNSS and stereo camera, implemented by considering GNSS satellites as vision feature points. Based on the framework of mature state-of-art pose-graph SLAM, a graph optimization is applied simultaneously on GNSS and vision positioning, to achieve a robust, accurate, yet versatile fusion system.

In Global Navigation Satellite System (GNSS) positioning, gross errors seriously limit the validity of Kalman filtering and make the final positioning solutions untrustworthy. Thus, the detection and correction of gross errors have become indispensable parts of Kalman filtering. Starting by defining an incremental Chi-square method of recursive least squares, this paper extends this definition to Kalman filtering to detect gross errors, explains its nature and its relation with the currently adopted Chi-square variables of Kalman filtering in model and data spaces, and compares them with the predictive residual statistics. Two robust Kalman filtering models based on an incremental Chi-square method (CI-RKF) were established, and the one with a better incremental Chi-square component was selected based on a static accuracy evaluation experiment. We applied the selected robust model to the GNSS positioning and the GNSS/inertial measurement unit (IMU) / visual odometry (VO) integrated navigation experiment in an occluded urban area at the East China Normal University. We compared the results for conventional Kalman filtering (CKF) with a robust Kalman filtering constructed using predictive residual statistics and an Institute of Geodesy and Geophysics (IGGШ) weight factor, abbreviated as “PRS-IGG-RKF”. The results show that the overall accuracy of CI-RKF in GNSS positioning was improved by 22.68%, 54.33%, and 72.45% in the static experiment, and 12.30%, 7.50%, and 16.15% in the kinematic experiment. The integrated navigation results indicate that the CI-RKF fusion method increased the system positioning accuracy by 66.73%, 59.59%, and 59.62% in one of the severe occlusion areas, and 42.04%, 59.04%, and 52.41% in the other.

Recurrence plot analysis of GPS ionospheric delay time series in extreme ionospheric conditions

The relationship and the mutual benefits of timekeeping and Global Navigation Satellite Systems (GNSS) are reviewed, showing how each field has been enriched and will continue to progress, based on the progress of the other field. The role of GNSSs in the calculation of Coordinated Universal Time (UTC), as well as the capacity of GNSSs to provide UTC time dissemination services are described, leading now to a time transfer accuracy of the order of 1–2 ns. In addition, the fundamental role of atomic clocks in the GNSS positioning is illustrated. The paper presents a review of the current use of GNSS in the international timekeeping system, as well as illustrating the role of GNSS in disseminating time, and use the time and frequency metrology as fundamentals in the navigation service.

The neutral atmosphere (or troposphere) causes refraction in radio frequency signals, which results in errors in Global Navigation Satellite Systems (GNSS) measurements. In meteorology, this effect can represent important measurements of the concentration of atmospheric constituents, especially in regions where conventional high-altitude atmospheric sounding (radiosondes) cannot be performed. There are two GNSS techniques used for this. In the first one, GNSS receivers are located on terrestrial stations that provide estimates of the vertically integrated moisture content (Precipitable Water Vapor - PWV). In the second case, receivers are in space platforms, which obtains profiles of atmospheric pressure, temperature and humidity, known as GNSS radio occultation. These measurements have significant potential for nowcasting applications (30 minutes in advance) of extreme precipitation events (>35 mm). This paper presents a review of the state of the art in the synergy between Geodesy and Meteorology for modeling the neutral atmosphere (neutrosphere), its effect on GNSS positioning and in the estimation of atmospheric constituents, and their applications. Furthermore, it offers the improvements and new challenges developed in modeling the delay for high accuracy positioning.

Abstract. This paper presents the development and evaluation of a Brazilian software for Precise Point Positioning (PPP) using multiple Global Navigation Satellite Systems (GNSS). The tool, named APPPOLO (Advanced Precise Point Positioning software for Optimized Localization), was designed to support advanced modeling and flexible configuration for academic and applied research in GNSS positioning. A specific performance analysis was conducted focusing on multi-GNSS PPP solutions using data from Brazilian continuously operating GNSS stations. The assessment examined the impact of different GNSS constellation combinations on positional accuracy and convergence time. The results demonstrate significant improvements in both accuracy and convergence when integrating GPS, GLONASS, Galileo, and BeiDou, compared to standalone systems. This paper contributes to ongoing efforts to develop robust, locally adapted GNSS processing tools capable of addressing atmospheric and infrastructural challenges found in South America.

Global Navigation Satellite System (GNSS) based Precise Point Positioning (PPP) has become the de facto standard for precise real-time offshore positioning applications. Current precision is of the order of 3−5 cm horizontally and twice this value for the vertical. However, this may not yet be good enough for tidal applications. In this contribution we will discuss new developments at Fugro, one of the world’s main providers of precise offshore real-time GNSS positioning services, to further improve PPP precision to the 2−3 cm level in the vertical component worldwide. For demanding applications, it is possible to even further improve this precision. These developments are based on merging PPP techniques (use of precise satellite orbits and clocks) with Integer Ambiguity Resolution (IAR), known from GNSS Real-Time Kinematic (RTK) positioning techniques. PPP IAR requires the generation and distribution to mobile users of Uncalibrated Phase Delays (UPDs) a network of reference stations. The network can be as small as one station or cover the entire globe. Once applied to the data of a mobile receiver, the carrier ambiguities should be integer. Fixing of these ambiguities to their proper integer value will result in significantly improved positioning performance. The infrastructure used to generate precise orbits, clocks and UPDs will be discussed. PPP IAR results will be shown from regional and global test beds, based on Fugro’s precise orbits and clocks for all currently available GNSSs. In addition, it will be shown that the introduction of new systems and signals, like triple-frequency GPS, Galileo and BeiDou, will help to significantly reduce the time required for PPP IAR solutions to converge to this centimeter level of accuracy.

Pose information is of great importance for control and navigation. For outdoor applications, Global Navigation Satellite System (GNSS) is a preferable choice because of its ability to supply global consistent positioning results. GNSS has been utilized in a mass of applications such as aviation and autonomous driving. On the other hand, a GNSS receiver is prone to interferences like multipath or spoofing attack. Therefore, a GNSS measurement should pass the authentication before incorporating into the pose estimation. Recently graph optimization based SLAM (Simultaneous Localization and Mapping) system that is tightly coupled with GNSS measurements has been developed to achieve a better positioning performance. However, little existing GNSS fault detection method can be directly adapted to such scheme. In this article we propose an innovation based GNSS fault detector. The proposed detector exploits the prior information derived from the marginalization process of the graph optimization, and can detect abnormalities such as drifts or jumps in GNSS positioning results. Moreover, the theoretically performance of the detector is evaluated in terms of the protection level, and several experiments over public datasets are conducted for performance validation.