Investigations of Single Antenna GPS Spoof...

http://commons.wikimedia.org/wiki/File:GPS-IIRM.jpg

Investigations of Single Antenna GPS Spoof

Detection !

Stanford University Global Positioning System Research

Laboratory with support from the FAA

WAAS program office !!

Emily McMilin, David De Lorenzo!Todd Walter, Thomas Lee,!

Per Enge!Oct 28, 20141


2

Outline!• Motivation!

• Purpose of talk!• Why vulnerable?!• Practical threats?!• Why detection?!• Dynamic patterns!

• Detection!• Design!• Measurement!• Patterns!• Simulation!

• Hybrid!• Full!

• Conclusion


3





• Conclusion

Today, I am going to show you a GPS spoof-detection antenna that is:!!

•Simple -- no math equations needed!•Static -- no movement needed!•Instantaneous -- no need to wait!•Small -- no larger footprint/radome required!•Backwards compatible -- no new receiver needed! (however receiver integration permits seamless functionality) !!

And it is also:!•Limited -- most effective in aerial applications

Motivation: Purpose of this presentation

4


Well-suited to constraints of aerial applications:

Form-factor constraints

Payload constraints

http://copter.ardupilot.com/wiki/advanced-multicopter-design/5http://xfaststyle.deviantart.com/art/AirPlane-198280783

http://copter.ardupilot.com/wiki/advanced-multicopter-design/

http://xfaststyle.deviantart.com/art/AirPlane-198280783

!

•Our technique for achieving this type of adaptability in small single antenna systems is by integrating discrete circuit components on or near the antenna.!!

• these circuit components manipulating signals in the RF domain can achieve analog “signal processing” directly on the antenna.!

!

•essentially eliminating additional computational complexity !

!

•However, signal processing in the digital domain often affords far more flexibility and applicability.!


6


7





• Conclusion

Image credit: Tyler Reid, 2014

Medium Earth Orbit ~20,000 km

Motivation: Why is GPS so vulnerable?

8

27 Watts


9 Image credit: Tyler Reid, 2014

27 Watts




158 attoWatts27 Watts



0.5 Watts




0.5 Watts158 attoWatts

27 Watts




27 Watts

1.58 picoWatts




27 Watts

1.58 picoWatts

1.58 pW : 158 aW10,000 :1

terrestrial : GPS SV



17





• Conclusion

Motivation: Why is GPS so vulnerable?Motivation: What are the practical threats?

18

Motivation: What are the practical threats?

19


20


21


22


23


24





• Conclusion

Spoofer spoofing

Goal is to mislead and avoid detection

Motivation: Why detection?

25

25

Spoofer spoofing



detection

26

26

Spoofer spoofing



detection

Spoofer jamming

Result is a costly jamming operation

27

27

Spoofer spoofing



detection

Spoofer jamming


elapsed time

28

28

Spoofer spoofing



detection

Spoofer jamming


elapsed time

Spoofer exposed

:)

29

29


30





• Conclusion

Motivation: Dynamic radiation patterns

normal-mode 31


normal-mode 32


normal-mode

Signal coming

from satellites

or spoofers?

33

detection-mode


34

If receive signal strength goes down,

then you were tracking a satellite.

detection-mode

If SNR goes down, then tracking a satellite.


35

If receive signal strength goes up,

then you were! tracking a spoofer!

If SNR goes up, then

tracking a spoofer.


detection-mode 36

If receive signal strength goes up,

then you were! tracking a spoofer!


detection-mode

But it turns out it is not

so easy.

37

Motivation: Our question

If we assume:!!

•GPS signals are originating from the upper hemisphere!•Spoofed signals are originating from the lower hemisphere,!!

can we achieve detection?

38

Motivation: ...but first, how?

How to achieve "detection-mode" radiation pattern?!•Create an large array aperture that can swing a beam to lower hemisphere angles?!•Mechanically flip the antenna upside-down?!!

Simple, static, instantaneous and backward compatible solution?!•No, so we will not be able to replicated the upper hemisphere pattern in the lower hemisphere, but can we find something comparable?

39

Motivation: a smaller question

How to achieve "detection-mode"?!•Create an large array aperture that can swing a beam to lower hemisphere angles?!•Mechanically flip the antenna upside-down?!!

Are these simple, static, instantaneous and backward compatible solutions?!•No, so we will not be able to replicate the upper hemisphere pattern in the lower hemisphere!

•Can we find something comparable?

40

Motivation: a smaller question

How to achieve "detection-mode"?!•Create an large array aperture that can swing a beam to lower hemisphere angles?!•Mechanically flip the antenna upside-down?!!

Are these simple, static, instantaneous and backward compatible solutions?!•No, so we will not be able to replicate the upper hemisphere pattern in the lower hemisphere!

•Can we find something comparable?

41


Outline!!

• Motivation!• Detection!• Design!• Measurement!• Patterns!• Simulation!


• Conclusion42

Looking to typical GPS antennas for inspiration

Detection

43

Detection: Typical GPS antenna

GPS/GNSS Antennas. By B. Rama Rao, W. Kunysz, R. Fante and K. McDonald, Artech House, 201244



Typical RHCP pattern!Typical LHCP pattern!

45


Typical RHCP pattern!Typical LHCP pattern!


Normal-mode:!!

46

Detection: Typical GPS antenna to satellites

Normal-mode:!GPS satellites see this RHCP pattern



Detection-mode:!GPS satellites see this RHCP pattern


Normal-mode >> Detection-mode!for GPS satellites



Normal-mode:!Spoofers see this

RHCP pattern

Detection: Typical GPS antenna to spoofers


Detection-mode:!Spoofers see this

RHCP pattern



emtodo RESEARCH ON GPS ANTENNAS AT MITRE, B. Rama Rao, M. N.Solomon, M. D.Rhines, L. J. Teig, R. J. Davis, E.N.Rosario, The MITRE Corporation



Normal-mode ~= Detection-mode!for Spoofers

52






Normal-mode ~= Detection-mode!for Spoofers

53





If SNR stays ~flat, then tracking a spoofer.


Normal-mode ~ Detection-mode!for Spoofers

54





If SNR stays ~flat, then tracking a spoofer.


Normal-mode ~ Detection-mode!for Spoofers

55

We can exploit this telltale drop in the received SNR or C/N0 to confirm the

signal is originating from above

a



a = upper hemisphere difference between

RHCP and LHCP (dB)

aa = cross polarization discrimination (XPD)



aa = upper hemisphere

difference between RHCP and LHCP (dB)



"Typical" GPS antenna patterns

a

b = lower hemisphere difference between

RHCP and LHCP (dB) b




RHCP and LHCP (dB)

"Typical" GPS antenna patterns

a

b = lower hemisphere difference between

RHCP and LHCP (dB) b




RHCP and LHCP (dB)In most GPS antennas a >> b. Thus, this often derided, yet unavoidable back-

lobe radiation becomes our ally.


Outline!!



• Conclusion61

x-axis port and x-axis

field

y-axis port and y-axis

field

Design: Circular Polarization

62

x-axis port and x-axis field

y-axis field lags by 90 deg

Design: Predominately RHCP! !

y-axis port and y-axis field

RHCP

LHCP63

RHCP

LHCP

Design: Predominately RHCP! !




normal-mode

64

RHCP

LHCP

Design: Predominately RHCP ! !

LHCP

normal-mode

RHCP




65

RHCP

Design: Predominately LHCP! !LHCP

x-axis field lags by 90 deg



66

RHCP

Design: Predominately LHCP! !LHCPdetection-mode




67

Design: Predominately LHCP! !detection-mode


LHCP

RHCP

RHCP

LHCP



68

RHCP

LHCP

Design: Predominately RHCP ! !

LHCP

normal-mode

RHCP




69



LHCP

RHCP

RHCP

LHCP



70



LHCP

RHCP

RHCP

LHCP



Main idea: switching back and forth between these two modes and watching for the telltale drop in the received SNR or C/N0.

71

90 degree hybrid coupler 50 ohm resister

antenna

Design: Basic GPS antenna

radio

72


antenna

DPDT switch

Design: GPS spoof detection antenna

Executive Function

Normal-mode

Detection-mode

radio

73


antenna

radio

DPDT switch

Design: GPS spoof detection antenna

Executive Function

Normal-mode

Detection-mode

b

c

d

e

a.x a.y

d

a.x a.y

74

b

ce

d

a.x a.y

Design: GPS spoof detection schematic

Note: • Simulation done with Agilent's

Advanced Design System (ADS) software

• Switching DC logic circuit and Executive function not shown.

75

a.x

d

a.y

a.y

a.x

d

Normal-mode: Port 4 lags by -90 deg phase shift

S-param!magnitude

S-param!phase

frequency

frequency

76

a.x

a.y

d

a.xa.y

d

S-param!magnitude

S-param!phase

frequency

frequencyDetection-mode: Port 3 lags by -90 deg phase shift77

a.x

d

a.y

a.y

a.x

d


S-param!magnitude

S-param!phase

frequency

frequency

78

a.x

d

a.y

a.y

a.x

d


S-param!magnitude

S-param!phase

frequency

frequency

79

Phase "jitter" less than 4 degrees

a.x

d

a.y

a.y

a.x

d


S-param!magnitude

S-param!phase

frequency

frequency

80

Total insertion loss: 0.7 dB

81

Design: Discrete components

bc

82


bc

83


bc

Both cost less than $1 in relatively small volume purchases

Design: Ceramic patch antennaIn order to test the spoof detection concept for various signal direction of arrivals (DoA), we needed an antenna's radiation pattern measurement data, including:!!

•Both RHCP and LHCP patterns!•Full back lobe pattern!!

It was not easy to find this information, so we decided on trying to make our own "typical" GPS patch antenna and conduct our own measurements.

84

Design: Ceramic patch antenna"Typical" is desirable because we are interested in as universal a solution as possible:!!

•Typical upper/lower hemisphere gain patterns!•Typical cross polarization description (XPD)!•Typical size (ARINC 743 compatible)!!

Even simple GPS antennas are optimized given an existing body of constrains, and the introduction of any new constraint will inevitably require trade-offs and a resulting performance degradation.

85

Design: Ceramic patch antenna

61mm x 61mm ground-plane

86


76mm x 76mm ground-plane

87


88


89

"Typical" GPS antennas also include quadrifilar helix antennas, crossed bow tie antennas, and any antenna that may

have multiple internal ports


Outline!!



• Conclusion90

*azimuth **elevation

Measurement! horn

**mount

*

foam

Measurement: Far field set-up

91

Measurement: Far field results

92


a = 7dB

b = 10dB

93


a = 7dB

b = 10dB

Turns out that "typical" is not that easy. The antenna we built does not meet some basic

GPS antenna requirements.

94


Outline!!



• Conclusion95

We revisited literature for simulated and measured patterns with full back lobe !RHCP/LHCP radiation patterns, to find

inspiration lacking in the antenna we built.

Patterns

96

Calculated pattern for GPS antenna in forward location

Calculated pattern for GPS antenna in aft location

Patterns: Typical GPS antenna on missile

RESEARCH ON GPS ANTENNAS AT MITRE, B. Rama Rao, M. N.Solomon, M. D.Rhines, L. J. Teig, R. J. Davis, E.N.Rosario, The MITRE Corporation97



a = 20dB a = 20dB





a = 20dB a = 20dB

b = 0dB b = 0dB



Patterns: Typical GPS antenna on plane

"Measurements on a GPS Adaptive Antenna Array Mounted on a 1/8-Scale F-16 Aircraft," Rao, B. Rama, Williams, Jonathan H., Proceedings of the 11th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GPS 1998)100

a = 20dB



a = 20dB

b = 0dB



a = 20dB

b = 0dB

ripple = 10dB




Outline!!



• Conclusion104


Hybrid Simulation: System Design

How to achieve backward capability with existing GPS receivers? !!

•No new processing blocks can be added:!•Exploit only minimum required set of existing functionality blocks.!•Report spoof-detection results using existing reporting framework: C/N0 or SNR!

105105

Detection-mode

Normal-modeRadio Executive

Function

Antenna

Hybrid Simulation: Overview

106


Detection-mode


Function

Antenna

Far field!measurement

data setPython scripts

107

Detection-mode


Function

Antenna


We assume an intelligent spoofer that has adjusted their transmit strength to reasonably

overpower LOS signal from GPS satellites.

108

Detection-mode


Function

Antenna


109


Function

Antenna

time


TDefault

Normal-mode

110

Detection-mode


Function

Antenna

time


TDefault TMonitor

Normal-mode

Detection!-mode

TN

TD

111

Detection-mode


Function

Antenna

time


TDefault

Normal-mode

Detection!-mode

TMonitor

TN

TD

TCoh

coherent integration period

112

Detection-mode


Function

Antenna

time


TDefault

Normal-mode

Detection!-mode

TCoh

TMonitor

TN

TD

coherent integration period

113

Tracking seven GPS satellites

114

Tracking seven GPS satellites

115

A single spoofing source

116

A single spoofing source

117

Two spoofing sources

118


Outline!!



• Conclusion119

Full Simulation: Overview

Detection-mode


Function

Antenna

Simulated far field measurement !

data setPython scripts

120

a = 13dB

b = 5dB

123

ripple = 15dB

a = 13dB

b = 5dB

124

Using simulated antenna data

125

5 dB

13 dB

126

15 dB

126

Using simulated antenna data

127


Outline!!



• Conclusion128

b

aa

Conclusion: Limitations

Requirement for detection:!•If we can assume SVs are above and spoofers are below:!•a >> b, for at least one satellite signal DoA!

!•If we can not assume SVs are above and spoofers are below:!•we can exploit characteristics unique to each DoA such as XPD ripple

ripple

129

We have designed an antenna that uses analog “signal processing” to perform simple, low cost, backwards compatible and instantaneous spoof-detection for aerial applications.

Conclusion

130

Special thanks to Paul Miller, Sunali Chokshi, Martin

McBride, Larry Arnett, Claudia Lam and Chris Hoeber at

Space Systems/Loral.!!

Also thanks to Dennis Akos at University of Colorado!!

131

Thank you for your time!!!

132

Y.-H. Chen, S. Lo, D. Akos, D. S. De Lorenzo, P. Enge, ``Validation of a Controlled Reception Pattern Antenna (CRPA) Receiver Built From Inexpensive General-purpose Elements During Several Live-jamming Test Campaigns,"Proceedings of the 2013 International Technical Meeting of The Institute of Navigation, San Diego, California, January 2013, pp. 154-163. !P. Montgomery and T. E. Humphreys, ``A Multi-Antenna Defense: Receiver-Autonomous GPS Spoofing Detection," Inside GNSS, no. March/April, pp. 40-46, 2009. !A. Konovaltsev, M. Cuntz, C. Haettich, M. Meurer, ``Performance Analysis of Joint Multi-Antenna Spoofing Detection and Attitude Estimation," Proceedings of the 2013 International Technical Meeting of The Institute of Navigation, San Diego, California, January 2013, pp. 864-872. !J. Nielsen, A. Broumandan,G. Lachapelle, ``GNSS Spoofing Detection for Single Antenna Handheld Receivers", NAVIGATION, Journal of The Institute of Navigation, Vol. 58, No. 4, Winter 2011-2012, pp. 335-344. !M. L. Psiaki, S. P. Powell, B. W. O'Hanlon, ``GNSS Spoofing Detection using High-Frequency Antenna Motion and Carrier-Phase Data," Proceedings of the 26th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS+ 2013), Nashville, TN, September 2013, pp. 2949-2991. !F. N. Bauregger, T. Walter, D. Akos, P. Enge, ``A Novel Dual Patch Anti Jam GPS Antenna," Proceedings of the 58th Annual Meeting of The Institute of Navigation and CIGTF 21st Guidance Test Symposium, Albuquerque, NM, June 2002, pp. 516-522. !B. Rama Rao, W. Kunysz, R. L. Fante and K. F. McDonald, in GPS/GNSS Antennas, Artech House, 2013 !B. Rama Rao, J. H. Williams, ``Measurements on a GPS Adaptive Antenna Array Mounted on a 1/8-Scale F-16 Aircraft," Proceedings of the 11th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GPS 1998), Nashville, TN, September 1998, pp. 241-250. !B. Rama Rao, M. N. Solomon, M. D. Rhines, L. J. Teig, R. J. Davis, E.N.Rosario, ``Research on GPS Antennas at MITRE'', Position Location and Navigation Symposium, IEEE 1998 , vol., no., pp.634,641, 20-23 Apr 1998

References

Investigations of Single Antenna GPS Spoof...

Documents

Transcript of Investigations of Single Antenna GPS Spoof...