Experimental validation of GNSS repeater detection based on antenna arrays for maritime applications

Abstract

In this work, we present an antenna array-based algorithm to detect GNSS repeater and/or spoofing attacks with an experimental validation. With an array receiver capable of measuring the impinging ranging signals direction of arrival in terms of azimuth and elevation, it is possible to estimate the antenna platforms attitude. The fact that this information is computed (w.r.t. a reference frame) during the position calculation is used. We propose an algorithm aiming to find the relation between both representations. This mapping defines the receiver’s attitude in terms of pitch, roll and yaw angle. The residual of this mapping is used to construct a quality metric for the mapping. If a threshold is undershot, spoofing/repeating is indicated. The performance is demonstrated using software simulations. To show the capabilities under realistic conditions, a test platform is described. It consists of a real-time array receiver and a sampling device enabling post-processing. A maritime measurement campaign including two vessels—one acting as receiver and the other acting as transmitter—is portrayed. Finally, the real-time and post-processing performance of the algorithm is evaluated.

1 Introduction

Nowadays, global navigation satellite systems (GNSS) are an essential part of many systems in the maritime community. The position information provided by the GNSS receivers is usually fused with other sensors like inertial measurement units (IMUs) or magnetic gyroscopes. The subsystem of sensors is subsequently integrated with electronic navigation charts (ENCs) and/or the automatic identification system (AIS), which is mandatory for larger vessels. This way, the main positioning, navigation and timing (PNT) unit—required for ships of a certain class—is formed.

The majority of accidents in the maritime context are caused by human error. Recent studies [1, 2] exploited that fact. A prominent example for a recent incident, which caused heavy public attention, is the Costa Concordia accident [3]. Misuse of the ship’s navigation system by the captain was discovered to be the reason. The introduction of autonomous and trustworthy semi-autonomous systems can very likely prevent such catastrophic events in future. Getting towards reliable systems, the International Maritime Organization (IMO) specifies and promotes the “e-Navigation” concept [4]. The goal is to achieve an integration of already existing electronic navigation devices.

One key element to implement the “e-Navigation” concept is to get towards a standardization of GNSS receivers’ positioning performance requirements in terms of integrity, accuracy and availability. Current activities aim to terrestrial (differential GNSS) or satellite-based (SBAS) augmentation systems in order to match the positioning requirements given by different (non-global) standards.

Studies [5] have been carried out to show the vulnerability of GNSS signals in maritime environments. Several sea trials have been performed by the General Lighthouse Authorities of the United Kingdom and Ireland (GLA) in collaboration with the UK Ministry of Defense (MOD). These studies aimed at exploiting the effects of jamming (i.e. radio frequency interference) on security and safety of maritime navigation [6]. An important result of the trials is that not only the positioning system is affected by interference. Since the positioning is an essential input for many different subsystems, many safety-critical applications (i.e., digital situation awareness, chart stabilization, digital selective calling and emergency communication) are affected as well.

For several decades, many research groups as well as receiver manufacturers have taken efforts to detect and mitigate RF interference. Due to the large traveling distance (more than 20,000 km) of the electromagnetic wave emitted by the navigation satellites towards the surface of the earth, a receiver is vulnerable to even unintentional interference. Since the transmission power of the satellites is in the order of 50 W the received power drops down to some femtowatts. This increases the risk for operational outages or performance degradation [7]. Systems sharing the same frequency band [e.g., aviation Distance Measurement Equipment (DME) for Galileo E5a] or systems operating in different bands but emitting harmonics in the GNSS bands [user terminals for mobile satellite systems (MSS)] are examples for unintentional interferers.

In contrast to that, intentional interference becomes a major issue not only in a military context. This is due to the almost unlimited availability of (cheap) so-called personal privacy devices (PPDs). By transmitting a relatively high-power signal, GNSS receivers (used for critical infrastructures) in a wide range are affected and therefore cannot deliver positioning (and timing) information anymore [8].

In the light of that, large maritime organizations, such as the Lloyd’s [9] register but also the European Global Navigation Satellite Systems Agency (GSA) [10], foresee that the field of navigation robustness and cybersecurity will be a major challenge and trend for the maritime community in the upcoming years.

Operational outages or performance degradation is of minor concern, if they are detected. This can be achieved by constantly monitoring the relevant spectrum and declare the system unhealthy if a radio frequency interference (RFI) event was identified.

However, during the last decade a different type of threat gained much attention in the GNSS community: the so-called “spoofing” threat. The ultimate goal of a spoofer is not to block but to control a victims receiver’s position (and time) measurement without being detected. The threat is not only of academic interest, but has also been demonstrated in reality. Especially in the maritime context, the authors of Ref. [11] have shown the vulnerability of a ship’s navigation system by spoofing a luxury yacht. Using the same self-developed spoofer [12], the research group could demonstrate, that also unmanned aerial vehicles (UAVs) [13] and critical infrastructures, such as power grids [14], are vulnerable against spoofing. In addition, several experiments performed under laboratory conditions [15] using signal generators generating different types of spoofing attacks showed the vulnerability of professional aeronautical receivers. Subcategories of the threat are so-called repeating (unintentional re-radiation) and meaconing (intentional re-radiation). The similarity to spoofing is the presence of GNSS-like signals at a “victim” receiver’s antenna.

If successful and undetected, the attack may cause major damage—not only in a monetary sense, but also to lives. Several possible receiver autonomous detection schemes have been presented in the literature. For single antenna receivers, the detection relies on the behavior of different signal parameters which are estimated during regular operation. Examples are signal power, Doppler frequency offset, the PRN code delay and its rates, the shape of the correlation function as well as the relation of the signal components at different carrier frequencies (see [16, 17] and [18] for instance). However, the most advanced protection against sophisticated spoofing attacks can be provided by using antenna arrays and utilizing signal processing in the spatial domain [19,20,21,22,23,24]. A GNSS receiver with multiple antennas is able to estimate the directions of arrival (DoA) of the impinging waveforms and therefore to distinguish between the authentic and counterfeit signals.

The remainder of the paper is organized as follows: first a system description is introduced, which leads to a mathematical description of the attitude estimation problem. Based on that derivation, a metric for anomaly detection is deduced. Combining these two results, an algorithm for joint attitude estimation and spoofing/repeater detection is presented. In the next chapter, a description of the test platform (including the array) is provided. Subsequently, the experimental evaluation as well as the results are presented. Finally, a summary and conclusion is provided.

2 Notation

The following notation is used throughout the paper:

• $\varvec{x}$: Bold face lower case letters denote column vectors.

• ${\varvec{ X }}$: Bold face capital letters denote matrices.

• $\mathcal {X}$: Calligraphic letters denote sets.

• $|\mathcal {X}|$: The number of elements contained in a set (cardinality).

• $(\cdot )^T$: The transpose of a vector or matrix.

• $\text {tr}(\cdot )$: The trace (i.e. sum of all diagonal elements) of a matrix.

• $\text {diag}(\varvec{x}):$ Creates a quadratic matrix, with the vector $\varvec{x}$ on its main diagonal. All other entries are zero.

3 System description

The goal of the architecture is to estimate the attitude of an antenna array-based receiver platform w.r.t. an east–north–up reference coordinate frame. To make the work at hand as self-contained as possible, the analysis performed in [22] or [25]¹ and later used in Ref. [27] are revisited. The corresponding estimation problem as well as a way to solve it is presented. The derivation provides deeper insights and naturally leads to a detection scheme.

The system’s core is an antenna array-based GNSS receiver. Assuming enough degrees of freedom (i.e. antennas), a measurement of the ranging signal’s elevation and azimuth is performed in the post-correlation domain, by using, for example Unitary ESPRIT [28] (if the geometry and pattern are sufficient to fulfill the assumptions). The message decoding and position calculation (PVT) is assumed to be available. Figure 1 depicts a block diagram of the generic system setup.

Fig. 1

Block diagram of the generic system setup (taken from [22])

$\varvec{s}_1(1) \cdots \varvec{s}_L(n)$ denote the sampled baseband representation of the input signals received by the L elements of the array antenna. By measuring the DoA of the incoming ranging signals, directional cosines² pointing from the origin of the antenna’s local reference frame towards the source (i.e. the satellites) are available. These are denoted by $\varvec{b}_j \in \mathbb {R}^3$ and collected in the set $\mathcal {B}=\{\varvec{b}_j\}_{j \in J}$. They are represented in a local antenna coordinate system (details can be found in Ref. [21]). J denotes the set of the corresponding PRN numbers of satellites with available measurements.

Decoding the almanac information allows calculation of direction cosines in an east–north–up (ENU) coordinate frame. The set is denoted by $\mathcal {A}=\{\varvec{a}_i\}_{i \in I}$. I denotes the set of PRN numbers, which are evaluated by the receiver. If it is assumed that the almanac information is available for all tracked satellites J is a subset of I.

Both coordinate frames are rotated versions of each other. The following equation for all pairs $K = J \cap I$ of available measurements and references can be stated:

$$\begin{aligned} \varvec{b}_k = {\varvec{ R }} \varvec{a}_k \quad \forall k \in \mathcal {K}. \end{aligned}$$

(1)

The rotation is represented by a rotation matrix ${\varvec{ R }} \in \mathcal {SO}(3)$³ (special orthogonal group). It contains the information about roll, pitch and yaw angle and therefore defines the current attitude. This rotation (i.e. attitude) describes the rotation of the ENU into the antenna coordinate frame at certain time instant when the PVT and DOA estimates are available. It therefore is a property of the receiver platform.

3.1 Measurement model

The ephemeris and PVT-based directional cosines $\{\varvec{a}_i\}_{i \in \mathcal {I}}$ are assumed to be perfectly known. This is justified by the large distance between the satellites and the surface of the earth (more than 20,000 km), where the receiver is expected to be. However, the array-based estimates suffer from imperfections. In Ref. [21] these errors are modeled using additive Gaussian noise ($\varvec{n}_k \sim \mathcal {N}(\varvec{0},\sigma ^2 {\varvec{ I }})$), yielding:

$$\begin{aligned} \varvec{b}_k = {\varvec{ R }} \varvec{a}_k +\varvec{n}_k \quad \forall k \in \mathcal {K}. \end{aligned}$$

(2)

It should be mentioned, that if the corresponding vectors $\varvec{a}_k$ and $\varvec{b}_k$ are unit vectors and both are rotated versions of each other, in a strict sense Eq. (2), cannot hold without further restrictions on the noise.

It seems convenient to model these errors using rotation matrices as well, since the noise affects the orientation of the directional cosines:

$$\begin{aligned} \varvec{b}_k = {\varvec{ R }}_k \underbrace{{\varvec{ R }}\varvec{a}_k}_{\varvec{b}_k^\text {perf}} \quad \forall k \in \mathcal {K}. \end{aligned}$$

(3)

A construction of these matrices can be performed by choosing a random rotation axis $\varvec{\omega }_k$ and a random angle $\alpha _k$ for each measurement separately.

3.2 Snapshot-based problem statement

The ultimate goal of the algorithms that we are developing in this work is to perform a computation of the rotation matrix ${\varvec{ R }}$ (which corresponds to the current attitude) and to detect anomalies in the DoA measurements (which could be caused by “spoofing” or meaconing).

Using the noise model described in Eq. (3), the following set of equations for $N=|K|$ different pairs of measurements can be stated:

$$\begin{aligned} \varvec{b}_1&={\varvec{ R }}_1{\varvec{ R }}\varvec{a}_1 \nonumber \\&\vdots \nonumber \\ \varvec{b}_k&={\varvec{ R }}_k{\varvec{ R }}\varvec{a}_k \nonumber \\&\vdots \nonumber \\ \varvec{b}_N&={\varvec{ R }}_N{\varvec{ R }}\varvec{a}_N. \end{aligned}$$

(4)

In the following, ${\varvec{ B }} \in \mathbb {R}^{3 \times N}$ and ${\varvec{ A }} \in \mathbb {R}^{3 \times N}$ denote matrices consisting of the available DoAs in their columns. Following the maximum likelihood principle, one is interested to minimize the noise of the measurement rotation. Therefore, the distance of the noisy versions of $\varvec{b}$ [see Eq. (3)] and the unaffected ones $\varvec{b}_k^\text{perf}$ is to be minimized.

Since the noisy rotations are assumed to be independent for different unit vectors, a measure $g(\cdot )$ for this distance is employed for each unit vector. The results are summed up, yielding the following cost function for the antennas’ attitude:

$$\begin{aligned} f({\varvec{ R }})= \sum \limits _{k=1}^N \underbrace{g({\varvec{ R }}\varvec{a}_k-\varvec{b}_k)}_\text {Difference caused by noise}. \end{aligned}$$

(5)

Using the squared $\ell _2$-norm for $g(\cdot )$ the following ML-based optimization problem can be stated:

$$\begin{aligned} {\varvec{ R }}^{*}=\text {arg }\underset{{\varvec{ R }} \in \mathcal {SO}(3)}{\text {min. }}\Vert {\varvec{ R }}{\varvec{ A }}-{\varvec{ B }}\Vert ^2. \end{aligned}$$

(6)

Other possible choices for $g(\cdot )$ can be found in Ref. [29] by constructing the induced norms from the metrics described therein. This optimization problem (which was derived in this work) is also known as Wahba’s problem (see for instance [30]).

3.3 Closed-form solution

In Ref. [21] an iterative approach was used to solve the problem stated in Eq. (6). In the following section a closed-form solution is derived, allowing further insight in the geometric properties and conditioning (i.e. under which conditions a solution exists) of the problem.

The side condition ${\varvec{ R }} \in \mathcal {SO}(3)$ is a more special case of ${\varvec{ R }} \in \mathcal {O}(3)$⁴, as $\mathcal {SO}(n) \subset \mathcal {O}(n)$ (i.e. mirroring is allowed for the orthogonal group). This implies six equality constraints, due to symmetry. Defining ${\varvec{ S }} = {\varvec{ R }}{\varvec{ R }}^T \in \text {Sym}(3)$⁵, these read:

$$\begin{aligned} s_{k,k}&= 1 \quad \forall \quad 1 \le k \le 3, \end{aligned}$$

(7)

$$\begin{aligned} s_{k,l}&= 0 \quad \forall \quad 1 \le k < l \le 3, \end{aligned}$$

(8)

$$\begin{aligned} s_{k,l}&= 0 \quad \forall \quad 1 \le l < k \le 3. \end{aligned}$$

(9)

Equations (8) and (9) are redundant since $s_{k,l} = s_{l,k}$. For the optimization, this yields six equality constraints. A matrix ${\varvec{ \Lambda }} \in \text {Sym}(3)$ is used to collect the Lagrangian multipliers. By constructing a function $h(\cdot )$ [see Eq. (10)], all six equality constraints are summed up. Setting this sum to zero is a more relaxed but still necessary condition compared to stating them separately:

$$\begin{aligned} h({\varvec{ R }}):=\text {tr}({\varvec{ \Lambda }}({\varvec{ R }}{\varvec{ R }}^T-{\varvec{ I }}))=0. \end{aligned}$$

(10)

The Lagrangian cost function therefore reads:

$$\begin{aligned} L({\varvec{ R }},{\varvec{ \Lambda }})=\Vert {\varvec{ R }}{\varvec{ A }}-{\varvec{ B }}\Vert ^2+\text {tr}({\varvec{ \Lambda }}({\varvec{ R }}{\varvec{ R }}^T-{\varvec{ I }})). \end{aligned}$$

(11)

The standard approach (see [31] for instance) is performed by setting the gradient w.r.t ${\varvec{ R }}$ to zero and we get:

$$\begin{aligned} \frac{1}{2} \nabla _R L({\varvec{ R }},{\varvec{ \Lambda }})= {\varvec{ R }}({\varvec{ A }}{\varvec{ A }}^T+{\varvec{ \Lambda }})-{\varvec{ B }}{\varvec{ A }}^T={\varvec{ 0 }},\end{aligned}$$

(12)

$$\begin{aligned} \underbrace{{\varvec{ R }}({\varvec{ A }}{\varvec{ A }}^T+{\varvec{ \Lambda }})}_{\text {lhs}}=\underbrace{{\varvec{ B }}{\varvec{ A }}^T}_{:={\varvec{ C }}=\text {rhs}}. \end{aligned}$$

(13)

The side condition (${\varvec{ R }}$ to be orthogonal) can be used in a tricky way to solve for ${\varvec{ \Lambda }}$. The transpose of the right-hand side (rhs) of the above equation is multiplied from the left. The term containing ${\varvec{ R }}$ cancels out. The remaining term in brackets is symmetric (due to the redundancy in ${\varvec{ \Lambda }}$). The result reads:

$$\begin{aligned} ({\varvec{ A }}{\varvec{ A }}^T+{\varvec{ \Lambda }})=({\varvec{ C }}^T{\varvec{ C }})^{\frac{1}{2}}. \end{aligned}$$

(14)

Combining this result with Eq. (13) yields:

$$\begin{aligned} {\varvec{ R }}({\varvec{ C }}^T{\varvec{ C }})^{\frac{1}{2}}={\varvec{ C }}. \end{aligned}$$

(15)

Using a singular value decomposition for ${\varvec{ C }}:={\varvec{ U }}{\varvec{ \Sigma }}{\varvec{ V }}^T$, the result can be further simplified. Due to the properties of ${\varvec{ U }} \in \mathcal {O}(3)$ and ${\varvec{ V }} \in \mathcal {O}(3)$ the following result can be stated:

$$\begin{aligned} {\varvec{ R }}{\varvec{ V }}{\varvec{ \Sigma }}={\varvec{ U }}{\varvec{ \Sigma }}. \end{aligned}$$

(16)

To finally solve for ${\varvec{ R }}$, the matrix ${\varvec{ \Sigma }} = \text {diag}(\sigma _1,\sigma _2,\sigma _3)$ has to be further investigated. Without loss of generality, the singular values are ordered decreasingly. Three cases can be distinguished, since if at least one measurement is available, the minimum rank of ${\varvec{ C }}$ is one.

• 1. All singular values are unequal to 0:

${\varvec{ \Sigma }}$ is invertible. The result for ${\varvec{ R }}$ reads:

$$\begin{aligned} {\varvec{ R }}^{'}={\varvec{ U }}{\varvec{ V }}^T. \end{aligned}$$

(17)

To ensure that a proper rotation matrix (the constraint $\text {det}({\varvec{ R }})=1$ was not taken into account so far) is derived, the following “normalization” has to be performed:

$$\begin{aligned} {\varvec{ R }}={\varvec{ U }} \text {diag}(1,1,\text {det}({\varvec{ U }}{\varvec{ V }}^T)){\varvec{ V }}^T. \end{aligned}$$

(18)

• 2. One singular value is equal to 0:

This corresponds to the case, where the set of $\{\varvec{a}_k\}_{k=1}^N$ or $\{\varvec{b}_k\}_{k=1}^N$ span only two dimensions. Since the goal of the optimization is to rotate one coordinate system onto the other, this information is enough, since the missing one is uniquely determined. The result for ${\varvec{ R }}$ therefore is the same as in the previous case.

• 3. Two singular values are equal to 0:

This case occurs, if only one direction is present in either $\{\varvec{a}_k\}_{k=1}^N$ or $\{\varvec{b}_k\}_{k=1}^N$. If more than one measurement is available, this is very unlikely for a GNSS constellation (almanac data). If the measurements however span only one dimension, an anomaly is very likely, which makes an attitude determination impossible.

4 Anomaly detection

As already mentioned in the previous section, an inspection of the singular values of ${\varvec{ C }}={\varvec{ B }}{\varvec{ A }}^T$ can be used to detect anomalies. Computing the sum of singular values as a metric is discussed in this section.

By definition, directional cosines have length one. This implies, that the sum of all singular values (of ${\varvec{ C }}$⁶) is equal to $N=|K| = |I \cap J|$. This property is used for inspection.

For noisy measurements, the normalized (divided by N) sum can be computed, yielding values in the interval ${[}0,1{]}$. If the resulting metric is below a certain threshold $\epsilon$ an anomaly is very likely. Figure 2 shows an example with moderate noise based on computer simulations. For all simulations, a fixed but randomly chosen constellation⁷ has been generated. The approach works for that case. A blue background depicts the presence of a repeater for the simulation. A raised flag indicates the detection.

Fig. 2

Sum of singular value-based detection of anomalies with noisy measurements (noise variance is 10 $\text {degree}^2$)

The results for more noisy measurements (a variance of 25 $\text {degree}^2$) is shown in Fig. 3. A reliable detection cannot be performed in that case, i.e., no threshold can be found to yield an acceptable misdetection and false alarm rate. The spoofer was turned on for the same time instances as in the previous simulation (indicated by the blue background again). The detection-flag is indicated in blue. It should be mentioned that the statistic not only depends on noise, but also on the current geometry, i.e. the satellite constellation and the direction of the spoofer/repeater.

Fig. 3

Sum of singular value-based detection of anomalies with noisy measurements (noise variance is 25 $\text {degree}^2$)

5 Snapshot-based attitude estimation

To summarize the results derived so far, the block diagram of the basic snapshot-based algorithm (depicted in Fig. 4) is presented. A quality metric based on the normalized sum of singular values $q \in {[}0,1{]}$ is computed by the algorithm:

$$\begin{aligned} q= f({\varvec{ \Sigma }}) = \frac{1}{N}\sum \limits _{k=1}^3 \sigma _k. \end{aligned}$$

(19)

A flag indicating spoofing $s_\text {spo}$ by comparing the sum with a certain threshold $\epsilon$ is returned as well:

$$\begin{aligned} s_\text {spo} = {\left\{ \begin{array}{ll} 1 \quad : 0 \le q \le \epsilon \\ 0 \quad : \epsilon < q \le 1. \end{array}\right. } \end{aligned}$$

(20)

Fig. 4

Block diagram of the basic snapshot-based algorithm (taken from [22])

First, the performance is analyzed using simulated data sets. A random almanac consisting of N unit vectors is generated. Afterwards a random attitude is generated by choosing a unit vector for the rotation axis and a scalar rotation angle randomly. The almanac unit vectors are then rotated by this attitude, yielding $\{\varvec{b}_k^\text {perf}\}_{k=1}^N$. Finally, the measurements are generated by again generating a random rotation (with the constraint, that the rotation axis is orthogonal to $\varvec{b}_k$).

Optionally a spoofer can be turned on for specified simulation runs. This will force all DoA estimates of the impinging signals to have the same azimuth and elevation, before noise is added. For the described examples, the affected simulations are the ones in the intervals [200, 400], [650, 800] and [1000, 1500].

5.1 Example 1: low noise with six signals

Figure 5 shows some exemplary results for 2000 subsequent runs using a noise variance of 5 $\text {degree}^2$ and 6 reference angles. Figure 5 shows the same setup for only three almanac measurements. The runs where a spoofer was active are indicated by a blue background.

Fig. 5

Difference to reference for roll, pitch and yaw in degree; the noise variance was 5 $\text {degree}^2$ and $N=6$

Figure 6 depicts the resulting normalized singular values for this example.

Fig. 6

Normalized singular values of ${\varvec{ C }}$; the noise variance was 5 $\text {degree}^2$ and $N=6$

Figure 7 shows the resulting SVD-based metric and the detection flag.

Fig. 7

Quality metric and returnd spoofing flag; the noise variance was 5 $\text {degree}^2$ and $N=6$

5.2 Example 2: high noise with four signals

Again 2000 runs were performed using only 3 signals with a three times higher noise variance of 15 $\text {degree}^2$. Figure 8 shows the resulting error of the attitude angles compared to the reference. The number of signals is too low to perform an estimate with such a big noise.

Fig. 8

Difference from reference for roll, pitch and yaw in degree; the noise variance was 15 $\text {degree}^2$ and $N=3$

Figure 9 shows the corresponding singular values. When spoofing is active, the second and third singular value ($\sigma _2$ and $\sigma _3$) again almost vanish, but not completely, which is due to the noise.

Fig. 9

Normalized singular values of ${\varvec{ C }}$; the noise variance was 15 $\text {degree}^2$ and $N=3$

Fig. 10

Quality metric and returned spoofing flag; the noise variance was 15 $\text {degree}^2$ and $N=3$

As depicted in Fig. 10, spoofing detection is still almost always reliably possible. Only one mis-detection happened around epoch 800.

6 Multi-antenna GNSS receiver test platform

The detection methods shown in the previous paragraphs (Sect. 3) are implemented in a receiver platform. By using such a platform, the performance of the detection methods and algorithms can be evaluated and compared. A block diagram of the platform is depicted in Fig. 11. The following qualitative requirements are mandatory and therefore have to be taken into account during the design phase:

• Robustness against environmental conditions, i.e., salty air, is essential.

• The power consumption has to be low enough to record long enough.

• To avoid fire, the heat produced by the devices has to be acceptable.

• The downmixing has to be done for all channels synchronously in parallel.

• A calibration signal is necessary to measure and therefore compensate different latencies of the cables connecting the antennas, that are in general not equal.

• Real-time processing and recording has to be done in parallel and therefore splitting of the signal in the IF-domain is mandatory.

• All devices (i.e., mixers and AD-samplers) have to be synchronized using a common local oscillator frequency.

• The sampling rate needs to be high enough to capture the whole GPS L1 band.

• The storage (i.e., RAID-device) has to be fast and big enough to allow high bit resolutions of the sampler and several minutes of recording time.

A block diagram of the whole test equipment is depicted in Fig. 11. The details of the different parts are described in the following subsections.

Fig. 11

Block diagram of the GNSS receiver test platform

An active antenna is used for reception. It includes low-noise amplifiers and RF bandpass filters. For downmixing the GPS L1 frequency band (center frequency: 1.57542 GHz) to an intermediate frequency, a front-end is used. It includes power supply for the amplifiers of the antenna, downmixers as well as a phase-locked loop frequency synthesizer, which is fed by an external 10 MHz reference. The signal is split in the IF domain. One path is fed into the sampling device. This is on custom of the shelf (COTS) hardware capable of sampling up to 16 channels in parallel. The sampled data are further processed using DLR’s software receiver (MAGELLAN). The second path is fed into the real-time array receiver GALANT. Again COTS hardware is used as a basis to implement the receiver logic in both field programmable gate array (FPGA) and software. Parts requiring computational expensive operations (i.e., MACs: multiply and accumulate units) are implemented on the FPGA. Further details can be found in Refs. [32, 33]. Both the software and the real-time receiver’s generic structure are depicted in Fig. 1 in Sect. 2.

6.1 Antenna array

The system’s antenna is the first element of the processing chain. The 2 $\times$ 2 uniform rectangular array (URA) dual-frequency antenna array provides 4 degrees of freedom (DOFs). The element spacing is approximately half the wavelength for both GPS L1 and Galileo E5a. The array is depicted in Fig. 12.

Fig. 12

Picture of the dual-band 2 $\times$ 2 uniform rectangular array

The array is the key-enabler for the whole system. To enable accurate DoA estimates, a calibration input is available to inject a calibration signal (patented, see [34]) synchronously into all patches. The interested reader can find further details in Ref. [35].

6.2 Front-end

A single front-end (designed and manufactured by DLR) is capable of downmixing up to nine channels in parallel for a certain frequency (in that case GPS L1). The mixing is implemented following a superheterodyne principle. The frequency is derived by locking a phase-locked loop (PLL) to an external clock (10 MHz). The intermediate frequency is chosen to be 75 MHz. The signals are amplified using low-noise amplifiers (LNAs) preserving a good signal-to-noise ratio (SNR). Another key element is a highly linear phase response of the IF-bandpass filter. In parallel, one synchronous upmixing channel allows to translate the calibration signal from the IF to the HF-domain.

An opened front-end box is shown in Fig. 13.

Fig. 13

Picture of the opened single-frequency RF front-end (for E1/L1), capable of downmixing up to nine channels in parallel

A detailed description of the front-end design can be found in Ref. [35].

6.3 Sampling device

The sampling device is based on custom of the shelf (COTS) hardware from National Instruments (NI). The processing is customized, by modifying the software (LabView), which is executed on a NI PXIe-8135 Core i7 processor. Sampling is performed using the NI PXIe-5171R oscilloscope providing up to eight channels with a resolution of 14 bit and a sampling rate of 250 MHz. Since the available signal bandwidth of the front-end is around 20 MHz, a downsampling to 100 MHz is implemented before data storage. The operation is performed on an FPGA, which is also part of the device. This involves a bandpass undersampling mechanism. The signal’s intermediate frequency after sampling therefore is 25 MHz in reverse frequency position. An external 10 MHz reference frequency is used for synchronization.

A storage device (NI HDD-8266 RAID with an overall capacity of 2 TB) is connected via an external PCIexpress interface. This allows a maximum storage time of around 25 min for eight channels. The sampling device (top) and the RAID (bottom) is shown in Fig. 14.

Fig. 14

Picture of the NI PXI System including the RAID storage

6.4 Real-time receiver platform (GALANT)

The digital part of the real-time receiver platform is again COTS hardware (PicoDigitzer 125). The whole device is clocked, using an external 10 MHz reference frequency. 16 A/D converters have a sampling rate of 100 MHz, making the signal again visible at 25 MHz in reversed frequency position. The correlation is performed on the internal VIRTEX-6 FPGA, whereas computationally less heavy operations run on an Core i7 processor. The calibration signal is generated and transferred to the analog domain using one of the up to 8 D/A channels. This allows the calibration of different cable lengths of the reception channels.

The receiver is shown in Fig. 15 (together with an L1 and E5a front-end):

Fig. 15

Picture of the real-time receiver GALANT (including two frontends)

7 Experimental evaluation of the test platform

The experiments using the platform were performed in calender week 24 of 2016. The tests including repeaters have been performed on $\text {June 17}\text {th},$ 2016. To be able to transmit in the GPS L1 frequency band, special permission is required. DLR is authorized by the corresponding German Authority⁸ to transmit these signals at certain locations (testbeds). For the campaign, the maritime jamming testbed in the Baltic sea (near Hiddensee) was chosen. The location is illustrated by the red circle in Fig. 16.

Fig. 16

Location of the jamming testbed, where the experiments have been performed

7.1 Dynamic trajectory

Two ships were available to perform the experiments. The planned dynamic repeater scenario is shown in Fig. 17. The static “repeater” vessel (Wind Protector) is anchored and depicted in orange. The dynamic “receiver” vessel (Baltic Taucher II) is shown in blue.

Fig. 17

Planned trajectory for the dynamic scenario

7.2 Repeater-vessel

A picture of the repeater installation is shown in Fig. 18. An aeronautical antenna was used for reception. After conditioning of the signal (amplification), a horn antenna was installed for re-transmission. Due to export regulations, further details of the repeater setup cannot be provided.

Fig. 18

Repeater installation on the transmission-vessel

7.3 Receiver-vessel

The system described in Sect. 5 was installed on the receiver-vessel. The antennas have been mounted on the mast to avoid multipath effects caused by reflections on the metal parts of the ship. A picture is shown in Fig. 19.

Fig. 19

Receiver vessel: the test platforms array antenna is depicted on the left and the ship’s navigation system’s antenna on the right

7.4 Board instruments

By inspecting the board instruments, the effect on ship’s navigation systems was used as an indicator for “success” of the repeater attack. An example of a successful experiment is shown in Fig. 20. The red line indicates the ground truth. During the attack, the position reported by the receiver vessel (circle) was almost the repeater vessel’s one (Wind Protector, shown in green).

Fig. 20

Board instruments visualizing a successful repeater attack

7.5 Real-time results

The algorithm depicted in Fig. 4 in Sect. 4 was implemented on the real-time receiver GALANT, described in Sect. 5. The processing result is sent to the graphical user interface including the “spoofing flag”. In Fig. 21, the presence of a spoofer/repeater is clearly indicated.

Fig. 21

Screenshot of the graphical user interface of the GALANT receiver, indicating the presence of a spoofer/repeater

7.6 Post-processing results

During the scenario, data were collected using the sampling device described in Sect. 5. The sampled data were fed into DLR’s software receiver. The previously described attitude estimation algorithm delivers the platform’s attitude together with the quality metric. A threshold of 0.985 was chosen for spoofing detection. This has been done by inspection, since not enough samples are available to derive and setup a clean statistical test. The result is depicted in Fig. 22.

Fig. 22

Post-processing result of the attitude quality used for indicating the presence of a repeater

The blue line shows the snapshot-based calculation of the singular value-based quality metric for every second. Caused by the noise added by the amplifiers of the repeater, the DoA estimates are fluctuating. Therefore, the quality metric q is fluctuating as well. This does not allow to find a proper threshold. Smoothing over a window of size w was implemented to compensate for this effect. Windows of size $w=10$ (red line) and $w=20$ (magenta line) are shown in Fig. 22.

A zoomed version of the plot is shown in Fig. 23. Smoothing allows for a more robust detection. The price for this is an increase in the possible time to detection of a few fractionals of a second as indicated in the plot.

For the spoofer/repeater being able to capture the receiver’s tracking loops (both implementations have been parametrized similarly), the distance between the repeater and victim receiver, the amplification of the repeater as well as the noise figure of the repeater’s amplifiers are the key parameters (see [36] for instance). However, once the loops are captured, the only thing that matters for detection is the estimated direction of arrival for the different impinging signals.

Fig. 23

Post-processing result of the attitude quality used for indicating the presence of a repeater (zoomed)

8 Summary and conclusion

In this work, an algorithm capable of simultaneously computing an array receiver’s attitude and providing a spoofing detection was presented. The performed experimental validation was described. The algorithm is based on direction of arrival measurements from the corresponding satellites. First, by using computer simulations, the performance of the algorithm was demonstrated. The platform utilized for real-time and post-processing was introduced. Finally, an experiment using the aforementioned platform was described, before the vulnerability of the state of the art as well the detection capabilities of the platform have been evaluated. Furthermore, the robustness of detection was increased by smoothing the returned quality metric. However, the time to detection is increased.