Secure global navigation satellite systems

Apparatuses and methods of securing Global Navigation Satellite Systems are disclosure. In one exemplary embodiment, a mobile device may comprise: a communication interface configured to monitor signals from a plurality of satellites, a processor configured to determine impairment of one or more satellites in the plurality of satellites using the signals form the plurality of satellites, a memory configured to store a status of the determined impairment of one or more satellites in the plurality of satellites, and the communication interface that transmits the status of the determined impairment of the one or more satellites in the plurality of satellites to a server. The processor further determines a position of the mobile device using the status of the determined impairment of one or more satellites in the plurality of satellites, and stores the determined position and a corresponding digital certificate indicative of authenticity of the determined position in a memory.

BACKGROUND

1. Background Field

This patent application relates to devices and methods for securing a Global Navigation Satellite System (GNSS), by use of point-to-point sessions, to transfer encrypted data related to position determination, between mobile devices and a server.

2. Background Information

Position location technologies typically utilize wireless signals concurrently transmitted from known locations to determine position. In many prior art technologies, the wireless signals are concurrently transmitted from a multiplicity of satellites (in satellite positioning systems) at a known time, and with a predefined frequency. For example, the Global Positioning System (GPS), the GLONASS owned by the Russian Federation Government, Quasi-Zenith Satellite System (QZSS) over Japan, Indian Regional Navigational Satellite System (IRNSS) over India, Beidou over China and Galileo over Europe, are satellite systems that provide users equipped with a GNSS receiver the ability to determine their location. A GNSS receiver determines its location by measuring signals transmitted by the GNSS satellites. Specifically, a GNSS receiver acquires a signal from each satellite within its view of the sky. The times of arrival of the signals along with the exact location of the in-view satellites and the exact times the signals were transmitted from each satellite are used to locate the position of the GNSS receiver, via a trilateration calculation well known in the art.

There are multiple functions implemented by an exemplary GNSS receiver of such satellite signals: (1) computation of pseudoranges to the various satellites, (2) based on data transmitted in the satellite signals, determination of satellite timing, and extraction of ephemeris (position) data, and (3) based on a combination of these (specifically, pseudoranges, timing and ephemeris) computation of the position of the satellite receiver. Pseudoranges (PRs) measure the time delays (or equivalently the ranges) between the satellites and the receiver, with a bias due to (a) the local clock in the receiver and (b) satellite clock. In conventional autonomous satellite receivers, the satellite ephemeris and time of transmission data are extracted from the satellite signal, once the satellite signal is acquired and tracked.

However, GNSS signals are relative easy to spoof. Spoofed GNSS signals can provide incorrect observable metrics (e.g. Time, C/No, Doppler, pseudorange, Carrier Phase). Spoofing of data modulated in a signal can present incorrect ephemeris and almanac information (orbit/clock/health). There appear to be no built-in authentication methods for civilian signals, although GPS has Y code for military users. A certification method fur civilian use appears to be in discussion, for Galileo. And, currently, there appears to be no built in authentication methods for civilian use of such GNSS signals. Even when not spoofed, actual GNSS signals are not guaranteed to be correct all the time. For example, GNSS constellations can break due to: (a) single satellite failures, for example unpredicted clock errors or other satellite vehicle (SV) malfunctions, (b) system wide failures, for example, corrupt upload of content such as the Glonass ephemeris failures, and (c) constellation can be intentionally directed to not comply with a published standard (e.g. ICD). GNSS failures of the type described above can affect various applications and/or users, such as: accurate timing of transactions, authentication of transactions (relying on trusted location sources), synchronization of infrastructure (Power, Communications), positions used by E911/public safety, positions for navigation, automobile positioning on a map and route guidance, precision agriculture, positioning of drones, etc. Hence, improvements of the type described below are needed.

SUMMARY

Apparatuses and methods of securing Global Navigation Satellite Systems are disclosure. In one exemplary embodiment, a mobile device may comprise: a communication interface configured to monitor signals from a plurality of satellites, a processor configured to determine impairment of one or more satellites in the plurality of satellites using the signals form the plurality of satellites, a memory configured to store a status of the determined impairment of one or more satellites in the plurality of satellites, and the communication interface is further configured to transmit the status of the determined impairment of the one or more satellites in the plurality of satellites to a server.

In another exemplary embodiment, a method of securing a Global Navigation Satellite System, may comprise: monitoring, by a communication interface of a mobile device, signals from a plurality of satellites, determining, by a processor of the mobile device, impairment of one or more satellites in the plurality of satellites using the signals form the plurality of satellites, storing, in a memory of the mobile device, a status of the determined impairment of one or more satellites in the plurality of satellites, and transmitting, by the communication interface of the mobile device, the status of the determined impairment of the one or more satellites in the plurality of satellites to a server.

In yet another exemplary embodiment, a server may comprise a transceiver configured to receive data collected from a plurality of satellites by a set of GNSS receivers, a processor configured to determine impairment of one or more satellites in the plurality of satellites, a memory configured to store a status of the determined impairment of one or more satellites in the plurality of satellites, and the transceiver is further configured to provide the status of the determined impairment of the one or more satellites in the plurality of satellites to one or more mobile devices. The determined impairment of one or more satellites in the plurality of satellites may comprise at least one of: an integrity impairment received from an augmentation system, an identification of a type of source of the integrity impairment, or a combination thereof. The data collected from the plurality of satellites may comprise observable metrics of the plurality of satellites, modulation data of the plurality of satellites, or some combinations thereof in some aspects, the set of GNSS receivers are located at geographically dispersed locations, and the set of GNSS receivers are protected from viruses, malware attacks and remote administration technologies.

In yet another exemplary embodiment, a method of securing a Global Navigation Satellite System, may comprise: receiving, by a transceiver of a server, data collected from a plurality of satellites by a set of GNSS receivers, determining, by a processor of the server, impairment of one or more satellites in the plurality of satellites, storing, in a memory of the server, a status of the determined impairment of one or more satellites in the plurality of satellites, and providing, by the transceiver of the server, the status of the determined impairment of the one or more satellites in the plurality of satellites to one or more mobile devices.

In some aspects, encrypted impairment SPS satellite data that includes identification of at least one of impairment or non-impairment of one or more satellite(s) in a satellite positioning system (SPS) may be received, from a wireless transmitter (e.g. of a cellular base station). Note that satellites are also sometimes referred to as satellite vehicles, abbreviated as SV in the following description. Identifier(s) of one or more impaired or unimpaired SPS satellite(s) may be decrypted from the encrypted impairment SPS satellite data received. Prior to their transmission by the wireless transmitter, the just-described identifiers of impaired (or unimpaired) SPS satellite(s) may be obtained by combining information from multiple sources, which are external to a mobile device. A position of the mobile device may be then determined, by using a plurality of observable metrics measured in the mobile device, of signals received from unimpaired SPS satellites without accessing navigation messages broadcast in the signals, based on access of navigation data related to acquiring SPS satellites stored in memory, and based on the identifier(s) of the one or more impaired or unimpaired SPS satellite(s).

In certain embodiments, a method includes receiving in a mobile device from a wireless transmitter, encrypted impairment SPS satellite data that comprises identification of at least one of impairment or non-impairment of one or more satellite(s) in a satellite positioning system (SPS). The method includes decrypting from the encrypted impairment SPS satellite data received in the mobile device, identifier(s) one or more impaired or unimpaired SPS satellite(s) obtained by combining information from multiple sources external to the mobile device. The method includes, accessing navigation data related to acquiring SPS satellites. The method includes determining a position of the mobile device, by using observable metrics measured in the mobile device of signals received from unimpaired SPS satellites without accessing navigation messages broadcast in the signals, based on the navigation data accessed by the accessing, and based on the identifier(s) of the one or more impaired or unimpaired SPS satellite(s) decrypted by the decrypting. Depending on the embodiment, the just-described accessing and determining may be performed in the mobile device, or performed in a server which receives the observable metrics measured in the mobile device.

In several embodiments, a mobile device includes a wireless receiver configured to receive from a wireless transmitter, encrypted impairment SPS satellite data that comprises identification of at least one of impairment or non-impairment of one or more satellite(s) in a satellite positioning system (SPS). The just-described mobile device also includes one or more processor(s) coupled to the wireless receiver. The one or more processor(s) are configured to decrypt from the encrypted impairment SPS satellite data received in the mobile device, identifier(s) of one or more impaired or unimpaired SPS satellite(s) obtained by combining information from multiple sources external to the mobile device. The one or more processor(s) are also configured clock offset access navigation data related to acquiring SPS satellites. The one or more processor(s) are further configured to determine a position of the mobile device, by using observable metrics measured in the mobile device of signals received from unimpaired SPS satellites without accessing navigation messages broadcast in the signals, based on the navigation data accessed by the one or more processor(s) configured to access, and based on the identifier(s) of the one or more impaired or unimpaired SPS satellite(s) decrypted by the one or more processor(s) configured to decrypt.

In some embodiments, one or more non-transitory computer-readable storage media have stored thereon, instructions, which, when executed by one or more computer(s), cause one or more processor(s) in the computer(s) to receive encrypted impairment SPS satellite data that comprises identification of at least one of impairment or non-impairment of one or More satellite(s) in a satellite positioning system (SPS). The just-described instructions, when executed by the one or more computer(s), may further cause the one or more processor(s) in the computer(s) to decrypt from the encrypted impairment SPS satellite data, identifier(s) of one or more impaired or unimpaired SPS satellite(s) that may be obtained by combining information from multiple sources external to the computer(s). The just-described instructions, when executed by the one or more computer(s), may also cause the one or more processor(s) in the computer(s) to access navigation data related to acquiring SPS satellites. The just-described instructions, when executed by the one or more computer(s), may further cause the one or more processor(s) in the computer(s) to determine a position of a mobile device, by using observable metrics measured in the mobile device of signals received from unimpaired SPS satellites without accessing navigation messages broadcast in the signals, based on the navigation data accessed execution of the instructions to access, and based on the identifier(s) of the one or more impaired or unimpaired SPS satellite(s) decrypted by execution of the instructions to decrypt.

In many embodiments, an apparatus includes means for receiving encrypted impairment SPS satellite data that comprises identification of at least one of impairment or non-impairment of one or more satellite(s) in a satellite positioning system (SPS), means for decrypting from the encrypted impairment SPS satellite data received by the means for receiving, identifier(s) of one or more impaired or unimpaired SPS satellite(s) obtained by combining information from multiple sources external to the apparatus, means for accessing navigation data related to acquiring SPS satellites, and means for determining a position of a mobile device, by using observable metrics measured in the mobile device of signals received from unimpaired SPS satellites without accessing navigation messages broadcast in the signals, based on the navigation data accessed by the means for accessing, and based on the identifier(s) of the one or more impaired or unimpaired SPS satellite(s) decrypted by the means for decrypting.

It is to be understood that several other aspects and embodiments will become readily apparent to those skilled in the art from the description herein, wherein it is shown and described in various aspects and embodiments, by way of illustration. The drawings and detailed description below are to be regarded as illustrative in nature and not as restrictive.

DETAILED DESCRIPTION

Unless expressly stated otherwise, reference numerals identical to one another in the attached drawings ofFIGS. 1A-1F, 2A-2F, 3A-3B, 4A-4D, 5A-5B, 6, 7A-7D, 8, and 9A-9Drefer to components that operate similar or identical to one another, as readily apparent to a skilled artisan in view of the description below.

The detailed description set forth below in connection with the attached drawings is intended as a description of various aspects of the present disclosure and is not intended to represent the only aspects in which the present disclosure may be practiced. Each aspect described in this disclosure is provided merely as an example or illustration of the present disclosure, and should not necessarily be construed as preferred or advantageous over other aspects. The detailed description includes specific details for the purpose of providing a thorough understanding of the present disclosure. However, it will be apparent to those skilled in the art that the present disclosure ma be practiced without these specific details. In some instances, well-known structures and devices are shown in block diagram form in order to avoid obscuring the concepts of the present disclosure. Acronyms and other descriptive terminology may be used merely for convenience and clarity and are not intended to limit the scope of the disclosure.

In several embodiments, a server103(FIG. 1A), which may correspond to a particular provider of assistance data on impairment (or non-impairment) of one or more satellite(s) of a satellite positioning system (SPS) to mobile devices in a geographic region, may exchange one or more messages with a mobile device110(FIG. 1A) and/or software provisioned therein, as part of an authentication process. Specifically, in such embodiments, server103is configured to provide assistance data to mobile device110, only after authentication and registration with server103.

Accordingly, in some embodiments, server103may be representative of one or more computing platforms provisioned to function similar (or identical) to a location server that provides location assistance data to mobile device110and receives location related information from mobile device110. Accordingly, server103may configure, information in mobile device110related to protection of assistance data that includes information on impairment of SPS satellites. Hence, various techniques may be implemented via server103and/or mobile device110to protect such assistance data (which may include impairment SPS satellite data140shown inFIG. 1C, for example), as described in US Publication 2014/0351886, entitled “METHODS AND APPARATUSES FOR PROTECTING POSITIONING RELATED INFORMATION” by Stephen William Edge, and Andreas Klaus Wachter, as inventors, which is incorporated by reference herein in its entirety.

In certain instances, an authentication process used by server103may verify whether impairment SPS satellite data140(FIG. 1C) may be provided to a secure GNSS client112(which may be implemented as hardware or software, depending on the embodiment), provisioned within mobile device110. Alternatively, or additionally, an authentication process used by secure GNSS client112may verify the identity of a particular provider represented by server103. Accordingly, in some embodiments, server103and mobile device110may communicate with one another and/or with third party computers in a secure manner, to verify that a relationship exists between a provider of assistance data and software that needs a position of mobile device110, to allow for transfer of impairment SPS satellite data140from server103to mobile device110, in an encrypted manner.

Accordingly, in some embodiments, as illustrated inFIG. 1A, a user101may use a computer102in a point-to-point communication session104(or alternatively, mobile device110itself may set up a point-to-point communication session104), to register with server (also called “secure GNSS server”)103, and on successful completion of registration (e.g. by answering questions), receive credentials during this session. Although user101is a human in several embodiments illustrated inFIG. 1A, one or more actions of user101may be performed in alternative embodiments by software executing in computer102and/or in mobile device110, or a combination thereof.

The credentials received from server103on authentication and registration, may thereafter be used by a processor405(FIG. 5A) in mobile device110in executing instructions in client software (also called “secure GNSS client”)112in memory401, to create a point-to-point connection (also called “point-to-point communication session”)105with server103(FIG. 1A), over a wireless link119(FIG. 1B) between wireless transceiver118in mobile device110and wireless transmitter107of a wireless network (e.g. in a cellular base station). The processor405in mobile device110may then receive, via wireless transceiver118through this point-to-point connection105, encrypted impairment SPS satellite data140from server103(seeFIGS. 1A, 1B and 1C) and store the received data in memory401. Hence, in some embodiments of the type described in the preceding paragraph above, wireless transceiver118, memory401and processor405programmed with software comprising instructions, in combination with one another implement a means for receiving information via a point-to-point communication session and a means for transmitting information via the point-to-point communication session.

In certain embodiments, the above-described point-to-point communication session104and105may be implemented with server103functioning as a SUPL Location Platform (SLP) and mobile device110functioning as a SUPL Enabled Terminal (SET). In such embodiments, server103and mobile device110may support a SUPL location solution defined by OMA, and may exchange messages with one another as part, of a SUPL session according to the SUPL Userplane Location Protocol (ULP). ULP may be used to establish and release SUPL sessions between server103and mobile device110, transfer assistance data including impairment SPS satellite data140from server103to mobile device110, and transfer one or more observable metrics from mobile device110to server103and or enable other aspects of secure transfer of information between one another, e.g. as described for PPAD and PPD in US Publication 2014/0351886. As part of a SUPL session between server103and mobile device110, one or more positioning protocols may be used whose messages may be embedded inside SUPL messages (e.g. inside SUPL POS and SUPL POS INIT messages) and transferred as part of the SUPL session. The positioning protocol messages may be used in some embodiments to transfer PPAD and PPD. The positioning protocols may comprise the 3GPP defined LTE Positioning Protocol (LPP), the OMA defined LPP Extensions (LPPe) protocol, the 3GPP defined Radio Resource Control (RRC) protocol, the 3GPP defined Radio Resource LCS Protocol (RRLP) and the 3GPP2 defined IS-801 or C.S0022 protocol.

As noted herein, in some embodiments, the server103may need to verify the identity of a provider of a mobile device110in order to know, from an existing relationship, that any assistance data (e.g. impairment SPS satellite data140) sent by server103will be treated securely by mobile device110. Similarly, a mobile device110may need to verify the identity of a provider of server103in order to know that observable metrics sent by mobile device110to server103will be treated securely and/or to know that server103can send certain useful or reliable types of assistance data to mobile device110. The identity of the provider of server103may be a name (e.g. a printable character string), a decimal number, a sequence of decimal digits, a sequence of hexadecimal digits, a sequence of characters, a binary number or some other value and may be standardized (e.g. by ISO, ITU, 3GPP, IETF) or may be proprietary.

The encrypted impairment SPS satellite data140(FIG. 1C) transmitted by server103to mobile device110may identify only localized impairment (or non-impairment) of one or more satellite(s)120N (seeFIG. 1B), by limiting identification of impairment(s) (or non-impairments) to a geographic region (cellular region serviced by (or covered by) wireless transmitter107) in which is located the mobile device110(to which the encrypted impairment SPS satellite data is transmitted). Impairment of one or more, satellite(s), e.g. satellite120N (seeFIG. 1B) may be due to any reason, e.g. due to localized spoofing by a spoofer109which may be physically present in the same geographic region as mobile device110(e.g. within 10 miles distance). Alternatively, satellite120N may be impaired due to some defect therein.

The impairment SPS satellite data140is used by mobile device110to determine a new position114(seeFIG. 1B) of itself, and/or to send to server103measurements (or observable metrics) of signals received from satellite(s)120A-120M (seeFIG. 1A) identified as unimpaired, for use by server103in position determination of mobile device110. Hence, a position of mobile device110may be determined (either by mobile device110, or by server103, or by both), by using observable metrics of satellite signals121A-121N that are received (and one or more of which are measured) in mobile device110. Specifically, observable metrics measured by mobile device110, are at least of satellite signal(s)121A-121M (seeFIG. 1B) received from one or more satellite positioning system (SPS) satellite(s)120A-120M identified as unimpaired in the impairment SPS satellite data140(seeFIG. 1C).

Depending on the embodiment, observable metrics of signal(s) from one or more satellite(s)121N (seeFIG. 1B) identified as impaired in the impairment SPS satellite data, may be not measured by mobile device110(if GNSS receiver111therein has a filter responsive to satellite IDs), or alternatively may be measured by mobile device110(if GNSS receiver111has no filter responsive to satellite IDs), but discarded after being measured. The measurements of unimpaired observable metrics (e.g. pseudoranges) are stored in memory401of mobile device110and used in position determination, without accessing navigation message(s) broadcast in signals)121A-121M. Instead of demodulating navigation message(s) from signal(s)121A-121M, position determination in many embodiments may be based on navigation data108(seeFIG. 1A) related to acquiring one or more of SPS satellite(s)121A-121N that is accessed (e.g. by retrieval of stored version of navigation data108from memory), and further based on encrypted impairment SPS satellite data received securely from server103, via a point-to-point connection105.

As noted above, the encrypted impairment SPS satellite data may be transmitted to mobile device110via the point-to-point connection (also called “point-to-point communication session”)105from server103, through a wireless transmitter107(which may be a component of a cellular base station134shown inFIG. 1C). Mobile device110may decrypt the impairment SPS satellite data140received from server103, in addition to accessing the navigation data108(seeFIG. 1A), and based thereon determine the new position114(seeFIG. 1B), by using observable metrics of unimpaired satellite signals121A-121M (seeFIG. 1B) measured therein. Depending on the embodiment, access of navigation data108, may be performed in mobile device110by a means for additionally decrypting the navigation data108from a point-to-point communication session, which may be implemented similar or identical to means for decrypting encrypted impairment SPS satellite data from point-to-point communication session105.

In certain embodiments, server103may identify in impairment SPS satellite data140, identifiers of one or more SPS satellite(s)120A, . . .120I . . . (seeFIG. 1C) as impaired (or as unimpaired) in a geographic region in which mobile device110is located, based on observable metrics of satellite signals that are measured (e.g. to determine pseudoranges to corresponding satellites) by a number of receivers130A,130B,130C, . . .130I . . .130R,130S,130T (e.g. T receivers) that are protected from multiple known problems and are located at geographically dispersed locations which are precisely known (e.g. located across the US and/or across the world), installation of the just-described receivers, also called reference receivers130A,130B,130C, . . .130U . . .130R,130S,130T at geographically dispersed locations protects preparation of impairment SPS satellite data140by server103, from localized spoofing and/or impairments that may occur at locations external to these receivers and/or in other regions covered by other satellites. Each of reference receivers130A,130B,130C, . . .130I . . .130R,130S,130T may include a GNSS receiver coupled to memory and processor and/or positioning engine circuitry implemented in hardware, similar or identical to mobile device110shown inFIG. 5A.

Observable metrics that may be measured by a mobile device110I or a reference receiver130I depend on the embodiment. Any data obtained from GNSS signal processing may be measured to obtain observable metrics. Examples of observable metrics that may be used as described herein, in some embodiments, include: Code Phase, Pseudorange, Pseudorange Rate, and Doppler. In certain embodiments, a pseudorange is determined as a difference between two times: received time (as measured by a receiver's clock)—transmit time (as measured by satellite's clock).

In some embodiments, a plurality of reference receivers130A-130C (seeFIG. 1C) may demodulate at least a specific signal broadcast by a specific SPS satellite e.g. SPS satellite120A, to extract raw demodulated data therefrom. These multiple reference receivers then transmit the raw demodulated data to server103, via a plurality of point-to-point communication sessions (e.g. point-to-point communication sessions136A-136C). In several such embodiments, server103generates, for a specific SPS satellite120A, a corresponding specific ephemeris, which is included in navigation data transmitted to mobile devices in a geographic region (e.g. cellular region) in which the specific SPS satellite120A is visible, based on the raw demodulated data received from reference receivers130A-130C.

In many embodiments, encrypted impairment SPS satellite data140which is transmitted by server103to a mobile device110I (FIG. 1D) may be limited to SPS satellites that are (or soon will be) visible in a geographic region (e.g. cellular region135I) in which the mobile device110I is located, and may lack identifications of impairments in other geographic regions (e.g. cellular region135M). Mobile device110ofFIGS. 1A-1Cdescribed above can be any of mobile devices110A . . .110I . . .110J . . .110N shown inFIG. 1D. Moreover, cellular base station134shown inFIG. 1Cand described above can be any of cellular base stations134A . . .134I . . .134J . . .134N shown inFIG. 1D. Similarly, impairment SPS satellite data140shown inFIG. 1Cand described above can be impairment SPS satellite data140I shown inFIG. 1D.

As illustrated inFIG. 1D, server103may maintain in its memory510, a table indexed by identifiers of cellular base stations (e.g. names of cities), and for each cellular base station the table may contain the following columns: SVs that are visible now, impaired SVs, and navigation data for unimpaired SVs. Hence, in such embodiments, a geographic region (for which navigation data and/or impairment SPS satellite data is localized) is identified at, least partially based on a location of a cellular base station134I (which includes a wireless transmitter) currently in communication with a mobile device110I, and through which mobile device110I forms a point-to-point communication session137I with server103.

Hence, in embodiments of the type shown inFIG. 1D, mobile device110I may receive, via the above-described point-to-point communication session137I, navigation data (e g. in the first row of the table in memory510) which includes specific ephemeris of one or more specific SPS satellites (e.g. SVs2,3,4,5,6,7) that are visible in the cellular region135I (in which mobile device110I is currently located), and lacks ephemeris of other satellites (e.g. SVs21,22,23,23,17) visible in other geographic regions (e.g. cellular region135M). Depending on the embodiment, the navigation data may include or exclude, ephemeris of SPS satellites (e.g. SV1) that may be visible in cellular region135I but currently identified as impaired (e.g. from 1 to 2 pm, in cellular region San Jose). Depending on the embodiment, server103may or may not identify impairment of SVs in impairment SPS satellite data sent to mobile device110, as being localized in time, e.g. by identifying a specific start time and end time (or duration from start time), during which each satellite is identified as impaired (in a cellular region135I).

Based on the navigation data localized for a cellular region (e.g. as shown in the right-most column of the table in memory510inFIG. 1D), mobile device110I or server103(depending on the embodiment), uses observable metrics of signals received from SPS satellites visible in the cellular region to determine pseudoranges to the SPS satellites that are known to be unimpaired. Depending on the embodiment, SVs may be directly identified as unimpaired, e.g. by a listing of unimpaired SVs which may be included in impairment SPS satellite data140, or alternatively SVs may be indirectly identified as unimpaired by subtraction of a listing of impaired SVs included in impairment SPS satellite data140from a listing of visible SVs. In several such embodiments, the position of a mobile device110I may be determined based at least partially on pseudoranges to unimpaired SPS satellites (e.g. SVs2,3,4,5,6,7shown in the first row of a table illustrated inFIG. 1D), and ephemeris (included in navigation data) of the same unimpaired SPS satellites (e.g. SVs2,3,4,5,6,7).

Note that impairment SPS satellite data140described above can be, for example, impairment SPS satellite data140I for a cellular region135I as illustrated inFIG. 1E. Specifically, in certain embodiments, server103stores in its memory510(FIG. 1E), impairment SPS satellite data140I for each cellular region135I (FIG. 1D), in which a cellular base station134I is currently in communication with a mobile device110I. In the just-described embodiments, server103includes in impairment SPS satellite data140I, a count141(FIG. 1E) of how many SPS satellites (also called SVs) are impaired in cellular region135I (FIG. 1D). In addition, server103includes in impairment SPS satellite data140I, as many impairment records as the value of count141, one for each impaired SV. As illustrated inFIG. 1E, an impairment record may include an identifier142N of impaired SV # N, a start time114N which indicates when the impairment begins, a duration145N which indicates for how long the impairment occurs, and a type143N of the source of impairment information.

Specifically, server103assigns to type143N, one of multiple predetermined values147(FIG. 1E), which in some embodiments can be binary values. In the embodiment illustrated inFIG. 1Ethe type143N is assigned a value147D indicative of real time integrity identification received from an augmentation system (such as SBAS). The just-described value147D is selected by server103, in the embodiment illustrated inFIG. 1Efrom among four values: a first value147A indicative of co-located mobiles, a second value147B indicative of health bits from SVs, a third value147C indicative of reference receivers, and a fourth value147D indicative of real time integrity from an augmentation system (e.g. SBAS), based on where did server103receive information indicative of impairment of SV # N.

In some embodiments, the above-described first value147A for the type143N of the impairment's source is based on harvesting performed by server103in operation323(seeFIG. 3B), and in such embodiments SVs that are identified as impaired by this harvesting are subjected to testing (e.g. see act427inFIG. 4B) in mobile device110I and only when continued as unimpaired, then an observable metric of a signal from the SV is used in position determination in operation233(seeFIG. 2A). In the just-described embodiments, the above-described second value147B, third value147C, and fourth value147D, for the type143N of the impairment's source is determined directly by server103, e.g. in operation321, or in operation324or in operation325(FIG. 3B). Therefore, in several such embodiments, position determination in mobile device110may be performed by unconditionally not using observational metrics from SPS satellites that are identified as impaired by server103unless impairment of an SPS satellite120N is identified in sever103by harvesting of measurements from co-located mobile devices116I,117I in which case any measurement in mobile device110I of a signal from SPS satellite120N is subjected to additional tests, e.g. by use of a threshold (see act427, described below in reference toFIG. 4B), which threshold is automatically changed in some embodiments, depending on the type of source of impairment (of SPS satellite120N, e.g. if the value is147A as shown inFIG. 1E).

In the embodiment shown inFIG. 1E, another satellite SV # X is identified by server103as impaired (in impairment SPS satellite data140I), based on information received from reference receivers130A-130N, as indicated by third value147C assigned by server103to the type of impairment's source for this satellite SV # X in record146. In still another example shown inFIG. 1E, yet another satellite SV # Z, is identified by server103as impaired (in impairment SPS satellite data1400, based on information received from co-located mobiles116I and117I (FIG. 1D), as indicated by first value147A assigned by server103to the type of impairment's source for this satellite SV # Z in record148.

In some embodiments, N mobiles devices11A,110B . . .110I . . .110N transmit multiple sets of observable metrics to server103via corresponding N point-to-point communication sessions. In addition, using the same (or in some embodiments different) N multiple point-to-point communication sessions, the N mobiles devices11A,110B . . .110I . . .110N may additionally transmit to server403, identifiers of SPS satellites identified as impaired, multiple subsets of satellites, e.g. N subsets of satellites that are internally found by the N mobiles devices to fail corresponding N RAIM techniques. Thus, the N subsets of satellites marked as impaired are selected from among corresponding N sets of satellites visible to the N mobiles devices11A,110B . . .110I . . .110N located in the N geographic regions. Hence, in such embodiments, in each subset in one or more SPS satellite(s)120N (FIG. 1B) may be identified as impaired, by a mobile device110I (also referred to as mobile device110inFIG. 1B), by identification of the impairment due to RAIM failure in mobile device110I, with the just-described identification being done in mobile device110I from among a respective set of satellites120A-120N (FIG. 1B) that are visible to mobile device110I in the corresponding geographic region (e.g. cellular region135I).

Although four predetermined values147are illustrated for the impairment source's type, in the embodiment shown inFIG. 1E, in other embodiments, a type143N may be assigned one of only two values (e.g. binary values) as noted above, wherein a first binary value (e.g. value 0) denotes the type of impairment source to be co-located mobiles, and a second binary value (e.g. value 1) denotes the type of impairment source to be any other source (such as health bits from SVs, reference receivers, and real time integrity from an augmentation system). In embodiments that assign a binary value to the type of impairment source, a mobile device110I that receives impairment SPS satellite data140I may still use the value received for a satellite SV # Z in record148, to determine whether or not to perform additional tests in act operation (FIG. 2B) on signals received from SV # Z (as described below, in reference toFIG. 2B), in order to decide whether or not observable metrics of signals from SV # Z may be used in position determination in operation233(also described below).

In some embodiments that use multiple predetermined values147(e.g. as described in the preceding three paragraphs above), server103prepares impairment SPS satellite data140I by combining information from multiple sources, all of which are external to mobile device110I (FIG. 1D). Server103sends impairment SPS satellite data140I to mobile device110I after encryption, via a point-to-point connection137I (FIG. 1D). In addition to sending impairment SPS satellite data140I, server103additionally sends navigation data108(FIG. 1F) to mobile device110I, e.g. via the same point-to-point connection137I (FIG. 1D). In some embodiments, navigation data108includes a count of how many SPS satellites (also called SVs) are visible in cellular region135I (FIG. 1D), followed by a corresponding number of navigation records. Each navigation record includes an identifier152A of a SV # A, and ephemeris data153A of SV # A.

In some embodiments, server103prepares navigation data to include demodulated data received from SPS satellites via reference receivers130A-130T described above, and in addition further include extended ephemeris data. In several embodiments, the extended ephemeris data is prepared based on predictions that are valid for many days (typically 7 days, but can be as along as 31 days). Depending on the embodiment, the just-described predictions and/or extended ephemeris data may be generated internally by computations performed within server103, or received from a third party computer, such as a computer of a vendor (for example Rx Networks).

In addition, in certain embodiments, receivers130A-130I and optionally mobile devices110A-110N may acquire and track one or more impaired SPS satellites, such as SPS satellite120N (FIG. 1B), in addition to acquiring and tracking unimpaired SPS satellites120A-120M (FIG. 1B) even though observable metrics measured from and data demodulated (e.g. ephemeris) from signals transmitted by the impaired SPS satellite120N may be not used in position determination. Instead, such data from the impaired SPS satellite120N may be used for Cross Correlation detection etc. Accordingly, in some embodiments, receivers130A-130T and optionally mobile devices110A-110N may obtain ephemeris by demodulating signals from all visible SPS satellites (e.g.,120A-120M and120N inFIG. 1B), which then enables a server103to quickly find all SPS satellites in one or more geographic regions, such as cellular regions130A-130I (FIG. 1C), in some embodiments, navigation data108awhich is prepared by server103and transmitted to mobile device110may contain ephemeris and other such data which is limited to only those SPS satellites that determined by server103to be visible (or soon to be visible, e.g. within an hour) in a geographic region in which mobile device110is currently located. In alternative embodiments, the navigation data108amay be prepared by server103and transmitted to mobile device110to contain ephemeris and other such data not limited to only visible SPS satellites, (e.g. include ephemeris and other such data for all SPS satellites in a constellation).

In some embodiments, a geographic region may be small, e.g. a cellular region135I (FIG. 1D) on the order of a few kilometers around a cellular base station134I containing a wireless transceiver107(FIG. 1C) that is in communication with a wireless receiver118in mobile device110inFIG. 1C(also referred to as mobile device1100I inFIG. 1D), in other such embodiments, a geographic region may be large, e.g. on the order of the size of an area code of a telephone number, or even larger, on the order of the size of a country itself (e.g. in Europe), or even on the order of the size of a continent, depending on the embodiment.

In some embodiments, mobile device110includes client software (also called “secure GNSS client”)112that in turn includes registration logic210(FIG. 2A), communication interface220(e.g. implemented in software comprising instructions), and positioning engine230(e.g. implemented in software comprising instructions). Registration logic210(FIG. 2) responds to receipt of credentials (which may be received from a user101as described above in reference toFIG. 1A) by using these credentials to perform operation211(FIG. 2A) to create a point-to-point communication session105(with server103), followed by operation212(FIG. 2A) in which secure GNSS client112is authenticated, e.g. by use of keys and/or certificates, depending on the embodiment.

After successful authentication in operation212(FIG. 2A), registration logic210invokes operation of communication interface220. In certain embodiments, communication interface220(FIG. 2A) performs one or more operations, such as operation221(FIG. 2A) to receive securely from server103, via the point-to-point communication session105, encrypted impairment SPS satellite data140I (FIG. 1E). The encrypted impairment SPS satellite data140I contains identification of impairment of satellite(s), e.g. identifiers of impaired SVs (or in alternative embodiments, identifiers of unimpaired SVs). In some aspects, impairment SPS satellite data140I is regionalized (regardless of whether impaired SVs are identified or unimpaired SVs are identified therein) to contain identifiers of only those SVs that are visible in a geographic region (e.g. a cellular region), in which mobile device110is currently located. Receipt of impairment SPS satellite data140I which is regionalized enables mobile device110I to obtain a position fix faster, because extraneous impairment information relevant to other geographic regions (e.g. cellular regions135A,135B . . .135J, and135M, seeFIG. 1D), is not currently needed in mobile device110I is deliberately excluded.

In operation222(FIG. 2A), communication interface220decrypts the received impairment SPS satellite data140, to obtain identifiers of impaired SVs (or in alternative embodiments, identifiers of unimpaired SVs). As noted above in reference toFIG. 1F, identifier(s) of one or more impaired or unimpaired SPS satellite(s) (which are obtained by decryption in operation222) were included in impairment SPS satellite data140I by server103combining information from multiple sources, all of which are external to mobile device110I (FIG. 1D).

In some embodiments, a list of identifiers of impaired SVs (or a list of unimpaired SVs in the alternative embodiments) obtained by performing the operation221(FIG. 2A), may be supplied by a processor405(FIG. 5A) in mobile device110to an input port of a GNSS receiver111(seeFIGS. 2A and 5A) that contains a filter (e.g. in hardware). The just-described filter in GNSS receiver111may be designed to exclude generation of observable metrics (e.g. pseudoranges) from signals of SVs that are impaired, in other embodiments, another such GNSS receiver271(FIG. 2B) may not have an input port to accept identifiers of SVs that are impaired (or unimpaired SVs in the alternative embodiments), because GNSS receiver271does not have the just-described filter, to exclude SVs (seeFIG. 2B), in which case identifiers of impaired SVs (or unimpaired SVs in the alternative embodiments) may be stored by operation223(FIG. 2B), which is performed by mobile device110, in a storage device251(FIG. 2B) that is accessible to positioning engine230for future use therein, e.g. to discard in operation252(seeFIG. 2D, described below) any impaired data that may be generated by GNSS receiver271.

In certain embodiments, positioning engine230(FIG. 2A) performs one or more operations, such as operation231to access navigation data, and thereafter operation233to determine a new position of the mobile device, followed by operation234to store the new position with a digital certificate indicative of authenticity of the new position, a discussed below. Specifically, in operation231, positioning engine230accesses the navigation data108(FIG. 1A), e.g. by retrieval from a memory401(FIG. 5A) of mobile device110or from a storage device251(FIG. 2B). In some alternative embodiments, operation233may be implemented by receipt and decryption of navigation data in mobile device110, from a point-to-point communication session with server103. Hence, in some embodiments, a common point-to-point communication session105is used to securely receive (via cellular circuitry within mobile device110that is wirelessly connected to wireless transmitter107) both encrypted impairment SPS satellite data and navigation data. In some embodiments, both the just-described data in the preceding sentence may be limited by server103to a geographic region (e.g. a cellular region), in which mobile device110is currently located.

In operation233(FIG. 2A), positioning engine230(FIG. 2A) determines a position of the mobile device110, by using observable metrics (e.g. pseudoranges) measured in mobile device110(e.g. by GNSS receiver111) of signal(s)121A-121M (seeFIG. 1B) received from unimpaired SPS satellite(s)120A-120M without accessing navigation message(s) broadcast in the signal(s)121A-121M which are received in mobile device110, based on accessed navigation data (e.g. obtained from memory, or by decrypting the point-to-point communication session105) and based on unimpaired SPS satellite(s)120A-120M identified by decryption of encrypted impairment SPS satellite data (e.g. also obtained by decrypting the point-to-point communication session105).

Some embodiments of operation233(FIG. 2A) receives from GNSS receiver111only observable metrics of signals121A-121M from SPS satellites120A-120M identified as unimpaired. In such embodiments, operation233may be implemented, by performing one or more acts241-246illustrated inFIG. 2C. However, in alternative embodiments, operation233may receive from GNSS receiver271observable metrics of all signals121A-121N (which include all visible SPS satellites120A-120N, which includes impaired SPS satellite120N) as shown inFIG. 2B. In these alternative embodiments, operation233may be implemented as shown inFIG. 2), by performing one or more acts241-246(which are identical to these same acts shown inFIG. 2C), and in addition performing acts261,262(seeFIG. 2D) to process observable metrics of signal121N from impaired satellite120N to obtain a new position114(FIG. 1B) of mobile device110, as discussed below.

On completion of operation233, positioning engine230may perform a storage operation234(FIG. 2A), wherein a new position114of mobile device110is Stored securely in secure storage113(which may be implemented in, memory401of mobile device110), in association with a new certificate115that is indicative of authenticity of new position114. In some embodiments, secure storage113is implemented by a processor programmed with software comprising instructions to generate a checksum for each piece of data being stored by storage operation234, e.g. a first checksum for the new position114and a second checksum for the new certificate, and these two checksums are stored in a storage location that is normally inaccessible (e.g. inaccessible to positioning engine230), e.g. accessible only to the operating system.

Although the just-described storage operation234is performed in mobile device110of some embodiments, in other embodiments this storage operation234may be performed by server103, or storage operation234may be performed by both, depending on the embodiment. Accordingly, a processor programmed with software to generate one Of more checksum(s) as described in the preceding paragraph above may be included in either mobile device110or in server103or in both, depending on the embodiment. Moreover, in some embodiments, such a processor programmed with software to generate checksums) may be used to implement a means for storing in secure storage, based on memory and/or a storage device in combination with an operating system, to make the checksum(s) inaccessible outside the operating system.

In some embodiments, storage operation234protects the data being stored from unauthorized access and/or dissemination, whether accidental or deliberate. By way of an example, new position114of mobile device110is protected data. As another example, observable metrics (e.g. pseudoranges) generated by mobile device110are protected data. As yet another example, impairment SPS satellite data140are also protected data. All such protected data may be stored securely in some embodiments, by use of checksums as described in the preceding paragraph above. Various methods and apparatuses may be provided, e,e. as described in US Publication 2014/0351886, to implement protected storage of various types. The protected data may be transmitted directly or indirectly after encryption, between different electronic devices, such as server103and mobile device110. Moreover, as noted herein, in certain implementations an authentication process may be performed to ensure that a particular mobile device110is authorized to obtain protected data directly or indirectly from a particular server103. Here, for example, a certain protected data may be indicative of confidential (and possibly very precise) navigation data and/or ephemeris of one or more SPS satellites. In another example, in certain implementations an authorization process may be performed to insure that a particular server103is authorized to obtain protected data (e.g. observable metrics and/or position of a mobile device11t) directly or indirectly from mobile device110. Here, for example, certain protected data may be indicative of confidential location information regarding mobile device110.

In some embodiments, communication interface220(FIG. 2B) may perform one or more additional operations, such as operation223(similar to above-described operations221and222) to receive securely from wireless transmitter107and decrypt encrypted impairment SPS satellite data140I. In several such embodiments, in operation223, mobile device110stores in storage device251(which may be implemented, for example, as a hard disk or flash memory), identifiers of all satellites that are identified as impaired in impairment SPS satellite data140I, specifically hen records corresponding thereto have any value in the type of impairment's source which is not same as “co-located mobiles” (e.g. any of values147B,147C and147D inFIG. 1E).

When any record in impairment SPS satellite data140I identifies a satellite SV # Z as impaired and the type of impairment's source is first value147A indicating “co-located mobiles”, then such satellites are tested further in operation224. Specifically, in operation224(FIG. 2B), mobile device110applies one or more tests to signals received from satellite SV # Z, and if SV # Z is found to fail the one or more tests then mobile device110stores the identifier SV # Z in storage device251and marks it as impaired and unusable, so as to prevent use of observable metrics therefrom in position determination in operation233. Depending on the embodiment, in addition to marking SAT47as impaired in storage device251mobile device110may notify the server103, that SV # Z failed the one or more tests.

In some embodiments, impairment SPS satellite data140received in operation223(FIG. 2B) may optionally include a clock offset between a time base of the SPS and a cellular signal's transmission time from the base station, e.g. cellular base station134(FIG. 1C) which includes wireless transmitter107. In alternative embodiments, the just-described clock offset may be generated within a cellular base station134, based on another clock offset that is received therein (e.g. from server103or alternatively from wireless transmitter107), which may be adjusted based on a start time of transmission of a cellular signal from wireless transmitter107. In some of these alternative embodiments, a clock offset may originate in and be sent directly by wireless transmitter107to mobile device110(FIG. 2B), separately from impairment SPS satellite data140. Regardless of how the clock offset is received in operation223, mobile device110may store the clock offset in storage device251(FIG. 2B) and/or use it in an operation225.

Specifically, in operation225(FIG. 2B) mobile device110access the clock offset and uses it internally to identify in operation226, any SV that fails receiver autonomous integrity monitoring (RAIM) based on the received clock offset. The RAIM-failed SVs which are internally determined in operation226(FIG. 2B) may be transmitted to server103and optionally stored in storage device251for future use, e.g. to exclude observable metrics therefrom (e.g. pseudoranges), during position determination in operation233.

Position determination operation233(which may be performed in mobile device110and/or in server103depending on the embodiment), includes one or more acts241-246illustrated inFIG. 2C, and described next. In act241, positioning engine230may retrieve from memory, identities of one or more impaired SPS satellite(s) decrypted from encrypted data, and/or previously determined and stored locally (in mobile device110). The just-described encrypted data may include, for example impairment SPS satellite data and/or navigation data, received securely via point-to-point connection105. In some embodiments, the identities of impaired SPS satellite(s) which are retrieved in act241are used in act242, to generate pseudoranges, based on observable metrics of signals from SPS satellite(s) identified as unimpaired. Hence, the pseudoranges generated in act242include unimpaired pseudorange(s) between mobile device110and unimpaired SPS satellites120A-120M (seeFIG. 1B). In some embodiments, in act241, mobile device110may perform RAIM on the pseudoranges generated, to identify one or more SPS satellite(s) that are currently visible, as mobile-RAIM-failed based on, for example, outlier detection using observable metrics (and/or dock offset between GNSS time base and transmission time of signal at cellular station, as described above in reference to operation226inFIG. 2B).

In several embodiments, mobile device110(FIG. 2C) identifies unimpaired SPS satellites in act242, for subsequent use in position determination. Specifically, in act242of certain embodiments, impairment SPS satellite data140includes one or more records containing identifiers of impaired satellites, and these satellites are subtracted from a list of visible satellites, to identify the unimpaired SPS satellites. In alternative embodiments, impairment SPS satellite data140may include records containing identifiers of unimpaired satellites, and these satellites are identified in act242as unimpaired SPS satellites. Thereafter, the unimpaired SPS satellites are used to generate pseudoranges thereto, for use in position determination, also in act242.

In some embodiments, pseudoranges generated in act242(seeFIG. 2C) may be subjected to act243that uses the pseudoranges in a receiver autonomous integrity monitoring (RAIM) technique to locally identify one or more additional SPS satellite(s) as impaired, and these impairment identifications may be securely transmitted to server103as mobile-RAIM-failed. An identifier SV # Z of a satellite that is identified as mobile-RAIM-failed in mobile device110I (FIG. 2C) may be further checked by server103and thereafter identified as impaired, with the type of source being assigned the value “co-located mobile”, and distributed to mobile devices116I and117I (FIG. 1D) that are currently physically located in the same geographic region (or cellular region135I) as mobile device110I.

In some embodiments, a RAIM technique used in act243(seeFIG. 2C) in mobile device110may solve an over-constrained problem, for example, by obtaining five position-and-time solutions based on five combinations of four satellites, in a situation where five satellites are visible and identified as unimpaired. In this example, when there is a large error in pseudorange to one specific satellite, four solutions based on this specific satellite may be found to be similar to each other, and these four may differ significantly (e.g. more than 10%) from a fifth solution (which excludes this one specific satellite). In this case, the specific satellite is marked as mobile-RAIM-.failed (and the problem may be again solved, without this specific satellite's pseudorange which has been determined to be erroneous). Identity of a mobile-RAIM-failed satellite may be transmitted securely by mobile device110to server103, via point-to-point communication session105.

Instead of, or in addition to over-constraining by use of an extra satellite, other embodiments of a RAIM technique used in act243(seeFIG. 2C) may receive as input, the above-described clock offset (between GNSS time base and GSM signal's transmission time from cellular base station134), previously stored in storage device251(seeFIG. 2B). Thus, the clock offset may be used, to mark a specific satellite as mobile-RAIM-failed, in some embodiments of act243. Hence, depending on the embodiment, the just-described clock offset (also referred to as GSM-GNSS clock offset) may be additionally or alternatively used, with observable metrics generated in mobile device110(which in turn are used to calculate unimpaired pseudoranges), to ascertain a position in act245of each unimpaired SPS satellite that is visible (based on ephemeris of the unimpaired SPS satellite and observable metrics of a signal therefrom, pseudorange thereto).

Some embodiments of a RAIM technique used in act243(seeFIG. 2C) in mobile device110may receive as input, one or more sensor measurements, e.g. an indication of the current state of mobile device110as being either stationary or moving, as may be output by a motion sensor (which may be one of sensors417in mobile device110, shown inFIG. 5A). In several embodiments, input for RAIM technique used in act243may include (instead of or in addition to the stationary or moving current state of mobile device110), other data which may be indicative of terrestrial position and/or speed of mobile device110, e.g. output of position computation within mobile device110, based on measurements or metrics of other types of wireless signals, such as a WiFi signal which may indicate a rough position of mobile device110, e.g. within a few hundred meters (instead of a few meters, or a few feet based on use of GPS signals).

In certain embodiments of the type just described, the stationary state of mobile device110(seeFIG. 2C) is used with concurrently-determined position (e.g. in a prior iteration of act246and/or subsequent iteration of act246) to identify a specific satellite as “mobile-sourced” impaired if a triangulation solution based on observable metrics of a signal transmitted by the specific satellite (e.g. pseudorange indicates that mobile device110is moving (e.g. by comparison of positions output by the just-described two iterations of act246).

Some embodiments perform act243(which applies one or more RAIM techniques) prior to act242(which generates a plurality of pseudoranges), so that the pseudoranges generated are known to be unimpaired, and hence may be used directly in act244(seeFIG. 2C), described below. In alternative embodiments, pseudoranges may be generated (e.g. in act261inFIG. 2D) based on observable metrics of signals from impaired SPS satellites (which may be in addition to the above-described act242for unimpaired SPS satellites, or such pseudorange generation may be without distinction between impaired and unimpaired). In the just-described alternative embodiments, positioning engine230may perform an act262(FIG. 2D) to discard the pseudoranges of signals from SPS satellites that are identified as impaired (regardless of whether the identification of impairment originated in the server103, or locally within mobile device110).

Thus, in the just-described position determination operation233, based on SPS satellite(s)120N being known to be impaired (e.g. from the encrypted impairment SPS satellite data), one or more impaired pseudorange(s) to the impaired satellite(s)120N may be either not generated during pseudorange generation in act242, or are generated in act261(FIG. 2D) but are programmatically excluded (by being discarded in act262by execution of software) from usage in position determination. Hence, on completion of act242and on entering the act243(inFIGS. 2C and 2D), unimpaired pseudorange(s) between mobile device110and unimpaired SPS satellite(s)120A-120M (seeFIG. 1B) are generated, which improves accuracy of the244-246(described below), in position determination operation233.

In some embodiments, positioning engine230in mobile device110performs acts244-246in a normal manner, to determine position of mobile device110in three coordinates (x, y, z) and an offset t of an internal clock within mobile device110. Specifically, in act244, positioning engine230applies to unimpaired pseudoranges received from act242, one or more corrections, such as corrections for clock offset, relativistic effects, ionospheric signal propagation delays, which mobile device110may receive securely from server103, via point-to-point communication session105.

In some embodiments, after operation of registration logic210, mobile device110may perform in communication interface220, one or more operations226,227and/or228(FIG. 2E) in addition to (or in some embodiments instead of) operations221and222(FIG. 2A) and/or223-226(FIG. 2B). Specifically, in operation226, communication interface220in mobile device110generates observable metrics of satellite signals (e.g. pseudoranges) directly or indirectly by operation of GNSS receiver111, and optionally one or more measurements from multiple sensors of various types in mobile device110, such as a motion detector, a camera, and a microphone. Operation226(FIG. 2E) is followed by operation227in which a point-to-point communication session is used by communication interface220to transmit to server103, encrypted observable metrics of signals from SPS satellites, and/or sensor measurements. The just-described point-to-point communication session which is used in operation227may be same or different (depending on the embodiment) from a point-to-point communication session105over which encrypted impairment SPS satellite data may (or may not) have been received by mobile device110from server103, e.g. in operation221(FIG. 2A) or operation223(FIG. 2B).

In embodiments of the type described in the preceding paragraph, in an operation252(FIG. 2F), server103receives the encrypted observable metrics of satellite signals (and optionally the sensor measurement(s)), decrypts the received data (including the observable metrics (e.g. pseudoranges), and the sensor measurements), and discards certain observable metrics that are of signals from satellites identified as impaired. Then, in operation253(FIG. 2F), server103determines a position of mobile device110by using observable metrics (e.g. pseudoranges) measured in mobile device110of signal(s) received from unimpaired SPS satellite(s) without accessing navigation message(s) broadcast in the signal(s) received.

Server103may perform operation253ofFIG. 2Fin addition to or as an alternative to mobile device's own position determination operation233ofFIG. 2A. Operation253performed by server103may be based on navigation data (e.g. received from reference receivers), and based on unimpaired SPS satellite(s) (e.g. also received from reference receivers), in addition to a set of observable metrics of satellite signals measured in and received from mobile device110. Hence, operation253in server103may be performed in a manner similar (or in some cases, identical) to operation233described above in reference toFIG. 2A, for a mobile device's own position determination. For an illustrative implementation of operations233and253, seeFIG. 4A, described below. Depending on the embodiment, operation253in server103(FIG.2E) may differ from operation233in mobile device110(FIG. 2A), e.g. due to certain sensors' measurements being available in mobile device110but not in server103, and/or due to observable metrics of satellite signals measured in other mobile devices being available in server103but not in mobile device110.

On completion of operation253, server103may perform operation254ofFIG. 2F, to store in secure storage (e.g. in memory510), a secure position based on: mobile device's position determined in operation233, and a newly-.generated digital certificate that is indicative of authenticity of the position. Thereafter, server103may perform an operation235(FIG. 2F) to transmit to mobile device110, via a point-to-point communication Session, in encrypted form, the just-described position and the certificate. Mobile device110then performs operation228(FIG. 2E), to, receive the position (and the digital certificate) in encrypted form from server103, decrypts the received position and authenticates it using the received certificate.

In some embodiments, instead of (or in addition to) operations254and255, server103may be programmed to perform one or more of operations256and257(FIG. 2F). Specifically, in operation256, server103simply stores a newly-determined position of mobile device110with a time stamp which is indicative of a time at which mobile device110measured the observable metrics used in position determination. After operation256, server103returns to operation252(FIG. 2F). After performance of operation253and256(FIG. 2F) repeatedly for a predetermined number of times (or for a predetermined duration, e.g. 1 hour), server103performs operation257(FIG. 2F) wherein server103prepares a trajectory of mobile device110based on the stored positions (over the predetermined duration), and creates a certificate to indicate authenticity of the trajectory, and then securely transmits the trajectory with the certificate in encrypted form, over a point-to-point connection, e.g. to mobile device110and/or to a third party requester.

In some embodiments of the type illustrated inFIG. 1C, reference receivers130A-130T at locations geographically dispersed from one another, generate observable metrics and raw demodulated data from signals that are received from SPS satellites120A-120Z, as shown by act312(FIG. 3A). Act312is followed by act313(FIG. 3A) in which reference receivers130A-130T transmit the observable metrics and demodulated data, via a plurality of pint-to-point communication sessions136A-136T (collectively referred to as point-to-point connections136) to server103(FIG. 1C). Each of reference receivers130A-130T also performs an act311to execute anti-virus, anti-malware and/or other anti-hacking software before, after, between, and concurrently with (in a time shared manner), acts311and312described above. By performance of act311, reference receivers130A-130T are protected from multiple known problems, e.g. various types of viruses, malware attacks, and remote administration technologies (RATs).

In embodiments of the type described in the preceding paragraph, server103may be programmed with software to perform one or more of operations321-326(FIG. 3B) as follows. In operation321, server103accesses from memory510, observable metrics514stored therein, which were previously received from reference receivers130A-130T (T in number), via a plurality of point-to-point communication sessions136A-136T (also T in number), after measurement of satellite signals by receivers130A-130T (see act313inFIG. 3A). In operation321, server103applies a global integrity monitoring technique to the T sets of observable metrics (e.g. pseudoranges) from the T reference receivers, to mark as impaired N subsets of satellites (e.g. one or more impaired satellites in each subset). Impaired satellites identified in each subset by server103are selected respectively from among N sets of satellites (e.g. six to eight satellites in each set) that are visible in corresponding N geographic regions (e.g. N cellular regions, such as cellular regions135A-135N shown inFIG. 1D). In addition to identifying impaired satellites, in some embodiments, server103also identifies (and stores in memory510), a type of source of impairment, for each impaired satellite and a third value147C (FIG. 1E) for this type (as “reference receivers”) is automatically selected by server103as described above. A global integrity monitoring technique, which is used by server103in operation321, may be implemented in some embodiments, as described below in reference toFIG. 4D.

Then, server103may perform an operation322(FIG. 3B), by selecting from among these N subsets of impaired satellites, a specific subset I that corresponds to a cellular region135I where a mobile device110I is located, to prepare one or more records in impairment SPS satellite data140I shown inFIG. 1F, for future use, specifically in transmission (in operation326, described below), via a point-to-point communication session137I to mobile device110I. In preparing the records in impairment SPS satellite data140I, server103may optionally include (depending on the embodiment), identification of the type of impairment's source (e.g. third value147C) for each impaired satellite. Also depending on the embodiment, in operation322, server103may optionally further include a start time and duration (or end time) of impairment, in each record in impairment SPS satellite data140I.

In some embodiments, server103may be programmed with software to perform an operation323to repeatedly apply a regional integrity monitoring technique as follows. Specifically, in operation323(FIG. 3B), server103accesses from memory510, multiple sets of observable metrics515I stored therein, which were previously received from corresponding multiple mobile devices110I,116I and117I located in cellular region135I (seeFIG. 1D), via corresponding multiple point-to-point communication sessions, such as point-to-point communication session137I (which is just one of the multiple individual sessions with respective multiple mobile devices), after measurement of satellite signals by the mobile devices110I,116I and117I (see operation227inFIG. 2E). In operation323, server103applies a regional integrity monitoring technique to the multiple sets of observable metrics515I from the multiple mobile devices110I,116I and117I, to mark one or more satellites currently visible in cellular region135I as impaired. In addition to identifying impaired satellites, in some embodiments, server103also identifies (and stores in memory510), a type of source of impairment, for each impaired satellite and a first value147A (FIG. 1E) for this type (as “co-located mobiles”) is automatically selected by server103as described above. A regional integrity monitoring technique, which is used by server103in operation323, may be implemented in some embodiments, as described below in reference toFIG. 4C. Operation323may be performed repeatedly, to iterate over each cellular region135I from which at least one mobile device110I establishes a point-to-point session with server103.

In embodiments of the type described in the preceding paragraph, server103may additionally perform an operation324(FIG. 3B) iteratively for each cellular region135I, by combining into impairment SN satellite data140I which is currently stored in memory510(see operation322) for a cellular region135I, one or more newly-created records that are prepared using identifiers of one or more satellite(s) identified as impaired by regional integrity monitoring in operation323. In doing so, as noted above in reference to operation322, server103may optionally include identification of type of impairment's source (e.g. first value147A), for each impaired satellite and optionally a start time and duration (or end time) of impairment.

In certain embodiments, server103performs an operation325(FIG. 3B) to combine into impairment SPS satellite data140I stored (see operations322and324) for cellular region135I, (in which mobile device110I is located), one or more newly-created records that are prepared using identifiers of one or more satellite(s) identified as impaired by real time integrity in assistance information from augmented systems (e.g. SBAS), or in health bits from SVs, which information is previously received, and stored in memory510. In doing so, as noted above in reference to operation322, server103may optionally include identification of type of impairment's source (e.g. second value147B or fourth value147D), for each impaired satellite and optionally a start time and duration (or end time) of impairment.

In an operation326, after a point-to-point connection is set up with a mobile device110I, server103uses an identifier of a base station of cellular region135I in which mobile device110I is located, to access impairment SPS satellite data140I, which includes identification of impairment of satellite(s) in region in135I, and optionally identification of type of impairment's source and optionally start time and, duration of impairment), followed by encrypting and transmitting impairment SPS satellite data140I to mobile device110I.

In some embodiments, one or more processor(s) in either or both of mobile device110may determine a new position in operation233(FIGS. 2A, 2B) and/or server103may determine a new position (of a mobile device110) in operation253(FIG. 2F), by performing method410including acts411-415illustrated inFIG. 4A, as follows. Specifically, in act411, the processor may retrieve from a memory, pseudoranges, time and ephemeris of a specific unimpaired SV, followed by an act412in which the time and ephemeris retrieved are used to compute a state of the unimpaired SV, wherein the state may include, for example, position and/or velocity of the unimpaired SV. Acts411and412are repeatedly performed, for three or more SVs that are unimpaired and visible to a mobile device whose new position is to be computed. Next, in an act413, the processor(s) set up multiple pseudorange equations (one for each SV), as follows:
PseudoRange=Clock Bias+|SV Pos−User Pos)|

In the above formulation, SV Pos denotes a first position vector of a satellite SV in three dimensions, and User Pos denotes a second position vector in three dimensions of the mobile device on earth, and the vertical bars indicate that a magnitude of vector difference is to be added to clock bias (which is an offset between time at the mobile device and time at the satellite). User Pos and Clock Bias are unknown in this example, in which User Pos includes three coordinates (x, y, z) and Clock Bias includes a fourth coordinate of time (t), for all four of which a solution is obtained in a normal manner (e.g. by solving four simultaneous linear equations, using matrix operations) in act414(FIG. 4A).

Specifically, in act414(FIG. 4A), the processor(s) solve a linearized version of the pseudorange equations set up in act413, e.g. by using a weighted least squares formulation, known to a skilled artisan. Completion of act414results in three dimensional (3D) coordinates (x, y, z) of the mobile device's position on earth, as well as a time coordinate (t), all of which are stored in act415by the processor(s) performing method410, in memory (e.g. in secure storage113in mobile device110as shown inFIG. 5A, or in secure storage513in server103as shown inFIG. 5B).

In some embodiments, mobile device110performs an operation226(described above in reference toFIG. 2B), to identify impaired SVs using observable metrics based on GSM-GNSS clock offset, as illustrated by a method420including acts421-428(FIG. 4B), as follows. Specifically, in act421, one or more processor(s)405in mobile device110compute a current time in a SV, using GSM/Cell Offsets, as follows: Time=Local Cellular time+Time Offset. In performing the act421, time in multiple cell towers (which may be accessible to wireless transceiver118in mobile device110) can be averaged, to obtain more reliable local cellular time, in the above equation. In the above equation, Time Offset is a difference between the cellular network's time and a time base of SPS satellites) in a GNSS constellation, received by mobile device110from server103in operation226as described above in reference toFIG. 2B. Thereafter, also in act421, processor(s)405in mobile device110determine uncertainty in computed time, as follows: Uncertainty=Uncertainty of Local Cellular Time+Uncertainty of Time Offset.

In some embodiments, mobile device110performs another act422(FIG. 4B), to determine a time of transmission of a signal from a specific GNSS SV, as follows: Time of Transmission=SV Bit number+SV Bit Offset+SV Code Phase. In the just-described formulation, SV Bit number may be decoded from transmitted data, SV Bit Offset may be obtained from synchronizing SV Data bit edges, SV Code phase may be obtained from tracking code phase for SV signals. Thereafter, in act423, mobile device110checks if an approximate position thereof is known, e.g. based on a location of a cellular base station with which mobile device110is currently in communication.

If the answer in act423is no, mobile device110goes to act424, and computes received time as follows: Received Time=Time of Transmission+Default Time of Flight. In some embodiments, 80 milliseconds is used as the default time of flight, because SVs are in determined orbits around the earth, and the time it takes for signals to travel from SVs to earth's surface is bounded (approximately 80 milliseconds). In addition, in act424, mobile device110additionally computes uncertainty in the received time as follows: Received Time Uncertainty=Uncertainty of Approximate Position/Speed of Light. In the just-described formulation. Uncertainty of Approximate Position describes how accurate the Approximate Position is estimated to be. In some embodiments, location of a wireless transmitter of a cellular base station in communication with mobile device110is used as an approximate location of mobile device110, and the uncertainty is in the range of few kilometers to 10 s of kilometers. On completion of act424, mobile device110goes to act426, described below. In act423, if the answer is yes, then mobile device110goes to act425and computes received time as follows: Received Time=Time of Transmission+Time of Flight. In this formulation, Time of flight is time taken by a signal to go from SV to mobile device110. On completion of act425, mobile device110goes to act426.

In act426(FIG. 4B), mobile device110compares (a) received time for the specific SV with (b) time computed (e.g. in act421above). If the times (a), (b) differ by more than a threshold (which may be predetermined, or automatically selected), in act427mobile device110identifies the specific SV as RAIM-failed, else confirms the specific SV as unimpaired. Thereafter, in act428, mobile device110stores in memory401, the identification made (in act427) if this SV is identified as mobile-RAIM-failed (or marks this SV as unimpaired if confirmed), and also sends an identifier of the SV to server103when the SV is determined to be mobile-RAIM-failed.

In several embodiments, threshold comparison in act427(FIG. 4B) is performed using a Chi-Square test, to determine whether the SV is impaired or not, in such embodiments, the chi-square test is configured to test a measurement residual (e.g. received time) against an expected model (e.g. computed time), and if the residual is larger than an expected amount by a factor n (for example n=3) then the SV is identified as impaired. In several embodiments, the just-described factor n (with which an expected amount of time difference Δt may be multiplied) is automatically selected based on a type of source of impairment. For example, the just-described factor n, which is used in act427is set to value a 2 (or in some cases to value n=1) when a type of source of impairment has a first value147A that denotes “co-located mobiles”. But for all other types of sources of impairments, the just-described factor n, which is used in act427is set to value n=3 (which is less stringent, and thus easier for an SV to be confirmed as unimpaired). In alternative embodiments, the just-described factor n is predetermined to be same (e.g. value n=3) for all SVs (regardless of type of source of impairment or unimpaired).

Hence, some embodiments of method420(FIG. 4B) may perform a Chi-Square test in act427, to test a parameter (e.g. time difference) against a computed uncertainty thereon, by using the multiplying factor “n”. The value of this multiplying factor “n” determines, in such embodiments, the reliability and/or robustness of the test in act428. For example multiplying factor of n=3 provides 99% probability that the test identifies impaired satellites, whereas a factor of n=6 improve this test to provide better than 99.99% probability (for Gaussian distributions).

Therefore, in some embodiments, the above-described act427(FIG. 4B) is performed by a processor in mobile device110programmed with software comprising instructions, to implement a means for performing a test (such as the Chi-Square test) on one or more observable metric(s) of a signal received from an impaired satellite, to determine whether to include an observable metric measured thereof (e.g. a pseudorange), in determination of a new position of mobile device110.

In some embodiments, server103performs an operation323(described above in reference toFIG. 3B), to apply a regional integrity monitoring technique, as illustrated by a method430including acts431-436(FIG. 4C), as follows. Specifically, in act431, one or more processor(s)501in server103retrieve from memory510, observable metrics515I (e.g. in the form of pseudoranges) that are measured by multiple mobile devices, such as mobile device110I (described above). Then, in act432, server103uses time and ephemeris, to compute a state of a sped tic SV (position, velocity, etc.). The just-described acts431and432are repeated for each SV that is unimpaired, thereby to determine the states of unimpaired SVs. Subsequently, in act433, server103groups the mobile devices110A-110N (FIG. 1D) by geographic proximity (e.g. within a certain radius of a cellular base station, or by common SN's seen by mobile devices).

Thereafter, in act434(FIG. 4C), server103sets up pseudorange equations for a specific group of mobile devices, e.g. mobile devices110I,116I and117I that are currently located in cellular region135I (FIG. 1D). The pseudorange equations set up in act434are similar to the pseudorange equations set up in act413in, method410described above in reference toFIG. 4A, except that act434is performed repeatedly, for pseudorange measurements received from all mobile devices110I,116I and117I which are currently in cellular region135I.

Thereafter, in act435(FIG. 4C), server103uses the just-described RAIM formulation for a specific group of mobile devices, to determine if one or more SVs are identified as outliers, in a normal manner. Specifically, server103eliminates one measurement at a time from the above-described formulation for the specific group, and evaluates an answer obtained (for a mobile device's position) without the eliminated measurement, and checks if everything about that answer is consistent. If server103determines that including one particular measurement makes the answer inconsistent, then this measurement is determined to be an outlier.

Subsequently, in act436(FIG. 4C), server103collects pseudoranges of SVs that are commonly identified as outliers for positions of multiple mobile devices, to form an impaired set of pseudoranges, and then identifies one or more common outlier SVs as being impaired (and, in some embodiments also assigns “co-located mobiles” as a value of a type of source, of impairment). Thereafter, server103repeats the acts434-436for all other groups of mobile devices, which are located in corresponding cellular regions.

In some embodiments of the type described above, wherein server103is programmed with software comprising instructions to perform method430(FIG. 4C), having multiple mobile devices110A-110N (FIG. 1D) identify common impairments, increases the probability that the detection is correct, which therefore makes detection of impaired SPS satellites much more reliable and robust. For example if detection probability for one mobile device is Pd, then the detection probability for n mobile devices would be 1−(1−Pd)n.

In some embodiments, server103performs an operation321(described above in reference toFIG. 3B), to apply a global integrity monitoring technique, as illustrated by a method440including acts441-445(FIG. 4D). The global integrity monitoring technique can be implemented as an extension of RAIM (which is specific to one receiver), although there are more observable metrics (e.g. pseudoranges) than the number of unknowns to be determined, and a few of these observable metrics may be incorrect. The global integrity monitoring technique uses redundancy to determine (1) there is an error, and (2) which observation(s) are in error. With measurements received from multiple reference receivers130A-130T (FIG. 1C), there are more measurements than number of unknowns to be determined, for all the T reference receivers.

For every reference receiver there can be up to 4 unknowns to be determined (Position X, Position V, Position Z, and Time Offset). So there can be 4T unknowns to be determined. If every reference receiver sends more than 4 observable metrics, there are more than 4T observable metrics514(FIG. 5B) in memory510of server103. Hence, server103may determine if there are impairments in any observable metrics514and if so which specific observable metrics are in error. To reduce computation burden, the server103may group the T receivers into smaller sub groups and determine common pseudoranges that are impaired within those sub groups. The just-described subgrouping can be geography based, e.g. reference receivers within certain distance from one another can be formed by server103, into one sub group and processed as a cluster.

Accordingly, in some embodiments, in an act441, server103retrieves from memory510, observable metrics514received from reference receivers130A130T (FIG. 1C). Thereafter, in an act442, server103uses known locations of reference receivers130A-130I to determine if any SPS satellites120A-120Z (FIG. 1C) appear impaired, as seen by a particular reference receiver130I (e.g. if a code phase of a specific SV falls outside of a predetermined threshold, the specific SV is marked by server103as impaired, for this reference receiver130I). Note that as reference receivers are stationary and located at known locations, the only one variable is time in each reference receiver, which therefore needs to be estimated. Hence, all SV code phases compared to one reference SV should normally fall within a predetermined threshold.

Thereafter, in act443, server103checks if multiple computations for corresponding multiple reference receivers commonly determine any SVs as appearing impaired. If the answer in act443is no, then server103exits the global integrity monitoring technique, with no SV identified as impaired. If the answer in act443is yes, then server103goes to act444. In act444, server103checks if any SV(s) appear impaired to a majority of reference receivers, e.g. more than 50% of T reference receivers. If the answer in act444is no, then server103exits the global integrity monitoring technique, with no SV identified as impaired. If the answer in act444is yes, then server103identifies as impaired, all SVs that appear impaired to the majority of reference receivers. And, in some embodiments, in act445, server103also assigns “reference receivers” as a value of a type of source of impairment.

In some embodiments, a server103may be authenticated by using any one of several techniques of the type described in US Publication 2014/0351886. For signaling between a mobile device110and server103that is not secure (e.g. which may be intercepted by a third party), various known methods of authentication may be used (e.g., Message Digest 5 (MD5), Hash Message Authentication Code (HMAC), Cipher-based Message Authentication Code (CMAC), etc.), in which case a common secret key may be used, which may be hidden and not signaled openly. The common secret key may be agreed by a provider of assistance data that operates server103, and another provider that manufactures mobile device110, in the case that a relationship exists between these two providers. Such a secret key may be configured in each mobile device110manufactured by the mobile device provider and in each server103belonging to or operated by the assistance data provider. Thereafter, the just-described secret key, which is configured in server103and in mobile device110, may be used to authenticate a mobile device manufacturer to an assistance data provider and/or the assistance data provider to the mobile device manufacturer. If signaling between a mobile device110and server103is secure (e.g., as limy occur within a SUPL session), a common secret key may be used as a password and transferred openly from mobile device110to server103since it cannot be intercepted by other parties.

In some embodiments, to transfer authentication related data between server103and mobile device110, when authentication of an assistance data provider and/or mobile device manufacturer occurs as part of a SUPL session, the authentication data may be transferred using an existing authentication protocol, such as IETF EAP. Alternatively, the authentication data may be transferred using customized new parameters in SUPL or in a positioning protocol used with SUPL such as LPPe.

FIG. 5Aprovides a schematic illustration of one embodiment of mob device110that can perform the methods provided by various embodiments, as described herein. Similarly,FIG. 5Bprovides a schematic illustration of one embodiment of server103that can perform the methods provided by various embodiments, as described herein.FIGS. 5A and 5Bare meant only to provide generalized illustrations of certain components of mobile device110and server103respectively, any and/or all of which may be utilized in certain embodiments as appropriate.FIGS. 5A and 5Btherefore, broadly illustrate how individual system elements may be implemented in a relatively separated or relatively more integrated manner in mobile device110and server103.

Mobile device110may be any portable electronic device such as a cellular or other wireless communication device, personal communication system (PCS) device, personal navigation device (PND), Personal Information Manager (PIM), Personal Digital Assistant (PDA), laptop, camera, smartphone, or other suitable mobile platform that is capable of providing a user interface. Mobile device110includes hardware elements that can be electrically coupled via a bus (or may otherwise be in communication, as appropriate).

The hardware elements of mobile device110may include one or more processors405configured to perform one or more acts and/or blocks and/or operations described above, and may further include without limitation one or more general-purpose processors and/or one or more special-purpose processors (such as digital signal processing chips). Mobile device110may further include a positioning engine230implemented in hardware circuitry, and a GNSS receiver111also implemented in hardware, with either or both coupled to memory401and processor(s)405(FIG. 5A).

Mobile device110may include one or more input devices, such as touch-sensitive screen403and/or a microphone, and/or a speaker, a keyboard and/or the like. Mobile device110may also include a camera419. Mobile device110may further include (and/or be in communication with) one or more non-transitory memory401and/or storage device418, and either or boat of which can comprise, depending on the embodiment, local and/or network accessible storage, and/or can include, without limitation, a disk drive, a drive array, an optical storage device, a solid-state storage device such as a random access memory (“RAM”). Mobile device110may include read-only memory (“ROM”)409, which can be programmable, flash-updateable and/or the like. Storage device418may be configured to implement any appropriate data storage, including without limitation, various file systems, database structures, and/or the like, to implement the mobile device110, as may be apparent to a skilled artisan.

Mobile device110may also include a wireless transceiver118(e.g. including a modem therein) and/or a wireless network card, an infrared communication device, a wireless communication device and/or chipset (such as an 802.11 device, a WiFi device, a WiMax device, cellular communication facilities, etc.), and/or the like. Wireless transceiver118may permit data to be exchanged with a cellular network (such as the network described below, to name one example), other computer systems, and/or any other devices described herein.

Wireless transceiver118may include circuitry to interface to various wireless communication networks such as a wireless wide area network (WWAN), a wireless local area network (WLAN), a wireless personal area network (WPAN), and so on. The term “network” and “system” are often used interchangeably. A WWAN may be a Code Division Multiple Access ((DMA) network, a Time Division Multiple Access (TDMA) network, a Frequency Division Multiple Access (TDMA) network, an Orthogonal Frequency Division Multiple Access (OFDMA) network, a Single-Carrier Frequency Division Multiple Access (SC-FDMA) network, and so on. A CDMA network may implement one or more radio access technologies (RATs) such as cdma2000, Wideband-CDMA (W-CDMA), and so on. Cdma2000 includes IS-95, IS-2000, and IS-856 standards. A TDMA network may implement Global System for Mobile Communications (GSM), Digital Advanced Mobile Phone System (D-AMPS), or some other radio access technology (RAT). GSM and W-CDMA are described in documents from a consortium named “3rd Generation Partnership Project” (3GPP). Cdma2000 is described in documents from a consortium named “3rd Generation Partnership Project 2” (3GPP2). 3GPP and 3GPP2 documents are publicly available. A WLAN may be an institute of Electrical and Electronics Engineers (IEEE) 802.11x network, and a WPAN may be a Bluetooth network, an IEEE 802.15x, or some other type of network. The techniques may also be used for any combination of WWAN, WLAN and/or WPAN.

The described embodiments may be implemented by wireless transceiver118in conjunction with Wi-Fi/WLAN or other wireless networks. In addition to Wi-Fi/WLAN signals, mobile device110may receive via a receiver therein (e.g. GNSS receiver111), signals from satellites, which may be from a GPS, Galileo, Global Navigation Satellite System (GLONASS), Navigation Satellite Timing and Ranging System (NAVSTAR), QZSS, a system that uses satellites from a combination of these systems, or any satellite positioning system developed in the future, each referred to generally herein as a Satellite Positioning System (SPS) or Global Navigation Satellite System (GNSS).

In certain example implementations, an SPS may include at least one Global Navigation Satellite System (GNSS). By way of example but not limitation, a GNSS resource may include a GPS resource, an SBAS resource, a QZSS resource, a GLONASS resource, a Galileo resource, a Compass/BeiDou resource, and/or other like resources. By way of example but not limitation, a GNSS resource may be identified as being associated with a particular GNSS signal, a particular GNSS signal band, and/or particular space vehicle (SV).

Position determination method410(FIG. 4A) described above may be implemented in conjunction with various wireless communication networks such as a wireless wide area network (WWAN), a wireless local area network (WLAN), to wireless personal area network (WPAN), and so on. The term “network” and “system” are often used interchangeably. A WWAN may be a Code Division Multiple Access (CDMA) network, a Time Division Multiple Access (TDMA) network, a Frequency Division Multiple Access (FDMA) network, an Orthogonal Frequency Division Multiple Access (OFDMA) network, a Single-Carrier Frequency Division Multiple Access (SC-FDMA) network, Long Term Evolution (LTE), and so on. A CDMA network may implement one or more radio access technologies (RATs) such as cdma2000, Wideband-CDMA (W-CDMA), and so on. Cdma2000 includes IS-95, IS-2000, and IS-856 standards. A TDMA network may implement Global System for Mobile Communications (GSM), Digital Advanced Mobile Phone System (D-AMPS), or some other RAT. GSM and W-CDMA are described in documents from a consortium named “3rd Generation Partnership Project” (3GPP). Cdma2000 is described in documents from a consortium named “3rd Generation Partnership Project 2” (3GPP2). 3GPP and 3GPP2 documents are publicly available. A WLAN may be an IEEE 802.11x network, and a WPAN may be a Bluetooth network, an IEEE 802.15x, or some other type of network. The techniques may also be implemented in conjunction with any combination of WWAN, WLAN and/or WPAN.

A satellite positioning system (SPS) typically includes a system of transmitters positioned to enable entities to determine their location on or above the Earth based, at least in part, on signals received from the transmitters. Such a transmitter typically transmits a signal marked with a repeating pseudo-random noise (PN) code of a set number of chips and may be located on ground based control stations, user equipment and/or space vehicles. In a particular example, such transmitters may be located on Earth orbiting satellite vehicles (SVs). For example, a SV in a constellation of Global Navigation Satellite System (GNSS) such as Global Positioning System (GPS), Galileo, GLONASS or Compass may transmit a signal marked with a PN code that is distinguishable from PN codes transmitted by other SVs in the constellation (e.g., using different PN codes for each satellite as in GPS or using the same code on different frequencies as in GLONASS).

In accordance with certain aspects, the techniques presented herein are not restricted to global systems (e.g., GNSS) for SPS. For example, the techniques provided herein may be applied to or otherwise enabled for use in various regional systems, such as, e.g., Quasi-Zenith Satellite System (QZSS) over Japan, Indian Regional Navigational Satellite System (IRNSS) over India, Beidou over China, etc., and/or various augmentation systems (e.g., an Satellite Based Augmentation System (SBAS)) that may be associated with or otherwise enabled for use with one or more global and/or regional navigation satellite systems. By way of example but not limitation, an SBAS may include an augmentation system(s) that provides integrity information, differential corrections, etc., such as, e.g., Wide Area Augmentation System (WAAS), European Geostationary Navigation Overlay Service (EGNOS), Multi-functional Satellite Augmentation System (MSAS), GPS Aided Geo Augmented Navigation or GPS and Geo Augmented Navigation system (GAGAN), and/or the like. Thus, as used herein an SPS may include any combination of one or more global and/or regional navigation satellite systems and/or augmentation systems, and SPS signals may include SPS, SPS-like, and/or other signals associated with such one or more SPS.

Mobile device110may be sometimes referred to as a mobile station (MS) or user equipment (UE), such as a cellular phone, mobile phone or other wireless communication device, personal communication system (PCS) device, personal navigation device (PND), Personal Information Manager (PIM), Personal Digital Assistant (PDA), laptop or other suitable mobile device which is capable of receiving wireless communication and/or navigation signals. The term “mobile device” is also intended to include devices which communicate with a personal navigation device (PND), such as by short-range wireless, infrared, wireline connection, or other connection—regardless of whether satellite signal reception, assistance data reception, and/or position-related processing occurs at the device or at the PND. Also, “mobile device” is intended to include all devices, including wireless communication devices, computers, laptops, etc. which are capable of communication with a server, such as via the Internet, WiFi or other network, and regardless of whether satellite signal reception, assistance data reception, and/or position-related processing occurs at the device, at a server, or at another device associated with the network. Any operable combination of the above are also considered a “mobile device.”

In many embodiments, mobile device110may include a non-transitory memory401(FIG. 5A), which can include a random-access memory (RAIM) or read-only (ROM) device, as described above. One or more of the storage devices and/or memory401of mobile device110may comprise software (e.g. secure GNSS client112), to perform acts and/or blocks and/or operations of a method shown inFIGS. 2A-2F,3A,38,4A-4D,6,7A-7D,8, and9A-9D including an operating system, device drivers, executable libraries, and/or other code, such as one or more application programs, which may comprise computer programs provided by various embodiments, and/or may be designed to implement methods, and/or configure systems, provided by other embodiments, as described herein. Merely by way of example, one or more procedures described with respect to the method(s) discussed above, liar example as described with respect toFIGS. 2A-2F, 3A, 38, 4A-4D, 6, 7A-7D, 8, and 9A-9Dmight be implemented as code and/or instructions executable by mobile device110(and/or one or more processor(s)405therein) in an aspect, then, such code and/or instructions can be used to configure and/or adapt a general purpose computer (or other device) to perform one or more operations in accordance with the described methods.

A set of these instructions and/or code to perform a method ofFIGS. 2A-2F, 3A, 3B, 4A-4D, 6, 7A-7D, 8, and 9A-9Dmight be stored on a computer-readable storage medium, such as non-transitory memory401described above and/or storage device418. In same cases, the storage device418and/or the non-transitory memory401might be incorporated within a computer system, such as mobile device110. In other embodiments, the storage device418and/or the non-transitory memory401might be separate from mobile device110(e.g., a removable storage medium, such as a compact disc), and/or provided in an installation package, such that the storage medium can be used to program, configure and/or adapt a general purpose computer with the instructions/code stored thereon. These instructions might take the form of executable code, which is executable by mobile device110and/or might take the form of source and/or installable code, which, upon compilation and/or installation on mobile device110(e.g., using any of a variety of generally available compilers, installation programs, compression/decompression utilities, etc.) takes the form of executable code.

Substantial variations may be made in accordance with specific requirements. For example, customized hardware might also be used in mobile device110, and/or particular elements might be implemented in hardware, software (including portable software, such as applets, etc.), or both to perform any of operations or acts shown inFIGS. 2A-2F, 3A, 3B, 4A-4D, 6, 7A-7D, 8, and 9A-9D. For example, some or all of the procedures of the described methods may be performed by mobile device110in response to processor(s)405executing one or more sequences of one or more instructions (which might be incorporated into an operating system and/or other code, such as an application program) contained in memory401. Such instructions may be read into non-transitory memory401horn another computer-readable medium, such as one or more of the storage device(s)411.

If implemented in firmware and/or software, instructions to perform a method ofFIGS. 2A-2F, 3A, 3B, 4A-4D, 6, 7A-7D, 8, and 9A-9Dmay be stored as on one or more non-transitory computer-readable storage media. Examples include non-transitory computer-readable storage media in physical form encoded with a data structure and non-transitory computer-readable storage media encoded with a computer program. Non-transitory computer-readable storage media may take the form of an article of manufacture. Non-transitory computer-readable storage media in physical form includes any physical computer storage media that can be accessed by a computer. By way of example, and not limitation, such non-transitory computer-readable storage media in physical form can comprise SRAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other non-transitory medium in physical form that can be used to store desired program code in the form of instructions or data structures and that can be accessed by a computer; disk and disc, as used herein, includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and Blu-ray disc where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above should also be included within the scope of computer-readable media in physical form.

In some embodiments, one or more position(s) of a handset is/are determined, by avoiding use of spoofed GNSS signals. In several embodiments, position determination may be done locally in a handset, or in a server. When done in a server, the server may store a series of position(s) collected over time, as a trace of the handset. Regardless of whether determined locally or in a server, a determined position(s) may be paired, in some embodiments, with a new private certificate, to indicate authenticity of the position(s). Depending on the embodiment, certificate(s) and position(s) protected thereby can be stored locally or centrally, and supplied locally or over a network, to any application that requires certified position(s) of a handset. During position determination, spoofed GNSS signals may be avoided in some embodiments, by not using any modulation data from a GNSS satellite, and instead using substitute modulation data: (a) within a server that determines positions based on observable metrics received from multiple handsets via secure channels or (b) locally within each handset that determines its own position based on substitute modulation data received via a secure channel from a server. Spoofed GNSS signals may be further avoided in certain embodiments, by not using observable metrics identified (either by handset or by server) (a) as impaired via a secure channel or (b) based on time derived from a multi-technology source, e.g. WWAN or WLAN.

In some embodiments, new position(s) determined from spoof-avoided and/or unimpaired SPS satellite signals are paired with a new certificate, to indicate authenticity of the new position(s). Moreover, in certain embodiments, a server determines positions of handsets, based on locally-stored substitute modulation data (e.g. Ephemeris), and observable metrics received from handsets via secure communication channels. Furthermore, in several embodiments, each handset determines its own position, using observable metrics received from satellites, and substitute modulation data received via a secure communication channel from a server. Various embodiments of the type just described, in the preceding sentence, avoid observable metrics from SPS satellites that are expressly identified as impaired (e.g. by a server), via a secure communication channel. Moreover, some embodiments avoid observable metrics that are identified locally as impaired (within a mobile device), based on use of time from a non-satellite source (which may be a multi-technology source, e.g. WWAN or WLAN).

Various forms of computer-readable storage media in physical form may be involved in carrying one or more sequences of one or more instructions to the processor(s)405for execution. Merely by way of example, the instructions may initially be carried on a magnetic disk and/or optical disc of a remote computer. A remote computer might load the instructions into its dynamic memory and send the instructions as signals over a transmission medium to be received and/or executed by mobile, device110. These signals, which might be in the form of electromagnetic signals, acoustic signals, optical signals and/or the like, are all examples of carrier waves on which instructions can be encoded, in accordance with various embodiments.

Wireless transceiver118may receive wireless signals, and the bus then might carry the received signals (and/or the data, instructions, etc. carried by the received signals) to non-transitory memory401, from which processor(s)405retrieves and executes the instructions. The instructions received by memory401may optionally be stored on a non-transitory storage device418(e.g. a hard disk or flash memory) either before or after execution by processor(s)405. Memory401may contain at least one database according to any of the databases and methods described herein. Memory401may thus store any of the values discussed in any of the present disclosures, including a position and a certificate (e.g. in a pair of checksum-protected memory locations) in storage113that implements secure storage (seeFIG. 1A).

Many embodiments of the type described herein never use any demodulated data bit in a satellite signal received within a receiver of a mobile device. Moreover, in several such embodiments, all orbit/clock/health data used in a mobile device is only recovered from a centralized, authenticated server that uses industrial grade encryption for all communication transactions. In some such embodiments, the mobile device (which includes a secure GNSS client) is incapable of stand-alone operation of position determination (and instead, must be connected to a secure GNSS server, to determine the mobile device's position). In numerous embodiments, both the client and the server are authenticated. Thus, various such embodiments are implemented to use a new server type that only works with authenticated clients.

Moreover, in many embodiments, the mobile devices are configured to never set time front a GNSS signal. Instead, some embodiments of mobile devices may replace time setting with GTP TDP and/or use certified time supplied by a server. In several such embodiments, only authenticated mobile devices are allowed to access this service (for receiving time from the server). Numerous embodiments use a global set of reference receivers, to develop SV orbit clock predictions, and these reference receivers are configured to collect the measurements and raw demodulated data and send the same to a server. In many such embodiments, communications between reference receivers and a server are protected by strong usernames passwords and employ best encryption methods known, to minimize likelihood of a network attack. Furthermore, constant monitoring of all SPS satellites by secured reference receivers permits rapid identification of impaired SPS satellites and/or Constellations.

Measurement of observable metrics in mobile devices, and navigation data supplied by a server to the mobile devices in some embodiments, permit errant SPS satellites (one or more SVs, including a whole constellation in certain embodiments), to be identified in a couple of seconds. As soon as a fault is detected in several such embodiments, an alarm is sent to all registered mobile clients to block the use of this errant set of satellites. Localized spoofing of measurements is still possible in many embodiments, but this is made more difficult because navigation data is ignored. Hence in several such embodiments, spoofing is inconsistent with the secure data from the server, and therefore the spoofing easier to detect. A spoofing detection event by an authenticated and registered mobile device110is sent back, in many embodiments, to a server to permit alarms to be sent to all other mobile devices in its neighborhood, e.g. in the same geographic region (such as a cellular region).

FIG. 6illustrates an exemplary method of securing a Global Navigation Satellite System according to aspects of the present disclosure. As shown inFIG. 6, in block602, the method receives, by a transceiver of a server, data collected from a plurality of satellites by a set of GNSS receivers. In block604, the method determining, by a processor of the server, impairment of one or more satellites in the plurality of satellites. In block606, the method storing, in a memory of the server, a status of the determined impairment of one or more satellites in the plurality of satellites. In block608, the method providing, by the transceiver of the server, the status of the determined impairment of the one or more satellites in the plurality of satellites to one or more mobile devices. According to aspects of the present disclosure, the determined impairment of one or more satellites in the plurality of satellites may comprise at least one of: an integrity impairment received from an augmentation system, an identification of a type of source of the integrity impairment, or a combination thereof. The data collected from the plurality of satellites may comprise observable metrics of the plurality of satellites, modulation data of the plurality of satellites, or some combinations thereof. The set of GNSS receivers are located at geographically dispersed locations, and the set of GNSS receivers are protected from viruses, malware attacks and remote administration technologies.

FIGS. 7A-7Cillustrate various exemplary implementations of determining impairment of one or more satellites according to aspects of the present disclosure. In the example shown inFIG. 7A, in block702, the method determines whether a measured parameter of the satellite falls outside of a first reference threshold using the data collected from the plurality of satellites by the set of GNSS receivers. In block704, the method marks the satellite as an impaired satellite in response to a reference percentage of GNSS receivers in the set of GNSS receivers have identified the measured parameter of the satellite falls outside of the first reference threshold. In block706, the method stores information about the impaired satellite in the memory.

FIG. 7Billustrates another exemplary implementations of determining impairment of one or more satellites according to aspects of the present disclosure. As shown inFIG. 7B. In block712, the method selects, based on, geographic proximity, a group of mobile devices, in block714, the method examines range measurements, received from the group of mobile devices, with respect to the plurality of satellites. In block716, the method identifies outliers of the range measurements and corresponding one or more satellites associated with the outliers of the range measurements. In block718, the method marks the corresponding one or more satellites associated with the outliers of the range measurements as impaired satellites. In block720, the method stores information about the impaired satellites in the memory.

FIG. 7Cillustrates yet another exemplary implementations of determining impairment of one or more satellites according to aspects of the present disclosure. As shown inFIG. 7C, in block722, the method receives an identifier of an impaired satellite from a mobile device, where the impaired satellite is determined by the mobile device based on comparing a measured time of signal transmission between a satellite and a known location to a computed time of signal transmission between the satellite and the known location, and identifying the satellite as the impaired satellite in response to a difference between the measured time and the computed time being larger than a second reference threshold. According to aspects of the present disclosure. The status of the determined impairment of one or more satellites may comprise a number of impaired satellites in a geographic region; and for each impaired satellite in the geographic region, the status may further comprise a start time, a duration, and a type of source of impairment for each of the impaired satellite.

FIG. 7Dillustrates an exemplary implementation of assisting positioning of a mobile device according to aspects of the present disclosure. In the exemplary implementation shown inFIG. 7D, in block724, the method assists positioning of a mobile device, using the status of the determined impairment of the one or more satellites in the plurality of satellites, via a point-to-point communication session with the mobile device.

FIG. 8illustrates another exemplary method of securing a Global Navigation Satellite System according to aspects of the present disclosure. In the example shown inFIG. 8, in block802, the method monitors, by a communication interface of a mobile device, signals from a plurality of satellites. In block804, the method determines, by a processor of the mobile device, impairment of one or more satellites in the plurality of satellites using the signals from the plurality of satellites. In block806, the method stores, in a memory of the mobile device, a status of the determined impairment of one or more satellites in the plurality of satellites. In block808, the method transmits, by the communication interface of the mobile deice, the status of the determined impairment of the one or more satellites in the plurality of satellites to a server.

FIG. 9Aillustrates yet another exemplary implementations of determining impairment of one or more satellites according to aspects of the present disclosure. As shown inFIG. 9A, in block902, the method compares a measured time of signal transmission between a satellite and a known location to a computed time of signal transmission between the satellite and the known location. In block904, the method identifies the satellite as an impaired satellite in response to a difference between the measured time and the computed time being larger than a first reference threshold in block906, the method transmits an identifier of the impaired satellite to the server. According to aspects of the present disclosure, the method performed in block906may optionally and/or additional include the method performed in block908. In block908, the method determines a position of the mobile device using the status of the determined impairment of one or more satellites in the plurality of satellites.

FIG. 9Billustrates an exemplary implementation of determining a position of the mobile device according to aspects of the present disclosure. In the exemplary implementation shown inFIG. 9B, in block912, the method receives an encrypted data from the server via a point-to-point communication session between the mobile device and the server. In block914, the method decrypts the encrypted data from the server, wherein the decrypted data comprises an assistance data for a geographical region of the mobile device, where the assistance data comprises information about unimpaired satellites in the geographical region of the mobile device. In block916, the method determines a position of the mobile device using the assistance data for the geographical region of the mobile device.

According to aspects of the present disclosure, the method performed in block916may optionally and/or additional include the method performed in block918. In block918, the method stores, in the memory, the determined position and a corresponding digital certificate indicative of authenticity of the determined position.

FIG. 9Cillustrates another exemplary implementation of determining a position of the mobile device according to aspects of the present disclosure. In block922, the method receives an encrypted data from the server via a point-to-point communication session between the mobile device and the server. In block924, the method decrypts the encrypted data from the server, wherein the decrypted data comprises an assistance data for a geographical region of the mobile device, and where the assistance data comprises information about impairment status of satellites in the geographical region of the mobile device. In block926, the method processes the assistance data to identify unimpaired satellites in the geographical region of the mobile device. In block928, the method determines a position of the mobile device using the identified unimpaired satellites in the geographical region of the mobile device.

According to aspects of the present disclosure, the method performed in block928may optionally and/or additional include the method performed in block930. In block930, the method stores, in, the memory, the determined position as a three dimensional coordinate and a corresponding digital certificate indicative of authenticity of the determined position.

FIG. 9Dillustrates yet another exemplary implementation of determining a position of the mobile device according to aspects of the present disclosure. As shown inFIG. 9D, in block932, the method measures pseudoranges based on signals from a group of observable unimpaired satellites. In block934, the method applies one or more corrections to the pseudoranges. In block936, the method determines a position of each unimpaired satellite in the group of observable unimpaired satellites. In block938, the method performs triangulation to determine the position of the mobile device using the position of each unimpaired satellite in the group of observable unimpaired satellites. Note that the one or more corrections applied to the pseudoranges may comprise at least one of: corrections for clock offsets, corrections for ionospheric signal propagation delays, corrections for relativistic effects, or some combinations thereof.

According to aspects of the present disclosure, the method performed in block938may optionally and/or additional include the method performed in block940. In block940, the method stores, in the memory, the determined position as a three dimensional coordinate and a corresponding digital certificate indicative of authenticity of the determined position.

Note that at leastFIGS. 1A-1C, 5A-5B, 8, 9A-9Cand their corresponding descriptions have provided support for the structures that comprise means for monitoring signals from a plurality of satellites; means for determining impairment of one or more satellites in the plurality of satellites using the signals from the plurality of satellites; means for storing a status of the determined impairment of one or more satellites in the plurality of satellites; means for transmitting the status of the determined impairment of the one or more satellites in the plurality of satellites to a server; means for comparing a measured time of signal transmission between a satellite and a known location to a computed time of signal transmission between the satellite and the known location; means for identifying the satellite as an impaired satellite in response to a difference between the measured time and the computed time being larger than a first reference threshold; means for transmitting an identifier of the impaired satellite to the server; means for determining a position of the mobile device using the status of the determined impairment of one or more satellites in the plurality of satellites; means for receiving an encrypted data from the server via a point-to-point communication session between the mobile device and the server; means for decrypting the encrypted data from the server, wherein the decrypted data comprises an assistance data for a geographical region of the mobile device, and wherein the assistance data comprises information about unimpaired satellites in the geographical region of the mobile device; means for determining a position of the mobile device using the assistance data for the geographical region of the mobile device; means for storing the determined position and a corresponding digital certificate indicative of authenticity of the determined position; means for receiving an encrypted data from the server via a point-to-point communication session between the mobile device and the server; means for decrypting the encrypted data from the server, wherein the decrypted data comprises an assistance data for a geographical region of the mobile device, and where the assistance data comprises information about impairment status of satellites in the geographical region of the mobile device; means for processing the assistance data to identify unimpaired satellites in the geographical region of the mobile device; means for determining a position of the mobile device using the identified unimpaired satellites in the geographical region of the mobile device

means for measuring pseudoranges based on signals from a group of observable unimpaired satellites means for applying one or more corrections to the pseudoranges; means tom determining a position of each unimpaired satellite in the group of observable unimpaired satellites; means for performing triangulation to determine the position of the mobile device using the position of each unimpaired satellite in the group of observable unimpaired satellites; and means for storing the determined position as a three dimensional coordinate and a corresponding digital certificate indicative of authenticity of the determined position.

Some embodiments expose an IZat SDK to the application layer+deliver an application that allows a mobile device to register with the server. Such registration may allow such embodiments to create an account (with associated billing). In some embodiments, a secure GNSS client is distributed and installed in mobile devices, but is disabled until a mobile device has signed up (by supplying therefrom, a credit card number a bank account lumber or other payment information.). In several embodiments, a transaction of the type just described is independent of partner support. Additionally, in some embodiments, a secure GNSS client permits a Secure GNSS server to provide a signed version of a location, using private certificates that are created during account registration. In several such embodiments, use of a private certificate by a mobile device and/or server ensures that one or more new positions of a mobile device that are determined based on use of a secure GNSS client and/or secure GNSS server as described herein are available for distribution to any software and/or hardware that needs the mobile device's positions.

Moreover, in some embodiments, these positions can be cross checked against positions of the mobile device that may be obtained in other ways, using other software and/or hardware. Several embodiments support a secure location trace service, wherein, in addition to generating a secure position of a mobile device in real time on the mobile device, the mobile device may provide a secure Past Location Trace service wherein past raw measurement is provided by the mobile device to a server, and the server in turn may provide the same to other computer(s). In some embodiments, methods of the type described herein are extended to provide secure position as a service, and this secure position is treated as a certifiable service. Thus, in several embodiments, in addition to real time secure location on mobile devices, a service provides secure past locations and/or authenticated past locations reported by mobile devices, in offline server based type environment. Furthermore, certain embodiments provide sufficient information, in terms of measurement buffers from a mobile device to a server and the server produces authenticated location trace for the mobile device.

In several embodiments, a mobile devices stores measurement data that includes observable metrics, in a software-protected space in memory, and signs the stored data, when sending it to a server. Some such embodiments, are useful for law enforcement, financial transactions tracking, and secure tracking of mobile devices (making sure that a mobile device did not stray from predetermined paths) etc. Several embodiments may be implemented to provide secure authenticated “almost” real time positions, based on measurements that a server receives from mobile devices which may be some mobile devices configured with a secure GNSS client, and other mobile devices that do not contain any secure GNSS client. In some embodiments, the only data a server receives from mobile devices is raw measurements (as raw as possible, potentially multi technology measurements) and all computations using them are performed in a server, “securely”. Doing such computations in a server enables use o additional information, which is not normally available in mobile devices (such as a database of maps).

Some embodiments of servers include, in assistance data that is supplied securely to mobile devices, map data Or other authenticated data available in the servers. Moreover, some embodiments of servers extend a crowd sourcing/harvesting method, to add an extra protection layer. Furthermore, some embodiments of mobile devices collect suspected interference, spoofing data from multiple mobile devices, and store the spooling data collected in a database in the server, to identify what kind of trouble is prevalent in which areas/at times of day. Several such embodiments use this data base, to augment methods of the type described herein, to be more conservative (or less conservative) in terms of certifying positions of mobile devices.

Some embodiments use only GPS observables but no modulated navigation data, to determine position of a mobile device. Moreover, several embodiments use RAIM to detect oscillator drift, and identify a specific SPS satellite's signal(s) as faulty in a specific geographic location where spoofing is happening. An encryption-protected server of several such embodiments maintains a list of pairs (of spoofed satellite and geographic region), and sends alarms that identify spoofed satellites to mobile devices (so the mobile devices may avoid using the spoofed satellite's signals). Furthermore, in some embodiments, each reference receiver locally performs detection of spoofed satellites, and forwards spoofed satellite IDs to the server. Additionally, in several embodiments, a server identifies spoofed signal(s) centrally, based on raw measurements of GPS observables received from (1) multiple reference receivers that are stationary at known positions and (2) multiple mobile devices with less precisely known position (which, although less reliable individually, is based on a large number of these raw measurements).

In several such embodiments, each mobile determines its own position, using in its GPS calculation: (a) pseudo-range measurements of satellite signals, excluding an impaired satellite identified via a secure communication channel from a server, in combination with (b) broadcast ephemeris being totally replaced in the mobile by ephemeris data received via the secure communication channel. Furthermore, many embodiments combine (a) a set of geographically dispersed GNSS receivers protected from known problems (“integrity” receivers) in comb nation with (b) server extraction of broadcast ephemeris from integrity receivers, followed by server distribution of this ephemeris to mobile devices via corresponding secure communication channels. Moreover, in many embodiments, a server customizes identification of impaired SPS satellites to mobile devices, based on coincidence in time and position of each mobile device relative to an impaired SPS satellite.

Many embodiments implement distribution (via a secure communication channel) of a time offset of an asynchronous wireless signal from a cellular base station, relative to a GPS time base. Combination of two or more novelties as described above, in a Secure GNSS service (implemented by use of a secure GNSS client in mobile devices, and a secure GNSS server) has synergy in some embodiments, by use of a GPS-WWAN time offset from a server to enable a mobile device to locally identify and exclude SPS satellites that are impaired, and exclusion of impaired SPS satellites makes observable metrics generated in mobile devices more accurate, and this greater accuracy in turn enables the server to use such mobile-generated data, to identify additional impaired satellites. Some embodiments of the type described herein avoid use of spoofed GPS signals, based on a combination of components, each of which may or may not be implemented as described above, depending on the embodiment.