Global navigation satellite system interference attack detection

Methods, apparatus, and systems for detecting signals interfering with satellite signaling and determining a location of the interfering source are disclosed. In one example aspect, a method for detecting a signal directed at interfering with satellite signaling includes receiving, by a receiving node, a signal from a signal source, the signal produced by the signal source disguised as a satellite signal; determining an estimated position of the receiving node based on an orbital position of the satellite and a characteristic of the signal; comparing the estimated position of the receiving node with a reference position of the receiving node; determining that the signal source is a spoofing source different than the satellite; and determine a location of the spoofing source in part based on the estimated position.

BACKGROUND

A Global Navigation Satellite System (GNSS) refers to a constellation of satellites providing signals from space to transmit positioning and timing data to GNSS receivers. In general, GNSS signals have low power. A weak interference source can cause a GNSS receiver to fail or to produce hazardously misleading information. The issue of intentional or inadvertent interference to GNSS signals is of growing concern throughout the world.

DETAILED DESCRIPTION

A spoofing attack is when a malicious party impersonates another device or user on a network in order to launch attacks against network hosts, steal data, spread malware or bypass access controls. Spoofing attacks on global satellite signals become more prevalent nowadays, especially with the advancement in 5G technology (e.g., denser deployment of cells) and in autonomous driving.

This patent document discloses techniques that can be implemented in various embodiments to allow global satellite signal receivers to detect whether a suspicious interfering signal (also referred to as a jamming or a spoofing signal) is present. Furthermore, for receivers that are equipped with multiple antennas, an estimated location of the jamming signal can be determined based on Multiple-In-Multiple-Out (MIMO) technology. The disclosed techniques are applicable to both fixed assets (e.g., base stations) that are aware of their locations and mobile assets (e.g., cell phones) that can obtain location information from other access technologies, such as the Long-Term Evolution (LTE) and/or the Fifth-Generation (5G) wireless communication networks.

FIG.1illustrates an example scenario100in which a GNSS receiver receives signals from a satellite in accordance with one or more embodiments of the present technology. In some embodiments, the GNSS receiver101is aware of its own position (also referred to as a reference position). For example, the GNSS receiver101is a fixed station that knows its precise location based on configuration information (e.g., a base station configured by a cellular network). Alternatively, or in addition, the GNSS receiver101can calculate its reference position based on past signals it has received over time. As another example, the GNSS receiver101is a mobile device that is configured with a reference position. For example, the mobile device can be a mobile phone, a mobile tablet, a tracking device or telecommunications transceiver device deployed on vehicle such as an autonomous vehicle, AR/VR goggles, a wearable computing device (such as a smart watch or fitness tracker), or an Internet of Thing (IoT) device. The mobile device can receive assistance information from a cellular network indicating the mobile device's reference position. Based on the incoming signals, the GNSS receiver101can calculate an estimated position of itself based on the orbital position of the satellite and characteristics of incoming signals. By comparing the reference position with the estimated position, the GNSS receiver101can determine whether the incoming signal has been interfered (e.g., spoofed or jammed) by a GNSS jamming device.

FIG.2illustrates an example200of representing a position of a GNSS device or a satellite using spherical coordinates in accordance with one or more embodiments of the present technology. In this example, the GNSS receiver201stores its reference position with respect to the center of the Earth as (r1, θ1, φ1). The reference position can be configured by a network or be calculated by the receiver201based on past signals. The GNSS receiver201is also aware of the precise orbital position of the satellite203. The satellite203transmits a signal211that includes a message to the GNSS receiver201. The message can include a satellite identifier (ID), a week number, and Ephemeris information about satellite's location.FIG.11illustrates an example frame of a frame1100of a satellite message in accordance with one or more embodiments of the present technology. The Ephemeris information can include the current location of the satellite, the prediction location of the satellite, and/or status of the satellite. The Ephemeris can be used by the GNSS receivers to estimate locations relative to the satellites and/or positions on earth. The Ephemeris information can also be used to predict future satellite conditions for a given place and/or time. The GNSS receiver201can derive its estimated location as (r2, θ2, φ2) based on the orbital position of the satellite203and the characteristics of the signal211.

Table 1 shows example Ephemeris parameters that can be used to determine satellite coordinates at an observation epoch. These can parameters are periodically renewed to ensure validity and accuracy of the satellite positions.

ParameterExplanationtoeEphemerides reference epoch in seconds within the week√{square root over (a)}Square root of semi-major axiseEccentricityMoMean anomaly at reference epochωArgument of perigeeioInclination at reference epochΩoLongitude of ascending node at the beginning of the weekΔnMean motion differenceiRate of inclination angle{dot over (Ω)}Rate of node's right ascensioncuc, cusLatitude argument correctioncrc, crsOrbital radius correctioncic, cisInclination correction

An example algorithm is shown below to compute satellite coordinates (non-spherical coordinates) from the satellite message.

Operation101: compute the time tkfrom the ephemerides reference epoch toe(t and toeare expressed in seconds in a week).
tk=t−toeEq. (1)

Operation102: compute the mean anomaly for tk.

Operation103: compute the true anomaly vk:

Operation107: compute the longitude of the ascending node λk(with respect to Greenwich). This calculation uses the right ascension at the beginning of the current week (Ωo), the correction from the apparent sidereal time variation in Greenwich between the beginning of the week and reference time tk=t−toe, and the change in longitude of the ascending node from the reference time toe:
λk=Ωo+({dot over (Ω)}−ωE)tk−ωEtoeEq. (7)

Operation108: compute the coordinates in Terrestrial Reference System (TRS) frame, applying three rotations (around uk, ik, and λk):

R1and R3are the rotation matrices defined in Transformation between Terrestrial Frames.

In some embodiments, the GNSS receiver201can derive an estimated position of the receiver relative to the satellite203based on the reception angle and the magnitude of the signal211. While only one satellite203is depicted inFIG.2, a GNSS receiver can receive and decode signals from multiple satellites (e.g., between 4 to 24 satellites). For example, based on the amplitude of signals coming to the antenna, the GNSS receiver201can determine the power of received signals. If the GNSS receiver201is located in a rural or suburban area, the received signals can be deemed as the direct line of sight (LOS) signals because the receiver201does not receive much reflected signals from the nearby buildings. If the GNSS receiver201is located in an urban setting, random oscillating noise from reflections (e.g., reflections from nearby building) can be identified in the received signals. Based on the oscillating pattern, the GNSS receiver201can derive the power of the direct line of sight (LOS) signal by removing the oscillating noise. Based on the determined LOS signals, the GNSS receiver201can estimate the Longitude, Latitude, and Height positions of the satellite based on measuring the different speed of light (299,792 km/s) delays in the signals coming from the satellites. In some embodiments, each satellite signal includes the time the message was transmitted, orbital information (known as the Ephemeris information) and/or approximate orbits of the satellites (known as the Almanac information). The GNSS receiver201compares the estimated location (e.g., represented in spherical coordinates as (r2, θ2, φ2)) with the reference position (e.g., represented in spherical coordinates as (r1, θ1, φ1)) to determine whether the signal211can potentially be an interfering signal coming from a GNSS jamming device.

In some embodiments, the GNSS receiver can be a fixed station, such as a base station in a cellular network, that knows its precise location.FIG.3illustrates an example300of detecting a jamming signal that interferes satellite signals by a fixed station in accordance with one or more embodiments of the present technology. InFIG.3, a GNSS jamming device305transmits a jamming signal311towards to the fixed station301to interfere with signals from the satellite303. In this example, the fixed station301only needs to check the actual reception angle of the signal311to determine whether the signal311is from the satellite or a jamming device. For example, upon receiving the jamming signal311, the fixed station301calculates the reception angle β of the jamming signal311(e.g., represented using spherical coordinates). The fixed station301also derives a range of expected reception angles [θ1, θ2] with respect to its own position based on the orbital position of the satellite303. Because β falls out of the range of expected reception angles [θ1, θ2], the fixed station301can determine that the signal311is a jamming signal coming from a jamming device305. The fixed station301can carry out such determination for multiple satellites from which it receives signals.

With advancement in cellular technologies, the techniques shown inFIG.3can be extended to mobile stations to allow mobiles stations to distinguish jamming signals from the actual satellite signals. For example, assisted Global Positioning System (A-GPS) is a technology implemented in many mobile devices to allow the locations of these devices to be determined by the cellular network. The mobile devices can receive assistance information from the cellular network so that they are aware of their respective positions.FIG.4illustrates an example400of detecting a jamming signal that interferes a satellite signal by a mobile device in accordance with one or more embodiments of the present technology. InFIG.4, the mobile station401can obtain its own reference position from a cellular network based on techniques such as cell identifiers (IDs) and/or triangulation. A GNSS jamming device405transmits a jamming signal411towards the mobile station401to interfere with signals from satellites403a,403b. Upon receiving the jamming signal411, the mobile station401calculates the reception angle β of the jamming signal411(e.g., represented using spherical coordinates). The mobile station401also derives respective ranges of expected reception angles [θ1, θ2] and [η1, η2] relative to its own position based on the orbital positions of the satellites403a,403b. Because β falls out of these ranges (e.g., [θ1, θ2] and/or [η1, η2]), the mobile station401can determine that the signal411is a jamming signal coming from a jamming device405.

In some embodiments, when the mobile device401is in motion, movement of the mobile device401and/or its surroundings can impact the received GNSS signals. The GNSS signals may be attenuated; at times one or more satellites may not be visible. To ensure that the mobile device401can still estimate its location relative to the satellites when it is in motion, the cellular network can further provide information about the constellation of satellites. For example, the mobile device401can be initially configured to listen to GPS satellites. Based on the information provided by the cellular network, the mobile device401can listen to additional GNSS satellites from different global navigation satellite systems, such as the Global Navigation Satellite System (GLONASS), the Galileo satellite navigation system, and/or the BeiDou Navigation Satellite system (BDS), to compensate for any loss of signals. Based on its own location (e.g., determined based on assistance information) and additional satellite information from the cellular network, the mobile device401that is in motion can derive and refine the reception angle β of the jamming signal411, thereby determining that the jamming signal411comes from a jamming device405.

In some embodiments, a GNSS jammer is positioned to block signals from a satellite so as to mimic real satellite signals. In those cases, relying only on the actual reception angle of the incoming signal is not sufficient. The GNSS receiver can derive its estimated position based on other characteristics of the signal and determine whether the signal is a jamming signal or a satellite signal. For example, the GNSS receiver can expect certain parts of a message from a particular satellite. When the incoming signal fails to match the expected parts of the message, the incoming signal can be deemed as a jamming signal.

FIG.5illustrates an example500of detecting a jamming signal that blocks a satellite signal in accordance with one or more embodiments of the present technology. InFIG.5, a GNSS jamming device505is positioned to block signals from a satellite503. In some embodiments, interference between the signal511from the GNSS jamming device505and the signal from the satellite403causes the signal511to completely mask out the signal from satellite503. In those cases, the GNSS receiver501can determine that the signal511is a jamming signal.

In some embodiments, the signal511from the GNSS jamming device505is interpreted by the GNSS receiver501as a signal from the satellite503. However, the received signal511is deemed as invalid by the GNSS receiver501when the signal is corrupted or fails to match the expected parts of the message. Correspondingly, the GNSS receiver501can determine that the signal511is a jamming signal.

In some embodiments, the signal511from the GNSS jamming device505is interpreted by the GNSS receiver501as a valid signal from the satellite503. Based on the characteristics of the received signal511(e.g., the intensity of the signal), the GNSS receiver501calculates its estimated position and compares the estimated position with its reference position. Upon detecting that there is a mismatch between the estimated position and the reference position (e.g., the difference between the two positions exceeds a threshold), the GNSS receiver501can determine that the signal511is a jamming signal

After detecting a jamming signal, the precise location of the GNSS jamming device can be determined based on information from one or more GNSS receivers. For example, Multiple-Input-Multiple-Output (MIMO) is an antenna technology for wireless communications in which multiple antennas are used as the transmitter and receiver. A GNSS receiver using MIMO technology can provide multiple estimated positions that facilitate the triangulation of the GNSS jamming device location.FIG.6illustrates an example600of determining a location of a GNSS jamming device605in accordance with one or more embodiments of the present technology. InFIG.6, the GNSS receiver601is a fixed station equipped with multiple antennas621a,621b,621c. Each of the antennas621a,621b,621ccan be used to derive an estimated location of the respective antenna upon receiving the signal from the GNSS jamming device605. When the fixed station601has a large dimension and the antennas621a,621b,621care positioned reasonably apart from each other, multiple estimated positions can be used to triangulate the precise position of the GNSS jamming device605.

FIG.7illustrates another example700of determining a location of a GNSS jammer in accordance with one or more embodiments of the present technology. InFIG.7, multiple mobile GNSS receivers701a,701b,701cdetect jamming signals from the GNSS jamming device705. Each of the GNSS receivers701a,701b,701ccan determine an estimated position of the GNSS jamming device705relative to itself. The GNSS receivers then transmit the estimated positions to a communication node707(e.g., a base station). Based on information from multiple GNSS receivers, the communication node707can determine the location of the GNSS jamming device705using techniques such as triangulation. In particular, when a group of mobile devices within a cell or a few neighboring cells indicates that they have received a jamming signal, the network operator can easily determine where the jamming signals come from.

FIG.8illustrates a method800for detecting a signal directed at interfering with satellite signaling in accordance with one or more embodiments of the present technology. The method800includes, at operation810, receiving, by a receiving node, a signal from a signal source. The signal source produces a signal to mimic signals of a satellite or otherwise disguises itself as a satellite. The method800includes, at operation820, determining, by the receiving node, an estimated position of the receiving node based on an orbital position of the satellite and a characteristic of the signal. The method800includes, at operation830, comparing, by the receiving node, the estimated position of the receiving node with a reference position of the receiving node. The method800includes, at operation840, determining, by the receiving node, that the signal source is a spoofing source different than the satellite. The method800also includes, at operation850, determining, by the receiving node, a location of the spoofing source in part based on the estimated position.

FIG.9illustrates a method900for determining a location of a spoofing source in accordance with one or more embodiments of the present technology. The method800includes, at operation910, receiving, by a network node in the communication network, a first set of information from a first communication node indicating a first estimated location of the spoofing source. The method900includes, at operation920, receiving, by a network node, a second set of information from a second communication node indicating a second estimated location of the spoofing source. The method900includes, at operation930, receiving, by a network node, a third set of information from a third communication node indicating a third estimated location of the spoofing source. The method900also includes, at operation940, determining, by the network node, a final location of the spoofing source based on triangulating the first, the second, and the third estimated locations of the spoofing source.

CONCLUSION

The present application discloses techniques that can be implemented in various embodiments to detect interfering signals from suspicious sources. The techniques can be implemented in both fixed base stations or mobile assets such as phones, tablets, autonomous cars, or IoT devices. The wide applicability of the disclosed techniques also enables the determination of the locations of the suspicious sources. Network operators can easily identify the locations of the suspicious sources based on information provided by base stations equipped with multiple antennas or a group of mobile devices.

FIG.10is a diagrammatic representation of a machine in the example form of a computer system1000within which a set of instructions, for causing the machine to perform any one or more of the methodologies or modules discussed herein, can be executed.

In the example ofFIG.10, the computer system1000includes a processor, memory, non-volatile memory, and a network communication interface device. The computer system1000can also include multiple antennas for receiving signals from various signal sources. Various common components (e.g., cache memory) are omitted for illustrative simplicity. The computer system1000is intended to illustrate a hardware device on which any of the components described in the example ofFIGS.1-8(and any other components described in this specification) can be implemented. The computer system1000can be of any applicable known or convenient type. The components of the computer system1000can be coupled together via a bus or through some other known or convenient device.

The algorithms and displays presented herein are not inherently related to any particular computer or other apparatus. Various general purpose systems can be used with programs in accordance with the teachings herein, or it can prove convenient to construct more specialized apparatus to perform the methods of some embodiments. The required structure for a variety of these systems will appear from the description below. In addition, the techniques are not described with reference to any particular programming language, and various embodiments can thus be implemented using a variety of programming languages.

In alternative embodiments, the machine operates as a standalone device or can be connected (e.g., networked) to other machines. In a networked deployment, the machine can operate in the capacity of a server or a client machine in a client-server network environment, or as a peer machine in a peer-to-peer (or distributed) network environment.

In some circumstances, operation of a memory device, such as a change in state from a binary one to a binary zero or vice-versa, for example, can comprise a transformation, such as a physical transformation. With particular types of memory devices, such a physical transformation can comprise a physical transformation of an article to a different state or thing. For example, but without limitation, for some types of memory devices, a change in state can involve an accumulation and storage of charge or a release of stored charge. Likewise, in other memory devices, a change of state can comprise a physical change or transformation in magnetic orientation or a physical change or transformation in molecular structure, such as from crystalline to amorphous or vice versa. The foregoing is not intended to be an exhaustive list in which a change in state for a binary one to a binary zero or vice-versa in a memory device can comprise a transformation, such as a physical transformation. Rather, the foregoing is intended as illustrative examples.

A storage medium typically can be non-transitory or comprise a non-transitory device. In this context, a non-transitory storage medium can include a device that is tangible, meaning that the device has a concrete physical form, although the device can change its physical state. Thus, for example, non-transitory refers to a device remaining tangible despite this change in state.

The teachings of the invention provided herein can be applied to other systems, not necessarily the system described above. The elements and acts of the various examples described above can be combined to provide further implementations of the invention. Some alternative implementations of the invention may include not only additional elements to those implementations noted above, but also may include fewer elements.