International GNSS Summer School 2019
Organized by Tokyo University of Marine Science and Technology

CourseModule A: GNSS Signal Security
Module B: Spoofing & GNSS Signal Authentication
Module C: Android GNSS Raw Data Processing
Dinesh MANANDHAR
Center for Spatial Information Science
The University of Tokyo
dinesh@iis.u-tokyo.ac.jp
29th July – 3rd August 2019, Tokyo
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 1

• Dinesh Manandhar• Associate Professor (Project), Center for Spatial Information Science, The
University of Tokyo• Adjunct Associate Professor, Asian Institute of Technology, Thailand• Member, ISO/TC-204, WG18
• Member, ICAO/NSP, DFMC/SBAS Signal Authentication

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 2

Outline of the Lecture• Module A: GNSS Signal Security• Introduction to GNSS Vulnerabilities• Interference• Jamming• Spoofing• Module B: Spoofing and GNSS Signal Authentication• Detail discussions on Spoofing• Demonstration of Spoofing• Anti-Spoofing Methods• Demonstration of Anti-Spoofing Method• Module C: Android GNSS Raw Data Processing• Introduction• Android Devices• Data Logging Tools• Data Processing Tools• Data Processing Outputs• Innovative and Challenging Applications

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 3

Module: C-I
Background on
GNSS Raw Data Measurement

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 4

Background Information : GPS Signal Structure
900 Phase Reversex154

L1 Carrier, 1575.42Mhz∑
x1/10
X1, Clock10.23Mhz

C / A Code, 1.023Mhz

x1/204600

Navigation Data, 50Hz

L1 Band GPS Signal

P Code, 10.23Mhz
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 5GPSConvert to
Lower Frequency
Defined by
Sampling Frequency and IF

Antenna

AGC

Pre-Amp(LNA)

Down
Converter

A/D Converter

Replica Signal
Generator
Frequency
Generator

Oscillator
Ref. Clock 10.23MHz

Output fromBase-band
Signal Processing

GPS RF signal at1575.42MHz

Architecture of a GNSS Receiver

Digital Signal Output

Position Output(PVT)

Baseband Signal
Processing

Acquisition

Tracking

To find out visible satellites,
approximate Doppler
and Code-phase
To continuously demodulate the signal
to extract the navigation data bits
Done by using DLL, FLL and PLL.
Outputs from Acquisition
are used as input for Tracking

Navigation Data

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Generate Pseudorange, Doppler etc
Extract Ephemeris orSatellite Orbit related Data
Extract Clock related data

Slide : 6

GPS

Position Output(PVT)

Convert to
Lower Frequency
Defined by
Sampling Frequency and IF

Antenna

AGC

Pre-Amp(LNA)

Down
Converter

A/D Converter

Replica Signal
Generator
Frequency
Generator

Oscillator
Ref. Clock 10.23MHz

Output fromBase-band
Signal Processing

GPS RF signal at1575.42MHz

Architecture of a GNSS Receiver

Digital Signal Output

Baseband Signal
Processing

Acquisition

Tracking

RAW Data
Data necessary to compute
Pseudorange, Carrier Phase,
Doppler, TimeError etc

To find out visible satellites,
approximate Doppler
and Code-phase
To continuously demodulate the signal
to extract the navigation data bits
Done by using DLL, FLL and PLL.
Outputs from Acquisition
are used as input for Tracking

Generate Pseudorange, Doppler etc
Extract Ephemeris orSatellite Orbit related Data
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp Extract Clock related data
Navigation Data

Slide : 7

Acquisition of GPS L1C/A Signal

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 8

Acquisition Output shown for Doppler Frequency
File: LS2.dat, SV: GPS, PRN ID:8
CodePhase: 2339, Doppler: -5100Hz, CohInt.: 2, NonCohInt: 5
41
40
39

Signal Power, dB

38
37
36
35
34
33
32
Acquisition Output for Maximum Code Phase Value
31

-5900

-4900
-3900
Doppler Frequency, Hz

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp-3000

Slide : 9

Acquisition Output shown for Code Phase (PRN Code Chip Delay)
File: LS2.dat, SV: GPS, PRN ID:8
CodePhase: 2339, Doppler: -5100Hz, CohInt.: 2, NonCohInt: 5
41
40
39

Signal Power, dB

38
37
36
35
34
33
32
Acquisition Output for Maximum Doppler Value
31

2220

2250

2280

2310
2340
Code Phase

2370

2400

2430

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 10

GPS Signal Tracking• Tracking Loops (PLL & DLL) are used to continuously lock theincoming signal and demodulate it by using the carrier frequency
and code phase values detected in Acquisition.
• PLL• Phase Lock Loop
• To Track the Carrier Frequency• DLL• Delay Lock Loop
• To Track the Code Phase (PRN Code Delays)

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 11

GPS Signal Tracking Output
Navigation Data Bits
1’s and 0’s

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 12

SNR & C/No
• SNR

• Signal to Noise Ratio, unit is dB• S: Signal Power in dBm or dBW• N: Noise power in a given bandwidth in dBm or dBW• C/No• Carrier to Noise Density, unit is dB-Hz• C: Carrier power in dBm or dBW• No: Noise power density in dBm-Hz or dBW-Hz• SNR = C/No-BW (BW = bandwidth of the Front End)• If BW = 4Mhz = 10*log10(4000000) = 66dB
• If C/No = 48dB-Hz• SNR = C/No-BW = 45-66 = -21dB• Noise Density (No) at Room Temperature (290K): -204dBW/Hz• Received Power (GPS L1C/A Signal) at Antenna: -158.5dBW• C/No = -158.5-(-204) = 45.5dB-Hz
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 13

Module: C-II
Android GNSS Raw Data Processing

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 14

Purpose• Provide updates related with Android GNSS Raw Data
• Results from Raw Data Processing• Tokyo, Japan• Suva, Fiji
• Melbourne, Australia• Florida, USA• Sharing of Raw Data to practice• Please refer MGA Webinar #8 for additional information• https://home.csis.u-tokyo.ac.jp/~dinesh/WEBINAR.htm

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 15

Android Device for GNSS Raw Data
• Many Android devices with OS 7.0 or higher can output GNSS Raw
Data• These data can be used for RTK post-processing• Some devices have Multi-Frequency (L1/L5) GNSS receiver• Multi-System (GPS, GLONASS, GALILEO, BEIDOU, QZSS)• Multi-Frequency (L1/E1/B1, L5/E5)• Outputs more than 40 channels• Some devices output NAV BIT Data and/or AGC values

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 16

GNSS Raw Data Compatible Smart-Phones
Raw Data output used in System Score

S. No.

Model

Satellite Systems used in System
Score

System Functio
AccumulTotal
L5
Android Score n Score
NAV ated HW
Score AGC
Suppor GPS GLO GAL BDS QZSS SBAS
version Max: 6 Max: 5
MSG delta clock(D + E)
t
(D)
(E)
range

4
31
33

Xiaomi Mi 8
Samsung S8
Huawei P10

8.1
7
7

5
5
5

4
3
3

9
8
8

no
no
no

yes
yes
yes

yes
yes
yes

yes
yes
yes

yes
no
no

yes
yes
yes

yes
yes
yes

yes
yes
yes

yes
yes
yes

yes
yes
yes

no
no
no

42

Huawei Mate 20 X

9

4

4

8

no

yes

yes

yes

yes

yes

yes

yes

no

yes

no

19
20
22
1
2

Google Pixel 2 XL
Google Pixel 2
Samsung Note 8
Pixel 3 XL
Pixel 3

8
8
7.1
9
9

5
5
4
4
4

2
2
3
3
3

7
7
7
7
7

yes
yes
no
yes
yes

no
no
yes
no
no

no
no
yes
yes
yes

yes
yes
yes
yes
yes

no
no
no
no
no

yes
yes
yes
yes
yes

yes
yes
yes
yes
yes

yes
yes
yes
yes
yes

yes
yes
yes
yes
yes

yes
yes
no
no
no

no
no
no
no
no

43

Huawei Mate 20 RS

9

4

3

7

no

no

yes

yes

yes

yes

yes

yes

yes

no

no

44

Huawei Mate 20 Pro

9

4

3

7

no

no

yes

yes

yes

yes

yes

yes

yes

no

no

45
10

Huawei Mate 20
Huawei P20

9
8.1

4
3

3
3

7
6

no
no

no
yes

yes
yes

yes
yes

yes
no

yes
yes

yes
yes

yes
no

yes
no

no
yes

no
no

11

Samsung Galaxy S9

8

3

3

6

no

yes

yes

yes

no

yes

yes

no

no

yes

no

18

Huawei Mate 10 Pro

8

3

3

6

no

yes

yes

yes

no

yes

yes

no

no

yes

no

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp for Latest Updates
Check  https://developer.android.com/guide/topics/sensors/gnss

Slide : 17

Android Raw Data Logging Tool – 1: GnssLogger

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 18

GNSS Raw Data Output Format from Smart Phone Device• #• # Header Description:• # Version: v2.0.0.1 Platform: 9 Manufacturer: Xiaomi Model: MI 8
• # Raw,
•
•
•
•
•
•
•
•

ElapsedRealtimeMillis,TimeNanos,LeapSecond,TimeUncertaintyNanos,FullBiasNanos,
BiasNanos,BiasUncertaintyNanos,DriftNanosPerSecond,DriftUncertaintyNanosPerSecond,
HardwareClockDiscontinuityCount,Svid,TimeOffsetNanos,State,ReceivedSvTimeNanos,
ReceivedSvTimeUncertaintyNanos,Cn0DbHz,PseudorangeRateMetersPerSecond,
PseudorangeRateUncertaintyMetersPerSecond,AccumulatedDeltaRangeState,
AccumulatedDeltaRangeMeters,AccumulatedDeltaRangeUncertaintyMeters,CarrierFrequencyHz,
CarrierCycles,CarrierPhase,CarrierPhaseUncertainty,MultipathIndicator,
SnrInDb,ConstellationType,AgcDb,CarrierFrequencyHz• # Fix,• Provider,Latitude,Longitude,Altitude,Speed,Accuracy,(UTC)TimeInMs• # Nav,• Svid,Type,Status,MessageId,Sub-messageId,Data(Bytes)

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 19

Sample GNSS Raw Data Output

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 20

GNSS Raw Data Analysis Tool for GnssLogger• GNSS Analysis APP• Matlab-based Tool
• Linux, Windows, MacOS• Version 2.6.3.0• Release Notes:
https://developer.android.com/guide/topics/sensors/
gnss#releaseGNSS Analysis app v2.6.3.0 release notes.

Click for KML FileClick for Report File

The GNSS Analysis app is built on MATLAB, but you don't need to have MATLAB to run
it. The app is compiled into an executable that installs a copy of the MATLAB Runtime.
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 21

Position Output from Android GNSS Receiver, Komaba• Standard Position Computation• No DGPS or RTK Corrections• All visible GNSS Satellites are used
• Frequency : L1/L5/E5• Surrounding : Tall Buildings
aroundDinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 22

Position Output from Android GNSS Receiver, Hongo

Smart-Phone is kept under the Tree
Red Circle Radius : 5m

Smart-Phone is kept under the TreeDinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 23

Position Output from Android GNSS Receiver
Smart-Phone is kept in an Open Area
Red Circle Radius: 5m

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 24

Position Output from Android GNSS Receiver, Melbourne

Smart-Phone is kept on a Bench in the park
Red Circle Radius: 5m
SEE Next SLIDE
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 25

Smart-Phone is kept on a Bench in the park
Red Circle Radius: 5m
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 26

Output from GNSS Analysis Tool, Data Logged by GNSSLogger

Data logged by Mi8 Smart-phone inside the car

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 27

Output from GNSS Analysis Tool, Data Logged by GNSSLogger
Location:
Kennedy Space Center
FloridaData logged by Mi8 Smart-phone inside the car
Driving from Hotel to Kennedy Space Center

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 28

Output from GNSS Analysis Tool, Data Logged by GNSSLogger

Kennedy Space Center

Data logged by Mi8 Smart-phone inside the car
Driving from Hotel to Kennedy Space Center
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 29

GNSS Position Data from Mi8 Android Device

Yellow Circles : Mi8 Device
White Circle : 5m Radius

Location: SUVA, FIJI

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 30

GNSS Position Data from P20 Android Device

Red Circles : P20 Device
White Circle : 5m Radius

Location: SUVA, FIJI

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 31

GNSS Position Data from Mi8 & P20 Android Devices

Red Circles : P20 Device
Yellow Circles : Mi8 Device
White Circle : 5m Radius

Location: SUVA, FIJI

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 32

Position Output from Android
GNSS Receiver
海洋大学 (TUMSAT)

Base 253013400

Base 152453400• Mobile-phone is kept static for about 60min thenmoved around the roof.
• A GNSS base-station (Trimble NetR9) on the roof isused to collect correction data.

These data were logged at TUMST, Dr. Yize

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 33

Android GNSS Raw Data Information

1

Base-Station File 1

53013400.18o

Trimble NetR92

Base-Station File 252453400.18o

Trimble NetR9

3

Android GNSS Data GEOP3400

4RINEX NAV File

Device Mi8
Logger: Geop++

brdm3400.18p

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 34

GPS L1 vs GPS L1/L5

Data logged by Mi8 Smart-phone

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 35

GPS L1 vs GPS + QZS L1

Data logged by Mi8 Smart-phone

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 36

GPS L1 vs GPS + QZS L1/L5

Data logged by Mi8 Smart-phone

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 37

GPS L1 vs GPS + QZS + BDS L1

Data logged by Mi8 Smart-phone

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 38

GPS L1 vs GPS + BDS + QZS L1/L5

Data logged by Mi8 Smart-phone

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 39

GPS L1 vs GPS + GAL+ BDS + QZS L1

Data logged by Mi8 Smart-phone

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 40

GPS L1 vs GPS + GAL+ BDS + QZS L1/L2/L5

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 41

GPS L1 vs GPS + GLO + GAL+ BDS + QZS L1

Data logged by Mi8 Smart-phone

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 42

GPS L1 vs GPS + GAL+ BDS + QZS L1/L5

Data logged by Mi8 Smart-phone

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 43

(Possible) Applications of Android GNSS Raw Data
• High-Accuracy Positioning• Multi-System, Multi-Frequency• Interference and Jamming Detection• Crowd Sourcing• Spoofing Detection• Signal Authentication• Atmospheric Parameter Estimations• Ionosphere and Troposphere• Space Weather• Scientific Applications
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 44

White Paper on GNSS Raw Data Measurement

http://galileognss.eu/wpcontent/uploads/2018/05/Using-GNSSRaw-Measurements-on-Androiddevices.pdf

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 45

GNSS Raw Measurements
Taskforce Workshop
GNSS Raw Measurements Taskforce Workshop was held on
26th June 2019, Prague, GSA European Agency Headquarters
Refer https://www.gsa.europa.eu/gnss-raw-measurements-taskforce-workshop for more information

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 46

References• GNSS Raw Data Measurement Tutorial File by Dr, Frank Van Diggelen,
Google Inc.

• https://home.csis.utokyo.ac.jp/~dinesh/GNSS_Raw_files/GNSS%20102%20Measurements%20from%2
0Phones%20Short%20Course%20Slides.pdf• GPS Receiver Signal Processing background information file:• https://home.csis.utokyo.ac.jp/~dinesh/WEBINAR_files/MGA_W08_RawDataMeasurement_Backgrou
nd.pdf• Video record of GNSS Raw Signal Measurement MGA WEBINAR held on
6th DEC 2018.
• https://www.youtube.com/watch?v=S217xg--O_Q&feature=youtu.be• Sample Data

• Sample GNSS Raw Data from Android Device• https://home.csis.u-tokyo.ac.jp/~dinesh/WEBINAR.htm

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 47

Additional Information• Main Page
• http://www.csis.u-tokyo.ac.jp/~dinesh• Webinar Page
• http://www.csis.u-tokyo.ac.jp/~dinesh/WEBINAR.htm• https://gnss.peatix.com• GNSS Training Courses• http://www.csis.u-tokyo.ac.jp/~dinesh/T141_30.htm• MGA 2018 GNSS Conference• http://www.csis.u-tokyo.ac.jp/~dinesh/mga2018.htm• Contact : dinesh@iis.u-tokyo.ac.jp

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 48

MGA GNSS Webinar

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 49