International GNSS Summer School 2019
Organized by Tokyo University of Marine Science and Technology

CourseModule A: GNSS Signal Security
Module B: Spoofing & GNSS Signal Authentication
Module C: Android GNSS Raw Data Processing
Dinesh MANANDHAR
Center for Spatial Information Science
The University of Tokyo
dinesh@iis.u-tokyo.ac.jp
29th July – 3rd August 2019, Tokyo
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 1

• Dinesh Manandhar• Associate Professor (Project), Center for Spatial Information Science, The
University of Tokyo• Adjunct Associate Professor, Asian Institute of Technology, Thailand• Member, ISO/TC-204, WG18
• Member, ICAO/NSP, DFMC/SBAS Signal Authentication

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 2

Outline of the Lecture• Module A: GNSS Signal Security• Introduction to GNSS Vulnerabilities• Interference• Jamming• Spoofing• Module B: Spoofing and GNSS Signal Authentication• Detail discussions on Spoofing• Demonstration of Spoofing• Anti-Spoofing Methods• Demonstration of Anti-Spoofing Method• Module C: Android GNSS Raw Data Processing• Introduction• Android Devices• Data Logging Tools• Data Processing Tools• Data Processing Outputs• Innovative and Challenging Applications

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 3

Module – A
GNSS Signal Security

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 4

Module – A : Contents• Background Information• GPS Signal Structure• Correlation and Cross-Correlation• Signal Power• Types of Interferences• Jamming Issues• Interference affected IF data samples

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 5

Introduction• What is GNSS Signal Security?
• This is about keeping the signals free from vulnerabilities like Jamming,
Interference and Spoofing.
• There are many guidelines, regulations, policies, laws related with Jammingand Interference• But, very little on Spoofing.

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 6

Background Information : GPS Signal Structure
900 Phase Reversex154

L1 Carrier, 1575.42Mhz∑
x1/10
X1, Clock10.23Mhz

C / A Code, 1.023Mhz

x1/204600

Navigation Data, 50Hz

L1 Band GPS Signal

P Code, 10.23Mhz
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 7

Background Information : Characteristics of PRN CodeAuto-correlation: Only four values 1023, 1, 63 or 65 (Ideal case)

Cross-correlation: Only three values 1, 63 or 65 (Ideal Case)• PRN codes are very uniquely designed.
• GPS and other GNSS use CDMA
• One PRN code is assigned to one satellite.
• In case of GPS, PRN code is 1023 bits long.
• GLONASS is different. It uses FDMA. The same code forall satellites but different frequencies.
• Some new signals of GLONASS also uses CDMA signals• Maximum Cross-correlation Value is -23dB.
• If any signal above this power enters a GPS receiver, it will
totally block all GPS signals.
• If longer PRN code is used, receiver becomes moreresistive to Jamming signal• But, signal processing is more complex

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 8

GPS Signal Power: How Strong or How Weak?
• GPS satellites are about 22,000km
away• Transmit power is about 30W• This power when received at thereceiver is reduced by 1016 times.

30Watt• The power reduces by 1/(distance)2• This is similar to seeing a 30W bulb
22,000Km far away

• GPS signals in the receiver is about
10-16 Watt, which is below thethermal noise
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

10-16 Watt
Slide : 9

GPS Signal Power: How Strong or How Weak?
• GPS Signal Power at Receiver• -130dBm or -160dBW• Thermal Noise Power• Defined by kTeffB, where• K = 1.380658e-23JK-1, Boltzman Constant• Teff = 362.95, for Room temperature in Kelvin at 290• Teff is effective Temperature based on Frii’s formula• B = 2.046MHz, Signal bandwidth• Thermal Noise Power = -110dBm for 2MHz bandwidth• If Bandwidth is narrow, 50Hz
• Noise Power = -156dBm

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 10

GPS Signal Power
Noise PowerAny Signal below thisnoise level can’t bemeasured in a
Spectrum Analyzer
GPS Signal Power at
Antenna-130dBm

Mobile phone, WiFi,
BT etc have power
level above -110dBm,
much higher than GPS
Signal Power

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 11Power of GPS vs. Other Signals
Signal TypePower (based on calculations, not measured)

Below Noise

Above Noise

Watt
Mobile Phone
Handset TX Power *Power at Mobile
Phone Handset*

dBW

dBm

1W

0dBW

30dBm

100e-6W-40dBW-70dBmZigBee316e-16W-115dBW-85dBm

VHF

200e-16W-137dBW-107dBm

Thermal Noise79e-16W-141dBW-111dBm

GPS**

1e-16W-160dBW-130dBm• * Actual power values will differ. These are just for comparison purpose• ** GPS Signals are hidden under the noise. Thus, it can’t be measured directlyDinesh Manandhar, The Universityof Tokyo,
Japan,Analyzer
dinesh@iis.u-tokyo.ac.jp
e.g. usinga Spectrum

Slide : 12

Consequences of Different Power Levels• The large power difference between GNSS and other signal levels
make GNSS receivers comparatively more susceptible tointerference• Mobile network devices are able to raise power levels to cope with
obstructions and poor radio environments.
• But, GNSS signal power levels are fixed• If GNSS signals shared frequencies with mobile systems, they would
be swamped by interference• GNSS reception would not be possible

Source: UN-Nepal GNSS Workshop, IDM Session
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 13

Types of Interference• Self-Interference• Interference from GPS like signals• Interference from Pseudolites or GPS like signals to GPS (same frequency and similar signals)• See Characteristics of PRN Code Slide• In-band Interference• Different frequency but within the bandwidth of GNSS signals• E.g. GPS L1C/A signal bandwidth is +/- 10MHz. Any signal with frequency within 1565MHz – 1585MHz may have in-band
interference.

• Out-Of-Band Emission (OOBE)• Different frequency outside of the bandwidth of GNSS signals• E.g. GPS L1C/A signal bandwidth is +/- 10MHz. Even if a signal is outside of 1565MHz – 1585MHz range, the signal may stillinterfere GNSS signal due to spurious or harmonics that’s falling within the GNSS signal’s frequency bandwidth• Spurious emission• Harmonic vs Intermodulation Products• Adjacent band interference• Signals that have frequency near the GNSS signal’s frequency bandwidth
Source: UN-Nepal GNSS Workshop, IDM Session
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 14

In-Band Interference from GPS like Signals• Interference from GPS like Signals• Pseudolites, GPS Signal Generators• It causes interference unless the transmit power is limited within theallowed level• In Japan, allowed maximum power level for license free weak signal is 64dBm at the antenna (EIRP) at 1575 Mhz.
• If a Pseudolite transmit power at antenna is -64dBm• It will completely affect all GPS receivers within 3-5m
• It will affect the C/No value of GPS receiver within 10m• This is just theoretical guideline, Actual values differs a lot depending upon location,
signal type etc• Values calculated from [Rx = Tx-a1-20*log10(d)] where, Rx is received power at distance d, Tx
is transmit power, a1 = 36dB attenuation in one meter for GPS L1 frequency.

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 15

In-Band CW Interference
Interference free signal
IF Signal from a software receiver front-end
IF = 4.13Mhz

CW interference within the 2MHz BW of GPS Signal
The center frequency is at 4.13MHz (IF Signal)

CW: Continuous Wave
produces narrow bandsignalPeak due toNarrowband
interference signal

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 16

Out-Of-Band Emission (OOBE)• Out-of-band emission is an emission on a frequency or frequencies immediately
outside the necessary bandwidth which results from the modulation process,but excludes spurious emissions• It raises the noise floor of the GNSS receivers and the Carrier signal-to-Noiseratio (CNR) is reduced, impacting GNSS receiver performancefc

Emission in thenecessary band

fc

GNSS Band

OOBE
Source: UN-Nepal GNSS Workshop, IDM Session
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 17

Spurious Emission• Spurious emission is an emission not deliberately created ortransmitted on a frequency or frequencies which are outside thenecessary bandwidth• Examples include harmonic emissions and intermodulation products

Source: UN-Nepal GNSS Workshop, IDM Session
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 18

Harmonic Emission• N-th harmonics for a signal whose fundamental frequency is f, has afrequency N*f• Generally not a significant interference mechanism

Source: UN-Nepal GNSS Workshop, IDM Session
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 19

Intermodulation Emission• Intermodulation products is caused by amplitude modulation of signals
containing two or more difference frequencies, caused by non-linearities in thefront end of a GNSS receiver• Intermodulation products can end up in the GNSS band and desensitize a GNSS
receiver frontend• Example: 3rd Intermodulation products from an adjacent band signal plan

Source: UN-Nepal GNSS Workshop, IDM Session
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 20

Adjacent Band Interference• Applicable in cases when high powered “terrestrial” service is planned adjacentto the quiet “satellite” bands to create overload• The frontend of the receiver is compressed or overloaded• Front-end filtering can help reduce this effect which can be difficult with highpower adjacent band source

Source: UN-Nepal GNSS Workshop, IDM Session
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 21

GPS Jammers
Many handy type GPS Jammers exists.
They will jam not only your GPS but many others in the vicinity of few kilometers

Thousands using GPS jammers on UK roads
pose risks, say experts : The Guardian-

https://www.theguardian.com/technology/2013/feb/13/gpsjammers-uk-roads-risks

https://www.jammer-store.com/gp5000-car-use-gps-jammer-blocker.html#

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 22

Jammers are illegal in the USA
and many other countries

Source: http://www.gps.gov/spectrum/jamming/
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 23

Impact on Signal Processing due to Noise or Interference Signal
PRN 13Integration Time : 1ms

PRN 13Integration Time : 3ms

PRN 13Integration Time : 6ms

PRN 22Integration Time : 1ms

PRN 22Integration Time : 3ms

PRN 22Integration Time : 6ms

PRN 3
Integration Time : 1ms

PRN 3
Integration Time : 3ms

PRN 3
Integration Time : 6ms

Presence of high level noiseThis requires longer integration of data
More processing power

Presence of noise

Very small noise

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 24

Interference Control Mechanism• Allocation• Frequency separation of stations of different services• Regulatory Protection• Not to cause harmful interference or claim protection• Power Limits• PFD to protect Terrestrial services• EIRP to protect Space services• EPFD to protect GSO from NGSO

• Coordination• Between administrations to ensure interference-free operations conditions
Source: Hon Fai Ng, RNSS & ITU Radio Regulations, ITU, 11th ICG Meeting, 2016, Sochi
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 25

Maximum Field Intensity at 3m Distance from Antenna
for Operation of License Free Weak Signals in Japan

Maximum Field Intensity of RF signal at 3m for License Free operation in JapanFor GPS , it is 35micro-volt/m at 3m from antenna. This corresponds to about -64dBm EIRP at antenna
Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 26

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 27

ITU RNSS Documents

Please refer ITU documents for details on regulations related with GNSS signals
Source:Fai Japan,
Ng, RNSS& ITU Radio Regulations, ITU, 11th ICG Meeting, 2016, Sochi
Dinesh Manandhar, The University
ofHonTokyo,
dinesh@iis.u-tokyo.ac.jp

Slide : 28

GNSS Signal with Interference NoiseIF Data Samples
GNSS
Antenna

GNSS
ReceiverInterference
Noise

ATT

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 29

AGC and Sky Plot
Normal GNSS Signal, No Interference Signal Present
T1

T2

SourceAntennaInterference
SignalIF
Frequency

1584

Not Present

Int. ATT
Ext. ATT
System

GNSS

SignalType

Multi
GNSS L1
L2, L5Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 30

Raw Sample IF Signal, Center Frequency: 1584MHz
Normal GNSS Signal, No Interference Signal Present
T1

T2

SourceAntennaInterference
SignalIF
Frequency

1584

Not Present

Int. ATT
Ext. ATT
System

GNSS

SignalType

Multi
GNSS L1
L2, L5Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 31

Power Spectrum of IF Signal, Center Frequency: 1584MHz
Normal GNSS Signal, No Interference Signal Present
T1

T2

SourceAntennaInterference
SignalIF
Frequency

1584

Not Present

Int. ATT
Ext. ATT
System

GNSS

SignalType

Multi
GNSS L1
L2, L5

L1 Band1575.42MHzIF Center Frequency
1584MHz

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 32

Histogram of IF Signal, Center Frequency: 1584MHz
Normal GNSS Signal, No Interference Signal Present
T1

T2

SourceAntennaInterference
SignalIF
Frequency

1584

Not Present

Int. ATT
Ext. ATT
System

GNSS

SignalType

Multi
GNSS L1
L2, L5Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 33

AGC and Sky Plot
Normal GNSS Signal and Interference Signal
SourceIF Frequency

T1

T2

AntennaInterference
Signal1584

1575.42Int. ATT

10Ext. ATT

30

SystemSignal Type

GNSS

GPS

Multi GNSS
L1 L2, L5

L1 Only

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 34

Raw Sample IF Signal, Center Frequency: 1584MHz
Normal GNSS Signal and Interference Signal
T1

T2

SourceAntennaInterference
SignalIF
Frequency

1584

1575.42Int. ATT

10Ext. ATT

30

System

GNSS

GPS

SignalType

Multi
GNSS L1
L2, L5

L1 Only

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 35

Power Spectrum of IF Signal, Center Frequency: 1584MHz
Normal GNSS Signal and Interference Signal
T1

T2

SourceAntennaInterference
SignalIF
Frequency

1584

1575.42Int. ATT

10Ext. ATT

30

SystemSignal
Type

GNSS
Multi
GNSS L1
L2, L5GPS
L1 Only

L1 Band1575.42MHzIF Center Frequency
1584MHz

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 36

Histogram of IF Signal, Center Frequency: 1584MHz
Normal GNSS Signal and Interference Signal
T1

T2

SourceAntennaInterference
SignalIF
Frequency

1584

1575.42Int. ATT

10Ext. ATT

30

System

GNSS

GPS

SignalType

Multi
GNSS L1
L2, L5

L1 Only

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 37

AGC and Sky Plot
Normal GNSS Signal and Strong Interference Signal
SourceIF Frequency

T1

T2

AntennaInterference
Signal1584

1575.42Int. ATT

10Ext. ATT

10

SystemSignal Type

GNSS

GPS

Multi GNSS
L1 L2, L5

L1 Only

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 38

Raw Sample IF Signal, Center Frequency: 1584MHz
Normal GNSS Signal and Strong Interference Signal
T1

T2

SourceAntennaInterference
SignalIF
Frequency

1584

1575.42Int. ATT

10Ext. ATT

10

System

GNSS

GPS

SignalType

Multi
GNSS L1
L2, L5

L1 Only

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 39

Power Spectrum of IF Signal, Center Frequency: 1584MHz
Normal GNSS Signal and Strong Interference Signal
T1

T2

SourceAntennaInterference
SignalIF
Frequency

1584

1575.42Int. ATT

10Ext. ATT

10

System

GNSS

GPS

SignalType

Multi
GNSS L1
L2, L5

L1 Only

L1 Band1575.42MHzIF Center Frequency
1584MHz

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 40

Histogram of IF Signal, Center Frequency: 1584MHz
Normal GNSS Signal and Strong Interference Signal
T1

T2

SourceAntennaInterference
SignalIF
Frequency

1584

1575.42Int. ATT

10Ext. ATT

10

System

GNSS

GPS

SignalType

Multi
GNSS L1
L2, L5

L1 Only

Dinesh Manandhar, The University of Tokyo, Japan, dinesh@iis.u-tokyo.ac.jp

Slide : 41