Abstract:
Disclosed are methods for minimizing the security boundary of PPS GPS receivers. The primary disclosure is a lump sum SA correction method. This method can be used to limit the security boundary to the portion of the GPS receiver that generates the lump sum SA correction, allowing all PPS measurement processing (within the receiver or across a PPS measurement interface) to reside outside the security boundary. In addition, two methods are disclosed (passive residual method and active residual method) by which the data content of the PPS measurement interface is entirely unclassified when keyed, thereby limiting the security boundary to the GPS receiver itself.

Description:
FIELD OF THE INVENTION 
     The present invention relates generally to global positioning system (GPS) receivers. More particularly, the present invention relates to GPS receivers which utilize methods for obtaining PPS accuracy with an unclassified PPS measurement interface. 
     BACKGROUND OF THE INVENTION 
     The GPS is a satellite-based navigation system. A GPS receiver measures the time offset between a Pseudo Random Noise (PRN) code received from a GPS satellite and a locally generated PRN code. The GPS receiver uses the time offset (referred to as a pseudorange measurement) from at least four satellites along with satellite position information broadcast by the satellites (referred to as ephemeris) to determine the receiver&#39;s location. The pseudorange measurement and satellite ephemeris are intentionally degraded by the U.S. Government using a Department of Defense (DoD) classified technique called Selective Availability (SA). An authorized user can enter a key supplied by the National Security Agency into the receiver. The receiver will use this key to remove the effects of SA from the pseudorange measurement and satellite ephemeris, thereby accessing what is referred to as the GPS Precise Positioning Service (PPS). 
     A GPS satellite also broadcasts, in encrypted form, Wide Area GPS Enhancement (WAGE) corrections. An authorized GPS receiver decrypts the WAGE corrections using the same key as used for SA and applies them to the pseudorange measurements to compensate for unintended system errors. WAGE corrections are not required to obtain PPS accuracy, but do allow the GPS receiver to obtain even better accuracy than PPS alone. Since WAGE corrections may be treated as just another component of SA compensation, references to SA in this disclosure should be understood to mean both with and without WAGE. 
     The DoD has classified SA correction components as secret. A keyed receiver must compute the SA correction components and apply them to the ephemeris and pseudorange measurements. The DoD has also classified as secret both satellite position derived from corrected ephemeris and pseudorange measurements corrected for satellite clock related SA components as secret. The DoD controls the security boundaries for all PPS-capable GPS receivers. A GPS receiver&#39;s security boundary includes all hardware and software that access classified data. The DoD requires that security reviews be held to ensure that the boundary is defined properly, that classified data within the boundary is handled properly, and that the hardware and software in the boundary are developed using the appropriate procedures. These special reviews and procedures are expensive, and the more receiver hardware/software inside the security boundary, the more involved the process. 
     The process becomes even more complicated when a host application needs to process pseudorange measurements outside the GPS receiver. This entails definition of a data interface between receiver and host that shall be referred to herein as a &#34;GPS measurement interface.&#34; If a GPS receiver makes corrected satellite position and pseudorange measurements available over such an interface, the interface becomes classified secret and the security boundary of the receiver extends to include parts of the host application. This further increases cost since the host must now participate in the DoD security review process. A GPS measurement interface whose purpose is to enable processing of pseudorange measurements from a keyed receiver with PPS accuracy shall be referred to herein as a &#34;PPS measurement interface&#34;. 
     SUMMARY OF THE INVENTION 
     Disclosed are methods for minimizing the security boundary of PPS GPS receivers. The primary disclosure is a lump sum SA correction method. This method can be used to limit the security boundary to the portion of the GPS receiver that generates the lump sum SA correction, allowing all PPS measurement processing (within the receiver or across a PPS measurement interface) to reside outside the security boundary. In addition, two methods are disclosed (passive residual method and active residual method) by which the data content of the PPS measurement interface is entirely unclassified when keyed, thereby limiting the security boundary to the GPS receiver itself. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     FIG. 1A is a block diagram illustrating a prior art PPS capable GPS receiver and method utilizing internal PPS measurement processing. 
     FIG. 1B is a block diagram illustrating a prior art PPS capable GPS receiver and method utilizing a PPS measurement interface over which classified data is passed. 
     FIG. 2A is a block diagram illustrating a PPS capable GPS receiver having internal PPS measurement processing and employing a first method of the present invention. 
     FIG. 2B is a block diagram illustrating a PPS capable GPS receiver having a PPS measurement interface and employing the first method of the present invention. 
     FIG. 3 is a block diagram illustrating a PPS capable GPS receiver having a PPS measurement interface and employing a second method of the present invention. 
     FIG. 4 is a block diagram illustrating a PPS capable GPS receiver having a PPS measurement interface and employing a third method of the present invention. 
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     The present invention includes methods of minimizing the security boundary of a GPS receiver, especially while supporting a PPS measurement interface. A PPS measurement interface is herein defined to be an interface and circuitry adapted to output line-of-sight measurements from a keyed GPS receiver together with enough satellite-related data to permit processing of those measurements with full PPS accuracy into a solution for user position, velocity, and time. 
     The following terms are referenced in this section and pertain to operation of a keyed GPS receiver. A (U) following the term indicates that the data represented by the term is unclassified, while an (S) indicates that the data represented by the term is classified secret by the Department of Defense (DoD). A (FOUO) indicates that the data represented by the term is unclassified, but restricted For Official Use Only. As used throughout this document, references to data being classified or unclassified is intended to represent the defined DoD classification of the data. 
     Definitions 
     P=receiver&#39;s or host&#39;s estimate of user position (U,FOUO) 
     b=receiver&#39;s or host&#39;s estimate of range bias (clock phase error X speed of light) (U) 
     PR raw  =raw pseudorange measured by the receiver (U) 
     D Delay  =deterministic correction for signal delays due to ionosphere, troposphere, and receiver hardware (U) 
     D SVclk  =deterministic correction for satellite clock error as derived by an unkeyed receiver (U) 
     cD SVclk  =deterministic correction for satellite clock error as derived by a keyed receiver (with/without WAGE)(S) 
     S=satellite position derived using uncorrected ephemeris (U) 
     cS=satellite position derived using ephemeris that has been corrected for SA error (S) 
     e=unit line of sight vector from user to satellite (U) (=R/r, where R=cS-P and r=∥R∥) 
     Standard PPS Measurement Interface 
     FIG. 1A diagrammatically illustrates a prior art PPS-capable GPS receiver 50 utilizing internal PPS measurement processing. PPS GPS receiver 50 includes GPS antenna 110, signal processing functions 115, and PPS only functions 130. Antenna 110 receives GPS signals from GPS satellites. Signal processing functions 115 receive the GPS signals as an input and provide as outputs a raw pseudorange PR raw  measured by the receiver and extracted downlink data. PPS only functions 130 receive the downlink data and implement the various functions to provide the illustrated PPS related outputs. 
     As is the case with each of the prior art and inventive GPS receivers described and illustrated in the FIGS., the illustrated functions are typically implemented in software within one or more microprocessors or other controllers. However, implementation with other circuitry is also possible. In general, a reference to a particular function or step in this description or in the figures is also intended to represent the microprocessor(s) (or functional portions thereof) and/or other circuitry used to implement the functions. The present invention is not limited to any particular implementation of the illustrated methods. 
     FIG. 1B diagrammatically illustrates a prior art PPS-capable GPS receiver 100 similar to GPS receiver 50 illustrated in FIG. 1A, but utilizing a PPS measurement interface to pass information to a host device 140. With the exception of the inclusion of PPS measurement interface 120, receivers 50 and 100 are substantially identical. (Note that FIG. 1B, for simplicity, does not show internal measurement processing which would normally be retained.) However, in receiver 100, host device 140 implements some of the illustrated functions such as processing pseudorange measurements outside of the GPS receiver. If GPS receiver 100 makes corrected satellite position and pseudorange measurements available over an external interface such as PPS measurement interface 120, the external interface is classified secret and the security boundary 150 of the receiver extends to include not only the relevant portions of circuitry and software implementing PPS data generating only functions 130, but also at least portions of the circuitry or software of host device or application 140. 
     Using the standard method employed by prior art PPS-capable GPS receivers, a keyed GPS receiver such as receiver 100 outputs the following classified information over the PPS measurement interface: 
     cS=satellite position derived using corrected ephemeris (S) 
     cPR=pseudorange measurement corrected for delays and authorized user satellite clock error (S) (=PR raw  -D Delay  +cD SVclk ) 
     Host device or application 140 can then, using software or other circuitry or functions, compute its own pseudorange residual z Host , from the relationship described in Equation 1, and process such residuals from multiple satellites in a Kalman filter or other predict-correction algorithm, to obtain a solution for user position, velocity and time (PVT) that reflects PPS accuracy. 
     
         Z.sub.Host =cPR-(∥cS-P.sub.Host ∥+b.sub.Host)Equation 1 
    
     This method, along with the resulting security boundary 150, is depicted in FIG. 1B. Although receiver 50 illustrated in FIG. 1A does not include a PPS measurement interface across which classified information is passed, its method of determining the pseudorange residual z for use in determining the receiver&#39;s PVT still results in an extended security boundary 150. 
     Standard PPS Measurement Interface with Innovation for Handling SA Corrections 
     FIGS. 2A and 2B diagrammatically illustrate PPS-capable GPS receivers 200 and 260 in accordance with some embodiments of the present invention. Receiver 260 is substantially identical to receiver 200 in its method of PPS measurement processing, except that no PPS measurement interface is involved. The method employed by receivers 200 and 260 minimizes the security boundary 250 in either case. The following discussions of GPS receiver 200 apply to GPS receiver 260 as well, except that the host device functions are implemented within receiver 260 and interface 220 is therefore omitted. 
     Receiver 200 includes GPS antenna 110, signal processing functions 115, PPS measurement interface 220, and PPS only functions 230. Signal processing functions 115 receive the GPS signals from antenna 110 and provide as outputs downlink data and raw pseudorange measurements PR raw . Using downlink data from signal processing functions 115, PPS data only functions 230 generate corrections to be applied to raw pseudorange. Using a method employed by receiver 200, the keyed GPS receiver outputs the following unclassified information over the PPS measurement interface 220: 
     S=satellite position derived using uncorrected ephemeris (U) 
     PR SA  =PR raw  -D Delay  +D SVclk  -D SA  (U) 
     Where the lump sum correction D SA  for the net effect SA on pseuodrange is determined from Equation 2: 
     
         D.sub.SA =∥cS-P∥-∥S-P∥+D.sub.SVclk -cD.sub.SVclk (U)                                         Equation 2 
    
     Note that, 
     ∥cS-P∥-∥S-P∥=net effect of correction to satellite position on range. 
     while, 
     D SVclk  -cD SVclk  =effect of SA on SV clock error claimed for an unauthorized user. 
     Host device 240 can then compute the pseudorange residual Z host  using the relationship of Equation 3: 
     
         Z.sub.Host =PR.sub.SA -(∥S-P.sub.Host ∥+b.sub.Host) (U)Equation 3 
    
     By substituting the expansion of the PR SA  and D SA  terms, it can be shown that this pseudorange residual Z Host  is equivalent to the pseudorange residual computed using the standard method, thereby allowing the host to compute a full PPS accuracy PVT solution. 
     Since S and PR SA  are unclassified, these items can reside outside the GPS security boundary 250. Only the computation of the D SA  term must reside within the GPS security boundary 250, thus allowing all measurement processing (within or outside the receiver 200) to be clear of the security boundary. Thus, the embodiment illustrated in FIGS. 2A and 2B minimizes the security boundary 250 such that the security boundary is limited to the PPS only functions 230. 
     Passive Residual PPS Measurement Interface 
     FIG. 3 diagrammatically illustrates PPS-capable GPS receiver 300, which is an alternate embodiment of the present invention utilizing a passive residual PPS measurement interface. Receiver 300 includes GPS antenna 110, signal processing functions 115, PPS measurement interface 320, PPS only functions 330 and data processing functions 360. Signal generating functions 115 receive the GPS signals from antenna 110 and provide as outputs raw pseudorange PR raw  and downlink data. Using the downlink data and a position estimate P generated by data processing functions 360, PPS only functions 330 generate PPS corrections used to provide the illustrated PPS interface signals or data. 
     Using a method employed by keyed GPS receiver 300, the GPS receiver outputs at interface 320 the following unclassified information: 
     P=user position as estimated by the GPS receiver (U) 
     b=estimated receiver range bias (U) 
     e=corrected unit line of sight vector from user to satellite (U) 
     z=pseudorange residual as computed by the receiver (U) 
     =(PR raw  -PR predicted ) 
     Where PR predicted  is computed using the relationship shown in Equation 4: 
     
         PR.sub.predicated =∥cS-P∥+b+D.sub.delay -cD.sub.SVclk (U)Equation 4 
    
     The host device 340 computes its own pseudorange residual Z Host  using the relationship shown in Equation 5: 
     
         Z.sub.host =z-e·(P.sub.host -P)-(b.sub.host -b)   Equation 5 
    
     This method has the limitation that (P host  -P) must be relatively small for the first order approximation e·(P Host  -P) to be good. Since P, b, e and z are unclassified, these items can reside outside the GPS receiver&#39;s security boundary 350, thus limiting the necessary security review to the corresponding software and/or circuitry of PPS only functions 330. 
     Interactive Residual PPS Measurement Interface 
     FIG. 4 diagrammatically illustrates PPS-capable GPS receiver 400, which is an alternate embodiment of the present invention utilizing an interactive residual PPS measurement interface. Receiver 400 includes GPS antenna 110, PPS measurement interface 420, signal processing functions 115, PPS only functions 430 and data processing functions 460. Using the downlink data and a position estimate P Host  from host device 440, PPS only functions 430 provide the illustrated PPS corrected data necessary for the generation of the PPS interface data to be provided through interface 420. The method implemented by keyed GPS receiver 400 is the same as the passive residual method implemented by receiver 300, except that the receiver uses the host&#39;s estimates of position P Host  and range bias b Host  instead of its own. 
     Using the interactive residual method, keyed GPS receiver 400 must receive the following inputs from host application or device 440: 
     P Host  =host&#39;s estimate of user position (U) 
     b Host  =host&#39;s estimate of range bias (U) 
     Using these inputs, GPS receiver 400 computes and outputs the following unclassified information over the PPS measurement interface 420: 
     e=corrected unit line of sight vector from user to satellite (U) 
     Z Host  =pseudorange residual for the host as computed by the receiver (U) 
     =(PR raw  -PR predicted ) 
     The PR predicted  term is as defined for the passive residual method, except that estimates by host device 440 of P and b are used instead of the receiver&#39;s estimates, since and Z Host  are unclassified, these items can reside outside the GPS receiver&#39;s security boundary 450. 
     Although the present invention has been described with reference to preferred embodiments, workers skilled in the art will recognize that changes may be made in form and detail without departing from the spirit and scope of the invention.