Patent Description:
Spoofing signals may be generated as a deliberate act or may be an unintentional consequence of a signal generating source. For example, it is common to generate test signals within aircraft maintenance hangars, so technicians providing maintenance on receiver equipment, have reference test signals for the receiver equipment to receive. If a hangar door is left open or the generated test signals are too strong, usually as the result of faulty equipment, the signals my reach out beyond the hangar causing potential spoofing situations in nearby receivers.

The ability to detect spoofed GNSS signals (i.e. signals transmitted from a location other than the satellite itself) is desired so their affects can be mitigated. <CIT> relates to GNSS spoofing detection. <CIT> relates to a spoofing detection system for a satellite positioning system. <CIT> relates to a Baidoo/inertia integrated anti-deception-jamming method based on Kalman filtering estimation.

Some optional features are defined by the dependent claims.

Embodiments can be more easily understood and further advantages and uses thereof will be more readily apparent, when considered in view of the detailed description and the following figures in which:.

In accordance with common practice, the various described features are not drawn to scale but are drawn to emphasize specific features relevant to the subject matter described. Reference characters denote like elements throughout Figures and text.

In the following detailed description, reference is made to the accompanying drawings, which form a part hereof, and in which is shown by way of illustration specific embodiments in which the inventions may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the embodiments, and it is to be understood that other embodiments may be utilized and that changes may be made without departing from the scope of the present invention. The following detailed description is, therefore, not to be taken in a limiting sense, and the scope of the present invention is defined only by the claims.

Embodiments provide a satellite spoofing detection system that uses error state estimates in determining if spoofing of satellite signals are present. Referring to <FIG>, a vehicle <NUM> including a system for detecting signal spoofing using error state estimates is illustrated. The vehicle may be an avionic aircraft, such as but not limited to a plane or drone, a land based vehicle, such as but not limited to a car or truck, or a water based vehicle such as but not limited to a ship.

The vehicle <NUM> in this example, includes at least one antenna <NUM> to detect satellite signals <NUM>-<NUM> through <NUM>-n from satellites <NUM>-<NUM> through <NUM>-n. The satellite signals can generally be identified by <NUM>. Similarly, the satellites can be generally identified by <NUM>. A receiver <NUM> is in communication with the antenna <NUM> to receive the detected satellite signals <NUM>. At least one controller <NUM>, that is communication with the receiver <NUM>, is configured to process the satellite signals <NUM> received from each satellite <NUM>. The processing may include determining raw pseudorange measurements to each associated satellite <NUM> based on instructions stored in at least one memory <NUM>. The raw pseudorange measurement may be determined by multiplying the speed of light by the time it took for the satellite signal <NUM> to travel from an associated satellite <NUM>. Since there are many physical effects that occur that may result in synchronization errors between the receiver and satellite clocks, the range determined is a raw pseudorange measurement instead of a true range measurement. The controller <NUM> employs one or more monitors to determine if the received satellite signals are being spoofed.

In general, the controller <NUM> may include any one or more of a processor, microprocessor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field program gate array (FPGA), or equivalent discrete or integrated logic circuitry. In some example embodiments, controller <NUM> may include multiple components, such as any combination of one or more microprocessors, one or more controllers, one or more DSPs, one or more ASICs, one or more FPGAs, as well as other discrete or integrated logic circuitry. The functions attributed to the controller <NUM> herein may be embodied as software, firmware, hardware or any combination thereof. The controller <NUM> may be part of a system controller or a component controller, such as but not limited to, the receiver controller or navigation controller. The memory <NUM> may include computer-readable operating instructions that, when executed by the controller provides functions of the satellite signal spoofing detection system. Such functions may include the functions of applying one or more monitors. The computer readable instructions may be encoded within the memory <NUM>. Memory <NUM> is an appropriate non-transitory storage medium or media including any volatile, nonvolatile, magnetic, optical, or electrical media, such as, but not limited to, a random access memory (RAM), read-only memory (ROM), non-volatile RAM (NVRAM), electrically-erasable programmable ROM (EEPROM), flash memory, or any other storage medium.

The controller <NUM> in embodiments is configured to implement one or more monitors <NUM>-<NUM> through <NUM>-n, discussed in detail below, to determine error state estimates that may indicate spoofing of the satellite signal is occurring. Error state estimates may be stored in the memory <NUM>. In some embodiments, it is determined if error state estimates are changing at a rate beyond what would be expected. Error state estimates that change beyond what would be expected may indicate the satellite signals are being spoofed.

The vehicle <NUM> of <FIG> includes a satellite signal spoofing detection system <NUM> for detecting satellite signal spoofing using sensor state error estimates. The satellite signal spoofing detection system <NUM> includes sensor <NUM> (which is an inertial navigation system (INS)) <NUM> and components for determining navigation state estimates based on received satellite signals generally referenced as a global positioning system (GPS) <NUM>. The INS <NUM> is a type of sensor that determines changes in angular orientation relative to some reference frame and translational position over a period of time. In an embodiment, the INS may be an inertial reference system (IRS). An IRS is a type of INS that uses gyroscopes and accelerometers to determine changes in angular orientation relative to some reference frame and translational position over a period of time. The vehicle <NUM> of the example illustrated in <FIG>, uses a combined GPS/INS system. With an integrated GPS/INS system, the GPS <NUM> may be used to correct state estimates determined by INS <NUM>. State estimates from the INS <NUM> tend to drift from true values while, although some noise effects state estimates in a GPS, GPS state estimates are generally not as susceptible to drifting, with any drifting that does occur, being predictable so that mitigation techniques can be employed. One other advantage of using a combined GPS/INS system is that the system allows for smoother position and velocity estimates since the INS <NUM> can be used to fill in gaps between the GPS positioning determinations.

The vehicle <NUM> further includes other sensors <NUM>-<NUM> through <NUM>-n that provide further sensor information to the controller <NUM> upon which the controller may determine state estimates. The sensors, generally indicated as <NUM> may include, but are not limited to, altitude sensors, speed sensors, airspeed sensors, direction sensors, etc. As with the INS sensor discussed above, the GPS <NUM> may be used to correct errors in the state estimates determined by the other sensors <NUM>.

Examples of state estimates include position, velocity, attitude, heading as well as inertial sensor biases, misalignments, scale factors, satellite clock phase, satellite clock frequency, satellite bias states (per satellite). The controller <NUM> of the satellite signal spoofing detection system <NUM> inputs sensor state estimates determined from sensor information (INS <NUM> and sensors <NUM>) and the satellite state estimates from GPS <NUM> information into filter <NUM>. Filter <NUM> may be an electronic filter, such as a Kalman filter, that is stored in memory <NUM>. The filter <NUM>, implemented by the controller <NUM> outputs information related to sensor error estimates. The controller <NUM> in embodiments, is configured to monitor the sensor error estimates to determine if spoofing in one or more of the satellite signals is present.

Further illustrated in <FIG> is an input/output <NUM> which provides a communication link between an operator and the controller <NUM>. The input/output may include an information input device, such as but not limited to, a keyboard and an output device, such as, but not limited to, a display. Also illustrated in this example embodiment is a navigation system <NUM> that is in communication with the controller <NUM>. The navigation system <NUM> may include navigation controls used to control the steering of the vehicle <NUM>. The navigation system <NUM> further may include a location system that uses the state estimations from the sensors <NUM> and <NUM> and the GPS <NUM> to determine a location of the vehicle <NUM>. In one embodiment, controller <NUM> is configured to determine location information and then pass it on the navigation system <NUM>. In some embodiments the controller <NUM> is configured to control the navigation system <NUM> based at least in part on detected spoofing associated with a satellite signal <NUM>. The control of the navigation system <NUM> may include, but is not limited to, removing a satellite signal <NUM> associated with a detected spoofing signal from a location determination and providing a spoofing alert to an operator via display in the input/output <NUM> or the navigation system <NUM>. The alarm may provide the operator with information regarding the integrity of a determined location.

As discussed above, the at least one controller <NUM>, in embodiments, is configured to apply one or more monitors <NUM>-<NUM> through <NUM>-n in determining if a satellite signal <NUM> is being spoofed. The monitors may generally be identified by <NUM>. An example of a first monitor <NUM> is an inertial error estimate monitor. The inertial error estimate monitor monitors inertial error state estimates. The inertial error state estimates (or generally sensor error state estimates) are determined by comparing determined sensor state estimates from the sensor (which may be the INS <NUM>) with the satellite state estimates from the GPS <NUM>. In an embodiment, the history of the inertial error estimates are compared with a then current inertial state estimate to determine if the inertial error state estimates are changing in a way (i.e. by a rate, for example), beyond what would be predicted based on known inertial error characteristics. In this example monitor <NUM>, if inertial error state estimates (such as position, velocity, heading etc., state error estimates) are beyond what would be predicted, this may imply one or more of the satellite signals are being spoofed.

A second example monitor <NUM> is an estimated satellite signal bias error monitor <NUM>. The estimated satellite signal bias error monitor monitors if estimated satellite signal bias errors are changing at a rate beyond expectations. In this example, individual pseudorange measurements from each satellite from more than four satellites are determined and a solution to a state, such as position, is determined from all of the pseudorange measurements. Each pseudorange measurement may then be cross-checked against the solutions provided by the other measurements to determine if errors are changing beyond a rate expected. For example, a separation solution may be employed that removes one pseudorange measurement from the solution at a time and compares the difference between the solution with the pseudorange measurement and the solution without the pseudorange measurement. Further, changes in errors are monitored over time. If pseudorange measurement errors associated with a specific satellite change at rate beyond what is expected, the satellite may be spoofed. For example, if a pseudorange measurement determined by a signal <NUM> from an associate satellite <NUM> normally has an error of around <NUM> meters every hour and suddenly it has an error of <NUM> meters, a spoofing event may be occurring.

A third example monitor <NUM> is a common clock error monitor <NUM>. The common clock error monitor <NUM> monitors common clock errors at the GPS receiver <NUM>. A GPS clock in the receiver <NUM> may drift over time. When it drifts however, the result is common error across all measurement from all of the satellite signals <NUM> since it comes from the same clock at the receiver <NUM> that is used to determine the time it took the satellite signals <NUM> to travel from their respective satellites <NUM> to the receiver <NUM>. Generally, the receiver <NUM> clock drift characteristics are known and can be accounted for when determining pseudorange measurement. In this embodiment if the drift of the GPS receiver is more than expected, spoofing may be present.

A fourth example monitor <NUM> is an altitude error monitor <NUM>. The altitude error monitor <NUM> monitors a vertical (altitude) measurement from a sensor <NUM> and an altitude solution from the GPS <NUM> to determine if a difference between the sensor and GPS derived altitude indicates that there may be spoofing of one or more satellite signals. An example of sensor <NUM> providing altitude data is a pressure sensor.

A fifth example monitor is a velocity measurement monitor <NUM>. The velocity measurement monitor <NUM> monitors differences between a velocity from a sensor <NUM>, such as an airspeed measurement sensor, and a GPS based determined velocity. Changes at rate beyond that expected by a change in wind, etc. may indicate one or more satellite signals are being spoofed. An example of an airspeed sensor is pitot tube. One or more of the above example monitors <NUM> may be implemented by the controller <NUM> to determine if spoofing is present in embodiments.

<FIG> illustrates a satellite signal spoofing detection flow diagram <NUM> using error state estimates of an example embodiment that is implemented by the at least one controller <NUM> by executing one or more of the monitors <NUM> stored in memory <NUM>. The satellite signal spoofing detection flow diagram <NUM> of <FIG> is provided as a series of sequential blocks. The sequence of the blocks may be different in other embodiments including blocks being implemented in parallel. Hence, embodiments are not limited to a specific sequence of blocks.

The satellite signal spoofing detection flow diagram <NUM> includes receiving satellite signals at block (<NUM>). The satellite signals are processed at block (<NUM>) to determine a satellite state estimate. In some embodiments, one or more sensor state estimates may be provided by sensor signals as illustrated in <FIG>. In particular, at block (<NUM>) sensor signals are generated by a sensor. An example of a sensor is an INS <NUM>. A sensor state estimate is generated at block (<NUM>). Additional sensors may be used to generate sensor signals, such as sensors <NUM> discussed above. If additional sensors are used, additional sensor signals are generated at block (<NUM>) and processed to determine sensor state estimates at block (<NUM>).

The generated satellite state estimate determined at block (<NUM>) and the generated sensor state estimates determined at block (<NUM>) and block (<NUM>) are input into block (<NUM>). At block (<NUM>) an error state estimate is determined. The error state estimate may be the difference between a sensor state estimate and the satellite state estimate in monitors using the GPS system to correct sensor state information. Further the error state estimate may come solely from the satellite signals as used in the estimated satellite signal bias error monitor and the common clock monitor described above. It is then determined at block (<NUM>) if the error state estimate is beyond what would be predicted for an error state estimate. If it is not beyond what would be predicted, the process continues receiving satellite signals at block (<NUM>) and generating sensor signals at blocks (<NUM>) and (<NUM>). In some embodiments, in determining if the error state estimates are beyond what is expected at block (<NUM>), past history of the error state estimates are compared with current error state estimates. The past histories may be obtained through a buffer system or an averaging system that keeps a running average the error state estimates. Further in an embodiment, more than one monitor is used determining if the error state estimate is beyond what is expected. For example, in this embodiment the results of one implemented monitor may be compared or verified with the results of a second implemented monitor. Further in an embodiment, more than one sensor can generate the sensor state estimate.

If it is determined at block (<NUM>) that the error state estimate is beyond what is expected, a spoofing alarm signal is generate at block (<NUM>). The spoofing alarm signal is provided to block (<NUM>) where the navigation system <NUM> may control the vehicle <NUM> based at least part on the received spoofing alarm signal. The process then continues receiving satellite signals at block (<NUM>) and generating sensor signals at blocks (<NUM>) and (<NUM>).

Examples of satellite signal spoofing detection using inertial state estimates are illustrated in the flow diagrams of <FIG>. The sequence of the blocks may be different in other embodiments including blocks being implemented in parallel. Hence, embodiments are not limited to a specific sequence of blocks illustrated in the flow diagrams of <FIG>.

Referring to <FIG>, a basic satellite signal spoofing detection flow diagram <NUM> using error state estimates according to another embodiment is illustrated. In this example, inertial state estimates, that are determined at block (<NUM>), are provided to a filtering block (<NUM>). Further, satellite state estimates, that is determined at block (<NUM>), are also provided to the filtering block (<NUM>). At filtering block (<NUM>), a filter such as Kalman filter <NUM>, is used by the controller <NUM> to generate state corrections. The state corrections are applied to the inertial state estimates at block (<NUM>) to determine total state estimates. The total state estimates are passed to the detect spoofing block (<NUM>) and a delay block (<NUM>) in a delay path. The delay block (<NUM>) generates past or delayed total state estimates. The delayed total state estimates are also passed to the detect spoofing block (<NUM>).

The detect spoofing block (<NUM>), in an embodiment, monitors differences between a then current total state estimate and the delayed state estimate in determining if a spoofing alert should be issued. In one embodiment, if the current total state estimate is increase beyond what would be expected as comparted to the delayed state estimate, a spoofing alert is issued. Further in an embodiment, a threshold is used to determine when a spoofing alert should be generated. The threshold may be determined based on other signals from the filter block (<NUM>) that keep track of how sensitive the error estimates are and how much they would be expected to change during a spoofing event.

Another example of a satellite signal spoofing detection flow diagram <NUM> using error state estimates and a covariance determination to set thresholds is illustrated in <FIG>. This example embodiment also generates inertial state estimates at block (<NUM>) and satellite state estimates at block (<NUM>). The state estimates are used at filtering block (<NUM>) to generate state corrections Δx and an error covariance P. An example equation for the state corrections may be Δx = Φx, where Φ is the state translation matrix over a propagation interval. An example of an equation for an error covariance P is P = ΦPΦT + Q, where Q is the process noise covariance matrix over the propagation interval.

The state corrections Δx are passed to block (<NUM>) wherein the total state estimates x are determined. The total state estimates x output from block (<NUM>) are passed to an input of a detect spoofing block (<NUM>) as well a delay block (<NUM>) in a state estimate delay path. The delay block (<NUM>) is configured to generate past total state estimates. In this embodiment, an output of the delay block (<NUM>) is passed to a propagate to current block (<NUM>). The propagate to current block (<NUM>) is configured to propagate the delayed total state estimates up to the current time to synchronize the delayed total state estimates with current total state estimates. The propagate to current block (<NUM>) outputs delay total state estimates xdelay which is passed to the detect spoofing block (<NUM>).

The error covariance P output from filter block (<NUM>) is also provided to detect spoofing block (<NUM>) as well as a delay block (<NUM>) in a covariance path. The error covariance P indicates a certainty value for each state solution estimate at a given time. For example, if there is an estimated <NUM> meters of error in an inertial measurement and it is expected the estimate is within plus or minus <NUM> meters, the error covariance is plus or minus <NUM> meters. The covariance is used to set thresholds in this example embodiment. The delay block (<NUM>) is configured to generate past error covariances. In one example, a buffer system is used and in another example embodiment and averaging system is used in the delay block (<NUM>). In each example, however, data that reflects past error covariances is used. An output of delay block (<NUM>) is passed to a propagate to current block (<NUM>). The propagate to current block (<NUM>) is configured to propagate the delayed error covariances up to the current time to synchronize the delayed error covariances with the current error covariances P. An output of the propagate to current block (<NUM>) is a delayed error covariance Pdelay which is passed to the detect spoofing block (<NUM>).

Yet another example of a satellite signal spoofing detection flow diagram <NUM> using error state estimates and a covariance determination to set thresholds is illustrated in <FIG>. This example embodiment also generates inertial state estimates at block (<NUM>) and satellite state estimates at block (<NUM>). The state estimates are used at filtering block (<NUM>) to generate state corrections Δx and an error covariance P. The state corrections Δx are passed to block (<NUM>) wherein the total state estimates x are determined. The state corrections Δx in this example is also passed to delay block (<NUM>) in a state estimate delay path. The delay block (<NUM>) is configured to generate past total state estimates. In this embodiment, an output of the delay block (<NUM>) is passed to block (<NUM>) where corrections are applied. An output of block (<NUM>) are passed to a propagate to current block (<NUM>). The propagate to current block (<NUM>) is configured to propagate the delayed total state estimates up to the current time to synchronize the delayed total state estimates with current total state estimates. The propagate to current block (<NUM>) outputs delay total state estimates xdelay which is passed to the detect spoofing block (<NUM>).

The error covariance P output from filter block (<NUM>) is also provided to detect spoofing block (<NUM>) as well as a delay block (<NUM>) in a covariance path. The error covariance P indicates a certainty value for each state solution estimate at a given time. The covariance is used to set thresholds in this example embodiment. The delay block (<NUM>) is configured to generate past error covariances. In one example, a buffer system is used and in another example embodiment and averaging system is used in the delay block (<NUM>). In each example, however, data that reflects past error covariances is used. An output of delay block (<NUM>) is passed to a propagate to current block (<NUM>). The propagate to current block (<NUM>) is configured to propagate the delayed error covariances up to the current time to synchronize the delayed error covariances with the current error covariances P. An output of the propagates to current block (<NUM>) is a delayed error covariance Pdelay which is passed to the detect spoofing block (<NUM>). The spoofing detector <NUM> may apply the blocks illustrated in <FIG> to the total state estimates x, the delayed total state estimates xdelay, the current error covariance P and the delayed error covariance Pdelay to determine if a spoofing alert should be issued.

An example of a process implemented in the detect spoofing of block (<NUM>) of the satellite signal spoofing detection flow diagram <NUM> and block (<NUM>) of a satellite signal spoofing detection flow diagram <NUM> is illustrated in the spoofing detection flow diagram <NUM> of <FIG>. Although this example implements a root sum square operator in determining a then current threshold, other operators may be used in other embodiments. As illustrated in <FIG>, in this example, a total state estimate x is subtracted from a delayed total state estimate xdelay with a mathematical operator <NUM> to determine a total state estimate difference dx. The threshold is determined with the current error covariance P and the delayed error covariance Pdelay at block (<NUM>). In one example, the threshold is determined with the following equation: <MAT>, for all states I; where σ = <MAT>, and <MAT>.

Determining if a spoofing alert should be generated, is provided at block (<NUM>). At block (<NUM>) it is determined if an absolute value of the difference dx is greater than the threshold Thresh(i), for state i. If it is determined at block (<NUM>) that the difference dx is greater than the threshold Thresh(i), a spoofing alert is generated.

Yet another example of a satellite signal spoofing detection flow diagram <NUM> using error state estimates and a covariance determination to set thresholds is illustrated in <FIG>. This example embodiment also generates inertial state estimates at block (<NUM>) and satellite state estimates at block (<NUM>). The state estimates are used at filtering block (<NUM>) to generate state corrections Δx and an error covariance P. The state corrections Δx are passed to block (<NUM>) where, in this example, corrections are accumulated and propagated to the current to generate accumulated recent state corrections dx. The accumulated recent state corrections dx output from block (<NUM>) are passed to an input to detect spoofing block (<NUM>). That is, in this embodiment, block (<NUM>) performs the functions of comparing the total state estimates with the delayed state estimates to determine the accumulated recent state corrections dx.

One example method of determining the accumulated recent state corrections dx is by using the following equation: <MAT>, where.

The error covariance P output from filter block (<NUM>) is also provided to detect spoofing block (<NUM>) as well as a delay block (<NUM>) in a covariance path. The error covariance P indicates a certainty value for each state solution estimate at a given time. As discussed above, the covariance is used to set thresholds. The delay block (<NUM>) is configured to generate past error covariances. In one example, a buffer system is used and in another example embodiment and averaging system is used in the delay block (<NUM>). In each example, however, data that reflects past error covariances is used. An output of delay block (<NUM>) is passed to a propagate to current block (<NUM>). The propagate to current block (<NUM>) is configured to propagate the delayed error covariances up to the current time to synchronize the delayed error covariances with the current error covariances P. An output of the propagate to current block (<NUM>) is a delayed error covariance Pdelay which is passed to the detect spoofing block (<NUM>). The detect spoofing block (<NUM>) is configured to generate a spoofing alert.

An example of a spoofing detection flow diagram <NUM> that may be used for the detect spoofing block (<NUM>) of the satellite signal spoofing detection flow diagram <NUM> is illustrated in <FIG>. This spoofing detection flow diagram <NUM> may be used where the accumulated recent state corrections dx determined at block (<NUM>) is directly input into block (<NUM>) of the spoofing detector. The threshold is determined as discussed above with regard to <FIG>, where: <MAT>, for all states I; where σ = <MAT>, and <MAT>.

Determining if a spoofing alert should be generated, is provided at block (<NUM>). At block (<NUM>) it is determined if an absolute value of the accumulated Recent State Corrections dx is greater than the threshold Thresh(i), for state i. If it is determined at block (<NUM>) that the difference dx is greater than the threshold Thresh(i), a spoofing alert is generated.

Referring to the velocity graphs <NUM> and <NUM> of <FIG> and <FIG>, graphical representations of how embodiments are applied to a velocity state are provided. Graph <NUM> illustrates velocity error state estimates over time. In particular, graph <NUM> illustrates what happens when a spoofing event occurs. In an example, inertial velocity state estimates are corrected with satellite velocity state estimates. Graph <NUM> includes thresholds 910a and 910b. Before a spoofing event, a corrected velocity state estimate will track with the delayed velocity state estimate <NUM>. After a spoofing event, at little after <NUM> seconds in graph <NUM>, the spoofed velocity state estimate <NUM> diverges from the delayed velocity state estimate <NUM>. In this scenario, spoofed satellite signals cause the spoofed velocity estimate <NUM> to diverge past the threshold 910a by incorrectly adjusting the inertial velocity estimate. The delayed state estimate <NUM>, after the diversion, illustrates a more accurate velocity which would be close to the inertial velocity state estimate without corrections derived from the satellite signals. <FIG> illustrates a velocity error state difference. Graph <NUM> illustrates the difference between the velocity state estimate and the delayed velocity state estimate as it would be determined in a detecting satellite signal spoofing using sensor estimate error system described above. As illustrated, the velocity state difference <NUM> stays within the thresholds 930a and 930b until the spoofing event is encountered, a little after <NUM> seconds. At that point the spoofed satellite signals used to adjust the inertial signals cause the velocity state difference <NUM> (i.e. the difference between the current state estimate x and the delayed state estimate xdelay) to be greater than the threshold 930a.

Similar graphs for position state estimates are illustrated in <FIG> and <FIG>. In <FIG> the position state estimates are illustrated over time. In particular, graph <NUM> illustrates thresholds 1010a and 1010b as well as a delayed position estimate <NUM> and a spoofed position estimate <NUM>. As illustrated, the estimates track with each other until a spoofing event is encountered, a little after <NUM> seconds. At that point the spoofed satellite signals cause the spoofed positioned estimate <NUM> to deviate from the delayed state estimate. Here again, the delayed position state estimate will be closer to the actual position based on other position information, such as from the INS <NUM> than state estimates corrected with a spoofed satellite signal. <FIG> illustrates a position error state difference. Graph <NUM> of <FIG> illustrates the difference between the state estimate and the delayed estimate as it would be determined in the detecting satellite signal spoofing using sensor estimate error systems described above. As illustrated, the position state difference <NUM> stays below the thresholds <NUM> until the spoofing event is encountered, a little after <NUM> seconds. At that point the spoofed satellite signals used to adjust the position state estimate information from another sensor causes the position state difference <NUM> (i.e. the difference between the current state estimate x and the delayed state estimate xdelay) to be greater to the threshold <NUM>.

Claim 1:
A system (<NUM>) for detecting satellite signal spoofing using error state estimates, the system (<NUM>) comprising:
at least one satellite receiver (<NUM>) to receive satellite signals (<NUM>);
at least one memory (<NUM>), the at least one memory (<NUM>) configured to store at least operation instructions; and
at least one controller (<NUM>) in communication with the at least one satellite receiver (<NUM>) and the at least one memory (<NUM>), the at least one controller (<NUM>) configured to determine state estimates from the received satellite signals (<NUM>), and characterized in that the at least one controller (<NUM>) is further configured to determine error state estimates based at least in part on differences in current state estimates and differences in delayed state estimates, the controller (<NUM>) further configured to determine if spoofing is occurring in one or more of the received satellite signals (<NUM>) when the error state estimates are greater than a select threshold; wherein
the system further comprises:
at least one sensor (<NUM>, <NUM>), wherein the determined state estimates include satellite state estimates determined from the satellite signals (<NUM>) and sensor state estimates determined from sensor information from the at least one sensor (<NUM>), the at least one controller (<NUM>) configured to determine the error state estimates based on differences between the sensor state estimates and the satellite state estimates;
a Kalman filter (<NUM>) configured to generate state corrections and, optionally, error covariances based on the sensor state estimates and the satellite state estimates;
wherein the at least one controller (<NUM>) is further configured to:
apply the state corrections to the sensor state estimates to generate current total state estimates;
delay one of the current total state estimate and the state corrections to generate delayed total state estimates; and
compare the current total state estimates with the delayed total state estimates to determine the error state estimates.