Patent Description:
A GNSS receiver is susceptible to GNSS spoofing, which can cause a GNSS receiver to determine an incorrect three dimensional location and/or time; time means time of day and date. GNSS Spoofing means manipulation of GNSS data received by a GNSS receiver so that the GNSS receiver determines an incorrect three dimensional location and/or time. GNSS data may be manipulated by a transmitter broadcasting data used for position and/or time determination, which mimics data broadcast from one or more GNSS satellites. This manipulated data is then detected by the GNSS receiver instead of the data from the one or more corresponding GNSS satellites, and is used by the GNSS receiver to determine location and time. GNSS spoofing attacks can cause a grave risk to a vehicle, personnel aboard the vehicle (if any), and objective(s) of the vehicle. For example, if altitude is incorrectly determined due to GNSS spoofing, an aircraft could take a landing trajectory that is too steep and may crash. <CIT> relates to global navigation satellite system (GNSS) spoofing detection and mitigation. <CIT> relates to using statistical data processing in altimeter and terrain awareness integrity monitoring systems.

The invention is as defined by the appended independent claims. Some optional features are defined by the dependent claims.

Exemplary features of the present disclosure, its nature, and various advantages will be apparent from the accompanying drawings and the following detailed description of various embodiments. Non-limiting and non-exhaustive embodiments are described with reference to the accompanying drawings, wherein like labels or reference numbers refer to like parts throughout the various views unless otherwise specified. The sizes and relative positions of elements in the drawings are not necessarily drawn to scale. For example, the shapes of various elements are selected, enlarged, and positioned to improve drawing legibility. The particular shapes of the elements as drawn have been selected for ease of recognition in the drawings. One or more embodiments are described hereinafter with reference to the accompanying drawings in which:.

In the following detailed description, reference is made to the accompanying drawings that form a part hereof, and in which is shown by way of illustration specific illustrative embodiments. However, it is to be understood that other embodiments may be utilized, and that logical, mechanical, and electrical changes may be made. Furthermore, the method presented in the drawing figures and the specification is not to be construed as limiting the order in which the individual steps may be performed. The following detailed description is, therefore, not to be taken in a limiting sense.

Techniques for detecting GNSS spoofing are subsequently described. Optionally, upon such detection, vehicle system(s) and/or vehicle crew can be alerted to GNSS spoofing so that they can take action to diminish risk. Optionally, upon such detection, alternative source(s) of position data may be used to provide position data, instead of a GNSS receiver, so as to determine position of the vehicle.

GNSS spoofing can be detected as follows. Vehicle height above terrain is determined with a sensor (that is not a GNSS receiver and is otherwise referred to as a height above terrain circuitry). Then, a difference between the determined vehicle height above terrain, and a calculated vehicle height above terrain is determined. The calculated vehicle height above terrain is determined by subtracting (a) terrain elevation from (b) vehicle altitude. The vehicle altitude may be determined solely using the GNSS receiver, or using both the GNSS receiver and alternate circuitry to determine position data. For example, vehicle altitude may be determined based upon combining vertical positions separately derived from data from the GNSS receiver and the circuitry to determine position data, which e.g., may be combined to by Kalman filtering, or alternatively averaging the vertical position derived from data from each of the GNSS receiver and the circuitry to determine position data.

Terrain elevation is determined with a terrain database using lateral position. Lateral position and altitude may be determined (at least in part) by the GNSS receiver, or another system utilizing position data derived from data from the GNSS receiver. For example, if the GNSS receiver determines position in polar coordinates, the other system can transform such coordinates to Cartesian coordinates to generate lateral position and altitude. The other system may be GNSS spoofing detection system (or processing circuitry and/or a spoof detection application discussed herein).

If the difference between the determined vehicle height above terrain and the calculated vehicle height above terrain exceeds a threshold level, then GNSS spoofing is determined to have occurred (or has been detected). By more reliably knowing when GNSS data is being spoofed, a vehicle utilizing GNSS technology can more readily protect against such spoofing and thus provide safer transport.

The embodiments disclosed herein are designed to be implemented in vehicles, such as aircraft. Although an aircraft is illustrated throughout the disclosure, this illustration is merely for pedagogical reasons and not intended to be limiting in any sense. Instead, the term "vehicle" is intended to convey the ordinary meaning as understood by one having skill in the art, which includes, but not limited to, air vehicles, space vehicles, water borne ships, submersibles, and other types of vehicles.

<FIG> illustrates a block diagram of one embodiment of a GNSS spoofing detection system (system) <NUM>. The system <NUM> is configured to be coupled to at least one GNSS receiver (GNSS receiver(s)) <NUM> (e.g. a GPS receiver, GLONASS receiver, BeiDou receiver, a Galileo receiver, and/or any other type of GNSS receiver), and height above terrain (HAT) circuitry <NUM>. The HAT circuitry means circuitry configured to measure the height above terrain, e.g. a radar altimeter, a depth (or echo) sounder, and/or any other circuitry for determining height above terrain.

Optionally, the system <NUM> is configured to be coupled to at least one alternate circuitry to determine position data (alternate circuitry to determine position data or alternate system(s) to determine position data) <NUM>, internal alert circuitry <NUM>, and/or at least one external communication system (external communications system(s)) <NUM>. The external communications system(s) <NUM> may comprise high frequency (HF), very high frequency (VHF), satellite communication (SATCOM), WiFi, WiMax, and/or automatic dependent surveillance radio(s). Optionally, the aforementioned components are configured to be mounted in or on a vehicle <NUM>. However, alternatively, the GNSS receiver may be detached from the vehicle <NUM>; for example, for a submarine, the GNSS receiver may be on a mast or a cable at or near a surface of water while the submarine remains submerged under the surface.

The alternate circuitry to determine position data <NUM> excludes GNSS receiver(s), and may comprise an inertial navigation system (INS), at least one radio navigation system, and/or other circuitry to determine position data. An INS comprises one or more inertial measurement units (IMUs), where each IMU comprises one or more accelerometers and/or one or more gyroscopes. A radio navigation system comprises one or more receivers configured to determine position based upon signals received from, e.g. long-range navigation (LORAN) transmitters, distance measuring equipment (DME) transmitter(s), Very High Frequency Omnidirectional Range (VOR) transmitter(s), and/or other equipment. Optionally, position data can also be obtained from the alternate system(s) to determine position data <NUM> instead of from the GNSS receiver <NUM>, when signal spoofing is detected.

The system <NUM> may be implemented as, e.g., a state machine or a neural network. For pedagogical purposes, <FIG> illustrates the system <NUM> implemented as a state machine comprising processing circuitry <NUM> coupled to memory circuitry <NUM>. Software and/or data stored in the memory circuitry <NUM> is executed in the processing circuitry <NUM>. In the illustrated embodiment, a GNSS spoof detection application <NUM> is stored in the memory circuitry <NUM>.

Optionally, a terrain database <NUM> is stored in the memory circuitry <NUM>. Optionally, the terrain database <NUM> comprises grid cells defined by lateral position of a surface, and at least a corresponding terrain elevation is associated with a grid cell. Alternatively or additionally, the terrain database <NUM> may comprise at least equation(s) relating lateral position to terrain elevation. Thus, the terrain database <NUM> comprises at least terrain elevation with respect to lateral position of a surface. A grid cell means a square or rectangle area of a map, e.g., of the Earth, that has a corresponding terrain elevation. Grid cells may or may have the same area (or size), but at different locations.

The terrain database <NUM>, however, may be stored elsewhere, e.g. in another system communicatively coupled to the processing system circuitry <NUM>. Optionally, the terrain database <NUM> may be stored in a Terrain Awareness and Warning System (TAWS) (or terrain awareness and warning circuitry), which is used to warn flight crew if a vehicle is in imminent danger of impacting the ground or another obstacle; the other system, e.g., TAWS, is configured to be communicatively coupled to the GNSS spoofing detection system.

The GNSS receiver <NUM> is configured to acquire GNSS signals, e.g. data from four or more satellites of a GNSS. The GNSS receiver <NUM> is further configured to use the GNSS signals to determine a three dimensional position, e.g., of the GNSS receiver <NUM>, and thus the vehicle <NUM>, relative to a body such as Earth. Position of the vehicle <NUM> may include vehicle altitude and vehicle lateral position (e.g. latitude and longitude coordinates). The HAT circuitry <NUM> is configured to determine the height above terrain of a vehicle <NUM> (vehicle HAT). For example, the HAT circuitry <NUM> may measure the vehicle HAT by determining the length of time it takes for a signal(s) emitted by the vehicle <NUM>, e.g., radio waves, acoustic waves, and/or other signals, to reflect from the terrain back to the HAT circuitry <NUM>; however, HAT circuitry <NUM> may use other techniques to determine height above terrain. The HAT circuitry <NUM> provides a measurement of the vehicle's HAT independent from position of the vehicle <NUM> derived from data the GNSS receiver <NUM>. Position derived from data from the GNSS receiver <NUM>, and vehicle HAT determined by a HAT circuitry <NUM>, are sent to the system <NUM> for analysis to determine whether possible GNSS spoofing has occurred.

System <NUM>, e.g. the processing circuitry <NUM>, is configured to execute the instructions of spoof detection application <NUM>. <FIG> illustrates one embodiment of a method of implementing the spoof detection application <NUM>; however, the spoof detection application <NUM> may be implemented in other ways.

The spoof detection application <NUM> determines a difference between a height above terrain (determined using data from the GNSS receiver <NUM> and the terrain database <NUM>) with the height above terrain determined by the HAT circuitry <NUM>. The difference is the absolute value of the difference. Optionally, one or more offset values may be added or subtracted from the difference; for example, one offset value corresponds to the difference between the location of the GNSS receiver and the vehicle <NUM>, e.g. due to separation due to a mast or a cable as illustrated herein. The absolute value of the difference is compared against a threshold value to determine if spoofing of a GNSS signal has occurred. The threshold value is determined by a system designer or vehicle operator. The threshold value may vary based upon, at least in part, grid cell resolution and/or vehicle height above terrain. For example, if grid cell resolution increases (higher resolution), the threshold value may decrease. For example, alternatively or additionally, if as vehicle height above terrain decreases, then so may the threshold value. The vehicle height above terrain may be determined using vehicle HAT determined by the HAT circuitry <NUM>, calculated vehicle height above terrain (discussed elsewhere herein), or some combination (e.g., an average of both).

Lateral position and/or altitude derived from data from the GNSS receiver <NUM>, the height above terrain determined by the HAT circuitry <NUM>, position, e.g. altitude, derived from data from alternate circuitry to determine position data <NUM> (if used to determine the difference), and/or terrain elevation determined from the terrain database are each filtered before being used to determine the difference. For example, in one embodiment, two or more sets of data may be low pass filtered during a filtering period by averaging the sets of data based upon the number of sets. For example, the number of sets of data to be filtered during a filtering period and/or the length of the filtering period may depend upon the speed of the vehicle; for example, as the speed of the vehicle <NUM> increases, the number of sets (to be filtered during the filtering period) and/or the filtering period may respectively decrease, and vice versa. Alternatively or additionally, the number of data sets (to be filtered during a filtering period) and/or the filtering period are determined based upon the grid cell resolution of the terrain database <NUM> corresponding to determined lateral position; for example, as the grid cell resolution decreases, the number of sets (to be filtered during the filtering period) and/or the filtering period may respectively decrease, and vice versa. Thus, as the vehicle speed increases and/or the grid cell resolution decreases, the sensitivity to spoofing decreases. One having ordinary skill in the art will recognize that the number of data sets (to be filtered during a filtering period) and the filtering period can be modified based on the needs of the particular system, e.g. when the filtering parameters vary based upon two or more independent variables such as vehicle speed and grid cell resolution as described above. However, filtering may be performed in different ways then described herein.

If the difference is greater than a threshold level (if the threshold level is a positive number), or less than a threshold level (if the threshold level is a negative number), then the spoof detection application <NUM> determines that spoofing of the GNSS signal has occurred. Optionally, the spoof detection application <NUM> only determines if the difference in two or more consecutive grid cells over which the vehicle <NUM> travels. Optionally, the threshold level is equal to (or greater) than the resolution for a grid cell above or in which the vehicle <NUM> is located.

In the case where GNSS spoofing is detected, system <NUM> may respond in a variety of ways depending upon the embodiment. For example, in one embodiment, system <NUM> optionally includes internal alert circuitry <NUM> for issuing an alert of a potential GNSS spoofing event, e.g. to system(s) in, and/or to a crew of, the vehicle <NUM>. Internal alert circuitry <NUM> can be configured to provide an alert: e.g., alert signal(s) (e.g. to system(s) of the vehicle <NUM>), a visual alert (e.g. a message on a display and/or flashing light(s) (e.g. using light emitting diodes)), and/or provide an audible alert (e.g. using an audio amplifier and speaker system). The alert signal(s) may be, e.g., an electrical signal that notifies other systems or circuitry that GNSS spoofing has been detected. Further for example, the alert signal may be sent to a vehicle system that is the GNSS receiver <NUM>. As a result of receiving the alert signal, the GNSS receiver issues an invalidation signal to all systems configured to receive position data from the GNSS receiver <NUM> warning, and/or the GNSS receiver <NUM> is configured to cease sending position data; upon receipt of the invalidation signal, a vehicle systems cease using position data from the GNSS receiver <NUM>, and optionally may commence using position data from alternate circuitry to determine position data <NUM>.

Alternatively or additionally, system <NUM> may be configured to provide an alert (that GNSS spoofing has been detected) to external systems (which are external to the vehicle <NUM>) and/or personnel (e.g. on other vehicle(s) or located terrestrially or in outer space) through the external communications systems <NUM>. Such external system(s) and/or personnel may be associated with control center(s) (e.g. air traffic control center(s)) or operations center(s) (e.g. airline operations center(s)).

<FIG> is a flow diagram illustrating one embodiment of a method <NUM> for detecting GNSS spoofing. Method <NUM> may be implemented using the system described in <FIG>, but may be implemented by other means as well. The blocks of the flow diagram have been arranged in a generally sequential manner for ease of explanation; however, it is to be understood that this arrangement is merely exemplary, and it should be recognized that the processing associated with the methods (and the blocks shown in the Figures) can occur in a different order (for example, where at least some of the processing associated with the blocks is performed in parallel and/or in an event-driven manner).

In block <NUM>, receive position data (e.g. lateral position, such as latitude and longitude coordinates, and altitude) of the GNSS receiver from a GNSS receiver. Optionally, adjust the received position data to compensate for the location of the GNSS receiver in, on, or outside of the vehicle; for example, the GNSS receiver may be deployed above the vehicle as describe elsewhere herein, or may be offset in or on the vehicle.

In block <NUM>, determine terrain elevation based upon received (or adjusted) lateral position data, e.g. using a terrain database. In block <NUM>, determine vehicle height above terrain using determined terrain altitude, e.g. by subtracting the determined terrain elevation from the vehicle altitude derived from data received from the GNSS receiver. Vehicle HAT can be determined though in other ways. For example, if a vehicle includes a GNSS receiver and alternate system(s) to determine position data, then vehicle altitude can be determined based on vehicle altitudes derived from data from the GNSS receiver and the alternate system(s) to determine position data, e.g. as discussed elsewhere herein.

In block <NUM>, receive HAT, e.g. from HAT circuitry. In block <NUM>, determine if GNSS spoofing has occurred (e.g. has been detected), e.g. as described elsewhere herein. If no GNSS spoofing has been determined to occur, then optionally proceed back to block <NUM>. In the case where no GNSS spoofing has been determined to occur, the position data received by a GNSS receiver is deemed to be sufficiently reliable and is continued to be sent to and/or used by, e.g. vehicle crew, other vehicle system(s), external entit(ies), and/or other vehicle(s) - for example for vehicle navigation. External entit(ies), may include, e.g., traffic control center(s), operations center(s), and/or other vehicle(s).

If GNSS spoofing is determined to occur, then in block <NUM>, issue an alert, e.g. as discussed elsewhere herein. If an alert is sent to other vehicle system(s) (e.g. a flight navigation system and/or a TAWS), the alert may optionally cause the other vehicle system(s) to cease using the position data received from the GNSS receiver, and further optionally may cause some or all of the other vehicle system(s) to commence use position data from alternate circuitry to determine position data in lieu of position data from the GNSS receiver. Alternatively or additionally, the alert may also be sent to the GNSS receiver, which then may send an invalid signal to some or all of the other vehicle system(s); other vehicle system(s) receiving the invalid signal cease using position data from the GNSS receiver and/or some or all of the other vehicle system(s) receiving the invalid signal commence using position data from alternate circuitry to determine position data. Optionally, the alert can include the location at which GNSS signals spoofing was detected, and the time of such detection.

The embodiments of methods can be implemented by computer executable instructions, such as program modules or components, which are executed by at least one processor. Generally, program modules include routines, programs, objects, data components, data structures, algorithms, and the like, which perform particular tasks or implement particular data types.

Instructions for carrying out the various process tasks, calculations, and generation of other data used in the operation of the methods described herein can be implemented in software, firmware, or other computer-readable or processor-readable instructions. These instructions are typically stored on any appropriate computer program product that includes a computer readable medium used for storage of computer readable instructions or data structures.

The processing circuitry <NUM> may include any one or combination of processors, microprocessors, digital signal processors, application specific integrated circuits, field programmable gate arrays, and/or other similar variants thereof. The processing circuitry <NUM> may include or function with software programs, firmware, or other computer readable instructions for carrying out various process tasks, calculations, and control functions, used in the methods described herein. These instructions are typically tangibly embodied on any storage media (or computer readable media) used for storage of computer readable instructions or data structures.

Suitable computer readable media may include storage or memory media such as the memory circuitry <NUM> illustrated herein. The memory circuitry <NUM> described herein can be implemented with any available storage media (or computer readable medium) that can be accessed by a general purpose or special purpose computer or processor, or any programmable logic device. Suitable computer readable media may include storage or memory media such as semiconductor, magnetic, and/or optical media, and may be embodied as storing instructions in non-transitory computer readable media, such as random access memory (RAM), read-only memory (ROM), non-volatile RAM, electrically-erasable programmable ROM, flash memory, or other storage media.

Terrain database <NUM> describes at least terrain elevation over an area. Terrain database <NUM> as used herein may include either conventional database(s), data storage formats of any type, e.g. data files, and/or equation(s). Optionally, the terrain database <NUM> may be a terrain map. The terrain database <NUM> contains terrain data, including at least terrain elevation data corresponding to at least one location. Such terrain data can embody a set of geographic coordinate points (e.g., represented in Cartesian coordinates) and terrain features (e.g. terrain elevation) corresponding to each point in discrete form and/or using a model, e.g., one or more equations. Optionally, the terrain database <NUM> may comprise one or more grid cells. Grid cells are lateral regions of the terrain database <NUM>. Optionally, each grid cell has a given resolution. The resolution is the area of the grid cell (e.g., how much of the Earth's surface it covers) in the terrain database <NUM>. The grid cell resolution of the terrain database <NUM> may vary amongst grid cells. For example, if vehicle <NUM> is an aircraft, the grid cell resolution may be higher (smaller grid cell area in a grid of geographic coverage) in locations where an aircraft is intended to land, e.g. an airport, a landing strip, or an aerodrome.

Terms of relative position as used in this application are defined based on a plane parallel to the conventional plane or working surface of a material (e.g. a layer or a substrate), regardless of orientation. Terms such as "on," "higher," "lower," "over," "top," and "under" are defined with respect to the conventional plane or working surface being on the top surface of a layer or substrate, regardless of orientation.

Claim 1:
A system, comprising:
processing circuitry (<NUM>) configured to receive position data for a vehicle from a global navigation satellite system, GNSS, receiver (<NUM>) and to receive a first height above terrain, HAT, for the vehicle from HAT circuitry (<NUM>), wherein a lateral position and an altitude for the vehicle is derived from the position data;
wherein the processing circuitry (<NUM>) is further configured to:
determine, with data obtained from a terrain database including a plurality of grid cells, terrain elevation based upon the lateral position;
determine a second height above terrain, HAT, for the vehicle based upon subtracting the determined terrain elevation from the altitude;
filter at least one of the lateral position, the altitude, and the received first height above terrain based upon at least one of vehicle speed and the grid cell resolution;
detect GNSS spoofing based upon determining whether the absolute value of the difference between the first HAT and the second HAT is greater than a threshold value which is based on at least one of: grid cell resolution and the first HAT, the second HAT, or an average of both the first HAT and second HAT; and
upon detecting GNSS spoofing, issue an alert.