Identification of Authentic GNSS Signals in Time-Differenced Carrier-Phase Measurements with a Software-Defined Radio Receiver

Zhen Zhu; Sanjeev Gunawardena; Eric Vinande,; Jason Pontious

doi:10.33012/navi.698

Abstract

The time-differenced carrier phase can be computed from measurements recorded by a multi-global navigation satellite system software-defined radio receiver such as PyChips, from which the user displacement and receiver clock drift can be solved. PyChips is able to simultaneously track authentic and inauthentic signals in separate channels, which makes it possible to observe both types of measurements with corresponding navigation data. A random sample consensus algorithm has been introduced to assess the consistency between the measurements and data. This algorithm successfully separated authentic channels from inauthentic channels when they are broadcast simultaneously.

Keywords

1 INTRODUCTION

In a global navigation satellite system (GNSS)-challenged environment, a user may simultaneously receive authentic and potentially inauthentic signals. An advanced GNSS receiver is capable of producing robust and accurate solutions for position, velocity, and time by selecting only authentic ranging measurements and navigation data. The receiver needs to differentiate inauthentic channels from authentic channels; however, inauthentic signals are often purposely disguised to behave like authentic channels, for example, recorded authentic signals may be replayed or inauthentic signals may be simulated on multiple channels (Psiaki & Humphreys, 2016). When inauthentic signals are consistently simulated across multiple channels, they are more difficult to detect and also have a larger impact on receivers (Wu et al., 2020). This work focuses on the identification of authentic GNSS signals in the presence of broadcast inauthentic signals generated by a GNSS simulator.

Naturally, authentic GNSS measurements will always agree with the actual motion and clock characteristics of the receiver and satellites. Despite noise and nominal errors, there is an inherent consistency that lies within all authentic GNSS measurements and data. In contrast, it is much less likely that inauthentic signals will maintain such consistency at all levels or over time. Therefore, an advanced GNSS receiver could observe how well the signals from all GNSS channels agree with each other, agree with the external data sources that can be used to model user motion, such as inertial measurements, and agree with the clock models of satellites and the receiver. For example, it is possible to detect inauthentic measurements by using the receiver motion (Psiaki et al., 2013), clock solution (Shang et al., 2020), or a combination of both (Hwang & McGraw, 2014). Furthermore, carrier-phase measurements may be more sensitive to some changes associated with inauthentic signals than pseudorange. Detection algorithms have been proposed based on carrier phase from a moving antenna (Psiaki et al., 2013), a dual-antenna system (Swaszek & Hartnett, 2014; Psiaki et al., 2014; Wang et al., 2018), multiple receivers (Stenberg et al., 2022), or a dual polarized antenna (De Wilde et al., 2018) or with aid from inertial measurements (Clements et al., 2020).

GNSS pseudorange measurements can be protected by the receiver autonomous integrity monitoring (RAIM) algorithm (Lee, 1986). Although it was originally designed to detect an outlier out of several Global Positioning System (GPS) satellites, it has been further developed for multi-constellation systems (Hewitson & Wang, 2006; Walter et al., 2019), carrier-phase-based solutions (Gratton et al., 2010), and multiple concurrent faults (Pervan, 1998). The family of RAIM-based algorithms has been widely accepted as the default method for protecting the integrity of GNSS solutions. However, these algorithms tend to be computationally expensive when there is a large number of measurements and multiple simultaneous faults, although recent developments have been reported to control the computational cost (Blanch & Walter, 2021).

The consistency among all available GNSS constellations and signals can also be assessed in the domain of time-differenced carrier-phase (TDCP) measurements. Typically, an integrated multi-constellation positioning solution always requires information on the inter-system timing bias. However, this bias can be cancelled via time-differencing. Therefore, Zhu et al. (2018) proposed to combine all available GNSS satellites in a single TDCP measurement model. The measurement model can produce a robust four-dimensional solution that includes the three-dimensional receiver velocity and the clock drift.

A random sample consensus (RANSAC) algorithm can estimate the unknown parameters of the underlying model, even when a significant portion of measurements arises from outliers. This algorithm was originally proposed to identify an inlier set from noisy measurements in computer vision (Fischler & Bolles, 1981). To date, the RANSAC algorithm has only been sparsely used in the GNSS community, for example, by Schroth et al. (2008) and Castaldo et al. (2014), most likely because a single-constellation positioning solution typically involves fewer than a dozen satellites and thus cannot fully benefit from the computational efficiency offered by RANSAC. More recently, Zhu et al. (2018) proposed that RANSAC be applied to TDCP measurements. The implementation of a multi-constellation GNSS solution documented by Zhu et al. (2022) has a fixed computational burden that does not increase with the number of measurements or outliers involved. A multi-constellation, multi-frequency receiver can typically measure the TDCP from more than 30 channels, making this RANSAC implementation much more efficient than RAIM. Various applications of RANSAC-TDCP have been presented, including a robust velocity solution for aviation and urban navigation (Zhu et al., 2022), modeling of carrier-phase error sources using the residuals of RANSAC-TDCP (Shah, 2021), and improving positioning solutions (Zhu, Gunawardena et al., 2023). It should be noted that, unlike RAIM, RANSAC has not yet been developed into an integrity monitor.

Instead of own-ship navigation solutions, a new type of applications of RANSAC in GNSS TDCP focuses on the detection and identification of inauthentic GNSS signals. For this, an advanced GNSS receiver is required to simultaneously track authentic and inauthentic signals. Here, a software-defined radio (SDR) receiver, PyChips (Gunawardena, 2021), will be used. Preliminary results reported by Zhu and Gunawardena (2022) and Zhu, Hindi et al. (2023) showed that it is indeed possible to separate the two types of signals in PyChips. The detection and identification mechanisms will be discussed in this work.

2 BACKGROUND

GNSS SDR receivers have been developed for post-processing and real-time applications. For example, Easy Suite (Borre, 2003) is an open-source software package developed in MATLAB that has been primarily used as a post-processing receiver at educational institutions. The Finnish Geospatial Research Institute’s FGI-GSRx software receiver (National Land Survey of Finland, 2024) is an open-source MATLAB-based package for research and development that is also designed for post-processing. Real-time SDR receivers are typically developed in an efficient low-level programming language (such as C or C++) optimized for efficiency and stability (Pany et al., 2024), such as the Multi-Sensor Navigation Analysis Tool (UniBwM, 2022) and PyChips.

PyChips consists of open-interface, open-source software that operates in a Python environment, with the computationally intensive tasks accelerated in C++. PyChips has been developed and made available for educational and research purposes, and it supports the Institute of Navigation’s GNSS SDR metadata standard (Gunawardena et al., 2021), which is available from Gunawardena and Pany (2019). Figure 1 presents a block diagram that represents the high-level architecture of PyChips. The high-level SDR specification is described in JavaScript Object Notation, which is parsed in Python and used to instantiate software objects that implement the specified functionality. For processes that require sample-level processing, optimum use of the central processing unit (CPU), graphics processing unit GPU), and field programmable gate array (FPGA) is achieved via C++ bindings. For other processes that do not require sample-level processing, the performance of Python-based implementation is sufficient.

FIGURE 1

Architecture of PyChips

It may be difficult to detect some inauthentic GNSS signals in a traditional receiver, especially when these signals are created to mislead receivers and to replace authentic signals (Psiaki & Humphreys, 2016). SDR receivers have been used to detect inauthentic signals (Pany et al., 2024). In particular, PyChips actively searches for and acquires multiple signals that appear to share the same carrier frequency and code. These signals could include live (authentic) signals and potentially multiple inauthentic copies. The pseudorange and carrier phase of each present signal are tracked and reported simultaneously in separate channels, allowing one to observe both authentic and inauthentic signals with corresponding navigation data.

Carrier-phase measurements from all GNSS constellations can be combined in a TDCP measurement model. Consider a GNSS satellite and a single user antenna, both of which move between two time stamps, t_i–1 and t_i, as shown in FIGURE 2. R^j is the geometric distance to satellite j, and e^j is the unit vector pointing to the satellite.

FIGURE 2

Change in rover and satellite position over time

In a simplified model, it is assumed that the received carrier-phase measurement ϕ^j,f for frequency f includes R^j, the satellite clock error B^j, the receiver clock bias b_r, and the integer ambiguity N. ε represents nominal errors and noise. Let ${\hat{B}}^{j}$ be the satellite clock correction, which may be obtained from the broadcast navigation data message or another data source:

$ϕ^{j, f} = R^{j} + B^{j} - {\hat{B}}^{j} + N λ^{j, f} - b_{r} + ε$ 1

Let TD be the change in carrier phase between t_i–1 and t_i:

$T D = ϕ^{j, f} (t_{i}) - ϕ^{j, f} (t_{i - 1})$ 2

Typically, the TDCP is used to solve for the displacement over a short time interval (for example, 1 s) and a short baseline. Most of the carrier-phase error sources are cancelled over a short baseline. For a short interval, the inter-system timing and hardware biases are considered to be slow-varying quantities (Qu et al., 2015; Paziewski & Wielgosz, 2015). These terms can be cancelled via sequential differencing as well. The receiver clock, however, could have a substantial drift during this time interval. Therefore, TD from Equation (2) actually reflects a combination of the change in geometric distance and the change in local clock bias b_r :

$T D = R^{j} (t_{i}) - R^{j} (t_{i - 1}) + b_{r} (t_{i}) + B^{j} (t_{i}) - {\hat{B}}^{j} (t_{i}) - b_{r} (t_{i - 1}) - B^{j} (t_{i - 1}) + {\hat{B}}^{j} (t_{i - 1}) + ϵ$ 3

where ϵ represents the residual error and noise terms. If we assume that the satellite clock error can be corrected, i.e., $B^{j} = {\hat{B}}^{j}$ , then we have the following:

$T D = R^{j} (t_{i}) - R^{j} (t_{i - 1}) + b_{r} (t_{i}) - b_{r} (t_{i - 1}) + ϵ$ 4

Let S^j and U_i be the satellite and receiver positions, respectively. The geometric distances at t_i–1 and t_i can be found by using the following:

$\begin{matrix} R^{j} (t_{i}) = (S V^{j} (t_{i}) - U (t_{i})) \cdot e^{j} (t_{i}) \\ R^{j} (t_{i - 1}) = (S V^{j} (t_{i - 1}) - U (t_{i - 1})) \cdot e^{j} (t_{i - 1}) \end{matrix}$ 5

Here, e^j(t_i) represents the unit vector pointing from the receiver antenna to the satellite:

$e^{j} (t_{i}) = \frac{S V^{j} (t_{i}) - U (t_{i})}{| S V^{j} (t_{i}) - U (t_{i}) |}$ 6

A rough estimation of the user and satellite position is expected in this equation, which can be computed from a pseudorange solution or a navigation filter. This work will demonstrate that the unit vector and TDCP solution are not sensitive to position biases, as the majority of such errors will be cancelled during differencing. The position biases can be on the order of a few thousand meters without a substantial deviation in the vector.

The delta range can be computed as follows:

$\begin{array}{l} Δ R_{i}^{j} & = R^{j} (t_{i}) - R^{j} (t_{i - 1}) \\ = (S V^{j} (t_{i}) - U (t_{i})) \cdot e^{j} (t_{i}) - (S V^{j} (t_{i - 1}) - U (t_{i - 1})) \cdot e^{j} (t_{i - 1}) \end{array}$ 7

We take the following definitions:

$\begin{matrix} c o r r_{-} s v = S V^{j} (t_{i}) \cdot e^{j} (t_{i}) - S V^{j} (t_{i - 1}) \cdot e^{j} (t_{i - 1}) \\ c o r r_{-} g e o = U (t_{i - 1}) \cdot e^{j} (t_{i - 1}) - U (t_{i - 1}) \cdot e^{j} (t_{i}) \end{matrix}$

such that:

$Δ R_{i}^{j} - c o r r_{-} s v (t_{i}) - c o r r_{-} g e o = - Δ U_{i} \cdot e^{j} (t_{i})$ 8

More details of the measurement model have been reported by Cohenour (2009). The observation of multiple TDCP measurements can be formulated into a least-squares solution:

$z = H x + ϵ$ 9

where x is a 4 × 1 state vector x = [ΔU_i ; Δb_i]. The average velocity and drift can then be derived from the state vector, $\frac{Δ U_{i}}{t_{i} - t_{i - 1}}; \frac{Δ b_{i}}{t_{i} - t_{i - 1}}$ , respectively. Each element of observation z is a TDCP measurement defined in Equation (2). A row in the H matrix has four elements: [–e^j(t_i);1]^T.

As shown in Equation (3), there are no frequency-specific items, such as wavelength, integer ambiguity, or hardware delay, in this measurement. As a result, multiple frequencies (L1, L2, and L5) of the same satellite can be included in the same measurement model. Because the timing difference among constellations is also canceled, multiple constellations (GPS, GLONASS, GALILEO, and BeiDou) can be combined in the same model as well. Therefore, the carrier phase from all of the constellations, frequencies, and satellites can be combined in the same measurement model.

In a modern multi-constellation receiver, there could easily be more than 30 live TDCP measurements simultaneously as of the year 2023. The generic RANSAC algorithm has been adapted to the TDCP solution.

Let us consider the following algorithm that loops with a fixed number of iterations: In iteration κ, randomly select M measurements in an initial “core” set. Solve for an initial core solution ${\tilde{x}}_{T D, κ}$ . If the solution is degenerate or otherwise erroneous, skip the remainder of this iteration.Evaluate the remainder of the measurements by computing an error function. Compare the errors against a fixed threshold γ to find inliers.Count the number of inliers for iteration κ.Stop if all measurements have been included as inliers.

The iteration with the greatest number of inliers is identified, and the inliers and solution from this iteration will be retained.

Detailed implementation of this algorithm has been documented by Zhu et al. (2022). The outcome of this algorithm includes the estimated states (displacement and clock change), the inlier set, and the residuals from all available measurements. The average velocity estimated with this algorithm is robust against various types of error sources. Zhu et al. (2022) showed that the velocity accuracy was significantly improved with RANSAC. The average velocity error was reduced from 0.3 m/s to 0.025 m/s in a vehicular test and from 0.69 m/s to 0.074 m/s in an urban scenario with heavy multipath. The residuals can be used to model some of the carrier-phase error sources, as described by Shah (2021). This algorithm can make positioning solutions more robust in two different ways (Zhu, Gunawardena et al., 2023). First, RANSAC can reject faulty satellites. Second, the displacement can aid or smooth the positioning solution. In this work, the selected inliers will be perceived as authentic measurements. In addition, the impact of outlier rejection will be illustrated and quantified with the estimated velocity and clock drift.

3 RESEARCH QUESTION

The satellite position SV^j and clock correction ${\hat{B}}^{j}$ can be computed for t_i based on received navigation data. Thus, the TDCP measurement with authentic SV^j(t_i) and ${\hat{B}}^{j} (t_{i})$ is as follows:

$\begin{array}{l} T D & = & (S V^{j} (t_{i}) - U (t_{i})) \cdot e^{j} (t_{i}) - (S V^{j} (t_{i - 1}) - U (t_{i - 1})) \cdot e^{j} (t_{i - 1}) \\ + b_{r} (t_{i}) + B^{j} (t_{i}) - {\hat{B}}^{j} (t_{i}) - b_{r} (t_{i - 1}) - B^{j} (t_{i - 1}) + {\hat{B}}^{j} (t_{i - 1}) + ϵ \end{array}$ 10

It is assumed that the source of the inauthentic signals is a sophisticated simulator system, which is able to generate pseudorange and carrier phase that are initially consistent with the simulated satellite position and the actual receiver position. This can be achieved if the target receiver is static or if the precise location and motion of the receiver can be tracked by the simulator system. The simulated satellite position and clock correction will be broadcast via the corresponding inauthentic navigation data.

Consider the following cases in which inauthentic measurements and data affect the TDCP measurement model.

Case 1: Because PyChips can track both authentic and inauthentic channels, it is possible to use the authentic carrier phase with inauthentic navigation data. In this case, Equation (2) remains the same:

$T D^{+} = ϕ^{j, f} (t_{i}) - ϕ^{j, f} (t_{i - 1})$ 11

Inauthentic navigation data result in an offset in SV^j, i.e., $S V_{i n a u t h}^{j} = S V^{j} + ε S V^{j}$ , and an inauthentic clock model ${\hat{B}}_{i n a u t h}^{j}$ . $S V_{i n a u t h}^{j}$ also causes an erroneous unit vector, $e_{i n a u t h}^{j}$ . Consequently, Equation (10) is as follows:

$\begin{array}{l} T D^{+} & = & (S V_{i n a u t h}^{j} (t_{i}) - U (t_{i})) \cdot e_{i n a u t h}^{j} (t_{i}) - (S V_{i n a u t h}^{j} (t_{i - 1}) - U (t_{i - 1})) \cdot e_{i n a u t h}^{j} (t_{i - 1}) \\ + b_{r} (t_{i} \begin{array}{l} ) - b_{r} (t_{i - 1}) + B^{j} (t_{i}) - B^{j} (t_{i - 1}) - ({\hat{B}}_{i n a u t h}^{j} (t_{i}) - {\hat{B}}_{i n a u t h}^{j} (t_{i - 1})) + ϵ \end{array} \end{array}$ 12

where $(S V_{i n a u t h}^{j} (t_{i}) - U (t_{i})) \cdot e_{i n a u t h}^{j} (t_{i}) - (S V_{i n a u t h}^{j} (t_{i - 1}) - U (t_{i - 1})) \cdot e_{i n a u t h}^{j} (t_{i - 1})$ reflects the change in the calculated geometric distance over time. For a raw magnitude of error estimation, it is assumed that over a short interval (~1 s), ϵe^j remains constant and e^j(t_i–1) ≈ e^j(t_i).

The error in the change in distance is dominated by (εSV^j(t_i) – εSV^j(t_i–1)). e^j(t_i), which represents the change in radial position error of this satellite. Because the carrier phase is authentic, B^j(t_i) – B^j(t_i–1) represents the actual satellite clock drift. $({\hat{B}}_{i n a u t h}^{j} (t_{i}) - {\hat{B}}_{i n a u t h}^{j} (t_{i - 1}))$ is the inauthentic clock correction.

Case 2: When the receiver starts to track inauthentic carrier-phase measurements, the authentic navigation data for this satellite may still be available. The measurements in Equation (2) are replaced with inauthentic measurements:

$T D^{-} = ϕ_{i n a u t h}^{j, f} (t_{i}) - ϕ_{i n a u t h}^{j, f} (t_{i - 1})$ 13

$ϕ_{i n a u t h}^{j, f}$ may be simulated with $B_{i n a u t h}^{j}$ , and it will agree with $S V_{i n a u t h}^{j}$ , although the authentic clock correction would be used, such that we have the following:

$ϕ_{i n a u t h}^{j, f} = (S V_{i n a u t h}^{j} (t_{i}) - U (t_{i})) \cdot e_{i n a u t h}^{j} (t_{i}) + B_{i n a u t h}^{j} - {\hat{B}}^{j} + N λ^{j, f} - b_{r} + ε$ 14

With the authentic satellite position and clock correction, Equation (10) is as follows:

$\begin{array}{l} T D^{-} & = & (S V^{j} (t_{i}) - U (t_{i})) \cdot e^{j} (t_{i}) - (S V^{j} (t_{i - 1}) - U (t_{i - 1})) \cdot e^{j} (t_{i - 1}) + b_{r} (t_{i}) \\ + B_{i n a u t h}^{j} (t_{i}) - {\hat{B}}^{j} (t_{i}) - b_{r} (t_{i - 1}) - B_{i n a u t h}^{j} (t_{i - 1}) + {\hat{B}}^{j} (t_{i - 1}) + ϵ \end{array}$ 15

Case 3: If the receiver uses both carrier-phase and navigation data from an inauthentic channel, then Equation (2) is as follows:

$T D^{*} = ϕ_{i n a u t h}^{j, f} (t_{i}) - ϕ_{i n a u t h}^{j, f} (t_{i - 1})$ 16

$ϕ_{i n a u t h}^{j, f}$ will also be simulated to be consistent with $S V_{i n a u t h}^{j}$ , similar to Equation (14). However, this term will now be corrected with ${\hat{B}}_{i n a u t h}^{j}$ :

$ϕ_{i n a u t h}^{j, f} = (S V_{i n a u t h}^{j} (t_{i}) - U (t_{i})) \cdot e_{i n a u t h}^{j} (t_{i}) + B_{i n a u t h}^{j} - {\hat{B}}_{i n a u t h}^{j} + N λ^{j, f} - b_{r} + ε$ 17

Therefore, we have the following:

$\begin{matrix} T D^{*} = (S V_{i n a u t h}^{j} (t_{i}) - U (t_{i})) \cdot e_{i n a u t h}^{j} (t_{i}) - (S V_{i n a u t h}^{j} (t_{i - 1}) - U (t_{i - 1})) \\ \cdot e_{i n a u t h}^{j} (t_{i - 1}) + b_{r} (t_{i}) - b_{r} (t_{i - 1}) + B_{i n a u t h}^{j} (t_{i}) - B_{i n a u t h}^{j} (t_{i - 1}) \\ - ({\hat{B}}_{i n a u t h}^{j} (t_{i}) - {\hat{B}}_{i n a u t h}^{j} (t_{i - 1})) + ϵ \end{matrix}$ 18

It should be noted that ${\hat{B}}_{i n a u t h}^{j}$ may not approximate $B_{i n a u t h}^{j}$ as was the case for authentic channels. It is assumed that all of the channels in a simulator are driven by the same clock, which is the same assumption made by Wu et al. (2020) for simulator-based attacks. If $B_{i n a u t h}^{j} \approx {\hat{B}}_{i n a u t h}^{j}$ were to be enforced for all channels, this could potentially cause ${\hat{B}}_{i n a u t h}^{j}$ to appear drastically different from the corresponding authentic term. Therefore, it is further assumed that ${\hat{B}}_{i n a u t h}^{j}$ would be disguised as a normal satellite clock correction, which would be inconsistent with the actual clock model in the simulator.

For each of these cases, we seek to determine whether we can identify inauthentic satellites and separate them from the authentic satellites using the TDCP.

4 METHODOLOGY AND RESULTS

A radiofrequency (RF) data set collected with a stationary antenna, which included GPS L1, L2C, and L5 signals, was processed with PyChips. In addition to the live satellite signals, secondary RF signals were simulated on the GPS L1 frequency only for all visible satellites and broadcast to the receiver antenna in real time. Although the exact details are not revealed, it was observed from the recorded data that the simulator was likely driven by a local oscillator and that the intended position appeared to be moving. The simulated pseudorange, carrier phase, and satellite position were consistent among themselves. The simulated clock data resemble those of the authentic satellites and are not consistent with the actual oscillator used by the simulator, which agrees with the assumptions made in Section 3.

The results presented in this section are taken from a data segment that is approximately 3 min long. PyChips simultaneously extracted code-phase, carrier-phase, and navigation data from inauthentic and live signals. The carrier-to-noise ratio of the inauthentic signals is 1–2 dB higher than that of the corresponding live signals in this data set, which causes PyChips to acquire and track the inauthentic signals before the live signals. Nine GPS satellites were visible in this segment and had authentic and inauthentic navigation data decoded, with six of these satellites being present throughout the whole segment. Two live L2C signals and three live L5 signals were also recorded. Partial results from this data set were first reported by Zhu, Hindi et al. (2023).

There are no historical data from the receiver that can help identify inauthentic satellites. The inauthentic satellites were manually flagged by comparing the corresponding navigation data with authentic data downloaded from the public Crustal Dynamics Data Information System database (Noll, 2010), which were used as the truth reference for channel classification. The satellite position calculated from the simulated navigation data was relatively close to the authentic position. One average, the absolute difference is approximately 3,000 m. However, over a period of 1 s, the average satellite displacement error |εSV^j(t_i) – εSV^j(t_i–1)| is approximately 0.2 m. When projected on the radial direction, the average of (εSV^j(t_i) – εSV^j(t_i–1)) · e^j(t_i) is 0.07 m. The error in unit vector e^j is approximately 0.03 mrad. The average difference between the simulated and authentic clock corrections is 277 m, which has been converted into distance. When differenced over 1 s, the clock correction is below 2 mm for both authentic and inauthentic channels.

RANSAC was applied to post-process the TDCP measurement recorded by PyChips. First, all available channels were combined with authentic navigation data, corresponding to case 2 in Section 3. A duration of slightly more than 1 min is required for PyChips to initialize and to acquire and start tracking all channels. Because the inauthentic channels are likely to be tracked first, RANSAC may choose inauthentic channels exclusively or a mixture of both types during initialization as inliers. If any inauthentic channels are classified as inliers, this will lead to incorrect solutions, and the outcome will be considered a failure for RANSAC. Therefore, a successful identification is declared only when all inliers flagged by RANSAC are in fact from authentic channels. The period corresponding to the last 100 s is considered a steady state, where all channels have been tracked. The velocity error magnitude has been computed for this segment. FIGURE 3 illustrates the three-dimensional velocity error magnitude and the receiver clock drift rate from this segment. The red crosses represent the velocity errors from the solutions for which RANSAC chose only inauthentic measurements, whereas the blue stars indicate errors from mixed solutions. RANSAC consistently chose only authentic measurements during the steady state, and the errors are shown in black circles. The average velocity error magnitude is 0.11 m/s during the last 100 s, corresponding to the steady state, as reported in Table 1. Inauthentic measurements had little impact on the velocity error, except for a possibly elevated noise level. In the steady state, the average clock drift rate is 0.63 ns/s, with a standard deviation of 0.18 ns/s, as shown in Table 2. It should be noted that similar results can be achieved with a modified carrier-phase RAIM algorithm in this data set, as there were only up to 16 channels available in the steady state. Because the number of inauthentic channels is unknown to RAIM, an exhaustive search of all possible combinations was performed for each epoch. Subsequently, RAIM can find the authentic solution in 100% of the steady-state epochs. However, if the total number of available channels increases, the computational cost of the exhaustive search would grow significantly.

FIGURE 3

Velocity error magnitude (top) and receiver clock drift rate (bottom) with authentic GPS L1, L2, and L5 measurements and inauthentic L1 measurements, all with authentic navigation data

View this table:

TABLE 1

Average Velocity Error Magnitude in the Steady State

View this table:

TABLE 2

Receiver Clock Drift Rate and Standard Deviation in the Steady State

In the second test, only GPS L1 measurements are included, such that the numbers of authentic and inauthentic measurements are always identical in the steady state. However, the velocity error magnitude reported in FIGURE 4 is similar to that in FIGURE 3, indicating that RANSAC can still reliably exclude inauthentic measurements. The average velocity error magnitude is slightly higher in this case, as shown in Table 1.

FIGURE 4

Velocity error magnitude (top) and receiver clock drift rate (bottom), with authentic and inauthentic GPS L1 measurements, both with authentic navigation data

The same conclusion applies to the receiver clock drift. The clock drift rate computed from the steady state is 0.58 ns/s, which is only slightly different from the rate obtained in the first test. However, the standard deviation is substantially greater, as shown in Table 2. With fewer authentic measurements involved, the noise levels on the velocity and clock drift rate increase, as expected. Nonetheless, all of the inauthentic measurements were still correctly expelled in the steady state. RANSAC succeeded in 100% of the epochs in both test 1 and test 2, as reflected in Table 3. The performance is reproducible in other similar scenarios. For example, in a second segment recorded 3 min later, which only contained authentic and inauthentic GPS L1 channels, 100% of the steady-state epochs were found with only authentic channels. Similar levels of velocity and clock drift errors were achieved.

View this table:

TABLE 3

Percentage of Epochs with Authentic/Inauthentic Identification During the Steady State (100 Epochs)

As shown in Equations (14) and (15), the inauthentic carrier phase and simulator clock error will not agree with the authentic data. The main difference would be caused by the term $B_{i n a u t h}^{j} (t_{i}) - B_{i n a u t h}^{j} (t_{i - 1}) - ({\hat{B}}^{j} (t_{i}) - {\hat{B}}^{j} (t_{i - 1}))$ . If the simulator clock drifts quickly over time, $B_{i n a u t h}^{j} (t_{i}) - B_{i n a u t h}^{j} (t_{i - 1})$ could have a significant error magnitude that is common across all satellites. Although the exact model and mechanism by which the clock drives this simulator are not available, the preliminary results presented in this section show that the average clock drift magnitude is approximately 80 ns/s, corresponding to an error of approximately 24 m/s. The standard deviation of noise observed on the inauthentic channels is greater than 1 m/s, whereas the expected TDCP noise level is at the level of cm/s. Because the authentic clock correction is satellite-specific, the time difference ${\hat{B}}^{j} (t_{i}) - {\hat{B}}^{j} (t_{i - 1})$ may be observed as additional noise on the TDCP, although the magnitude is small (<2 mm/s in this data segment). As a result, the solution calculated from inauthentic channels would have significantly greater bias and noise. The inauthentic channels can be easily detected by RANSAC, even if they outnumber the authentic channels.

In the third test, it is assumed that the measurement from each channel in PyChips will only use the navigation data from the corresponding channel: live measurements with authentic navigation data and simulated measurements with inauthentic navigation data, which are represented by case 3 in Section 3. Before the steady state can be reached, RANSAC is more likely to choose inauthentic satellites, compared with the previous two cases. Illustrated by the red crosses in FIGURE 5, the inauthentic velocity solution has a substantial bias. Similarly, the inauthentic clock drift rate was reported as approximately -80 ns/s. Obviously, this value is drastically different from the actual clock drift rate, which is represented by black circles. Equations (17) and (18) show that the carrier-phase and navigation data are both inauthentic and would largely agree with each other. Therefore, the simulated channels are largely consistent among themselves, with the exception that $B_{i n a u t h}^{j} \neq {\hat{B}}_{i n a u t h}^{j}$ . As with the first two tests, $B_{i n a u t h}^{j} (t_{i}) - B_{i n a u t h}^{j} (t_{i - 1})$ causes significant bias and additional noise in the TDCP. As a result, RANSAC can reliably choose authentic channels once the steady state is achieved. Out of 100 epochs, there were 4 failed exclusions in which RANSAC chose a mixture of authentic and inauthentic channels, as shown in Table 3. Consequently, the steady-state velocity error was 9.1 m/s. The mean clock drift was -2.3 ns/s, with a standard deviation of 20 ns/s. Excluding the failed epochs, the mean clock drift is 0.65 ns/s, with a standard deviation of 0.32 ns/s, which is consistent with the previous two tests.

FIGURE 5

Velocity error magnitude (top) and receiver clock drift rate (bottom), with authentic GPS L1 measurements matched with authentic navigation data and with inauthentic GPS L1 measurements matched with inauthentic navigation data

However, it should be noted that the detection of “inliers” in RANSAC is based on the comparison of an error function and a threshold computed via a priori measurement uncertainty models. Therefore, it is always possible that authentic channels may be falsely excluded or that inauthentic channels will not be detected in practice. In the first three tests, it was found that RANSAC occasionally excluded one out of six authentic satellites, which occurred in less than 2% of the steady-state epochs.

The last test involves live and simulated GPS L1 measurements with navigation data decoded from the inauthentic signals only, which combines cases 1 and 3. Before the steady state can be reached, RANSAC chose only inauthentic measurements for an extended period of time. As discussed for the third test, the noise standard deviation was greater than 1 m/s during this time.

When all authentic channels were tracked in the steady state, these channels were paired with inauthentic data, as described for case 1. This error is caused by an inauthentic satellite position and clock model. Because ${\hat{B}}_{i n a u t h}^{j}$ resembles an authentic clock model in this data set, the magnitude of clock error $B^{j} (t_{i}) - B^{j} (t_{i - 1}) - ({\hat{B}}_{i n a u t h}^{j} (t_{i}) - {\hat{B}}_{i n a u t h}^{j} (t_{i - 1}))$ may not be significant (0.004 mm/s) on the authentic channels. The error is dominated by the change in radial satellite position error (εSV^j(t_i) – εSV^j(t_i–1)) · e^j(t_i), with an average error magnitude of 0.07 m/s. These channels are still more consistent than the inauthentic channels in this test, as the inauthentic channels still suffer from errors arising from the simulator clock, $B_{i n a u t h}^{j} (t_{i}) - B_{i n a u t h}^{j} (t_{i - 1})$ .

FIGURE 6

Velocity error magnitude (top) and receiver clock drift rate (bottom), with authentic and inauthentic GPS L1 measurements and inauthentic navigation data

The elevated noise level in the authentic measurements causes RANSAC to mistakenly include some inauthentic channels. However, it is still more likely that the self-consistency among authentic channels will be identified. Here, 43% of the epochs converged on authentic channels only, whereas 12% of epochs converged on inauthentic channels only. The remainder of the cases included a mix of both types, as reported in Table 3. The velocity solution has much larger errors due to failed epochs, as shown in Table 1. The mean clock drift was -2.3 ns/s with a standard deviation of 20 ns/s, as shown in Table 2. If only the successful epochs were considered, the mean clock drift would be -0.44 ns/s, with a standard deviation 1.44 ns/s. Although the clock drift solution has a greater bias and standard deviation, it is still reasonably close to the actual clock drift.

The results from all four tests consistently highlight the role of the simulator clock. Because the actual simulator clock drift $B_{i n a u t h}^{j} (t_{i}) - B_{i n a u t h}^{j} (t_{i - 1})$ could not be corrected by the corresponding navigation data, the inauthentic channels could be identified by RANSAC, regardless of how consistent they were with the simulated satellite position. It is reasonable to hypothesize that even when the actual antenna position and the simulated position are both static, it will still be possible for RANSAC to identify the simulated channels.

5 SUMMARY

If an SDR receiver such as PyChips can simultaneously track authentic and inauthentic signals, the inauthentic signals cannot simply take over and replace the live satellite signals in this type of receiver. Live satellite signals are always consistent among themselves, and they agree with authentic satellite clock/orbital models. Therefore, RANSAC can easily separate authentic from inauthentic signals when authentic navigation data are applied. With the data set recorded for this work, RANSAC could identify and retain authentic signals in all of the steady-state epochs, even if inauthentic signals outnumbered the authentic signals. By using only the inlier channels selected by RANSAC, a robust pseudorange-based positioning solution can also be computed. More examples on how RANSAC and TDCP improve positioning solutions has been reported by Zhu, Gunawardena et al. (2023). The outcome of RANSAC can also be used to model the behavior of the simulator and its clock. In this work, the simulator clock drift rate was estimated from a solution obtained via inauthentic channels.

This paper focused on how inauthentic measurements can be identified when they are combined with live or simulated navigation data. It was assumed that the simulator system is sophisticated such that the generated pseudorange and carrier phase are consistent with the geometric distance between the actual receiver position and the simulated satellite position decoded from the inauthentic navigation data. Therefore, it was reasonable to hypothesize that RANSAC would choose inauthentic channels if the corresponding navigation data were applied. However, if these channels are driven by a single clock in the simulator, there may be a large discrepancy between the simulator clock and inauthentic navigation data. Consequently, the inauthentic TDCP measurements exhibited a bias and were more noisy than authentic measurements in the SDR receiver. Therefore, it is still more likely for RANSAC to choose authentic channels over inauthentic channels. In future work, we will further explore the feasibility of detecting inauthentic channels in PyChips when the actual antenna position and the simulated position are both stationary.

A potential drawback of the current study is the lack of diversity in constellation. Only inauthentic GPS L1 signals were present in the recorded data set, even though PyChips is a multi-constellation receiver. With a greater variety in authentic signals, such as GPS L1, L2 and L5, or signals from different constellations, it is expected that the detection of inauthentic signals will be more reliable and will remain computationally efficient.

HOW TO CITE THIS ARTICLE

Zhu, Z., Gunawardena, S., Vinande, E., & Pontious, J. (2025). Identification of authentic GNSS signals in time-differenced carrier-phase measurements with a software-defined radio receiver. NAVIGATION, 72(2). https://doi.org/10.33012/navi.698

ACKNOWLEDGMENTS

This work was supported by the Air Force Research Laboratory, FA8650-14-D-1737. This document has been approved for public release, with unlimited distribution. Case number 88ABW-2024-0385.

This is an open access article under the terms of the Creative Commons Attribution License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited.

REFERENCES

↵
Blanch, J., & Walter, T. (2021). Fast protection levels for fault detection with an application to advanced RAIM. IEEE Transactions on Aerospace and Electron Systems, 57(1), 55–65. https://doi.org/10.1109/TAES.2020.3011997
Google Scholar
↵
Borre, K. (2003). The GPS easy suite–Matlab code for the GPS newcomer. GPS Solutions, 7(1), 47–51. https://doi.org/10.1007/s10291-003-0049-3
Google Scholar
↵
Castaldo, G., Angrisano, A., Gaglione, S., & Troisi, S. (2014). P-RANSAC: An integrity monitoring approach for GNSS signal degraded scenario. International Journal of Navigation and Observation, 2014(1), 173818. https://doi.org/10.1155/2014/173818
Google Scholar
↵
Clements, Z., Yoder, J. E., & Humphreys, T. E. (2022). Carrier-phase and IMU based GNSS spoofing detection for ground vehicles. Proc. of the 2022 International Technical Meeting of the Institute of Navigation, Long Beach, CA, 83–95. https://doi.org/10.33012/2022.18252
Google Scholar
↵
Cohenour, J. C. (2009). Global Positioning System clock and orbit statistics and precise point positioning [Doctoral dissertation, Ohio University]. http://rave.ohiolink.edu/etdc/view?acc_num=ohiou1249043829
Google Scholar
↵
De Wilde, W., Sleewaegen, J. M., Bougard, B., Cuypers, G., Popugaev, A., Landman, M., Schirmer, C., Egea-Roca, D., López-Salcedo, J. A., & Seco-Granados, G. (2018). Authentication by polarization: A powerful anti-spoofing method. Proc. of the 31st International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2018), Miami, FL, 3643–3658. https://doi.org/10.33012/2018.15917
Google Scholar
↵
Fischler, M. A., & Bolles, R. C. (1981). Random sample consensus: A paradigm for model fitting with applications to image analysis and automated cartography. Communications of the Association of Computing Machining, 24(6), 381–395. https://doi.org/10.1145/358669.358692
Google Scholar
↵
Gratton, L., Joerger, M., & Pervan, B. (2010). Carrier phase relative RAIM algorithms and protection level derivation. Journal of Navigation, 63, 215–231. https://doi.org/10.1017/S0373463309990403
Google Scholar
↵
Gunawardena, S. (2021). A high performance easily configurable satnav SDR for advanced algorithm development and rapid capability deployment. Proc. of the 2021 International Technical Meeting of the Institute of Navigation, 539–554. https://doi.org/10.33012/2021.17808
Google Scholar
↵
Gunawardena, S., & Pany, T. (2019). GNSS software defined receiver metadata standard. https://sdr.ion.org/
Google Scholar
↵
Gunawardena, S., Pany, T., & Curran, J. (2021). ION GNSS software-defined radio metadata standard. NAVIGATION, 68, 11–20. https://doi.org/10.1002/navi.407
Google Scholar
↵
Hewitson, S., & Wang, J. (2006). GNSS receiver autonomous integrity monitoring (RAIM) performance analysis. GPS Solutions, 10, 155–170. https://doi.org/10.1007/s10291-005-0016-2
Google Scholar
↵
Hwang, P., & McGraw, G. (2014). Receiver autonomous signal authentication (RASA) based on clock stability analysis. Proc. of the IEEE/ION Position Location and Navigation Symposium (PLANS 2014), Monterey, CA, 270–281. https://doi.org/10.1109/PLANS.2014.6851386
Google Scholar
↵
Lee, Y. C. (1986). Analysis of range and position comparison methods as a means to provide GPS integrity in the user receiver. Proc. of the 42nd Annual Meeting of The Institute of Navigation, Seattle, WA, 1–4. https://www.ion.org/publications/abstract.cfm?articleID=12197
Google Scholar
↵
National Land Survey of Finland. (2024). FGI-GSRx software receiver. https://www.maanmittauslaitos.fi/en/fgi-gsrx-os. Accessed on 01/10/2024.
Google Scholar
↵
Noll, C. (2010). The Crustal Dynamics Data Information System: A resource to support scientific analysis using space geodesy. Advances in Space Research, 45(12), 1421–1440. https://doi.org/10.1016/j.asr.2010.01.018
Google Scholar
↵
Pany, T., Akos, D., Arribas, J., Bhuiyan, M. Z. H., Closas, P., Dovis, F., Fernandez-Hernandez, I., Fernández-Prades, C., Gunawardena, S., Humphreys, T., Kassas, Z., López-Salcedo, J. A., Nicola, M., Psiaki, M. L., Rügamer, A., Song, Y.-J., & Won, J.-H. (2024). GNSS software-defined radio: History, current developments, and standardization efforts. NAVIGATION, 71(1). https://doi.org/10.33012/navi.628
Google Scholar
↵
Paziewski, J., & Wielgosz, P. (2015). Accounting for Galileo-GPS inter-system biases in precise satellite positioning. Journal of Geodesy, 89(1), 81–93. https://doi.org/10.1007/s00190-014-0763-3
Google Scholar
↵
Pervan, B. S., Pullen, S. P., & Christie, J. R. (1998). A multiple hypothesis approach to satellite navigation integrity. NAVIGATION, 45(1), 61–71. https://doi.org/10.1002/j.2161-4296.1998.tb02372.x
Google Scholar
↵
Psiaki, M. L., & Humphreys, T. E. (2016). GNSS spoofing and detection. Proceedings of the IEEE, 104(6), 1258–1270. https://doi.org/10.1109/JPROC.2016.2526658
Google Scholar
↵
Psiaki, M. L., O’Hanlon, B. W., Powell, S. P., Bhatti, J. A., Wesson, K. D., & Humphreys, T. E. (2014). GNSS spoofing detection using two-antenna differential carrier phase. Proc. of the 27th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2014), Tampa, FL, 2776–2800. https://www.ion.org/publications/abstract.cfm?articleID=12530
Google Scholar
↵
Psiaki, M. L., Powell, S. P., & O’Hanlon, B. W. (2013). GNSS spoofing detection using high-frequency antenna motion and carrier-phase data. Proc. of the 26th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2013), Nashville, TN, 2949–2991. https://www.ion.org/publications/abstract.cfm?articleID=11137
Google Scholar
↵
Qu, L., Zhao, Q., Guo, J., Wang. G., Guo. X., Qiang, Z., Jiang, K., & Luo, L. (2015). BDS/GNSS real-time kinematic precise point positioning with undifferenced ambiguity resolution. Proceedings of the China Satellite Navigation Conference (CSNC) (Vol. 3, pp. 13–29). https://doi.org/10.1007/978-3-662-46632-2_2
Google Scholar
↵
Schroth, G., Rippl, M., Ene, A., Blanch, J., Belabbas, B., Walter, T., Enge, P., & Meurer, M. (2008). Enhancements of the range consensus algorithm (RANCO). Proc. of the 21st International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS 2008), Savannah, GA, 93–103. https://www.ion.org/publications/abstract.cfm?articleID=7937
Google Scholar
↵
Shah, N. (2021). Using random sampling consensus (RANSAC) to detect errors in global navigation satellite systems (GNSS) signals and data [Master’s thesis, East Carolina University]. https://thescholarship.ecu.edu/bitstream/handle/10342/9716/SHAH-MASTERSTHESIS-2021.pdf
Google Scholar
↵
Shang, S., Li, H., Wei, Y., & Lu, M. (2020). GNSS spoofing detection and identification based on clock drift monitoring using only one signal. Proc. of the 2020 International Technical Meeting of the Institute of Navigation, San Diego, CA, 331–340. https://doi.org/10.33012/2020.17147
Google Scholar
↵
Stenberg, N., Axell, E., Rantakokko, J., & Hendeby, G. (2022) Results on GNSS spoofing mitigation using multiple receivers. NAVIGATION, 69(1). https://doi.org/10.33012/navi.510
Google Scholar
↵
Swaszek, P. F., & Hartnett, R. J. (2014). A multiple COTS receiver GNSS spoof detector – extensions. Proc. of the 2014 International Technical Meeting of the Institute of Navigation, San Diego, CA, 316–326. https://www.ion.org/publications/abstract.cfm?articleID=11501
Google Scholar
↵
UniBwM. (2024). MuSNAT — LRT 9. https://www.unibw.de/lrt9/lrt-9.2/software-packages/musnat/view
Google Scholar
↵
Walter, T., Blanch, J., Gunning, K., Joerger, M., & Pervan, B. (2019). Determination of fault probabilities for ARAIM. IEEE Transactions on Aerospace and Electronic Systems, 55(6), 3505–3516. https://doi.org/10.1109/TAES.2019.2909727
Google Scholar
↵
Wang, F., Li, H., & Lu, M. (2018). GNSS spoofing detection based on unsynchronized double-antenna measurements. IEEE Access, 6, 31203–31212. https://doi.org/10.1109/ACCESS.2018.2845365
Google Scholar
↵
Wu, Z., Zhang, Y., Yang, Y., Liang C., & Liu, R. (2020). Spoofing and anti-spoofing technologies of global navigation satellite system: A survey. IEEE Access, 8, 165444–165496. https://doi.org/10.1109/ACCESS.2020.3022294
Google Scholar
↵
Zhu, Z., & Gunawardena, S. (2022). Identification of authentic GNSS signals in time-differenced carrier phase measurements with a software defined radio. Proc. of the 35th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2022), Denver, CO, 3570–3579. https://doi.org/10.33012/2022.18453
Google Scholar
↵
Zhu, Z., Gunawardena, S., Vinande, E., & Pontious, J. (2023). Identification of authentic GNSS signals in time-differenced carrier phase measurements with a multi-constellation software defined radio receiver. Proc. of the IEEE/ION Position Location and Navigation Symposium (PLANS), Monterey, CA, 1027–1032. https://doi.org/10.1109/PLANS53410.2023.10139922
Google Scholar
↵
Zhu, Z., Hindi, A., Dickerson, C., Vinande, E., & Pontious, J. (2023). Validation of low-cost RTK and PPK solutions assisted with random sample consensus in a GNSS-challenged environment. Proc. of the 36th International Technical Meeting of the Satellite Division of the Institute of Navigation (ION GNSS+ 2023), Denver, CO, 2737–2748. https://doi.org/10.33012/2023.19295
Google Scholar
↵
Zhu, Z., Vinande, E., & de Haag, M. U. (2018). Multi-constellation time differenced carrier phase solution with protection from multiple failures. Proc. of the IEEE/ION Position Location and Navigation Symposium (PLANS), Monterey, CA, 336–348. https://doi.org/10.1109/PLANS.2018.8373399
Google Scholar
↵
Zhu, Z., Vinande, E., Pontious, J., Hall, B., & Shah, N. N. (2022). A robust multi-constellation time-differenced carrier phase solution. GPS Solutions, 26, 1–12. https://doi.org/10.1007/s10291-021-01186-z
Google Scholar

PDF

Previous Next

Identification of Authentic GNSS Signals in Time-Differenced Carrier-Phase Measurements with a Software-Defined Radio Receiver

Abstract

1 INTRODUCTION

2 BACKGROUND

3 RESEARCH QUESTION

4 METHODOLOGY AND RESULTS

5 SUMMARY

HOW TO CITE THIS ARTICLE

ACKNOWLEDGMENTS

REFERENCES

In this Issue

NAVIGATION: Journal of the Institute of Navigation

Jump to section

Keywords

Identification of Authentic GNSS Signals in Time-Differenced Carrier-Phase Measurements with a Software-Defined Radio Receiver

Abstract

1 INTRODUCTION

2 BACKGROUND

3 RESEARCH QUESTION

4 METHODOLOGY AND RESULTS

5 SUMMARY

HOW TO CITE THIS ARTICLE

ACKNOWLEDGMENTS

REFERENCES

In this Issue

NAVIGATION: Journal of the Institute of Navigation

Alerts for this Article

Email This Article

Citation Tools

Identification of Authentic GNSS Signals in Time-Differenced Carrier-Phase Measurements with a Software-Defined Radio Receiver

Citation Manager Formats

Share This Article

Identification of Authentic GNSS Signals in Time-Differenced Carrier-Phase Measurements with a Software-Defined Radio Receiver

SAVE ITEM IN SELECTED FOLDER.

Jump to section

Related Articles

Cited By...

More in this TOC Section

Similar Articles

Keywords