"Due to the extensive problems these GNSS jammers can cause, it has become paramount to detect terrestrial GNSS jammers and take steps to mitigate the fallout."
Over the past decade, Global Navigation Satellite Systems (GNSS) such as GPS have undergone significant changes, and alongside these changes come new technologies and strategies to combat the integrity of the geolocation services these systems provide.
Recently, we’ve seen a sharp rise in GNSS outages resulting from deliberate GNSS jamming, particularly in conflict and war zones. Surprisingly, GNSS jamming efforts have even been effective against US aircraft in places like North Korea, Syria, and other high-conflict locations. Due to the extensive problems these GNSS jammers can cause, it has become paramount to detect terrestrial GNSS jammers and take steps to mitigate the fallout.
So, what can we do to locate GNSS jammers in real time and stop GNSS jamming efforts in their tracks?
GNSS Jammers: A High-Level Overview
GNSS jammers are typically used on the ground and directly impact the timing, velocity, and positioning data of GNSS signals. While these systems provide pinpoint accuracy for global navigation and remain reliable through severe weather conditions, GNSS is vulnerable to several types of attacks, namely GNSS jamming and GNSS spoofing.
Why is GNSS so susceptible to interference?
Due to their weak nature, GNSS and GPS signals are vulnerable to jamming. They travel from satellites operating in Low Earth Orbit around 20,000km above the Earth’s surface, so by the time they reach the ground receivers, they are easily disrupted by radio frequency interference.
Since relatively weak Radio Frequency (RF) signals are strong enough to overpower GNSS signals, they can result in unintentional jamming occurrences. However, the most problematic jamming is done intentionally, and cheap GNSS and GPS jammers can be purchased easily online despite being illegal in many countries.
GNSS jamming most often targets civilian and military maritime and aviation industries. It has become common to hear of corrupted AIS and ADS-B signals from ships and aircraft, which ultimately indicate a likelihood of GNSS jamming.
Methods for Geolocating Terrestrial GNSS Jammers
Without first knowing where a GNSS jammer is emitting its signals from, it makes it more or less impossible to stifle the attack. So, the first step to mitigating the dangers of GNSS jamming… Geolocation of the jammer.
Two strategies for geolocating terrestrial GNSS jammers involve ground station networks and satellites in low earth orbit, each outlined in detail below.
Geolocation with Ground Station Networks
When testing how well a network of ground-based receivers could geolocate jamming emitters, it was found that the ground stations could geolocate and even track chirp-style and matched-code jamming signals relatively well.
Still, receivers at fixed locations or those tactically deployed in a section of airspace can only locate jamming emitters in the immediate surrounding area, not across wide spatial ranges. Therefore, ground station networks can only be used in a limited scope of scenarios, and the need for global, low-latency, accurate GNSS interference detection remains a vital element of jamming mitigation.
Geolocation with Multiple LEO Satellites
GNSS jamming signals can also be detected and geolocated with satellites in Low Earth Orbit. In fact, satellite geolocation techniques can even classify the type of jammer and jamming signal being used, allowing a much more direct mitigation process when necessary.
Unlike ground networks, LEO-based geolocation offers global coverage and a frequent refresh rate, giving a more in-depth view of terrestrial GNSS interference sources like jamming and spoofing.
Further, since LEO satellites are so far from the interference source, they can track authentic GNSS signals, allowing precise time-tagged data collection from time-synchronized LEO-based receivers and precise orbit determination. LEO satellites with these time-synchronized receivers provide the best possible approach to locating GNSS jammers, and several commercial space-as-a-service entities offer GNSS jamming geolocation services - the most trustworthy being Spire Global and Hawkeye 360.
Two-Step Geolocation from LEO (T/FDOA)
While accurately geolocating jamming emitters with arbitrary waveforms using just one single satellite is impossible, geolocating emitters generating arbitrary wideband signals is possible. Multiple receivers use ‘Time and Frequency Difference of Arrival’ (T/FDOA) measurements in a two-step process to estimate emitter locations to geolocate wideband signals.
The first step involves comparing captured signals against one another and producing a time series of T/FDOA measurements. Then, the time series is input into a non-linear algorithm to geolocate the source.
Still, there are two weaknesses of two-step geolocation that can’t be overlooked.
Two-step geolocation ignores the typical constraint that all measurements should be consistent with either;
A single position (stationary emitters)
A single trajectory (moving emitters)
Interference signals displaying cyclostationarity create structures in T/FDOA measurements that make it challenging to track single emitters.
When multiple cyclostationary emitters with overlapping frequencies and a wide power range are present, tracking and geolocation become particularly challenging.
Single-Step Geolocation from LEO (Direct Geolocation)
Direct geolocation is an often superior multiple-receiver strategy that involves just a single-step - searching a geographical grid to estimate a jamming emitter’s location using the observed signals.
In direct geolocation, TDOA and FDOA data from the jamming emitter’s radar pulse are collected over numerous periods. Simultaneously, altitude measurements are taken from an aircraft. Once collected, the T/FDOA and aircraft altitude measurements can be used to estimate the emitter's location (longitude/latitude) for each period. Once a location is calculated for each time period, each is averaged to form a final estimated position of the jammer.
Direct geolocation is superior to the two-step geolocation method in low signal-to-noise ratio (SNR) environments and scenarios with short data capture, ultimately making it the most suitable choice for LEO-based jammer geolocation.
Exploring Spire Global’s GNSS Jammer Geolocation Capabilities
Spire has a growing constellation of CubeSats that operate in LEO and carry flexible SDR radios, which are used for detecting and geolocating GNSS jamming signals with a direct geolocation approach.
The primary component used in Spire’s detection capabilities is a GNSS reflectometry (GNSS-R) instrument - studying GNSS signals that are scattered or reflected off the Earth’s surface.
The GNSS-R is a flexible SDR receiver equipped with two high-gain nadir-oriented L-band antennas capable of capturing raw recordings and precise measurements of GNSS signals from Earth. Further, the L-band antenna is dual-frequency, which allows precise satellite positioning, making GNSS-R satellites and their variants highly suitable for GNSS jamming geolocation.
Multi-Satellite GNSS Interference Monitoring
Spire’s multi-satellite approach uses two LEO satellites flying in parallel formation or numerous other techniques when using three or more satellites. Spire uses state-of-the-art, hybrid TDOA/FDOA approaches to provide radio frequency geolocation when multiple satellites receive the same signal of interest.
Single-Satellite GNSS Interference Monitoring
Single-satellite interference monitoring uses Doppler-based measurements to geolocate interference. While this geolocation strategy is more challenging, it is a more cost-effective alternative to the multi-satellite approach.
Case Study: Spire Detects GNSS Interference Signals with GNSS-RO Satellites
With just a few days’ notice, Spire successfully leveraged their multi-satellite geolocation approach for the US government using their GNSS-RO satellites.
During live jamming tests, Spire assigned three satellites to collect raw Intermediate Frequency (IF) data. The RO CubeSats' antenna polarization and orientation were suitable, and they successfully detected known jamming signals from specific GPS jammers.
Two or more of the satellite passes were aligned in space and time to observe the active jammer and collect raw IF data.
The first data set showed a clear increase in spectral activity in the L-1 band. Upon analysis, the expected real PRN signals and evidence of false PRN broadcasts were shown. The Doppler observations for the false PRNs matched the expected characteristics of a jammer in the test location, so Spire concluded that the signals were, in fact, jamming signals.
Comments