In the modern era, cyber-attacks and other electronic sabotage against critical services, networks and utilities are becoming more powerful as societies depend increasingly on connected systems and infrastructure. Among critical infrastructure targets, interfering with Global Navigation Satellite System (GNSS) signals is an increasingly common technique.
GNSS Jamming and Spoofing
Positioning, Navigation, and Timing (PNT) information is critically important for a wide variety of civil and commercial activities including air and sea transport, road haulage, and private motoring, as well as general logistics. The UK government estimates that a 24-hour PNT outage could cost the economy £1.4 billion.
Attempts to disrupt GNSS navigation within a targeted area generally involve either jamming or spoofing techniques. Jamming involves broadcasting overwhelmingly strong signals in the frequency range of the satellite signals, which prevents receivers from finding the genuine signals. Spoofing begins with jamming, causing the receiver to re-find the satellite signal, and subsequently presents a stronger, fake signal with false information to misdirect the receiver’s calculations. Software‑defined radios (SDRs) and open‑source tools can generate these GNSS‑like signals at low cost. Spoofing can shift a vessel or aircraft’s reported position, manipulate timing systems, create false velocity vectors, or seamlessly take over a receiver without triggering alarms. This is an extremely dangerous threat that can silently mislead navigation and timing systems.
Navigation systems can fall back to alternative modes if satellite signals become unavailable, which can occur due to obscuring in urban canyons or other non-malicious effects. Dead reckoning uses the last known position, heading, and speed to estimate new position and can be assisted with an inertial measurement unit (IMU) to enhance accuracy. Comprising multiple sensors including accelerometers, gyroscopes, and magnetometers, the IMU can help the system maintain a position estimate for several minutes or even hours. Cars, robots, and autonomous guided vehicles (AGVs) can use data from wheel encoders, steering angle sensors and drivetrain models, while cameras or LiDAR are also employed to track motion relative to visual references. Also, constraining the estimated path to roads, lanes, or known routes can reduce drift.
Although these fallbacks can be effective against unintended or unavoidable signal loss, the holdover time for which the system can continue to maintain acceptable positional accuracy is usually quite short. In the event of unwanted signal interference, such as jamming, a much longer holdover duration may be needed. The key to this is timing.
Stable and Accurate Timing
Timing is critical in satellite navigation as position is calculated based on time-of-flight for the transmitted signals to reach the receiver. The receiver solves for both time and its own location as unknowns in the positioning equations. Hence four satellites must be in view despite calculating position by trilateration. While satellites use extremely accurate and stable atomic clocks to timestamp the exact moment each signal is transmitted, receivers have tended to rely on quartz-based timing. Although cost-effective and relatively compact, quartz resonators can exhibit significant vibration-related drift under environmental stressors. They also drift over temperature and due to ageing. The receiver must frequently realign its own timing with that of the satellites, when available. During an outage, drift in the receiver’s internal timing source is a key factor contributing to divergence between the calculated and actual positions. The divergence can become large if the satellite signal is unavailable for a long period.
Silicon MEMS resonators have about 1000 times less mass than quartz components, which dramatically reduces vibration sensitivity. SiTime’s Endura® super temperature compensated oscillator (Super-TCXO®), ENDR-TTT, has acceleration sensitivity of 0.004 ppb/g with ±50 ppb frequency stability over temperature and low aging enabled by the MEMS manufacturing process. In real-world PNT applications, where quartz-based solutions are significantly impacted by vibration, these properties enable approximately 20 times longer holdover.
In defense systems, local timing with ENDR-TTT remains accurate enough for synchronizing critical systems like imaging, datalinks, and control functions, even when exposed to harsh temperature and vibration. This can extend mission operations without satellite signals, even during GNSS jamming.
Moreover, extremely accurate local timing using a source such as ENDR-TTT enables systems to resist spoofing. Attacks usually begin with jamming, causing the receiver to lose the connection with the satellite signal and a spoofed signal is broadcast to capture the receiver during the reacquisition phase. As the attack duration grows, the search space in time and frequency the receiver must perform to find the signals also increases. The spoofer captures the receiver by being the strongest signal inside the search space. Precision timing can minimize the search window and prevent the spoofer from capturing the receiver.
Precision Timing Tested
In a recent test, a receiver containing the SiTime ENDR-TTT Super-TCXO evaded capture throughout a 4.5-minute attack by maintaining a narrow enough search space to avoid spoofing signals, even though the spoofer had knowledge of the vehicle’s location. The ENDR-TTT frequency stability was better than 0.1 parts per billion (PPB), contributing less than 10 meters to the total search window. This equates to more than 100% reduction in the probability of being captured by the spoofer.
Figure 1 shows the real and calculated positions of the receiver, which was mounted on board a boat, during the jamming and spoofing phases of the attack. The solid portion of the curve was recorded during the system self-calibration phase, while the dashed portion represents the jamming attack. During jamming, the receiver continues calculating its position accurately despite having lost satellite-signal acquisition. The spoofing signal is present when the jamming ends but is unable to capture the receiver due to the narrow search window.
Figure 1. Comparison of true and calculated positions.
Figure 2 shows the total range uncertainty as a composite of timing uncertainty and position uncertainty due to IMU error. Compared to the typical quartz TCXO performance, the superior stability of the silicon oscillator almost eliminates the timing component, reducing the overall range uncertainty by almost 60%. This is enough to prevent the spoofing signal from capturing the receiver.
Figure 2. Comparing the impact of quartz and MEMS TCXO stability on overall range uncertainty.
Future Spoof Resistance
Historically, GNSS receivers have obtained their first position fix by acquiring the L1-coarse acquisition signal (L1 C/A). This is a relatively simple signal easily replicated by spoofers. All GNSS systems also now operate on the L5 frequency using more modern and complex signals that require 20 times the bandwidth and transmission power compared to an L1 C/A spoofer. Due to this complexity, L5 acquisition makes spoofing attacks more difficult. To overcome this, spoofers can use L5 re-broadcast methods, or meaconing. A GNSS receiver containing the ultra-stable ENDR-TTT Super-TCXO can easily detect the spoofer’s reference oscillator error, thus providing a critical advantage in anti-spoofing capability.
Conclusion
Attacking GNSS signals is expected to become an increasingly common technique as a wide variety of modern services rely on these satellites for position, navigation, and timing information. Jamming and spoofing are attacks that compromise navigation in commercial, private, and military defense scenarios. Precision Timing, leveraging the stability of silicon MEMS oscillators, can enhance the accuracy of fallback navigation techniques based on dead reckoning and sensor fusion. In addition, by minimizing the signal-acquisition search window and enhancing the ability to identify replicated signals, Precision Timing can enhance resistance to spoofing.
For more information, visit: https://www.sitime.com/
Endura ENDR-TTT: https://www.sitime.com/products/ruggedized-timing/low-noise-super-tcxos/endr-ttt