Most resilient GNSS receiver: results from JammerTest in Norway

This article is also available in 简体中文

Across the globe there is a growing need for improved resilience of PNT (Positioning, Navigation, Time) systems. The US president signed an Executive Order to strengthen national resilience through PNT services. Geo-political tensions demand a higher level of security for operations in areas of navigational warfare (NAVWAR) under contested GNSS conditions. Companies in countries such as Finland are looking for capable receivers which can be connected in a network to detect malicious interference sources. For many GNSS applications like reference networks, drone surveillance or delivery as well as timing synchronization the consequences of PNT degradation or loss can be dire. That is why GNSS receivers used in these mission-critical applications need to have the highest level of resilience for robust operation in challenging environments.

AIM+ anti-jam and anti-spoof works against live GNSS interference

Septentrio provides receivers with the highest level of resilience against intentional and unintentional GNSS jamming and spoofing*. Testing the receiver technology under live interference conditions is crucial to validate and continuously improve anti-jam and anti-spoof algorithms. That is why Septentrio participated in a large-scale JammerTest 2023 event organized by the Norwegian government, on the remote island of Andøya, where live interference testing took place in a controlled environment. Septentrio regularly participates in such test events, however most such events are classified, and results cannot be shared publicly. The JammerTest is one of the first public events of this type where sharing or results is encouraged.

After 5 days of intensive testing in Norway AIM+ anti-jamming and anti-spoofing technology proved to work under live interference conditions. Test results revealed that under real interference receiver technology plays a key role, while the antenna technology plays a supporting role. By testing the receiver under various types of spoofing attacks it was shown that the best spoofing protection lies in having multiple anti-spoofing mechanisms working together.

Saab, a major aerospace and defense company, also took part in the JammerTest event and validated resilience of Septentrio receivers which are used in its demanding air traffic management system.

Although they may not realize it, each year hundreds of millions of passengers rely upon Saab’s air traffic management systems to get where they are going safely. Most of these systems in turn rely upon GPS/GNSS for positioning and time synchronization. With so much at stake, Saab is proud to offer industry leading anti-spoofing and anti-jamming capabilities using Septentrio equipment. Saab and Septentrio’s recent collaboration at JammerTest showcased just how effective we can be together.

Robert Brown

Director of Portfolio, Sales and Strategy, Saab Air Traffic Management

Septentrio GNSS receivers vs competition at JammerTest 2023

AIM+ detects and mitigates GNSS jamming

During the 5-day event in Norway Septentrio receivers were tested under various interference scenarios alongside several competition receivers. The figure on the right shows that during jamming a Septentrio GNSS receiver in a car delivered accurate positioning along the whole route (orange track), while a high-end GNSS/INS competition receiver lost positioning two times (red track). Loss of positioning in the field can result in halting operations which is costly, cumbersome and has a negative effect on company reputation. Drones which are jammed can lose control and crash or in the case of more advanced autopilots go into a “hover”, “land” or “circle” mode, or switch to other sensors like INS which can drift without absolute positioning.

During this test a “cigarette lighter” jammer was used, which is one of the most common types of jammers and can easily be purchased online. It emits signals with power between 10-15 dBm and jams GPS L1, L2 signals. Other jamming tests included highly powerful jammers with signals 10 million times more powerful than GNSS signals.

The plot below shows results of a mobile jamming test performed with the “cigarette lighter” low-power jammer. The signal-to-noise time plot shows that when jamming is started the quality of the tracked GNSS signals decreases. A Septentrio receiver, shown at the top continues to track the signals and to output positioning, while a competition receiver loses positioning for a period of time.

Over the 1-day period of intensive jamming tests, receivers with AIM+ demonstrated 99,5% positioning availability under various forms of jamming from simple continuous narrow-band interference to the most complex wide-band transmissions.

The magic is in the GNSS receiver

For mission-critical applications an anti-jam antenna can play a role in achieving maximum resilience against RF interference. During the JammerTest, 3 receivers were tested under heavy multi-frequency wideband jamming in combination with antennas of varying sophistication. The signal-to-noise time plots below show signal quality during this test. In the top plot, a receiver with a standard wideband helical antenna does not have AIM+ anti-jamming technology and so immediately loses tracking of satellite signals during jamming. A receiver with the same antenna, but with AIM+ continues to track signals and deliver positioning (middle plot). The bottom plot shows a receiver with AIM+ coupled with an anti-jam antenna. The drop in signal quality is slightly less than with a standard antenna and the receiver continues to track signals and to deliver positioning.

Antenna-comparison-receiver-with-without-AIM+ septentrio

Tests with various anti-jam antennas showed interference reduction of about 10 dB due to the antenna. While advanced anti-jam technology like AIM+ plays a key role in positioning availability under jamming, an antenna plays a supporting role and can improve the chances of getting positioning in cases where the jamming is still slightly stronger than the ability of the receiver to mitigate it. While anti-jam antennas can be effective for wide-band “white-noise” jamming they are less effective for other types of jamming.

Comprehensive anti-spoofing requires multiple layers of protection

As seen on the news GNSS spoofing is becoming more commonplace due to easily available transmitter hardware and signal simulator software. Hackers employ various types of spoofing to hijack positioning, navigation or time, from simple asynchronous spoofing to sophisticated synchronous types which are almost identical to real GNSS signals. For the highest degree of anti-spoofing protection and situational awareness a receiver requires several layers of protection:

•    Multi-frequency technology offering signal diversity for effective fallback and spoofing mitigation
•    Advanced anomaly detection algorithms for situational awareness
•    Satellite signal authentication using cryptography

AIM+ detects, flags and mitigates GNSS spoofing

Spoofing is actually more dangerous than jamming because the risk lies not only in halted operation, but hijacked navigation with high-risk consequences including a planned collision or theft. The plots below show positioning of several different receivers in a moving car during a GNSS spoofing attack.

During a live spoofing attack at the JammerTest 23 in Norway a Septentrio receiver in car stayed on track along the coastal road (orange track in each image), while competitor receivers (blue, green, red track) were spoofed and show erroneous positions.

In the plots above a Septentrio receiver (orange tracks in each image) mitigates GNSS spoofing and shows accurate positioning along the coastal road, while a competition receiver (blue track on the left) is spoofed and indicates a “flight” straight over the mountains. The plot in the middle shows another competition receiver (green) which indicates the same spoofed trajectory as the blue track, but with outliers. The right plot shows a third competition receiver (red) which is strongly affected by spoofing and delivers erroneous positions, which are different from those transmitted by the spoofer. During this spoofing attack the Septentrio receiver was able to stay on track because of its in-depth multi-frequency capability, which allowed it to mitigate spoofing by switching to other “healthy” signals of alternative constellations.

In most spoofing attacks, jamming is initially used to break the receiver’s “lock” on GNSS signals to increase the chances of the spoofed signals being accepted during reacquisition.

Septentrio receivers consistently detect GPS spoofing

During various live spoofing tests in Norway a large amount of data was collected from various receivers over several days. The graph below shows that unlike competition, Septentrio receivers consistently detected and flagged spoofing of all types and flagged all cases where spoofing would have resulted in large positioning errors. Spoofing which “places” the system far away from the real position is especially dangerous since it can result in a collision, system damage or compromise bystander safety.

Unflagged spoofed positions with error of more than 10 metres : Septentrio GNSS receiver vs competition

The spoofing flag of competition receivers did not go on during any of the spoofing attacks seen at the JammerTest event. The graph shows that for a significant percentage of time these receivers reported positions which were off by more than 10m, due to spoofing. During other periods the errors were smaller than 10m or no position was reported at all.

OSNMA Galileo signal authentication detects GNSS spoofing

Another layer of anti-spoofing protection is Navigation Message Authentication (NMA), which leverages cryptographic techniques to detect falsely generated signals. The image below shows Galileo’s OSNMA at work.

GPS spoofing detection on Septentrio GNSS receiver - web user interface

While OSNMA is effective for many types of spoofing it can still be fooled by “meaconing”, which is a type of spoofing which duplicates and retransmits genuine signals with a time delay. This is why NMA should be accompanied by other protection methods such as advanced anomaly detection for comprehensive spoofing security.

Tried, tested and true

Always accurate and available Positioning, Navigation and Time or Assured PNT is key to successful industrial or critical operations in challenging environments. By regularly participating in live events such as the JammerTest Septentrio anti-jamming and anti-spoofing technology is continuously being tested and improved to withstand the latest interference attacks. This technology has also been confirmed to be effective by users out in the field, who are using Septentrio receivers in places of malicious interference, such as near contested borders.

Although an anti-jam antenna can play a role in hardening the system, the most effective approach to securing your technology is to use a receiver with advanced anti-spoofing and anti-jamming (AJAS) protection. For spoofing this means leveraging several layers of protection within the receiver which shield it from various types of attacks. Septentrio receivers come in various formats from rugged boxes to OEM boards and compact modules, like the low-weight, low-power mosaic-X5 receiver. mosaic-X5 is also easy to integrate and is compatible with popular autopilots like Pixhawk, ArduPilot and PX4 Autopilot. For more information about resilient GNSS receivers and technology please contact Septentrio.

* Jamming is a form of radio interference which occurs when GPS frequency is overpowered by other radio waves, resulting in accuracy degradation or event total loss of position. Spoofing is a malicious form of radio interference, where misleading signals are sent into the receiver, resulting in faulty coordinates, which lead the target away from its predefined track.