The growing threat to GNSS and how to deal with it

 Dr Nigel Davies, Head of Secured Navigation, QinetiQ

In 2011, the Royal Academy of Engineering noted that our economy is so bound up with the performance of Global Navigation Satellite Systems (GNSS) that 6-7 per cent of GDP in Western countries is dependent on GNSS-derived data. Position, navigation and timing (PNT) data is vital to the Automatic Identification System (AIS) that tracks Europe’s sea traffic, the control of telecoms networks and energy grids and, over the next ten years, will lie at the heart of rail management, with railway signaling, train movement, control and monitoring all dependent on it.

This is before we even consider the original military purpose that GPS - the first GNSS - was created for. GNSS has been widely used in this arena for decades, from weapon guidance systems to military communications equipment.

Over the next few years, to reflect the important place PNT data plays in our world, the GNSS landscape will undergo a radical change. New constellations are being deployed by Europe (Galileo) and China (Beidou), GPS is undergoing an overhaul to its third iteration (GPS III), and the Russian system (GLONASS) is being modified to be more compatible with other systems. Galileo will be fully operational by 2020, with 26 satellites in orbit. The updated systems bring new services and diversity, and with more systems comes redundancy and resilience.

The need for this redundancy and resilience is growing at the same rate as our use of PNT data; electronic jamming or spoofing of GNSS signals is becoming an attractive target for those looking to cause major disruption with minimal effort.

GNSS suffer from two fundamental vulnerabilities. The first is in the strength of the GNSS signals that are used by receivers to calculate time and position. The satellites that transmit those signals orbit the Earth at an altitude of over 20,000 km, meaning that the signals are weak and vulnerable to interference by the time they reach the Earth. In fact, they are so weak as to be almost imperceptible from the background noise of other transmissions, requiring complex algorithms to identify and track them. An attacker who is able to transmit additional noise over the top of GNSS signals – essentially jamming it - can stop a receiver from working properly, or at all.

The second is the ease with which a false signal can be transmitted by an attacker to trick a receiver into generating a false position or time. The open access GNSS signals, which are widely used today by non-military users, are defined by open standards published on the internet. While this has led to a vibrant market in GNSS devices, it also means that the signals can be copied by attackers. To protect against this, GPS and Galileo constellations have ‘secure’ signals – PPS and PRS respectively - whose standards aren’t published, with only accredited users having access.

What does this look like in real life? It’s claimed that for roughly ten minutes every day the London Stock Exchange experiences problems with the signals it receives from GPS satellites due to such inadvertent jamming. The SENTINEL Project – a nationwide, UK Government-backed investigation into GNSS jamming – tracked the proliferation of jammers, finding in one location more than 60 GPS interference incidents in six months. Another study, by NSL, found 120 incidents of jamming in one month at a single location.

Having redundancy in place is the only way to guarantee resilience against these threats. Users must therefore be able to switch between multiple constellations and the different frequencies and signals emitted, both open-access and secure. This multi-constellation multi-frequency (MCMF) technology resides in the receiver chips that form part of the wider user system, switching between over 100 satellites, cross-checking signals for consistency, readjusting to the next available signal or ignoring signals (either spoofed or generated in error) which don’t agree with others. QinetiQ is developing the first chipset that combines full MCMF capabilities (4 constellations, 4 frequencies) with cutting edge anti-jamming and anti-spoofing signal processing. Further resilience can be achieved by adding existing technology to these systems: advanced signal processing technologies can identify and mitigate interference and smart, anti-jam antennas that can be fixed to the front of receivers will identify the direction of interference and steer the antenna away.

Resilience and redundancy are the core tenets of protecting industry from the motives of those who aim to disrupt PNT services. Already there is research into the next generation of secure satellite services beyond even these new receiver chips, adding further options for those protecting their timing and location systems. A “quantum compass” is being researched by Dstl that uses sub-atomic particles to determine relative position. QinetiQ is also looking at novel ways of celestial navigation, combining current technology with older techniques used in the past.

With GNSS receiver chip technology entering a new era, and even more experimental technologies due in the next few decades, rail, emergency services, telecoms, energy and other critical national infrastructure can improve their resilience to attacks, system crashes and outages caused by GNSS interference by combining the outputs of multiple systems different technologies. This is a framework for future infrastructure robustness, ensuring there is no single point of failure and protecting our critical economic and societal operations in an era of ever-growing technological threats.