Nghiên cứu giải pháp nâng cao khả năng chống nhiễu cho các bộ thu định vị GNSS tiên tiến robust signal processing techniques for modern GNSS receivers

LIST OF FIGURESFigure 1.1: Satellite navigation principle...18 Figure 1.2: Typical GNSS Threats...20 Figure 1.3: Signal conditioning and sampling stage...22 Figure 1.4: Acquisition Archi

MINISTRY OF EDUCATION AND TRAINING

HANOI UNIVERSITY OF SCIENCE AND TECHNOLOGY

NGUYEN DINH THUAN

ROBUST SIGNAL PROCESSING TECHNIQUES FOR MODERN

1 Assoc Prof Ta Hai Tung

2 Prof Letizia Lo Presti

Hanoi - 2019

STATEMENT OF ORIGINALITY AND AUTHENTICITY

I confirm that my dissertation is an original and authentic piece of work written bymyself The data, results in the thesis is reliable and has never been published byothers I further confirm that I have fully referenced and acknowledged all materialincorporated as secondary resources in accordance with the regulations

Hanoi,

Prof Letizia Lo Presti

I would like to express my gratitude to Hanoi University of Technology, GraduateSchool, School of Information and Communication Technology, Department ofComputer Engineering and Politecnico di Torino, NavSaS group for creatingfavorable conditions for me to work and study

I would like to express my special thanks to my supervisors, Assoc Ta Hai Tungand Prof Letizia Lo Presti The supervisors have always been helpful, giving greatadvice, scientific orientations so that I can develop and complete my research.Sincerely thank the lecturers, colleagues in the Department of ComputerEngineering, School of Information and Communication Technology, HanoiUniversity of Science and Technology where I work, study and carry out researchprojects for the enthusiastic in helping and encouraging me during the research.With gratitude to teachers, scientists, colleagues and close friends for encouragingand supporting me in the research process

Finally, I would like to express my deep gratitude to my family for encouraging me

to overcome all obstacles to complete this thesis

Nguyen Dinh Thuan

TABLE OF CONTENTS

STATEMENT OF ORIGINALITY AND AUTHENTICITY 1

ACKNOWLEDGEMENTS 2

TABLE OF CONTENTS 3

LIST OF ACRONYMS 6

LIST OF TABLES 8

LIST OF FIGURES 9

INTRODUCTION 13

1 FUNDAMENTAL BACKGROUND 18

1.1 GNSS positioning principle 18

1.2 History and development of GNSS 19

1.3 GNSS Threats 20

1.3.1 Multipath 21

1.3.2 Atmosphere 21

1.3.3 Interference 21

1.3.4 Spoofing 21

1.3.5 GNSS Segment errors 21

1.3.6 Cyber Attacks 22

1.4 GNSS Receiver Architecture 22

1.4.1 Signal Conditioning and Sampling 22

1.4.2 Acquisition 23

1.4.3 Tracking and Data Demodulation 23

1.4.4 Positioning Computation 24

1.5 Countermeasures to GNSS Threats 25

1.5.1 Antenna array processing techniques 25

1.5.2 Frontend and Digital Signal Conditioning based techniques 28

1.5.3 Correlator/Tracking and PVT based techniques 29

1.6 GNSS Simulator and effect of sampling frequency 30

2 GNSS SIGNAL SIMULATOR DESIGN AND IMPLEMENTATION 32

2.1 Modeling methodology 32

2.2 Overview of the modeling of antenna array signals in GNSS receivers 32

2.2.1 General model of the received signal in GNSS receivers 33

2.2.2 Interference 37

2.2.3 Multipath 38

2.2.4 Noise 39

2.3 Effect of sampling frequency on the positioning performance 39

2.3.1 Residual code phase estimation 40

2.3.2 Correlation output calculation 40

2.3.3 Effect of sampling frequency on correlation shape and DLL discriminator function 42 2.3.4 Effect of the sampling frequency and the integration period selection 42

2.3.5 Effect on the presence of Doppler and local oscillator (LO) clock drift 45

2.3.6 Theoretical code tracking loop error estimate 46

2.3.7 Theoretical results evaluation by simulated, and numerical models 49

2.3.8 Effect of Doppler and coherent integration period 50

2.4 Sampling Frequency Effect Mitigation Technique 53

2.4.1 Receiver implementation 55

2.5 Performance verification 57

2.5.1 Verification of the simulated antenna array signals 58

2.5.2 Antenna distortion simulation 64

2.5.3 Verification of multipath simulation 66

2.6 Conclusion 67

3 ANTENNA ARRAY PROCESSINGS FOR GNSS RECEIVERS 69

3.1 The proposed solution for synchronizing separated antenna array element 69

3.1.1 Determining the samples difference 70

3.1.2 Determining the clock phase shift 71

3.2 Implementation a low-cost antenna array 75

3.3 Antenna array frontend verification 76

3.3.1 Phase difference between frontends 76

3.3.2 Carrier to noise ration improvement 77

3.4 Conclusion 78

4 GNSS SNAPSHOT PROCESSING TECHNIQUE FOR GNSS RECEIVERS 80

4.1 Proposed Design of GNSS Snapshot Receiver 80

4.1.1 GNSS Grabber 80

Implementation of GNSS Grabber 80

Firmware Architecture 81

4.2 Server Software 81

4.2.1 GNSS signal acquisition 81

4.2.2 Combined Doppler and Snapshot Algorithm 84

4.3 Loosely coupled Snapshot GNSS/INS 89

4.4 Tightly coupled Snapshot GNSS/INS 96

4.5 Results 97

4.5.1 Standalone Snapshot GNSS Receiver 97

4.5.2 Snapshot GNSS/INS Integration 102

4.6 Conclusion 104

CONCLUSIONS AND FUTURE WORKS 105

PUBLICATIONS 107

REFERENCES 109

APPENDIX 116

A Correlation output calculation 116

B Error analysis for coherent early minus late DLL 117

LIST OF ACRONYMS

ADC Analog to Digital Converter

AWGN Additive White Gaussian Noise

BPSK Binary Phase Shift Keying

DFT Discrete Fourier Transform

DSP Digital Signal Processor

EGNOS European Geostationary Navigation

Overlay Service

FPGA Field Programmable Gate Array

6

FOC Full Operational Capability

GLONASS Global Orbiting Navigation Satellite

System

LIST OF TABLES

Table 2.4: The carrier phase relative to the first element of each satellite at the four elements

Table 2.6: Estimated carrier phase using the post-correlator beamforming tracking loop 62

LIST OF FIGURES

Figure 1.1: Satellite navigation principle 18

Figure 1.2: Typical GNSS Threats 20

Figure 1.3: Signal conditioning and sampling stage 22

Figure 1.4: Acquisition Architecture 23

Figure 1.5: Tracking Architecture 23

Figure 1.6: Transmission time estimation in GNSS receivers 24

Figure 1.7: Interference mitigation techniques in GNSS receivers 25

Figure 1.8: The traditional low-cost architecture of antenna array for GNSS applications 27 Figure 1.9: The correlation between 2 GPS signal grabbed by antenna array 28

Figure 1.10: Spectrum and histogram of GNSS signal in the absence of interference 28

Figure 1.11: Snapshot positioning architecture 29

Figure 2.1: Geometry of antenna array 33

Figure 2.2: The model of the received signal for a single antenna 33

Figure 2.3: GPS multi-antenna frontend 34

Figure 2.4: Flowchart of the simulator 35

Figure 2.5: Bandlimited Gaussian interference model 38

Figure 2.6: Multipath model 38

Figure 2.7: Effect of sampling frequency on the positioning performance 39

Figure 2.8: Residual code phases versus the number of samples per code chip with 4fc < f s < 5f c 40

Figure 2.9: Normalised correlator and EML discriminator functions for different sampling frequencies Results are obtained by correlating the incoming signal with various local generated replica signals that have the time delay from−Tc to Tc with step = 10-2 T c 42

Figure 2.10: Correlation shapes for 1 ms integration with various sampling frequencies 43

Figure 2.11: Ambiguous synchronization between a local PRN code and two different incoming analog signals of the same PRN sequence, but with slightly differing code phase offset 43

Figure 2.12: Correlation shapes and their errors with respect to the ideal correlation at a sampling frequency fs =16.3676 MHz using various coherent integration periods 44

Figure 2.13: Representation of code tracking loop [54] 46

Figure 2.14: DLL jitter versus different sampling frequencies (step= f c) for a GPS L1 C/A

with C/N0 =40 dB-Hz, BL =0.5 Hz, T=1 ms, and fixed BW βr = 2fc 48

Figure 2.15: Upper bound and lower bound of the DLL jitter versus different sampling frequencies (step = 5 ∗ 10 -2 f ) for a GPS L1 C/A with C/N c 0 =45 dB-Hz, B L =0.5 Hz, T=1 ms, and βr = f s 49

Figure 2.16: Mean values of two error bounds σs1 and σs2 versus different sampling frequencies (step = 10-1 f c ) for a GPS L1 C/A with C/N0 =45 dB-Hz, BL =0.5 Hz, T=1 ms, and βr = f s 49

Figure 2.17: DLL tracking error comparison among the simulated, numerical and theoretical models (step = 10-1 f c ) for a GPS L1 C/A with T=1 ms, and βr = f s 50

Figure 2.18: DLL tracking error versus Doppler frequencies fD for different integration periods T when the sampling frequency is an integer multiple of the nominal code rate (ns =4), in which the blue dotted lines indicate the typical Doppler range 51

Figure 2.19: DLL tracking error versus integration periods T GPS L1 C/A is used with f s = 4.092 MHz (ns =4), C/N0 =40 dB-Hz, B L=0.5 Hz, T=1 ms, and βr = f s 52

Figure 2.20: DLL tracking error versus Doppler frequencies fD for different integration periods T when the sampling frequency is a non-integer multiple of the nominal code rate 52

Figure 2.21: Code chip selection versus jitter values with M=4, where Triangle, circle, and diamond dots indicate samples belonging to (k−1)th , k th , and (k+1)th chips, respectively 54

Figure 2.22: Correlator shapes versus different jitter techniques for GPS L1 C/A signal, where τ runs in the range [−Tc ,T c ] with step interval =10−3 T c , f s =4.092 MHz, fD = 0

Hz, βr = f s and θNCO (0) = 0.125 55

Figure 2.23: Pseudo-code algorithm that can be used to implement jittering solution on SDR receiver 56

Figure 2.24: The results after applying the mitigation technique 57

Figure 2.25: Antenna array configuration 59

Figure 2.26: Post-correlator beamforming receiver architecture [30] 61

Figure 2.27: Scatter diagram of the tracking output of the satellite PRN01 at 4 elements 62 Figure 2.28: Estimated position of elements (East-North) 64

Figure 2.29: Estimated position of elements (Up) 64

Figure 2.30: Element patterns utilized for simulation (East-North) 65

Figure 2.31: The C/N0 of the satellite PRN 1 65

Figure 2.32: Multipath error 67

Figure 3.1: The architecture of antenna array based GNSS receiver 69

Figure 3.2: Time difference between 2 elements 71

Figure 3.3: Navigation message 71

Figure 3.4: The architecture of the system to determine the phase offset 72

Figure 3.5: The impact of clock phase shift 73

Figure 3.6: The loop filter using for estimating the clock drift 74

Figure 3.7: The estimated frequency shift using the loop filter 74

Figure 3.8: The scatter plot of the signal after mitigating clock phase shift 75

Figure 3.9: The 3-elements antenna array frontend modified from turner RTL2832Us 76

Figure 3.10: The setup of the verification of the frontend using a GPS simulator 77

Figure 3.11: Tracking output of satellites in view 77

Figure 3.12: / of the satellite PRN 09 for the received signal at every element and beamed signal 78

Figure 4.1: The architecture of the GNSS grabber 80

Figure 4.2: The flowchart of the grabber firmware 81

Figure 4.3: Acquisition search space 82

Figure 4.4: Probability of Detection w.r.t / with = − 84

Figure 4.5: FFT-based acquisition 84

Figure 4.6: Snapshot solution diagram 88

Figure 4.7: Traditional loosely-coupled GPS/INS integration 90

Figure 4.8: INS mechanization [3] 94

Figure 4.9: Tightly-coupled integration scheme 96

Figure 4.10: The prototype of GNSS grabber 98

Figure 4.11: Acquisition result of the grabbed signal 98

Figure 4.12: The position converged after 7 iterations 100

Figure 4.13: The positioning accuracy of the proposed solution 101

Figure 4.14: Power consumption comparison of our proposed solution and Ublox LEA 6T 102 Figure 4.15: The experiment setup 102

11

Figure 4.16: GNSS Snapshot/INS integration result 103

Figure 4.17: Positioning performance between GNSS Snapshot and GNSS Snapshot/INS

Nowadays, GNSS receivers have become core components in many applications rangingfrom vehicle navigation to unmanned vehicle guidance, from location-based services toenvironment monitoring Besides providing position information for many applications,GNSS services also provide a highly precise timescale for synchronizing systems such astelecommunication and network Hence, the performance of GNSS which haveconsiderable influence on the operation of these services must be guaranteed In [1] a list offour parameters of GNSS performance is reported: accuracy, availability, continuity, andintegrity Recently, the accuracy of GNSS has been significantly improved with thedevelopment of new navigation systems (Galileo-European system and BEIDOU-Chinesesystem) and the modernization of the existing navigation systems GPS and GLONASS.However, GNSS services are seriously being threatened by the emergence of jamming andspoofing threats

Because GNSS signals are buried under ambient noise, the signals and services of GNSSsystems are highly sensitive to interference such as radio frequency interference, jammingand spoofing; meanwhile, the quality of such services is not guaranteed to the conventionalusers Technically, the GNSS signal is transmitted from satellites away from Earth (about20.000 km), so when it comes to receivers, the signal power is smaller than the backgroundnoise about 1024 times (26dB) [2] Therefore, any source of interference (jammer, digitalterrestrial communication systems, ionosphere scintillation) may reduce the quality of thereceived signal, which in turn can disable the operation of the receiver In addition, becausethe GNSS systems are often under the management of military based organizations [3] [4][5], the open services (e.g., GPS L1 C/A, Beidou B1, GLONASS L1OF) are provided tousers without any guarantee of their reliability and continuity However, ensuring reliableand continuous position and time information is essential in modern GNSS receivers Tomeet these requirements, receivers must make use of advanced techniques to detect andmitigate interferences so that they can provide the requested continuous position and timeinformation These techniques are called “interference mitigation techniques”

In recent studies [6] [7] reflecting the state of the art, interference mitigation techniquescan be classified according to the position of the algorithm within the processing stages of

GNSS receiver chain In short, they are classified into three groups namely antenna array

processing techniques, frontend and digital signal conditioning-based techniques, and correlator/tracking and PVT based techniques

Antenna array signal processing technique: A popular method for robust GNSS receiver

performance consists in using multiple physical antenna elements which constitute a so-calledantenna array This technique has been studied since the 1940’s and has been widely used inradar and telecommunications applications [8] [9] [10] [11] Recent studies exploited thistechnique for GNSS applications considering it as an effective method to mitigate

interference However, conventional antenna array-based processing leads to complicatedand expensive systems, and it is not suitable for mobile receivers [12] [13] [14] Althoughthere are several efforts to design low-cost antenna array for GNSS applications [9] [10],issues involved to the implementation in a GNSS receiver still exist While 2 bits ofquantization in ADC, have been proved to be enough for GNSS receivers [15], however itmakes the GNSS receivers less robust to threats due to the saturation of the ADC againstthe high power of the interference Also, expanding the number of antenna elements is achallenge due to the limited interface bandwidth To overcome those limitations, the signalfrom elements can be independently grabbed first and then their signals are synchronized.

In this approach, synchronization becomes the vital process to be performed beforecombining the signals from the array Thus, the design of robust calibration algorithms thatcorrects for the time, phase and frequency mismatch among array data becomes anecessity To estimate the phase difference between elements, we can use least squares andmaximum likelihood such as [16] [17] Phase calibration of antenna arrays can also use thelive-sky GNSS signal [18] [11] Regarding time offset estimation, there are some studies intelecommunication field which address the issue using the correlation technique [41] [42].However, those studies assume that the power of the interested signal is much higher thanambient noise Therefore, the assumption may not hold true when GNSS signals areinvolved

Frontend and Digital Signal Conditioning based techniques: In this second group of

interference mitigation techniques, some unusual properties of interference signals such as highpower, spectrum shape, raw sample distributions are used for interference detection While [19]proposed the use of AGC to detect jamming signal, [15] uses this information to detect aspoofing repeater Although this is considered as a promising technique in detecting jammingand simplistic spoofing, the information needed for its implementation is not always available

in commercial frontends On top of this, for what concerns the application to spoofingdetection, since this technique observes the sudden change in the receiver power, it is usefulonly if it monitors the signal before the occurrence of a spoofing attack In more complicatedspoofing scenarios, the technique cannot differentiate the spoofed signal from the real signalsbecause the spoofed signals are mimicking the properties of the authentic signals While thefrontend-based techniques are only for interference detection, the digital signal conditioning-based techniques are useful in minimizing the effect of interference Among the techniques ofthis second group, pulse blanker and notch filter have shown that they can improve several dBafter jamming mitigation [20] [21] However, as mentioned above, this technique cannot apply

to spoofing mitigation because spoofing signal properties are analogous to those of authenticsignals

Correlator/Tracking and PVT based techniques: Like the second group of interference

mitigation techniques, these techniques rely on the detection of abnormal outputs incorrelator or PVT in order to identify the presence of interference Take C/N0 monitoring

technique as an example This technique is based on the abnormal power of theinterference However, it uses the carrier to noise ratio information instead of absolutereceived signal power using in the second group of interference mitigation techniques InPVT based techniques, the consistent check or cross check will guarantee the reliableinformation in PVT stages (i.e., pseudorange, ephemeris data) A typical technique in thisgroup is Receiver Autonomous Integrity Monitoring (RAIM) Although it is proved to beeffective to detect failures in pseudorange measurement [22] [23], the measurement isavailable only if the tracking stage is without loss of lock The requirement cannot beguaranteed under powerful jamming attack which aims to cause the receiver complete loss

of lock Therefore, to guarantee the availability of a PVT solution, recent studies havesuggested to adopt a coarse time positioning solution for coping with environmentsaffected by interference It is considered as an efficient method that can be applied to anarea where the continuous GNSS signal tracking is not guaranteed due to interference [24][25] Compared to traditional receiver, the positioning performance of this technique is lessprecise Recent studies have been improving its positioning performance on the GPS L1snapshot receiver [26] [27] [28] but the use of multi-constellation and INS integration insnapshot receiver has not been explored sufficiently in previous works

Another difficulty during the design and implementation of interference mitigation techniques

is the performance evaluation and verification process Currently, these processes can be doneusing either live-sky GNSS signal [29] or GNSS simulator signal [30] The first approach isstraightforward to implement, but it is difficult to control the environments along with GNSSsignals Therefore, the latter is the method being used favorite now However, there are existinglimitations with the use of GNSS simulators available in the market for SDR based study.Because the input data of the study is the digitalized IF signal, in order to grab such kind ofdata we need to use a grabber frontend which may include unavoidable errors, moreover, theperformance of the SDR based receiver are strongly affected by the sampling frequency so thechosen value should be considered carefully during simulation

Motivation

From the above analysis, advanced processing techniques for resilient positioning andtiming are essential in modern GNSS receivers Therefore, goal of this work is to proposetechniques to overcome the existing limitations in antenna array processing and snapshotprocessing for modern GNSS receivers The proposed techniques not only reduce theimplementation cost but also leverage the distributed data processing ability

Scope of Research

The work mainly focusses on antenna array processing technique and snapshot techniquefor modern multi-GNSS receivers While the first technique enables designing andimplementing a low-cost antenna array for GNSS applications, the second technique canprovide reliable position and time information in strongly interfered environment Remark

also that all the simulations through the dissertation are performed with the data generatedfrom a software-based GNSS simulator The design and implementation of this simulatorare also part of this thesis The approach to these techniques is based on SDR technologywhere the signal processing chains are implemented by means of software on a personalcomputer before deploying to the FPGA.

Methodology

For this study, the following approach is adopted First, relevant literature and studies arereviewed to get in-depth knowledge of interference mitigation techniques Also, theprocessing chains in GNSS receivers (i.e., acquisition, tracking and PVT computation) arereviewed Second, solutions are proposed to address the existing issues in theimplementation of modern GNSS receivers Finally, the obtained result is analyzed,processed and checked against information obtained from literature and previous studies

Contribution

As mentioned above, the study focuses on proposing solutions to address the two mainissues: the use of low-cost antenna array to detect GNSS threats and the use of multi-GNSSsnapshot positioning technique for discontinuous GNSS signal environment

Regarding antenna array signal processing technique, the work has proposed thesynchronization mechanism that enables the use of low-cost antenna array processing inGNSS field Theoretical and empirical results show that this is a promising solution thatwill not only reduce deployment costs but also be a flexible solution for expanding thenumber of antenna elements

As for the second issue addressed, the thesis proposes an integrated model of a system snapshot receiver with an inertial positioning system (INS) Theoretical andexperimental results have shown the superiority of performance of this solution over theuse of solutions exploiting only single GNSS systems This integrated model is particularlysuitable for environments where GNSS signals are intermittent

multi-The results presented in this thesis have been published in 6 conferences and 5 journals aslisted in the attachment The works have been carried on at Hanoi University of Scienceand Technology (Vietnam) and at Politecnico di Torino (Italy)

Thesis outline

The thesis is organized in 4 chapters as follows:

Chapter 1 – Fundamental Background: In this chapter, the background knowledge related

to the stages of GNSS receiver architecture including acquisition, tracking and datademodulation, and position computation are revised Also, this chapter show state of the art

of the interference mitigation techniques The limitations of existing works in the

implementation of antenna array frontend and snapshot positioning technique are alsocarefully considered.

Chapter 2 - GNSS Signal Simulator Design and Implementation: In this chapter, thedesign, and implementation of a GNSS software-based simulator are carefully considered

As one of the most critical parameters related to the speed of signal generation, the effect

of sampling frequency is also generalized theoretically in both simulator and receiver sides.Chapter 3 – Antenna Array Signal Processing for GNSS Receivers: This chapter focuses on

a solution enabling the extension of the number of elements and the quantization bits It isapplied in a low-cost antenna array for detecting the source of spoofing and interference.Chapter 4 – Snapshot Signal Processing for GNSS Receivers: This chapter shows how themulti-constellation snapshot technique can be effectively implemented In addition, toimprove positioning performance, the snapshot GNSS/INS integration is proposed

CHAPTER 1

1 FUNDAMENTAL BACKGROUND

This chapter provides the overview of relevant theory for the thesis As pointed out in theprevious sections, the thesis mainly focuses on the array processing and Snapshotpositioning for modern GNSS receivers under threats Therefore, this chapter first providesthe principle of GNSS positioning and history and development of existing GNSSes Then,the brief introduction of emerging threats is provided Finally, the processing chains inGNSS receivers are fully described

1.1 GNSS positioning principle

This section will explain the general principle of GNSS navigation Basically, GNSSpositioning is based on trilateration techniques In this technique, the receiver firstlydetermines the distance from its position to at least three known points After that, thereceiver’s position is determined by the intersection of 3 spheres (Figure 1.1)

Figure 1.1: Satellite navigation principle

Let = [ ] and = [ ] be the position of the receiver and of the satellite i The geometry distance from the receiver to satellite is defined as = || −

|| Clearly, the vector can be determined if we know the satellite position and the distance

with i=1,2,3

In GNSS receivers, the distance cannot be measured directly but it uses the transmissiontime from satellite to receiver Unfortunately, the receiver clock is not synchronized withthe atomic clocks onboard of GNSS satellites As a result, we have one more unknownvariable besides 3 unknown elements of With 4 satellites, the equations in these fourunknowns are as follows:

18

where c is the speed of light.

When considering the other errors (e.g., ionospheric, tropospheric), we have the complete form of the equations [31]

Denote vector solution = [ ] and using the first order of Taylor expansion as an approximate for every equation as follows:

1.2 History and development of GNSS

The first GNSS is the Global Positioning System (GPS) The project was approved by theUnited States Department of Defense in 1973 When the system was fully operational in

1995, its constellation consisted of 24 satellites spreading in 6 orbit planes The current

19

operational constellation is made up of 30 satellites GPS signal frequencies are allocated

in three bands: L1 (1575.42 MHz), L2 (1227.6 MHz), and L5(1176.45 MHz) [3]

Also in 1970s, Russia developed its own navigation satellite system called GLObal’nayaNAvigatsionnaya Sputnikovaya Sistema (GLONASS) It was designed to have 24 satellites

in 3 orbit planes At the time of writing, there were 29 satellites but only 24 satellites wereoperational The GLONASS signals are transmitted on G1 (1598.0625 – 1605.375 MHz),G2 (1242.9375 – 1248.625 MHz), and G3 (1201.5 MHz) bands [4]

With the objective of being the first civilian GNSS, Galileo project was approved byEuropean Space Agency in 2002 When fully deployed, the system will consist of 27operational and 3 spares satellites in 3 circular Medium Earth Orbit (MEO) Galileo signalsare transmitted in 4 frequency bands: E1 (1575.42MHz), E5 (1191.795 MHz), E5a(1176.45 MHz), E5b (1207.14 MHz) and E6 (1276.75 MHz) [32]

In 2000, China launched the first satellite of Chinese satellite navigation system 1) The coverage of the system was limited to China and neighboring regions The secondgeneration Beidou system became operational in 2011 with 10 satellites in orbit It isdesigned to have 5 geostationary Earth Orbit (GEO) satellites, 27 Medium Earth Orbit(MEO) satellites, and 3 inclined geosynchronous satellite orbit (IGSO) satellites TheBeidou signals are transmitted in three bands: B1 (1559.052 – 1591.788 MHz), B2(1166.22 – 1217.37 MHz), and B3 (1250.618 – 1286.423 MHz) [4]

(Beidou-1.3 GNSS Threats

To operate GNSS services in a reliable way, understanding the growing threats to satellitenavigation signals is essential Since the signal power is extremely weak, GNSS signalscan easily be disrupted by emerging threats which can be divided into 2 categories: natural(i.e., multipath and atmosphere) and man-made threats (interference, spoofing, GNSSsegment errors, and cyber-attacks) [33] (see Figure 1.2)

1.3.1 Multipath

The error is well-known and is source of problems not only in GNSS but also in the radiotelecommunication field It is caused by reflection: the GNSS signals are reflected by highbuilding or objects and cause large error if the receiver tracks the reflected signal instead ofthe line-of-sight signal Multipath is one of the most significant challenges amongst naturalthreats and can cause errors of several to hundreds of meters in positioning performance

1.3.2 Atmosphere

Before reaching GNSS receivers, GNSS signals must pass through the atmosphere with allits variations While the troposphere layer only causes small changes in signal phase andamplitude, the ionosphere causes more serious errors, particularly during periods of intensesolar activity Perturbation in the ionosphere around the equator and the two poles, which isthe so-called scintillation - can cause GNSS signal disruptions or very rapid changes inphase and amplitude of the signal Thus, a GNSS receiver will be loss of lock if it has not arobust engine

1.3.3 Interference

The simplest form of jamming consists in transmitting a specific signal or noise to causeGNSS receiver overload or loss of lock The attack is sometimes unintentional High powerharmonics from radar systems, TV radios, VHFs, mobile satellite services and personalelectronics can inadvertently interfere with the GNSS signal

Recently, with the advent of hand-held GNSS jammers, GNSS signals within a radius of asome tens of meters are completely disrupted The operating principle of these devices is touse a chirp signal to intervene in the operating frequency range of the GNSS signal Thereare currently no effective methods to minimize the impact of this type of attack

1.3.4 Spoofing

GNSS spoofing is a kind of attack that deceives a GNSS receiver by transmitting a fake GNSSsignal with false information or by transmitting the genuine signal grabbed elsewhere or atanother time These counterfeit signals modify the navigation message and code phase in such

a way that the receiver estimates its position somewhere else than in its actual position, or inthe correct position but at another time A common form of GNSS spoofing attacks beginsbroadcasting signals synchronized with the genuine signals The power of the counterfeit signal

is then gradually increased to dominate the genuine signal As a result, the GNSS receivercannot realize the change and completely tracks the counterfeit signals

1.3.5 GNSS Segment errors

The GNSS system can fail even without human intervention The satellite onboard atomicclocks sometimes generates cumulative errors before informing users On 1st January 2004,the error on GPS SVN-23 satellite caused a range error of up to 300 km

An error in signal modulation or generating process can also lead to errors in positioningperformance of the receiver In 1993, the evil waveform from GPS PRN 9 caused 8 meters

in pseudorange error

1.3.6 Cyber Attacks

Unlike other forms of attacks, this attack is related to manipulation of the software layer indevices to change the position information There is evidence that the attack is used in themaritime segment with Automatic Identification System (AIS) data manipulation

1.4 GNSS Receiver Architecture

1.4.1 Signal Conditioning and Sampling

The architecture of the signal conditioning and sampling is illustrated as in Figure 1.3

In this stage, the received signal is conditioned to meet the requirement of the samplingprocess For simplicity, consider the GPS L1 signal from a satellite:

(1.7)

( ) = √2 ( − ) ( − )cos(2 + )

where is the received power of the GPS L1 signal ( ) and ( ) denotes the code and data of the consdired satellite.

After the mixer, the received signal is separated into I and Q component Without loss ofgenerality, from now on, we will use the complex signal to represent the signal on I and Qchannel The signal after mixer is:

1.4.2 Acquisition

The acquisition stage is aimed to roughly estimate the code phase and Doppler shift ofvisible GNSS satellites In fact, the stage performs correlation with every Dopplerfrequency and code phase bin in the search space (Figure 1.4) A satellite is considered asvisible if there is the value of a cell in the search space higher than a specified threshold.The code and frequency corresponding to the cell is the output of the acquisition Theselected threshold must be considered carefully because it is related to the number ofsatellite in use that is proportional to the accuracy of the solution

FFT-based Acquisition Integration

Figure 1.4: Acquisition Architecture

1.4.3 Tracking and Data Demodulation

After the acquisition, the receiver has roughly code phase and Doppler frequency of everysatellite in view However, those parameters are changing over time due to the change ofthe relative position between the satellite and receiver The tracking stage is aimed to keeptrack the replica local code and carrier and the received signal with the Delay Lock Loop(DLL) and Phase Lock Loop (PLL)

Figure 1.5: Tracking Architecture

Similar to acquisition stage it performs mixing the received signal with the replica code andcarrier The PLL wipes off the carrier [31] and the DLL align the local and incoming PRNcodes The signal after the direct digital frequency synthesizer (DDFS) is down-converted tobaseband and is ideally contained in only the in-phase (I) channel The DLL tracks the timedelay of the incoming PRN The baseband signal is correlated with 3 local replica code-taps:Early (E), Prompt (P), and Late (L), through multiplication and integration, usually over aninteger PRN code period (T0) Discriminator feedbacks adjust the Code NCO, which fluctuatesthe local replica code rate to synchronize with the incoming code [34]

1.4.4 Positioning Computation

Positioning computation is performed with the assumption that the received signal isacquired and tracked successfully from a minimum of four satellites in view Afternavigation message demodulation, the receiver can determine the received time and theposition of all satellites in view To apply (1.1), the receiver needs to measure the distancefrom the receiver to all satellites In GNSS receivers, the quantity cannot be directlycalculated but it is derived through the transmission time It is worthy to note that theconvergence solution of (1.6) will not change if a constant value is added to allpseudoranges Therefore, the receiver will calculate the difference between transmissiontime instead of the absolute value The differences are computed by counting the number ofsample intervals since the receiver started to the preamble bits in the same subframe for allsatellites (Figure1.6)

Figure 1.6: Transmission time estimation in GNSS receivers

1.5 Countermeasures to GNSS Threats

This section presents the state of the art of antenna array processing techniques, frontend

and digital signal conditioning-based techniques, and correlator/tracking and PVT based techniques (see Figure 1.7) The implementation of antenna array and snapshot positioningare more emphasized because they are main focuses of the dissertation

Figure 1.7: Interference mitigation techniques in GNSS receivers

1.5.1 Antenna array processing techniques

With the spatial diversity setting by multiple elements, antenna array processing techniques areconsidered as a powerful tool for interference mitigation in GNSS applications [35] [36]

[37] [38] From an application point of view, the antenna array processing techniques can

be used to either suppress interference effect or localize the interference source

Regarding interference mitigation, although the specific implementation varies betweentechniques, the existing methods in this group can be classified based on the optimizationcriteria for calculating optimal weights

Minimum Mean Square Error Criterion: The technique was first proposed by [39] and aims to minimize the mean

square error between the output of the array ( ) and the interested signal ( )

In the implementation the referent signal is actually the local code and the navigation bits

in the tracking stage [30] However, the navigation bits are not available under stronginterference Hence, this technique is suitable for weak interference environment

Signal to Interference plus Noise Ratio Criterion:

(1.12)

Power Inversion Criterion:

With the assumption that the received signal is weaker than the interference, this technique

is proposed to null the stronger signal [40]

Beam Steering Criterion:

This technique merely maximizes the array gain following the direction of the interestedsignals

Solution

Null Steering Criterion:

Similarly, the null steering will minimize the gain in the direction of interference In [41],this technique can be used to suppress GNSS interference effectively The optimal criterionand weight vector is given as follows:

Solution

where is the vector of interference direction consisting of [1, exp( 1 ) , … , exp( Φ )]

Although the effect of this technique is undeniable, the most challenge in theimplementation of this technique is the antenna array frontend Recently, thanks to thecommercial availability of chipset for GNSS specialized applications, there are severalefforts for implementing low-cost antenna arrays for GNSS signal [42] [29]

In principle, the implementation of those frontends relies on the traditional architecture fordigital antenna array shown in Figure 1.8.

Figure 1.8: The traditional low-cost architecture of antenna array for GNSS applications

In this implementation, raw samples are interleaved into a packet and transfer to signalprocessing chains Clearly, the raw samples from elements are synchronized and they justneed a little effort in calibration to make the frontend work properly However, due to thelimitation of the interface bandwidth, both the number of elements and quantization bits arelimited Take [43] as an example, a packet sent to the signal processing chains is formed asshown in the right plot of Figure 1.8 and the sampling frequency is set to 16.368MSps andusing USB 2.0 with 60 MB/s of bandwidth As a result, the frontend will be limited tomaximum 15 elements In addition, the implementation requires a powerful PC forgrabbing raw samples from the frontend Therefore, the solution is not very appropriate formobile receivers

Another approach is to utilize the separated frontends with a common oscillator In thisapproach, the synchronization process is moved to the signal processing chains Besides, thesolution leverages the power of the distributed data processing In other words, the solutionrelaxes the dependence of the element properties (i.e., sampling frequency, quantization bits)

on the interface Consequently, it enables expanding the number of elements to infinite numbertheoretically However, the greatest challenge in implementing this solution is how toeffectively synchronize elements In telecommunication, there are some efforts to address theissues with the correlation technique [44] [45] The correlation in time domain is used for delayanalysis The function plots the similarity between signals for all possible lags

However, due to the unique properties of GNSS signals (i.e., using spreading code, weakreceived power), the technique cannot be applied in those signals Figure 1.9 shows thecorrelation of received signals between 2 elements Although the time lag is set to zero inthis experiment, there is no visible peak at 0 in time lag.

Figure 1.9: The correlation between 2 GPS signal grabbed by antenna array

Hence, one of the main focuses of this dissertation is to propose an effective technique toself-synchronize the elements without the use of any external sources

1.5.2 Frontend and Digital Signal Conditioning based techniques

The frontend-based techniques utilize the abnormal characteristics of interference such as

high power, spectrum shape, raw sample distributions for interference detection There areseveral studies exploited AGC information for detecting jamming and simplistic spoofingattacks [15] [19]

Figure 1.10: Spectrum and histogram of GNSS signal in the absence of interference

However, such information is not always available in commercial frontends Therefore,several works proposed the use of spectrum and histogram of raw samples in detectinginterference In interference absence condition, GPS signal spectrum is shaped by thefrontend filter and the histogram shape is like a Gaussian distribution (see Figure 1.10).The shape of the histogram is related to the fact that the received signal is dominated bywhite ambient noise [34].

While the frontend-based techniques are only for interference detection, the digital signalconditioning-based techniques are effective in minimizing the effect of interference.Among the techniques of the second group, pulse blanker and notch filter have shown thatthey can improve several dB after jamming mitigation [20] [21] However, the technique isnot effective in spoofing mitigation because the counterfeit signals are analogous to theauthentic ones

1.5.3 Correlator/Tracking and PVT based techniques

Like the above techniques, the correlator-based techniques (e.g., C/N0 monitoring) is alsobased on the unusual properties of the received signal However, it uses the carrier to noiseratio information instead of absolute received signal power

In PVT based techniques, Receiver Autonomous Integrity Monitoring (RAIM) is proved to

be effective to detect failures in pseudorange measurement [22] [23] However, themeasurement is available only if the tracking stage is without loss of lock The requirementcannot be guaranteed under jamming attack which aims to cause the receiver loss of lock.Therefore, recent studies have devoted some efforts to adopt the coarse time positioning forinterference environment

Figure 1.11: Snapshot positioning architecture

[27] introduces a technique, namely snapshot positioning In this technique, a user is equippedwith a GNSS data grabber, which collect GNSS signal on site The dataset is then transmitted

to a server (see Figure 1.11) At the server side, the available GPS data (provided by anotherGPS receiver) and the received dataset are used together to compute the position of the user Inthis technique, the most difficult tasks – signal synchronization and position computation – areperformed at the server side, whereas on the user side, only a simple GPS data grabber with acommunication modem is needed By this way, the computational requirement at the user side

is relaxed, and eventually, the power consumption is reduced significantly Although snapshotreceiver was first proposed by NASA [27] in 1997, it has

been widely studied in recent years due to the increasing demands on low power consumptionpositioning for mobile devices, especially for smartwatch, and object trackers.

In [27], the requirement for using the technique is that we need to know an approximateposition (so-called prior solution), which must be less than 150 km, equivalent to a half code-length, from the true position However, that information is not always available in reality Toovercome that distance limitation, recent studies, which propose feasible designs of snapshotreceivers for mobile computing [46] [47] use the position of the base stations of the cellularnetwork as the prior solution However, due to the policy of telecommunication companies,that information of base stations is also not always provided The work in [3] uses the Dopplerpositioning method in order to provide the prior solution for the snapshot positioning Althoughthe Doppler positioning is not so precise, however, that level of accuracy already satisfies the150-km-requirement However, the architecture in [28] requires the fine estimation of codedelay Therefore, the tracking process is mandatory, this leads to power consumption due to thecorrelation computation

Besides the signal processing part which is already relaxed by the snapshot technique, thecommunication part needs to control the power consumption also Therefore, the size of thedataset must be reduced as much as possible to meet that requirement In literature, theGPS data grabbers use 2 bits for quantization, with the sampling frequency of 2.046 MHz.The sampling frequency has an important impact to the accuracy of the positioning andcannot be reduced due to the Nyquist criterion Meanwhile, the number of quantization bitshas impact on the sensitivity of the positioning, which can be compensated by extendingthe integration time In addition, in the viewpoint of hardware design and implementation,the 1-bit data stream is much simpler and more stable than the 2-bit one since the SerialPeripheral Interface (SPI) interface, which is a fast data transfer protocol, can be useddirectly in 1-bit stream to facilitate the data transfer between the frontend and themicroprocessor

1.6 GNSS Simulator and effect of sampling frequency

As mentioned in section Scope of Research, this work focuses on software-basedprocessing techniques Therefore, all research starts from the digitalized intermediatefrequency signal Compared to hardware-based simulator, a software simulator is anefficient way to generate the input signal to the software receiver First, it allows creatingvarious signal conditions for simulation Second, it enables to add new signal features.Several software-based GNSS signal simulators have been developed as reported in theliterature [48] proposed the first MATLAB based GPS signal simulator which can provide acomplete GPS signal simulation ranging from signal properties (e.g., signal power,pseudorange, Doppler) to satellite constellation However, the solution is very computationalexpensive due to the simulation of RF signals with the very high sampling frequency

Other works related to software-based GNSS simulator do not generate the complete signalwaveforms but generate the analytical I and Q samples basing on the assumption that theincoming code and carrier align with the local ones [49] [50] The approach may reduce thecomputational burden but is less accurate in generating reliable signals for long periods.

Hence, the development of the GNSS simulator is also carefully considered in this study.Amongst the signal parameters, sampling frequency is directly related to the computationalburden of the software-based simulator Unfortunately, the sampling frequency is notproportional to the accuracy of the simulated signal from the positioning performance point

of view The effect of sampling frequency on the positioning performance was firstmentioned in [51] If the sampling frequency is an integer multiple of the nominal coderate, it leads to the distortion of the correlation shape and a significant accuracydegradation However, still more efforts are needed to generalize the effects of samplingfrequency on GNSS code tracking

CHAPTER 2

2 GNSS SIGNAL SIMULATOR DESIGN AND IMPLEMENTATION

Stemming from the need of a flexible simulator which can simulate reliable emergingthreats in GNSS fields (i.e., jamming, spoofing, and interference) beside the properties of aconventional simulator, this chapter presents the design and implementation of a software-based simulator In addition, the chapter generalizes the effect of sampling frequency onthe positioning performance to suggest the suitable sampling frequency for simulations.Deriving from the mathematical analysis, a proposed mitigation solution is also provided inthis chapter and verified with both simulation and live sky signal

Firstly, this chapter will present the modeling methodology of GNSS simulation Then, theeffect of sampling frequency and a simple mitigation technique is analyzed carefully fromthe accuracy performance point of view Moreover, some experiments conducted on boththe software receiver and a commercial receiver (i.e., Ublox) will be given in the resultsection, so validating the adopted models and the simulator performance The achievedresults reported in this chapter show that the developed simulator can be considered as alow-cost solution to simulate not only single antenna signals but also antenna array signals.The simulator has been used for reliable simulating spoofing and interference (e.g.,multipath) [52]

2.1 Modeling methodology

2.2 Overview of the modeling of antenna array signals in GNSS receivers

To model antenna array signals, we assume that a far-field signal (a GNSS signal or narrowband interference) impinges a GNSS receiver in the direction expressed by the azimuth and elevation angles ( , ) Thus, the unit vector of the incoming signal can be written as:

= [sin( ) cos( ) sin( ) sin( ) cos( )]

(2.1)

We also assume that the first element of the array is at the origin of the coordinate system

expressed as the propagation delay in the direction of the incoming signal from the origin

to the wavefront passing through the mth element [53] The delay in meters is

where = ( , , ) is the position of the th element.

32

Figure 2.1: Geometry of antenna array

In conclusion, the signal at the th element ( ( )) is a delayed version of the signal at the first element ( 1( ))

( ) = 1 ( − ) = 1 ( −

Δ

)

(2.3)

where c is the speed of light.

2.2.1 General model of the received signal in GNSS receivers

Figure 2.2: The model of the received signal for a single antenna

The received signal at the th element can be considered as the combination of the sight (LOS) signals, multipath signals, ambient noise and interferences (intentional orunintentional) (Figure 2.2) It can be expressed as

33

1 ( ) is the composite signal at the element m.

N, M and K are respectively the number of LOS signals, multipath signals and interferences

1, ( ) is the L1 LOS GPS signal of the th satellite at the element m.

, ( ) is the multipath signal of the th satellite at the element m.

( ) is the ambient noise at the element m.

( ) is the k th interference signal at the element m.

The received signal is then down-converted to an intermediate frequency and sampled atfrequency Such operations are performed by the receiver frontend, whose scheme isshown in Figure 2.3

Note that, as shown in Figure 2.3, the local oscillators are shared among the channels inorder to synchronize them

Figure 2.3: GPS multi-antenna frontend

The developed simulator is able to generate GNSS signals along with the operations of themulti-antenna frontend Therefore, the input of the simulator contains the user trajectory,the navigation files, the filter characteristics, and the profiles of signal power, multipath,and interference The output of the simulator is the digitalized signals at each element ofthe antenna array The flowchart of the simulator’s operation is shown in Figure 2.4

34

Figure 2.4: Flowchart of the simulator

As illustrated in Figure 2.4, the simulator contains three main processing blocks, namely:propagation delay computation, navigation message encoding, and digitalized signalgeneration The first block computes the propagation delay between the visible satellitesand the receiver, and the ionospheric and tropospheric delays The second block encodesthe navigation messages The last block synthesizes the given information data andgenerates the LOS and NLOS signals, interference, and noise

, is the Doppler frequency of the satellite k.

Φ is the initial carrier phase of the satellite k.

Φ is the carrier phase difference between the th element and the first element.

35

The delay at the ℎ element, expressed as , is present only in the carrier, since this delay can be neglected in the baseband signals C(t) and D(t) This is resulted from the propagation delay difference between elements that is much smaller than the C/A code length and data bit length.

Signal power

According to [30], the gain and phase of each array element depend on the incoming signaldirection and frequency However, in the simulator, the gain and phase is expressed as afunction of the direction of arrival (DOA) Therefore, the power of the received signal atthe th element in term of antenna gain can be written as:

, = ( ) ,

(2.6)

where:

is the DOA of the incoming signal,

( ) is the antenna gain corresponding to the DOA of the incoming signal The notation ( ) indicates that the antenna element gain is a function of the signal direction ( ),

The no distortion GPS power ( , ) can be written in term of / 0 as:

, = 10 (( / 0 ) + 0 )/10

(2.7)

where:

is the velocity vector of the k th satellite.

is the velocity vector of the user

is the LOS vector

36

1 is the transmitted frequency ( 1=1575.42MHz).

where is the propagation delay taking into account the earth rotation

is the delay due to the ionospheric layer

is the delay due to the tropospheric layer

Initial carrier phase

The carrier phase difference between the element and the first element is as follows:

is the antenna location of the element

is the incident angle of the satellite k.

2.2.2 Interference

Any signal with frequency components in the GNSS band represents a radio frequencyinterference (RFI) Many types of RFI signals exist (continuous waves, narrow-band,

pulses, etc ) In the simulator two types of RFI can be selected: continuous wave

interference and band-limited Gaussian interference

A continuous wave interference (CWI), which is one of the simplest forms of interference,can be expressed as follows:

,

,

is the frequency of the th interference

is the initial phase of the th interference

is the phase of the ℎ interference at the th element.

Note that the phase is evaluated as the GPS signal phase

The band-limited Gaussian interference can be modelled as a Gaussian noise through a band-limited filer (Figure 2.5)

Figure 2.5: Bandlimited Gaussian interference model

2.2.3 Multipath

A 1-ray multipath of the satellite can be modeled as:

− , ) exp ( (2 ( 1 + , + , , ) + Φ + , ))

where , is the multipath delay , is the multipath carrier phase , , is the multipath Doppler The remaining terms are defined as in section 2.2

38

According to [31], the multipath Doppler and delay can be expressed as follows:

ℎ is the receiver altitude concerning the reflected plane

is the angle shown in Figure 2.6

2.3 Effect of sampling frequency on the positioning performance

Figure 2.7 visualizes the effect of sampling frequency on the positioning performance In theexample, we use 2 GPS datasets with 4.092MSps and 4.093MSps in sampling frequency Theyare both processed with the modified software receiver from Akos [2] The positioning errormuch higher with 4.092MSps in sampling frequency compared to that of 4.093MSps

In this section, we will characterize the effect of sampling frequency on the positioningerror through mathematic expression

Figure 2.7: Effect of sampling frequency on the positioning performance

39