Nghiên cứu giải pháp nâng cao khả năng chống nhiễu cho các bộ thu định vị GNSS tiên tiến robust signal processing techniques for modern GNSS receivers

25 Figure 1.8: The traditional low-cost architecture of antenna array for GNSS applications 27 Figure 1.9: The correlation between 2 GPS signal grabbed by antenna array .... 67 Figure 3.

MINISTRY OF EDUCATION AND TRAINING

HANOI UNIVERSITY OF SCIENCE AND TECHNOLOGY

NGUYEN DINH THUAN

ROBUST SIGNAL PROCESSING TECHNIQUES FOR MODERN

1 Assoc Prof Ta Hai Tung

2 Prof Letizia Lo Presti

Hanoi - 2019

STATEMENT OF ORIGINALITY AND AUTHENTICITY

I confirm that my dissertation is an original and authentic piece of work written bymyself The data, results in the thesis is reliable and has never been published byothers I further confirm that I have fully referenced and acknowledged all materialincorporated as secondary resources in accordance with the regulations

Hanoi,SUPERVISORS PHD STUDENT

PGS.TS Tạ Hải Tùng Nguyễn Đình Thuận

Prof Letizia Lo Presti

ACKNOWLEDGEMENTS

I would like to express my gratitude to Hanoi University of Technology, GraduateSchool, School of Information and Communication Technology, Department ofComputer Engineering and Politecnico di Torino, NavSaS group for creatingfavorable conditions for me to work and study

I would like to express my special thanks to my supervisors, Assoc Ta Hai Tungand Prof Letizia Lo Presti The supervisors have always been helpful, giving greatadvice, scientific orientations so that I can develop and complete my research

Sincerely thank the lecturers, colleagues in the Department of ComputerEngineering, School of Information and Communication Technology, HanoiUniversity of Science and Technology where I work, study and carry outresearch projects for the enthusiastic in helping and encouraging me during theresearch

With gratitude to teachers, scientists, colleagues and close friends for encouragingand supporting me in the research process

Finally, I would like to express my deep gratitude to my family for encouraging me

to overcome all obstacles to complete this thesis

Nguyen Dinh Thuan

TABLE OF CONTENTS

STATEMENT OF ORIGINALITY AND AUTHENTICITY 1

ACKNOWLEDGEMENTS 2

TABLE OF CONTENTS 3

LIST OF ACRONYMS 6

LIST OF TABLES 8

LIST OF FIGURES 9

INTRODUCTION 13

1 FUNDAMENTAL BACKGROUND 18

1.1 GNSS positioning principle 18

1.2 History and development of GNSS 19

1.3 GNSS Threats 20

1.3.1 Multipath 21

1.3.2 Atmosphere 21

1.3.3 Interference 21

1.3.4 Spoofing 21

1.3.5 GNSS Segment errors 21

1.3.6 Cyber Attacks 22

1.4 GNSS Receiver Architecture 22

1.4.1 Signal Conditioning and Sampling 22

1.4.2 Acquisition 23

1.4.3 Tracking and Data Demodulation 23

1.4.4 Positioning Computation 24

1.5 Countermeasures to GNSS Threats 25

1.5.1 Antenna array processing techniques 25

1.5.2 Frontend and Digital Signal Conditioning based techniques 28

1.5.3 Correlator/Tracking and PVT based techniques 29

1.6 GNSS Simulator and effect of sampling frequency 30

2 GNSS SIGNAL SIMULATOR DESIGN AND IMPLEMENTATION 32

2.1 Modeling methodology 32

2.2 Overview of the modeling of antenna array signals in GNSS receivers 32

2.2.1 General model of the received signal in GNSS receivers 33

2.2.2 Interference 37

2.2.3 Multipath 38

2.2.4 Noise 39

2.3 Effect of sampling frequency on the positioning performance 39

2.3.1 Residual code phase estimation 40

2.3.2 Correlation output calculation 40

2.3.3 Effect of sampling frequency on correlation shape and DLL discriminator function 42 2.3.4 Effect of the sampling frequency and the integration period selection 42

2.3.5 Effect on the presence of Doppler and local oscillator (LO) clock drift 45

2.3.6 Theoretical code tracking loop error estimate 46

2.3.7 Theoretical results evaluation by simulated, and numerical models 49

2.3.8 Effect of Doppler and coherent integration period 50

2.4 Sampling Frequency Effect Mitigation Technique 53

2.4.1 Receiver implementation 55

2.5 Performance verification 57

2.5.1 Verification of the simulated antenna array signals 58

2.5.2 Antenna distortion simulation 64

2.5.3 Verification of multipath simulation 66

2.6 Conclusion 67

3 ANTENNA ARRAY PROCESSINGS FOR GNSS RECEIVERS 69

3.1 The proposed solution for synchronizing separated antenna array element 69

3.1.1 Determining the samples difference 70

3.1.2 Determining the clock phase shift 71

3.2 Implementation a low-cost antenna array 75

3.3 Antenna array frontend verification 76

3.3.1 Phase difference between frontends 76

3.3.2 Carrier to noise ration improvement 77

3.4 Conclusion 78

4 GNSS SNAPSHOT PROCESSING TECHNIQUE FOR GNSS RECEIVERS 80

4.1 Proposed Design of GNSS Snapshot Receiver 80

4.1.1 GNSS Grabber 80

Implementation of GNSS Grabber 80

Firmware Architecture 81

4.2 Server Software 81

4.2.1 GNSS signal acquisition 81

4.2.2 Combined Doppler and Snapshot Algorithm 84

4.3 Loosely coupled Snapshot GNSS/INS 89

4.4 Tightly coupled Snapshot GNSS/INS 96

4.5 Results 97

4.5.1 Standalone Snapshot GNSS Receiver 97

4.5.2 Snapshot GNSS/INS Integration 102

4.6 Conclusion 104

CONCLUSIONS AND FUTURE WORKS 105

PUBLICATIONS 107

REFERENCES 109

APPENDIX 116

A Correlation output calculation 116

B Error analysis for coherent early minus late DLL 117

LIST OF ACRONYMS

ADC Analog to Digital Converter

AWGN Additive White Gaussian Noise

BPSK Binary Phase Shift Keying

DFT Discrete Fourier Transform

DSP Digital Signal Processor

EGNOS European Geostationary Navigation

Overlay Service

FPGA Field Programmable Gate Array

6

FOC Full Operational Capability

GLONASS Global Orbiting Navigation Satellite

System

7

LIST OF TABLES

Table 2.1: GNSS Simulator Features 57Table 2.2: The coordinate of 4 elements 58Table 2.3: The direction of 6 visible satellites 59Table 2.4: The carrier phase relative to the first element of each satellite at the four

elements of the array

59

Table 2.5: The simulation scenario 60Table 2.6: Estimated carrier phase using the post-correlator beamforming tracking loop 62Table 4.1: Configuration of the GPS grabber 97Table 4.2: Information of acquired satellites 99

LIST OF FIGURES

Figure 1.1: Satellite navigation principle 18

Figure 1.2: Typical GNSS Threats 20

Figure 1.3: Signal conditioning and sampling stage 22

Figure 1.4: Acquisition Architecture 23

Figure 1.5: Tracking Architecture 23

Figure 1.6: Transmission time estimation in GNSS receivers 24

Figure 1.7: Interference mitigation techniques in GNSS receivers 25

Figure 1.8: The traditional low-cost architecture of antenna array for GNSS applications 27 Figure 1.9: The correlation between 2 GPS signal grabbed by antenna array 28

Figure 1.10: Spectrum and histogram of GNSS signal in the absence of interference 28

Figure 1.11: Snapshot positioning architecture 29

Figure 2.1: Geometry of antenna array 33

Figure 2.2: The model of the received signal for a single antenna 33

Figure 2.3: GPS multi-antenna frontend 34

Figure 2.4: Flowchart of the simulator 35

Figure 2.5: Bandlimited Gaussian interference model 38

Figure 2.6: Multipath model 38

Figure 2.7: Effect of sampling frequency on the positioning performance

39 Figure 2.8: Residual code phases versus the number of samples per code chip with 4fc < fs < 5fc 40

Figure 2.9: Normalised correlator and EML discriminator functions for different sampling frequencies Results are obtained by correlating the incoming signal with various local generated replica signals that have the time delay from−Tc to Tc with step = 10 -2Tc 42 Figure 2.10: Correlation shapes for 1 ms integration with various sampling frequencies 43

Figure 2.11: Ambiguous synchronization between a local PRN code and two different incoming analog signals of the same PRN sequence, but with slightly differing code phase offset 43

1 0

Figure 2.12: Correlation shapes and their errors with respect to the ideal correlation at asampling frequency fs =16.3676 MHz using various coherent integration periods .44

Figure 2.13: Representation of code tracking loop [54] 46

Figure 2.14: DLL jitter versus different sampling frequencies (step= fc) for a GPS L1 C/A

with C/N0=40 dB-Hz, BL=0.5 Hz, T=1 ms, and fixed BW βr = 2fc 48

Figure 2.15: Upper bound and lower bound of the DLL jitter versus different sampling frequencies (step = 5∗10-2 fc) for a GPS L1 C/A with C/N0=45 dB-Hz, BL=0.5 Hz, T=1 ms, and βr = fs 49

Figure 2.16: Mean values of two error bounds σs1 and σs2 versus different sampling frequencies (step = 10-1 fc) for a GPS L1 C/A with C/N0=45 dB-Hz, BL=0.5 Hz, T=1 ms, and βr = fs 49

Figure 2.17: DLL tracking error comparison among the simulated, numerical and theoretical models (step = 10-1 fc) for a GPS L1 C/A with T=1 ms, and βr = fs 50

Figure 2.18: DLL tracking error versus Doppler frequencies fD for different integration periods T when the sampling frequency is an integer multiple of the nominal code rate (ns=4), in which the blue dotted lines indicate the typical Doppler range 51

Figure 2.19: DLL tracking error versus integration periods T GPS L1 C/A is used with fs = 4.092 MHz (ns=4), C/N0=40 dB-Hz, BL=0.5 Hz, T=1 ms, and βr = fs 52

Figure 2.20: DLL tracking error versus Doppler frequencies fD for different integration periods T when the sampling frequency is a non-integer multiple of the nominal code rate 52

Figure 2.21: Code chip selection versus jitter values with M=4, where Triangle, circle, and diamond dots indicate samples belonging to (k−1)th, kth , and (k+1)th chips, respectively 54

Figure 2.22: Correlator shapes versus different jitter techniques for GPS L1 C/A signal, where τ runs in the range [−Tc,Tc] with step interval =10−3Tc, fs=4.092 MHz, fD = 0 Hz, βr = fs and θNCO(0) = 0.125 55

Figure 2.23: Pseudo-code algorithm that can be used to implement jittering solution on SDR receiver 56

Figure 2.24: The results after applying the mitigation technique 57

Figure 2.25: Antenna array configuration 59

Figure 2.26: Post-correlator beamforming receiver architecture [30] 61

Figure 2.27: Scatter diagram of the tracking output of the satellite PRN01 at 4 elements 62 Figure 2.28: Estimated position of elements (East-North) 64

Figure 2.29: Estimated position of elements (Up) 64Figure 2.30: Element patterns utilized for simulation (East-North) 65Figure 2.31: The C/N0 of the satellite PRN 1 65

Figure 2.32: Multipath error 67

Figure 3.1: The architecture of antenna array based GNSS receiver 69

Figure 3.2: Time difference between 2 elements 71

Figure 3.3: Navigation message 71

Figure 3.4: The architecture of the system to determine the phase offset 72

Figure 3.5: The impact of clock phase shift 73

Figure 3.6: The loop filter using for estimating the clock drift 74

Figure 3.7: The estimated frequency shift using the loop filter 74

Figure 3.8: The scatter plot of the signal after mitigating clock phase shift 75

Figure 3.9: The 3-elements antenna array frontend modified from turner RTL2832Us 76

Figure 3.10: The setup of the verification of the frontend using a GPS simulator 77

Figure 3.11: Tracking output of satellites in view 77

Figure 3.12: �/�� of the satellite PRN 09 for the received signal at every element and beamed signal 78

Figure 4.1: The architecture of the GNSS grabber 80

Figure 4.2: The flowchart of the grabber firmware 81

Figure 4.3: Acquisition search space 82

Figure 4.4: Probability of Detection w.r.t �/�� with ���� = �� − � 84

Figure 4.5: FFT-based acquisition 84

Figure 4.6: Snapshot solution diagram 88

Figure 4.7: Traditional loosely-coupled GPS/INS integration 90

Figure 4.8: INS mechanization [3] 94

Figure 4.9: Tightly-coupled integration scheme 96

Figure 4.10: The prototype of GNSS grabber 98

Figure 4.11: Acquisition result of the grabbed signal 98

Figure 4.12: The position converged after 7 iterations 100

Figure 4.13: The positioning accuracy of the proposed solution 101

Figure 4.14: Power consumption comparison of our proposed solution and Ublox LEA 6T 102Figure 4.15: The experiment setup 102

Figure 4.16: GNSS Snapshot/INS integration result 103Figure 4.17: Positioning performance between GNSS Snapshot and GNSS Snapshot/INSIntegration 103

INTRODUCTION

Nowadays, GNSS receivers have become core components in many applications rangingfrom vehicle navigation to unmanned vehicle guidance, from location-based services toenvironment monitoring Besides providing position information for many applications,GNSS services also provide a highly precise timescale for synchronizing systems such astelecommunication and network Hence, the performance of GNSS which haveconsiderable influence on the operation of these services must be guaranteed In [1] a list

of four parameters of GNSS performance is reported: accuracy, availability, continuity,and integrity Recently, the accuracy of GNSS has been significantly improved with thedevelopment of new navigation systems (Galileo-European system and BEIDOU-Chinesesystem) and the modernization of the existing navigation systems GPS and GLONASS.However, GNSS services are seriously being threatened by the emergence of jamming andspoofing threats

Because GNSS signals are buried under ambient noise, the signals and services of GNSSsystems are highly sensitive to interference such as radio frequency interference, jammingand spoofing; meanwhile, the quality of such services is not guaranteed to the conventionalusers Technically, the GNSS signal is transmitted from satellites away from Earth (about20.000 km), so when it comes to receivers, the signal power is smaller than the backgroundnoise about 1024 times (26dB) [2] Therefore, any source of interference (jammer, digitalterrestrial communication systems, ionosphere scintillation) may reduce the quality of thereceived signal, which in turn can disable the operation of the receiver In addition, becausethe GNSS systems are often under the management of military based organizations [3] [4][5], the open services (e.g., GPS L1 C/A, Beidou B1, GLONASS L1OF) are provided tousers without any guarantee of their reliability and continuity However, ensuring reliableand continuous position and time information is essential in modern GNSS receivers Tomeet these requirements, receivers must make use of advanced techniques to detect andmitigate interferences so that they can provide the requested continuous position and timeinformation These techniques are called “interference mitigation techniques”

In recent studies [6] [7] reflecting the state of the art, interference mitigation techniques can

be classified according to the position of the algorithm within the processing stages of

GNSS receiver chain In short, they are classified into three groups namely antenna array processing techniques, frontend and digital signal conditioning-based techniques, and correlator/tracking and PVT based techniques

Antenna array signal processing technique: A popular method for robust GNSS receiver

performance consists in using multiple physical antenna elements which constitute a called antenna array This technique has been studied since the 1940’s and has been widelyused in radar and telecommunications applications [8] [9] [10] [11] Recent studiesexploited this technique for GNSS applications considering it as an effective method

so-to mitigate

interference However, conventional antenna array-based processing leads to complicatedand expensive systems, and it is not suitable for mobile receivers [12] [13] [14] Althoughthere are several efforts to design low-cost antenna array for GNSS applications [9] [10],issues involved to the implementation in a GNSS receiver still exist While 2 bits ofquantization in ADC, have been proved to be enough for GNSS receivers [15], however itmakes the GNSS receivers less robust to threats due to the saturation of the ADC againstthe high power of the interference Also, expanding the number of antenna elements is achallenge due to the limited interface bandwidth To overcome those limitations, the signalfrom elements can be independently grabbed first and then their signals are synchronized

In this approach, synchronization becomes the vital process to be performed beforecombining the signals from the array Thus, the design of robust calibration algorithms thatcorrects for the time, phase and frequency mismatch among array data becomes anecessity To estimate the phase difference between elements, we can use least squares andmaximum likelihood such as [16] [17] Phase calibration of antenna arrays can also usethe live-sky GNSS signal [18] [11] Regarding time offset estimation, there are somestudies in telecommunication field which address the issue using the correlation technique[41] [42] However, those studies assume that the power of the interested signal is muchhigher than ambient noise Therefore, the assumption may not hold true when GNSSsignals are involved

Frontend and Digital Signal Conditioning based techniques: In this second group of

interference mitigation techniques, some unusual properties of interference signals such ashigh power, spectrum shape, raw sample distributions are used for interference detection.While [19] proposed the use of AGC to detect jamming signal, [15] uses this information

to detect a spoofing repeater Although this is considered as a promising technique indetecting jamming and simplistic spoofing, the information needed for its implementation

is not always available in commercial frontends On top of this, for what concerns theapplication to spoofing detection, since this technique observes the sudden change in thereceiver power, it is useful only if it monitors the signal before the occurrence of a spoofingattack In more complicated spoofing scenarios, the technique cannot differentiate thespoofed signal from the real signals because the spoofed signals are mimicking theproperties of the authentic signals While the frontend-based techniques are only forinterference detection, the digital signal conditioning-based techniques are useful inminimizing the effect of interference Among the techniques of this second group, pulseblanker and notch filter have shown that they can improve several dB after jammingmitigation [20] [21] However, as mentioned above, this technique cannot apply tospoofing mitigation because spoofing signal properties are analogous to those of authenticsignals

Correlator/Tracking and PVT based techniques: Like the second group of interference

mitigation techniques, these techniques rely on the detection of abnormal outputs incorrelator or PVT in order to identify the presence of interference Take C/N0 monitoring

technique as an example This technique is based on the abnormal power of theinterference However, it uses the carrier to noise ratio information instead of absolutereceived signal power using in the second group of interference mitigation techniques InPVT based techniques, the consistent check or cross check will guarantee the reliableinformation in PVT stages (i.e., pseudorange, ephemeris data) A typical technique in thisgroup is Receiver Autonomous Integrity Monitoring (RAIM) Although it is proved to beeffective to detect failures in pseudorange measurement [22] [23], the measurement isavailable only if the tracking stage is without loss of lock The requirement cannot beguaranteed under powerful jamming attack which aims to cause the receiver complete loss

of lock Therefore, to guarantee the availability of a PVT solution, recent studies havesuggested to adopt a coarse time positioning solution for coping with environmentsaffected by interference It is considered as an efficient method that can be applied to anarea where the continuous GNSS signal tracking is not guaranteed due to interference [24][25] Compared to traditional receiver, the positioning performance of this technique is lessprecise Recent studies have been improving its positioning performance on the GPS L1snapshot receiver [26] [27] [28] but the use of multi-constellation and INS integration insnapshot receiver has not been explored sufficiently in previous works

Another difficulty during the design and implementation of interference mitigationtechniques is the performance evaluation and verification process Currently, theseprocesses can be done using either live-sky GNSS signal [29] or GNSS simulator signal[30] The first approach is straightforward to implement, but it is difficult to control theenvironments along with GNSS signals Therefore, the latter is the method being usedfavorite now However, there are existing limitations with the use of GNSS simulatorsavailable in the market for SDR based study Because the input data of the study is thedigitalized IF signal, in order to grab such kind of data we need to use a grabber frontendwhich may include unavoidable errors, moreover, the performance of the SDR basedreceiver are strongly affected by the sampling frequency so the chosen value should beconsidered carefully during simulation Motivation

From the above analysis, advanced processing techniques for resilient positioning andtiming are essential in modern GNSS receivers Therefore, goal of this work is to proposetechniques to overcome the existing limitations in antenna array processing and snapshotprocessing for modern GNSS receivers The proposed techniques not only reduce theimplementation cost but also leverage the distributed data processing ability

Scope of Research

The work mainly focusses on antenna array processing technique and snapshot techniquefor modern multi-GNSS receivers While the first technique enables designing andimplementing a low-cost antenna array for GNSS applications, the second technique canprovide reliable position and time information in strongly interfered environment Remark

also that all the simulations through the dissertation are performed with the data generatedfrom a software-based GNSS simulator The design and implementation of this simulatorare also part of this thesis The approach to these techniques is based on SDR technologywhere the signal processing chains are implemented by means of software on a personalcomputer before deploying to the FPGA

Methodology

For this study, the following approach is adopted First, relevant literature and studies arereviewed to get in-depth knowledge of interference mitigation techniques Also, theprocessing chains in GNSS receivers (i.e., acquisition, tracking and PVT computation) arereviewed Second, solutions are proposed to address the existing issues in theimplementation of modern GNSS receivers Finally, the obtained result is analyzed,processed and checked against information obtained from literature and previous studies

Contribution

As mentioned above, the study focuses on proposing solutions to address the two mainissues: the use of low-cost antenna array to detect GNSS threats and the use of multi-GNSSsnapshot positioning technique for discontinuous GNSS signal environment

Regarding antenna array signal processing technique, the work has proposed thesynchronization mechanism that enables the use of low-cost antenna array processing inGNSS field Theoretical and empirical results show that this is a promising solution thatwill not only reduce deployment costs but also be a flexible solution for expanding thenumber of antenna elements

As for the second issue addressed, the thesis proposes an integrated model of a system snapshot receiver with an inertial positioning system (INS) Theoretical andexperimental results have shown the superiority of performance of this solution over theuse of solutions exploiting only single GNSS systems This integrated model isparticularly suitable for environments where GNSS signals are intermittent

multi-The results presented in this thesis have been published in 6 conferences and 5 journals aslisted in the attachment The works have been carried on at Hanoi University of Scienceand Technology (Vietnam) and at Politecnico di Torino (Italy)

Thesis outline

The thesis is organized in 4 chapters as follows:

Chapter 1 – Fundamental Background: In this chapter, the background knowledge related

to the stages of GNSS receiver architecture including acquisition, tracking and datademodulation, and position computation are revised Also, this chapter show state of the art

of the interference mitigation techniques The limitations of existing works in the

a solution enabling the extension of the number of elements and the quantization bits It isapplied in a low-cost antenna array for detecting the source of spoofing and interference.Chapter 4 – Snapshot Signal Processing for GNSS Receivers: This chapter shows how themulti-constellation snapshot technique can be effectively implemented In addition, toimprove positioning performance, the snapshot GNSS/INS integration is proposed.

in GNSS receivers are fully described.

1.1 GNSS positioning principle

This section will explain the general principle of GNSS navigation Basically, GNSSpositioning is based on trilateration techniques In this technique, the receiver firstlydetermines the distance from its position to at least three known points After that, thereceiver’s position is determined by the intersection of 3 spheres (Figure 1.1)

Figure 1.1: Satellite navigation principle

Let � = [�� �� �� ] and ��� = [�� �� �� ] be the position of thereceiver and of the satellite i The geometry distance from the receiver to satellite is defined

as �� = ||� − ��� || Clearly, the vector � can be determined if we know the satelliteposition ��� and the distance

i=1,2,3

In GNSS receivers, the distance cannot be measured directly but it uses the transmissiontime from satellite to receiver Unfortunately, the receiver clock is not synchronized withthe atomic clocks onboard of GNSS satellites As a result, we have one more unknownvariable ��� besides 3 unknown elements of � With 4 satellites, the equations in thesefour

unknowns are as follows:

where c is the speed of light

When considering the other errors (e.g., ionospheric, tropospheric), we have the completeform of the equations [31]

Denote vector solution � = [�� �� �� ��� ] and using the first order

��1�� + ����4 = �� �1�1 + ax2�� +

Δ�1,

az4 1

�2���3

Δ� = (�� �)−1�� Δ�

(1.6)

1.2 History and development of GNSS

The first GNSS is the Global Positioning System (GPS) The project was approved by theUnited States Department of Defense in 1973 When the system was fully operational in

1995, its constellation consisted of 24 satellites spreading in 6 orbit planes The current

operational constellation is made up of 30 satellites GPS signal frequencies are allocated inthree bands: L1 (1575.42 MHz), L2 (1227.6 MHz), and L5(1176.45 MHz) [3].

Also in 1970s, Russia developed its own navigation satellite system called GLObal’nayaNAvigatsionnaya Sputnikovaya Sistema (GLONASS) It was designed to have 24 satellites

in 3 orbit planes At the time of writing, there were 29 satellites but only 24 satellites wereoperational The GLONASS signals are transmitted on G1 (1598.0625 – 1605.375 MHz),G2 (1242.9375 – 1248.625 MHz), and G3 (1201.5 MHz) bands [4]

With the objective of being the first civilian GNSS, Galileo project was approved byEuropean Space Agency in 2002 When fully deployed, the system will consist of 27operational and 3 spares satellites in 3 circular Medium Earth Orbit (MEO) Galileo signalsare transmitted in 4 frequency bands: E1 (1575.42MHz), E5 (1191.795 MHz), E5a(1176.45

MHz), E5b (1207.14 MHz) and E6 (1276.75 MHz) [32]

In 2000, China launched the first satellite of Chinese satellite navigation system 1) The coverage of the system was limited to China and neighboring regions The secondgeneration Beidou system became operational in 2011 with 10 satellites in orbit It isdesigned to have 5 geostationary Earth Orbit (GEO) satellites, 27 Medium Earth Orbit(MEO) satellites, and 3 inclined geosynchronous satellite orbit (IGSO) satellites TheBeidou signals are transmitted in three bands: B1 (1559.052 – 1591.788 MHz), B2(1166.22 –

(Beidou-1217.37 MHz), and B3 (1250.618 – 1286.423 MHz) [4]

1.3 GNSS Threats

To operate GNSS services in a reliable way, understanding the growing threats to satellitenavigation signals is essential Since the signal power is extremely weak, GNSS signals caneasily be disrupted by emerging threats which can be divided into 2 categories: natural (i.e.,multipath and atmosphere) and man-made threats (interference, spoofing, GNSS segmenterrors, and cyber-attacks) [33] (see Figure 1.2)

Figure 1.2: Typical GNSS Threats

1.3.1 Multipath

The error is well-known and is source of problems not only in GNSS but also in the radiotelecommunication field It is caused by reflection: the GNSS signals are reflected by highbuilding or objects and cause large error if the receiver tracks the reflected signal instead ofthe line-of-sight signal Multipath is one of the most significant challenges amongst naturalthreats and can cause errors of several to hundreds of meters in positioning performance

1.3.2 Atmosphere

Before reaching GNSS receivers, GNSS signals must pass through the atmosphere with allits variations While the troposphere layer only causes small changes in signal phase andamplitude, the ionosphere causes more serious errors, particularly during periods of intensesolar activity Perturbation in the ionosphere around the equator and the two poles, which isthe so-called scintillation - can cause GNSS signal disruptions or very rapid changes inphase and amplitude of the signal Thus, a GNSS receiver will be loss of lock if it has not arobust engine

1.3.3 Interference

The simplest form of jamming consists in transmitting a specific signal or noise to causeGNSS receiver overload or loss of lock The attack is sometimes unintentional High powerharmonics from radar systems, TV radios, VHFs, mobile satellite services and personalelectronics can inadvertently interfere with the GNSS signal

Recently, with the advent of hand-held GNSS jammers, GNSS signals within a radius of asome tens of meters are completely disrupted The operating principle of these devices is touse a chirp signal to intervene in the operating frequency range of the GNSS signal Thereare currently no effective methods to minimize the impact of this type of attack

1.3.4 Spoofing

GNSS spoofing is a kind of attack that deceives a GNSS receiver by transmitting a fakeGNSS signal with false information or by transmitting the genuine signal grabbedelsewhere or at another time These counterfeit signals modify the navigation message andcode phase in such a way that the receiver estimates its position somewhere else than in itsactual position, or in the correct position but at another time A common form of GNSSspoofing attacks begins broadcasting signals synchronized with the genuine signals Thepower of the counterfeit signal is then gradually increased to dominate the genuine signal

As a result, the GNSS receiver cannot realize the change and completely tracks thecounterfeit signals

1.3.5 GNSS Segment errors

The GNSS system can fail even without human intervention The satellite onboard atomicclocks sometimes generates cumulative errors before informing users On 1st January 2004,the error on GPS SVN-23 satellite caused a range error of up to 300 km

An error in signal modulation or generating process can also lead to errors in positioningperformance of the receiver In 1993, the evil waveform from GPS PRN 9 caused 8 meters

in pseudorange error

1.3.6 Cyber Attacks

Unlike other forms of attacks, this attack is related to manipulation of the software layer indevices to change the position information There is evidence that the attack is used in themaritime segment with Automatic Identification System (AIS) data manipulation

1.4 GNSS Receiver Architecture

1.4.1 Signal Conditioning and Sampling

The architecture of the signal conditioning and sampling is illustrated as in Figure 1.3

In this stage, the received signal is conditioned to meet the requirement of the samplingprocess For simplicity, consider the GPS L1 signal from a satellite:

�(�) = √2�� �(� − ��)�(� − ��)cos(2��� � + ��)

(1.7)

where �� is the received power of the GPS L1 signal �(�) and �(�) denotes the codeand

data of the consdired satellite

After the mixer, the received signal is separated into I and Q component Without loss ofgenerality, from now on, we will use the complex signal to represent the signal on I and Qchannel The signal after mixer is:

�(�) = √�̂� �(� − ��)�(� − ��)��� (�(2���� � + �̂))

+ √�̂� �(� − ��)�(� − ��)��� (�(2�(2��1 + ��� )� + �̂))

(1.8)

Figure 1.3: Signal conditioning and sampling stage

1.4.2 Acquisition

The acquisition stage is aimed to roughly estimate the code phase and Doppler shift ofvisible GNSS satellites In fact, the stage performs correlation with every Dopplerfrequency and code phase bin in the search space (Figure 1.4) A satellite is considered asvisible if there is the value of a cell in the search space higher than a specified threshold.The code and frequency corresponding to the cell is the output of the acquisition Theselected threshold must be considered carefully because it is related to the number ofsatellite in use that is

proportional to the accuracy of the solution

FFT Code NCO

FFT-based Acquisition

Non- coh erent Integration

Figure 1.4: Acquisition Architecture

1.4.3 Tracking and Data Demodulation

After the acquisition, the receiver has roughly code phase and Doppler frequency of everysatellite in view However, those parameters are changing over time due to the change ofthe relative position between the satellite and receiver The tracking stage is aimed to keeptrack the replica local code and carrier and the received signal with the Delay Lock Loop(DLL) and Phase Lock Loop (PLL)

Figure 1.5: Tracking Architecture

Similar to acquisition stage it performs mixing the received signal with the replica code andcarrier The PLL wipes off the carrier [31] and the DLL align the local and incoming PRNcodes The signal after the direct digital frequency synthesizer (DDFS) is down-converted

to baseband and is ideally contained in only the in-phase (I) channel The DLL tracks thetime delay of the incoming PRN The baseband signal is correlated with 3 local replicacode- taps: Early (E), Prompt (P), and Late (L), through multiplication and integration,usually over an integer PRN code period (T0) Discriminator feedbacks adjust the CodeNCO, which fluctuates the local replica code rate to synchronize with the incoming code[34]

1.4.4 Positioning Computation

Positioning computation is performed with the assumption that the received signal isacquired and tracked successfully from a minimum of four satellites in view Afternavigation message demodulation, the receiver can determine the received time and theposition of all satellites in view To apply (1.1), the receiver needs to measure the distancefrom the receiver to all satellites In GNSS receivers, the quantity cannot be directlycalculated but it is derived through the transmission time It is worthy to note that theconvergence solution of (1.6) will not change if a constant value is added to allpseudoranges Therefore, the receiver will calculate the difference between transmissiontime instead of the absolute value The differences are computed by counting the number ofsample intervals since the receiver started to the preamble bits in the same subframe for allsatellites (Figure

1.6)

Figure 1.6: Transmission time estimation in GNSS receivers

1.5 Countermeasures to GNSS Threats

This section presents the state of the art of antenna array processing techniques, frontend and digital signal conditioning-based techniques, and correlator/tracking and PVT based techniques (see Figure 1.7) The implementation of antenna array and snapshot positioning

are more emphasized because they are main focuses of the dissertation

Figure 1.7: Interference mitigation techniques in GNSS receivers

1.5.1 Antenna array processing techniques

With the spatial diversity setting by multiple elements, antenna array processing techniquesare considered as a powerful tool for interference mitigation in GNSS applications [35][36] [37] [38] From an application point of view, the antenna array processing techniquescan be used to either suppress interference effect or localize the interference source

Regarding interference mitigation, although the specific implementation varies betweentechniques, the existing methods in this group can be classified based on the optimizationcriteria for calculating optimal weights

Minimum Mean Square Error Criterion: The technique was first proposed by [39] and aims

to minimize the mean square error between the output of the array �(�) and the interestedsignal �(�)

Problem min �{[�(�) − �� �(�)]}

(1.9)

�

In the implementation the referent signal is actually the local code and the navigation bits

in the tracking stage [30] However, the navigation bits are not available under stronginterference Hence, this technique is suitable for weak interference environment

Signal to Interference plus Noise Ratio Criterion:

Power Inversion Criterion:

With the assumption that the received signal is weaker than the interference, this technique

is proposed to null the stronger signal [40]

Problem min �{[�� �(�)]} subject to �� �= 1

Beam Steering Criterion:

This technique merely maximizes the array gain following the direction of the interestedsignals

Null Steering Criterion:

Similarly, the null steering will minimize the gain in the direction of interference In [41],this technique can be used to suppress GNSS interference effectively The optimal criterionand weight vector is given as follows:

In principle, the implementation of those frontends relies on the traditional architecture fordigital antenna array shown in Figure 1.8.

Figure 1.8: The traditional low-cost architecture of antenna array for GNSS applications

In this implementation, raw samples are interleaved into a packet and transfer to signalprocessing chains Clearly, the raw samples from elements are synchronized and they justneed a little effort in calibration to make the frontend work properly However, due to thelimitation of the interface bandwidth, both the number of elements and quantization bits arelimited Take [43] as an example, a packet sent to the signal processing chains is formed asshown in the right plot of Figure 1.8 and the sampling frequency is set to 16.368MSps andusing USB 2.0 with 60 MB/s of bandwidth As a result, the frontend will be limited tomaximum 15 elements In addition, the implementation requires a powerful PC forgrabbing raw samples from the frontend Therefore, the solution is not very appropriate formobile receivers

Another approach is to utilize the separated frontends with a common oscillator In thisapproach, the synchronization process is moved to the signal processing chains Besides,the solution leverages the power of the distributed data processing In other words, thesolution relaxes the dependence of the element properties (i.e., sampling frequency,quantization bits) on the interface Consequently, it enables expanding the number ofelements to infinite number theoretically However, the greatest challenge in implementingthis solution is how to effectively synchronize elements In telecommunication, there aresome efforts to address the issues with the correlation technique [44] [45] The correlation

in time domain is used

for delay analysis The function plots the similarity between signals for all possible lags