In-Car GNSS Jammer Localization Using Vehicular Ad-Hoc Networks
FIGURE 1: ISTA (left) and GATE (right) measuring vans at the parking place at the GATE site in Berchtesgaden (Click image to enlarge.)
This article addresses the exciting notion of using vehicular ad-hoc networks to locate in-car jammers. Theoretical and experimental results confirm that localization based on this approach is indeed possible, with an error below 40 meters providing sufficient accuracy for determining the origin of an interference source. Limitations and future improvements of the test model are presented alongside its current successes.
Working Papers explore the technical and scientific themes that underpin GNSS programs and applications. This regular column is coordinated by Prof. Dr.-Ing. Günter Hein, head of Europe's Galileo Operations and Evolution.
For the complete story, including figures, graphs, and images, please download the PDF of the article, above.
GNSS technology constitutes a fundamental element for new intelligent transport systems (ITSs) and their applications, such as advanced driver assistance, dangerous goods tracking, and distance- based toll systems. Due to the weak strength of navigation signals from distant satellites, however, these applications are threatened by malicious as well as unintentional interference.
In particular, so-called in-car jammers — also known as “personal privacy devices” — represent a serious threat for GNSS-based systems and applications.
These jammers are cheap devices able to obscure, partially or totally, the navigation signals received not only by the operator’s vehicle but also by other receivers in the vicinity.
The EC Standardization Mandate M/453 for cooperative ITSs provides a means to counter the interference threat. The introduction of standards for vehicular ad-hoc networks (VANETs) enables the exchange of data regarding detected interference events. This data exchange can be used to enhance the awareness of interference sources, allowing their localization and mitigation, thus increasing the reliability of future ITSs.
GNSS Interference Detection and Localization
In the case of identified GPS threats, the system disseminates alerts and reports to subscribed JLOC users through the SIPRNet (Secure Internet Protocol Router Network), a system of interconnected computer networks used by the U.S. departments of defense and state to transmit classified information. The core element is the JLOC master station, operated by the U.S. National Geospatial-Intelligence Agency (NGA), which collects information on interference events through dedicated sensors incorporating GPS receivers. These sensors generate reports when they detect signal degradation as measured by carrier- to-noise ratio (C/N0) readings.
For the actual localization of the interference source, angle-of-arrival (AOA) information is collected from receivers capable of digital beam-forming, while time-difference-of-arrival (TDOA) measurements are computed with snapshots of data from multiple locations (further details in the article by A. Brown et alia in Additional Resources).
Further studies have been done to integrate mobile devices, such as cell phones, into the network of sensors. Also airborne sensors that can be carried on small unmanned aerial vehicles (UAVs) are envisaged for possible use in future jammer location systems.
Interference monitoring and localization systems have been developed to protect safety critical aviation services as required by the International Civil Aviation Organization (ICAO) for GPS-based approach procedures.
In this application, location of interference sources is commonly based on direction-finding sensors. For example, in the United States the localization of interference is performed by the combined use of airborne (AIMDS), transportable (TIMDS), portable (PIMDS), handheld (HIMDS), and fixed (FIMDS) interference monitoring and detection systems. In Europe, similar systems are operated, such as the so-called GIMOS (GNSS Interference Monitoring System) in Germany.
The problem that can be caused for aviation by GPS jammers became very visible in November 2009 at the Newark Liberty International Airport (New York City). Without an appropriate interference localization system in place, it took more than three months to find the reason for periodic outages of the airport’s ground-based augmentation system (GBAS) reference stations: a GPS jammer transmitting from a vehicle passing near the airport. The airport eventually tackled the problem by making infrastructural changes, such as relocating the GBAS reference antennas over a wider area and enhancing interference detection and localization capabilities.
Based on recent flight inspection reports, civil aviation organizations need to move beyond current direction-finding systems to high-resolution localization systems. The Additional Resources section lists articles about GIMOS and the November 2009 situation at Newark Liberty.
For maritime applications, the threat represented by jammers became evident in 2008, when the General Lighthouse Authorities of the United Kingdom and Ireland (GLA) conducted a series of sea-trials with the aim of characterizing the full effects of GPS jamming on safe navigation at sea (see the article by A. Grant et alia). The test unveiled serious effects on GLA differential GPS (DGPS) reference stations and GPS receivers on ships, as well as radar systems using GPS as their time reference.
These results gave rise to the GAARDIAN/SENTINEL projects. The GAARDIAN project developed and deployed probe sensors at various locations around the United Kingdom and Ireland to continuously report on the integrity, continuity, accuracy, and reliability of GPS signals. The monitoring network was then further expanded by including the Ordnance Survey’s OS Net, consisting of more than 100 continuously operating GNSS receivers. This system bases detection of anomalies on a mask for C/N0 measurements.
The SENTINEL project later added interference localization capability to this network through the use of handheld GPS interference detection devices. AOA, TDOA, and differential-received-signal-strength (DRSS)–based geolocation are currently under investigation.
Protecting all GNSS users, including the road transportation sector as well as users of portable navigation devices (PNDs), requires a much more comprehensive interference detection and localization system. Therefore, the U.S. Department of Homeland Security (DHS) is looking into deployment of a civil interference localization system, similar to the military JLOC system. The U.S. Interference Detection and Mitigation Plan (IDM), so-called “Patriot Watch”, is currently under development as a national sensor capability (see the article by J. Merrill in Additional Resources).
The Patriot Watch architecture follows a system-of-systems approach with an open architecture where detected interference events shall be reported over a standardized interface. DHS has developed a central data repository for storage of all domestic GPS interference events. Initially, the plan links together existing government equipment including Federal Communications Commission (FCC) and Federal Aviation Administration (FAA) receiver sensors and UNITRAC.
UNITRAC is an information technology system that enables U.S. agencies to manage and monitor the location of GPS tracking terminals of designated resources. The U.S. IDM initiative envisions the integration of additional receiver networks such as the Continuously Operating Reference Stations (CORS) network of more than 1,800 GNSS stations operated by the U.S. National Geodetic Survey (NGS).
In the frame of the presented InCarITS project, an interference detection and localization network based on GNSS receivers as part of a Cooperative Intelligent Transport System (C-ITS) infrastructure is proposed (see articles by R. Bauernfeind et alia). C-ITS applies information and communication technology to improve transportation efficiency, sustainability, and safety.
Primary technologies enabling C-ITS are:
Given the safety relevance of the interference threat to future C-ITS, detection and reporting of interference events should be included in the safety-related vehicular communication protocol and standardized accordingly.
Vehicular Communication Standardization
Up to now, most of the standardization activities on ITS communication systems in Europe have been performed by the European Telecommunications Standards Institute (ETSI) Technical Committee on Intelligent Transport Systems in cooperation with the European Committee for Standardization (CEN). Harmonization between CEN and International Organization for Standardization (ISO) working groups on cooperative Systems (CEN/TC278/ WG16 and ISO/TC204/WG18) is also strongly supported.
The communication between nodes in a VANET face many unique challenges: factors such as high vehicle speeds, low signal latencies, varying topology, and scalability induce challenges that make conventional wireless technologies and protocols unsuitable for VANETs. The C-ITS communication link is based on the IEEE 802.11p standard with signals transmitted at 5.9 GHz (see Additional Resources).
The IEEE 802.11p standard describes the physical (PHY) layer and parts of the media access control (MAC) layer that will be adopted by ETSI within European Standard (EN) 202 663. In the ETSI context, this radio technology is called ITS-G5. Also ISO used IEEE 802.11p as possible access technology for its CALM standards. There the technology is called CALM-M5.
The ITS station positioning system is hosted at the application support facility layer. It permanently processes information received from the GNSS receiver and other vehicle sensors and combines them to obtain the ITS-S position information. The standardization of ITS-S position and time (ETSI/TC ITS/WG1) is a current work item (WI 0010013) and will be published within ETSI TS 102890-3.
The technical specification will provide information on position and time information used in messages and the data quality based on application requirements. Examples of safety applications under standardization are the Road Hazard Signaling (TS 101 539 - 1), the Intersection Collision Risk Warning (TS 101 539 - 2), and the Longitudinal Collision Risk Warning (TS 101 539 - 3). Currently defined position related parameters in the ITS cooperative awareness messages are: elevation, heading, latitude, longitude, horizontal position confidence as ellipse, and 95 % confidence level for longitude and latitude (see ETSI in Additional Resources).
ITS standardization intends to allow flexible implementation of positioning technologies, but a common position and time accuracy estimation method will be required.
The ongoing standardization process and the strong interest shown from the automotive industry in ITS applications suggest that this technology will be available in the near future. Because future C-ITS applications rely on the GNSS position, the system would definitely benefit from an interference detection and localization capability to protect the applications relying on it. Based on the communication architecture and the traffic management centers linked to local police forces, the ITS infrastructure could provide significant support for law enforcement with the capability to accurately locate the sources of interference.
Jammer Localization: Theoretical Analysis
Measurements Model. The localization system considered here includes elements with known coordinates and one element, the jamming source, which must be localized. Each sensor is identified by its own position vector known a priori ...
. . .
In order to retrieve the path-loss information, one possibility is to use predicted or measured spatial digital maps; another option is to jointly estimate α as a nuisance parameter in the localization algorithm. The latter approach is expected to improve the estimation accuracy at the expense of requiring more measurements in order to estimate the jammer position. The problem of the path-loss exponent is further discussed with an experiment described later in this article.
Maximum Likelihood Estimation. Two classes of methods can solve the localization problem in a WSN: centralized methods, which collect measurements at a central unit prior to calculation, and distributed methods, which require sensors to share information only with their neighbors in an iterative fashion.
Considering the WSN jamming localization problem, VANETs are characterized by a highly dynamic scenario: the fast appearance and disappearance of nodes in the vicinity of an interference source makes the distributed localization quite difficult. For this reason it seems that the centralized approach is the most suitable one. Information related to the interference event can be transmitted by each node to the back-end office in charge of computing the jammer position as explained in the article by R. Bauernfeind et alia in Additional Resources.
In this study a centralized method based on maximum likelihood estimation (MLE) was adopted. The MLE is the optimal estimator criterion, as its accuracy asymptotically approaches the Cramér-Rao Lower Bound (CRLB) for increasing signal-to-noise ratio.
. . .
In general no closed-form solution to the optimization problem in (5) exists, and a numerical search method is needed.
This approach presents two main difficulties. First, the convergence of the algorithm is strongly influenced by initializing values: if they are not close to the correct solution, the optimization search could well converge to a local maximum. Besides, when measurements deviate from the assumed model, the results are no longer guaranteed to be optimal.
Lee and Buehrer propose and analyze a different estimation criterion based on the least-square (LS) solution. The two aforementioned issues however are always present for nonlinear optimization problems.
Lower Bound. The CRLB is a lower bound on the covariance of any unbiased estimator. Such a lower bound provides a useful tool for researchers and system designers — not only for testing localization algorithms but also for obtaining some understanding of the positioning performance with respect to the design parameters.
Here we present the expression of the CRLB on the position accuracy obtained with DRSS measurements. For more details on the mathematical derivation see the articles by N. Patwari et alia and R. J. R. Thompson et alia in Additional Resources.
. . .
Jammer Localization: Open Field Measurements
For this measurement campaign two measuring vans were used, one belonging to the University FAF Munich’s Institute of Space Technology and Space Applications (ISTA) and one provided by the GATE operators. The two vehicles are shown in Figure 1 (see inset photo, above right).
Both vans where equipped with the following devices (see Manufacturers section at the end of this article):
. . .
Scenario A. The first goal was to study the interference range of each jammer under analysis. Depending on the jammer power level measured by the GNSS receiver, three different regions can be identified: the first one is in the proximity of the interference source, where the interference power is so strong that the receiver front-end saturates (near region); the second region is an intermediate distance at which the received power level is proportional to the distance from the interference source according to a certain path-loss propagation law (intermediate region); the third region is where the jamming signal is too weak to be measured (far region).
In order for the localization algorithm to work, the sensors or vehicles need to be in the intermediate region. The identification of these three regions is thus essential in order to set up a proper scenario for the experiments.
The area surrounding the interference source can be further divided into an area where the GNSS receiver tolerates the interference level and still provides position information (GNSS area), and an area where the jamming power is too strong for the receiver to work properly (non-GNSS area). The point at which the receiver passes from GNSS area to non-GNSS area is expected to be somewhere in the intermediate region. In conditions of strong interference, an INS device embedded in the vehicle plays a fundamental role for a reliable estimation of the vehicles’ positions.
. . .
Scenario B. A different scenario was chosen for collecting the measurements to use in estimating the jammer location. In particular, a big crossroad seemed to be the best test environment for ensuring a small uncertainty region.
As for the previous experiment, measurements were taken making use of two GNSS receivers mounted on two different vehicles, a moving and reference van. The reference receiver was located at a distance to the jammer where the front-end quantization of the received signal was optimal (no saturation). The moving receiver was placed at different sites during the recordings in order to simulate the presence of several vehicles (VANET).
. . .
. . .
Indeed the study case represents a specific scenario where the vehicles are placed all around the jammer (crossroad). This is in general not the case, especially along highways where the sensors are placed only along one direction. Map matching can be used for a good initialization of the localization algorithm and to set constraints in the estimation.
An additional note: use of two measuring vans recording sequentially from different positions instead of a set of vehicles operating at the same time prevented the possibility of studying the effect of spatial correlation.
In the context of the current InCarITS II project, the localization algorithms are being further developed. The use of C-ITS infrastructure for cooperative interference and multipath mitigation techniques as well as cooperative relative positioning based on GNSS data exchange among vehicles is also being investigated.
For cooperative interference and multipath mitigation purposes, a local dynamic map can be used to develop situation awareness of the GNSS signal environment. As already mentioned, the LDM is a geographical database managing all relevant information related to the C-ITS infrastructure such as interference sources (e.g. DME transmitters).
For cooperative multipath mitigation, the LDM can be used to provide a statistical description of the multipath environment based on the GNSS constellation and the current user-vehicle position. Finally, to enhance the accuracy of relative positioning in VANETs, techniques based on raw data exchange among vehicles can be used to mitigate common error sources and to obtain more accurate position solution.
ManufacturersIfEN GmbH, Poing, Germany, developed and operates the GATE Berchtesgaden facility. The RTK III is a front-end for receiving GNSS signals in the L1 frequency band, specifically developed by the Fraunhofer Institute for the ipexSR. A Model 511 antenna from NovAtel, Inc., Calgary, Alberta, Canada, was mounted on the roof of the vehicle. The GATE position feedback receiver system consists of a NovAtel SPANSE GPS L1/L2 receiver with integrated FSAS-EI-SN inertial measurement unit from iMAR Navigation Solutions, St. Ingbert, Germany. The JLOC system mentioned in the article is the NAVSYS Jammer Detection and Location system from NAVSYS Corporation, Colorado Springs, Colorado USA. NAVSYS also developed the GPS Defender Android Application to demonstrate the integration of cell phones into JLOC.
Copyright © 2017 Gibbons Media & Research LLC, all rights reserved.