Multi-Receiver GPS-Based Direct Time Estimation
While phasor measurement units depend on GPS for precise time and synchronization, GPS L1 C/A signals are vulnerable to external timing attacks because of their low power and unencrypted signal structure. Here the authors propose a novel multi-receiver direct time estimation algorithm using the measurements from multiple receivers triggered by a common clock. Through outdoor field experiments, they validate the algorithm’s increased resilience against malicious timing attacks that include jamming and meaconing.
Incorporation of real-time synchronized phasor measurements in the control of power grids can play an important role in maintaining the overall closed-loop stability of the power system. In the past, instability in the power grid caused disturbances ranging from small local perturbations to severe large scale blackouts as can be seen from Figure 1. Currently, the synchronization achieved in measurements collected using devices known as supervisory control and data acquisition (SCADA) is not robust enough for efficient monitoring the power grid.
Modern power systems can benefit from deploying phasor measurement units (PMUs) as they provide synchronized measurements of up to 60 observations per second in regard to the current state of the system. The operation of PMUs greatly relies on precise time-keeping sources, such as GPS signals, to obtain absolute time for synchronization.
However, traditional GPS signals are of low power and unencrypted thereby making them susceptible to external timing attacks. In this article, we propose a novel multi-receiver direct time estimation (MRDTE) algorithm which utilizes the concept of maximum likelihood estimation.
This current setup is an extension of our earlier work focusing on single receiver direct time estimation (DTE), described in the paper by Y. Ng and G. X. Gao (2016) listed in Additional Resources near the end of this article. This prior article illustrated and verified the ability of DTE to detect meaconing attacks at an early stage and tolerate high noise levels. This multi-receiver architecture uses the information from spatially dispersed receiver locations to improve noise resilience and reduce the influence of external timing attacks.
Multi-Receiver Direct Time Estimation
In our setup, there are L different receivers that receive GPS signals from N visible satellites at any time instant t. All the receivers are triggered by the same common external clock. Different cable lengths introduce a bias across the receivers that can be pre-accounted for. Thereby, the clock states are considered to be the same across the receivers, as indicated in equation (1).
Xt,k : 3D Position and velocity of the kth receiver at tth time instant = [xk, yk, zk, ẋk, ẏk, żk]t
The higher level architecture of the MRDTE described in Figure 2 consists of two major steps. The first step involves applying a novel signal processing technique known as DTE.
In the second step, known as MRDTE filter, the DTE outputs obtained from the receivers are collectively processed through an overall kalman filter. The corrected overall clock vector Tt,overall at any time instant t obtained as the output from MRDTE, is given as input to the PMUs. This strategy is adopted to reduce the search space from 8L (Xt,k, Tt,k) to 2 (Tt,overall), thereby increasing the robustness and decreasing the computational complexity.
Direct Time Estimation
The corresponding satellite channel delay residual is directly proportional to the clock bias residual, and the channel doppler residual is proportional to the clock drift residual. Given this, the channel delay and carrier doppler estimation are split into two parallel threads and independently estimated. (See Figure 3.)
Correlations are performed on a per satellite channel basis to obtain the correlation amplitude with respect to the code residual in Figure 4a while fourier transforms are carried out in parallel to obtain the spectrum magnitude with respect to the carrier doppler residual as shown in Figure 4b.
Non-coherent summation of the correlation amplitudes and spectrum magnitudes is computed respectively across the N visible satellites. These obtained summation of correlation values are allocated as weights that represent the likelihood of a particular gj in the 2D-search space.
MRDTE Filter. After obtaining, the measurement error vectors ek for each of the individual receivers, an individual receiver level measurement update Tt,k is done using a kalman filter. The next stage involves incorporating the individual receiver corrected clock parameters Tt,kk into an overall kalman filter to obtain the final corrected clock state Tt,overall corresponding to the common shared clock.
The overall measurement update at any instant t is:
The prediction of the overall and individual receiver states for the next time instant t+1 is achieved by linearly propagating the clock parameters based on the first order state transition matrix.
Initialization of MRDTE. The initialization T0,k for each receiver can be done using any commercial techniques like scalar tracking etc. or by considering an optimum initial search space. Given that power grid is a static system, the receiver locations can be accurately pre-determined using the already available off-the-shelf techniques and averaged over time to get the best 3D position and velocity estimate.
Hardware setup. We validated the robustness of the proposed multi-receiver DTE using four GNSS antennas mounted onto the roof of Talbot Laboratory, University of Illinois at Urbana-Champaign, as shown in Figure 5.
The antennas are connected to a common chip scale atomic clock (CSAC), chosen for its low drift rate, to form a receiver network, and the raw voltage data are logged using respective universal software radio peripherals (USRPs) each equipped with a daughterboard as in Figure 6.
Software Setup. GNUradio, a free opensource software development toolkit that provides signal processing blocks to implement software radios, was used for collecting the raw GPS L1 signal samples from USRP at a sampling rate of two megahertz. We chose to implement this technique in the python software-defined radio developed in our lab (pyGNSS), given its flexible and object-oriented framework. In our case, the 3D position and velocity of the receivers are calculated using multi-receiver vector tracking as described in the article by Y. Ng and G. X. Gao (2015) listed in Additional Resources. For the vector correlation, we opted for a coherent integration time of ΔT = 20ms. The measurement noise covariance matrix is evaluated using the covariance of the last 20 individual measurement residuals.
Results and Analysis
Figure 7 is indicative of the robustness of the MRDTE algorithm. In the presence of 12 decibels added noise, the scalar tracking loses track. However, the MRDTE still successfully tracks the signal accurately.
In Figure 8, the clock bias and clock drift residuals are compared for added noise with respect to the signal noise floor. In the presence of 5 decibels of added noise, the clock bias is estimated with an error of within 10 nanoseconds and, in the case of 12 decibels of added noise, within an error of 100 nanoseconds. Thus, a more robust clock state is estimated by implementing MRDTE algorithm.
Meaconing. In this case, a replay signal with similar GPS signal structure and signal power two decibels more than that of the authentic signal is added onto the incoming GPS signal. The first 36 seconds correspond to that of scalar tracking and after which the spurious signal is introduced represented by the thick black dotted line. At this point we turn on the MRDTE algorithm and compare its performance to that of scalar tracking for the next 30 secs.
When meaconing starts, the scalar tracking locks onto the counterfeit signal as shown in Figure 9 whereas the MRDTE still consistently tracks the authentic signal thereby mitigating the effect of meaconing attack.
Reference herein to any specific commercial product, process, or service by trade name, trademark, manufacturer, or otherwise does not necessarily constitute or imply its endorsement, recommendation, or favoring by the United States Government or any agency thereof. The views and opinions of authors expressed herein do not necessarily state or reflect those of the United States Government or any agency thereof.
ManufacturersThe antennas used in the test equipment configuration were 3GNSSA4-XT-1 antennas from AntCom Corporation, Torrance, California USA. The CSAC used in this research was the Quantum SA.45s Chip Scale Atomic Clock from Microsemi Corporation, Aliso Viejo, California USA. The USRP was the DBSRX2 USRP Daughterboard from Ettus Research (a National Instruments company), Santa Clara, California USA.
Author ProfilesSriramya Bhamidipati, Yuting Ng, and Grace Xingxin Gao
University of Illinois at Urbana-Champaign
Copyright © 2017 Gibbons Media & Research LLC, all rights reserved.