In-Car GNSS Jammer Localization Using Vehicular Ad-Hoc Networks

FIGURE 1: ISTA (left) and GATE (right) measuring vans at the parking place at the GATE site in Berchtesgaden

Working Papers explore the technical and scientific themes that underpin GNSS programs and applications. This regular column is coordinated by Prof. Dr.-Ing. Günter Hein, head of Europe’s Galileo Operations and Evolution.

For the complete story, including figures, graphs, and images, please download the PDF of the article, above.

GNSS technology constitutes a fundamental element for new intelligent transport systems (ITSs) and their applications, such as advanced driver assistance, dangerous goods tracking, and distance- based toll systems. Due to the weak strength of navigation signals from distant satellites, however, these applications are threatened by malicious as well as unintentional interference.

In particular, so-called in-car jammers — also known as “personal privacy devices” — represent a serious threat for GNSS-based systems and applications.

These jammers are cheap devices able to obscure, partially or totally, the navigation signals received not only by the operator’s vehicle but also by other receivers in the vicinity.

The EC Standardization Mandate M/453 for cooperative ITSs provides a means to counter the interference threat. The introduction of standards for vehicular ad-hoc networks (VANETs) enables the exchange of data regarding detected interference events. This data exchange can be used to enhance the awareness of interference sources, allowing their localization and mitigation, thus increasing the reliability of future ITSs.

GNSS Interference Detection and Localization
Interest in developing GNSS interference detection and localization capabilities has increased steadily in the last few years. The first efforts in this direction have come for military applications, like the jammer detection and location (JLOC) system described in the news report, “Jammer Location Gets NGA Attention,” listed in the Additional Resources section near the end of this article). This system provides situational awareness on GPS interference events to U.S. military personnel and predicts effects worldwide to enhance battlefield situational awareness and mission planning.

In the case of identified GPS threats, the system disseminates alerts and reports to subscribed JLOC users through the SIPRNet (Secure Internet Protocol Router Network), a system of interconnected computer networks used by the U.S. departments of defense and state to transmit classified information. The core element is the JLOC master station, operated by the U.S. National Geospatial-Intelligence Agency (NGA), which collects information on interference events through dedicated sensors incorporating GPS receivers. These sensors generate reports when they detect signal degradation as measured by carrier- to-noise ratio (C/N₀) readings.

For the actual localization of the interference source, angle-of-arrival (AOA) information is collected from receivers capable of digital beam-forming, while time-difference-of-arrival (TDOA) measurements are computed with snapshots of data from multiple locations (further details in the article by A. Brown et alia in Additional Resources).

Further studies have been done to integrate mobile devices, such as cell phones, into the network of sensors. Also airborne sensors that can be carried on small unmanned aerial vehicles (UAVs) are envisaged for possible use in future jammer location systems.

Interference monitoring and localization systems have been developed to protect safety critical aviation services as required by the International Civil Aviation Organization (ICAO) for GPS-based approach procedures.

In this application, location of interference sources is commonly based on direction-finding sensors. For example, in the United States the localization of interference is performed by the combined use of airborne (AIMDS), transportable (TIMDS), portable (PIMDS), handheld (HIMDS), and fixed (FIMDS) interference monitoring and detection systems. In Europe, similar systems are operated, such as the so-called GIMOS (GNSS Interference Monitoring System) in Germany.

The problem that can be caused for aviation by GPS jammers became very visible in November 2009 at the Newark Liberty International Airport (New York City). Without an appropriate interference localization system in place, it took more than three months to find the reason for periodic outages of the airport’s ground-based augmentation system (GBAS) reference stations: a GPS jammer transmitting from a vehicle passing near the airport. The airport eventually tackled the problem by making infrastructural changes, such as relocating the GBAS reference antennas over a wider area and enhancing interference detection and localization capabilities.

Based on recent flight inspection reports, civil aviation organizations need to move beyond current direction-finding systems to high-resolution localization systems. The Additional Resources section lists articles about GIMOS and the November 2009 situation at Newark Liberty.

For maritime applications, the threat represented by jammers became evident in 2008, when the General Lighthouse Authorities of the United Kingdom and Ireland (GLA) conducted a series of sea-trials with the aim of characterizing the full effects of GPS jamming on safe navigation at sea (see the article by A. Grant et alia). The test unveiled serious effects on GLA differential GPS (DGPS) reference stations and GPS receivers on ships, as well as radar systems using GPS as their time reference.

These results gave rise to the GAARDIAN/SENTINEL projects. The GAARDIAN project developed and deployed probe sensors at various locations around the United Kingdom and Ireland to continuously report on the integrity, continuity, accuracy, and reliability of GPS signals. The monitoring network was then further expanded by including the Ordnance Survey’s OS Net, consisting of more than 100 continuously operating GNSS receivers. This system bases detection of anomalies on a mask for C/N₀ measurements.

The SENTINEL project later added interference localization capability to this network through the use of handheld GPS interference detection devices. AOA, TDOA, and differential-received-signal-strength (DRSS)–based geolocation are currently under investigation.

Protecting all GNSS users, including the road transportation sector as well as users of portable navigation devices (PNDs), requires a much more comprehensive interference detection and localization system. Therefore, the U.S. Department of Homeland Security (DHS) is looking into deployment of a civil interference localization system, similar to the military JLOC system. The U.S. Interference Detection and Mitigation Plan (IDM), so-called “Patriot Watch”, is currently under development as a national sensor capability (see the article by J. Merrill in Additional Resources).

The Patriot Watch architecture follows a system-of-systems approach with an open architecture where detected interference events shall be reported over a standardized interface. DHS has developed a central data repository for storage of all domestic GPS interference events. Initially, the plan links together existing government equipment including Federal Communications Commission (FCC) and Federal Aviation Administration (FAA) receiver sensors and UNITRAC.

UNITRAC is an information technology system that enables U.S. agencies to manage and monitor the location of GPS tracking terminals of designated resources. The U.S. IDM initiative envisions the integration of additional receiver networks such as the Continuously Operating Reference Stations (CORS) network of more than 1,800 GNSS stations operated by the U.S. National Geodetic Survey (NGS).

In the frame of the presented InCarITS project, an interference detection and localization network based on GNSS receivers as part of a Cooperative Intelligent Transport System (C-ITS) infrastructure is proposed (see articles by R. Bauernfeind et alia). C-ITS applies information and communication technology to improve transportation efficiency, sustainability, and safety.

Primary technologies enabling C-ITS are:

GNSS, by providing location information of vehicles
vehicular ad-hoc networks (VANETs), which have been introduced in order to enable real-time communication of vehicle position and state
floating car data (FCD), which enables the system to collect data on the vehicle environment with vehicle sensors
local dynamic map (LDM), a geographical database managing the information.

Given the safety relevance of the interference threat to future C-ITS, detection and reporting of interference events should be included in the safety-related vehicular communication protocol and standardized accordingly.

Vehicular Communication Standardization
In October 2009 the European Commission issued a mandate (M/453) inviting the European Standardization Organizations to prepare a coherent set of standards, specifications, and guidelines to support wide implementation and deployment of C-ITS within the European community. These focus on what are known as ITS stations (ITS-S), multi-technology packages that may be installed on vehicles or in roadside infrastructure.

Up to now, most of the standardization activities on ITS communication systems in Europe have been performed by the European Telecommunications Standards Institute (ETSI) Technical Committee on Intelligent Transport Systems in cooperation with the European Committee for Standardization (CEN). Harmonization between CEN and International Organization for Standardization (ISO) working groups on cooperative Systems (CEN/TC278/ WG16 and ISO/TC204/WG18) is also strongly supported.

The communication between nodes in a VANET face many unique challenges: factors such as high vehicle speeds, low signal latencies, varying topology, and scalability induce challenges that make conventional wireless technologies and protocols unsuitable for VANETs. The C-ITS communication link is based on the IEEE 802.11p standard with signals transmitted at 5.9 GHz (see Additional Resources).

The IEEE 802.11p standard describes the physical (PHY) layer and parts of the media access control (MAC) layer that will be adopted by ETSI within European Standard (EN) 202 663. In the ETSI context, this radio technology is called ITS-G5. Also ISO used IEEE 802.11p as possible access technology for its CALM standards. There the technology is called CALM-M5.

The ITS station positioning system is hosted at the application support facility layer. It permanently processes information received from the GNSS receiver and other vehicle sensors and combines them to obtain the ITS-S position information. The standardization of ITS-S position and time (ETSI/TC ITS/WG1) is a current work item (WI 0010013) and will be published within ETSI TS 102890-3.

The technical specification will provide information on position and time information used in messages and the data quality based on application requirements. Examples of safety applications under standardization are the Road Hazard Signaling (TS 101 539 – 1), the Intersection Collision Risk Warning (TS 101 539 – 2), and the Longitudinal Collision Risk Warning (TS 101 539 – 3). Currently defined position related parameters in the ITS cooperative awareness messages are: elevation, heading, latitude, longitude, horizontal position confidence as ellipse, and 95 % confidence level for longitude and latitude (see ETSI in Additional Resources).

ITS standardization intends to allow flexible implementation of positioning technologies, but a common position and time accuracy estimation method will be required.

The ongoing standardization process and the strong interest shown from the automotive industry in ITS applications suggest that this technology will be available in the near future. Because future C-ITS applications rely on the GNSS position, the system would definitely benefit from an interference detection and localization capability to protect the applications relying on it. Based on the communication architecture and the traffic management centers linked to local police forces, the ITS infrastructure could provide significant support for law enforcement with the capability to accurately locate the sources of interference.

Jammer Localization: Theoretical Analysis
In this section we provide a mathematical description of the jammer localization problem. Vehicles surrounding a jamming device constitute an ad-hoc wireless sensor network (WSN) whose elements have an estimated knowledge of their own positions, provided by GNSS, possibly integrated with an inertial navigation system (INS) and map matching. In the following discussion the vehicles are referred to as sensors, elements, or nodes of the network.

Measurements Model. The localization system considered here includes elements with known coordinates and one element, the jamming source, which must be localized. Each sensor is identified by its own position vector known a priori …

. . .

In order to retrieve the path-loss information, one possibility is to use predicted or measured spatial digital maps; another option is to jointly estimate α as a nuisance parameter in the localization algorithm. The latter approach is expected to improve the estimation accuracy at the expense of requiring more measurements in order to estimate the jammer position. The problem of the path-loss exponent is further discussed with an experiment described later in this article.

Maximum Likelihood Estimation. Two classes of methods can solve the localization problem in a WSN: centralized methods, which collect measurements at a central unit prior to calculation, and distributed methods, which require sensors to share information only with their neighbors in an iterative fashion.

Considering the WSN jamming localization problem, VANETs are characterized by a highly dynamic scenario: the fast appearance and disappearance of nodes in the vicinity of an interference source makes the distributed localization quite difficult. For this reason it seems that the centralized approach is the most suitable one. Information related to the interference event can be transmitted by each node to the back-end office in charge of computing the jammer position as explained in the article by R. Bauernfeind et alia in Additional Resources.

In this study a centralized method based on maximum likelihood estimation (MLE) was adopted. The MLE is the optimal estimator criterion, as its accuracy asymptotically approaches the Cramér-Rao Lower Bound (CRLB) for increasing signal-to-noise ratio.

. . .

In general no closed-form solution to the optimization problem in (5) exists, and a numerical search method is needed.

This approach presents two main difficulties. First, the convergence of the algorithm is strongly influenced by initializing values: if they are not close to the correct solution, the optimization search could well converge to a local maximum. Besides, when measurements deviate from the assumed model, the results are no longer guaranteed to be optimal.

Lee and Buehrer propose and analyze a different estimation criterion based on the least-square (LS) solution. The two aforementioned issues however are always present for nonlinear optimization problems.

Lower Bound. The CRLB is a lower bound on the covariance of any unbiased estimator. Such a lower bound provides a useful tool for researchers and system designers — not only for testing localization algorithms but also for obtaining some understanding of the positioning performance with respect to the design parameters.

Here we present the expression of the CRLB on the position accuracy obtained with DRSS measurements. For more details on the mathematical derivation see the articles by N. Patwari et alia and R. J. R. Thompson et alia in Additional Resources.

. . .

Jammer Localization: Open Field Measurements
Open field measurements in Germany’s Galileo test area GATE (Galileo Test – und Entwicklungsumgebung) were performed in order to make a first assessment on the feasibility of jammer localization through VANETs. GATE Berchtesgaden is one of the five German outdoor test and development environments for Galileo and GPS satellite navigation. It consists of eight virtual Galileo satellites (ground transmitters) located on top of several mountains around the test area. The GATE site is characterized by a well-suited topology in order to support different testing scenarios and conditions.

For this measurement campaign two measuring vans were used, one belonging to the University FAF Munich’s Institute of Space Technology and Space Applications (ISTA) and one provided by the GATE operators. The two vehicles are shown in Figure 1 (see inset photo, above right).

Both vans where equipped with the following devices (see Manufacturers section at the end of this article):

a PC running the ISTA PC-based Experimental Software Receiver (ipexSR), a real-time multi-frequency GNSS receiver realized completely in software (Visual C++/ assembler), capable of recording a GNSS raw intermediate frequency (IF) signal stream for post-processing.
a front-end designed for receiving L1 GNSS signals connected via USB cable to the PC. The gain of the frontend is set to be constant for all measurements.
an An antenna mounted on the roof of the vehicle.

. . .

Scenario A. The first goal was to study the interference range of each jammer under analysis. Depending on the jammer power level measured by the GNSS receiver, three different regions can be identified: the first one is in the proximity of the interference source, where the interference power is so strong that the receiver front-end saturates (near region); the second region is an intermediate distance at which the received power level is proportional to the distance from the interference source according to a certain path-loss propagation law (intermediate region); the third region is where the jamming signal is too weak to be measured (far region).

In order for the localization algorithm to work, the sensors or vehicles need to be in the intermediate region. The identification of these three regions is thus essential in order to set up a proper scenario for the experiments.

The area surrounding the interference source can be further divided into an area where the GNSS receiver tolerates the interference level and still provides position information (GNSS area), and an area where the jamming power is too strong for the receiver to work properly (non-GNSS area). The point at which the receiver passes from GNSS area to non-GNSS area is expected to be somewhere in the intermediate region. In conditions of strong interference, an INS device embedded in the vehicle plays a fundamental role for a reliable estimation of the vehicles’ positions.

. . .

Scenario B. A different scenario was chosen for collecting the measurements to use in estimating the jammer location. In particular, a big crossroad seemed to be the best test environment for ensuring a small uncertainty region.

As for the previous experiment, measurements were taken making use of two GNSS receivers mounted on two different vehicles, a moving and reference van. The reference receiver was located at a distance to the jammer where the front-end quantization of the received signal was optimal (no saturation). The moving receiver was placed at different sites during the recordings in order to simulate the presence of several vehicles (VANET).

. . .

Simulation Results
Starting from the IF sample streams recorded during the experiments, we computed DRSS measurements in post-processing for each of the measurement points.

. . .

Conclusion
In this article we have extensively discussed the potential for using VANETs to locate in-car jammers. Both from a theoretical and an experimental point of view, the results show that such a jammer- localization application based on VANETs is possible. As achieved in the CRLB estimation results, an error below 40 meters would probably be enough for public authorities to find the origin of an interference source.

Indeed the study case represents a specific scenario where the vehicles are placed all around the jammer (crossroad). This is in general not the case, especially along highways where the sensors are placed only along one direction. Map matching can be used for a good initialization of the localization algorithm and to set constraints in the estimation.

An additional note: use of two measuring vans recording sequentially from different positions instead of a set of vehicles operating at the same time prevented the possibility of studying the effect of spatial correlation.

In the context of the current InCarITS II project, the localization algorithms are being further developed. The use of C-ITS infrastructure for cooperative interference and multipath mitigation techniques as well as cooperative relative positioning based on GNSS data exchange among vehicles is also being investigated.

For cooperative interference and multipath mitigation purposes, a local dynamic map can be used to develop situation awareness of the GNSS signal environment. As already mentioned, the LDM is a geographical database managing all relevant information related to the C-ITS infrastructure such as interference sources (e.g. DME transmitters).

For cooperative multipath mitigation, the LDM can be used to provide a statistical description of the multipath environment based on the GNSS constellation and the current user-vehicle position. Finally, to enhance the accuracy of relative positioning in VANETs, techniques based on raw data exchange among vehicles can be used to mitigate common error sources and to obtain more accurate position solution.

Acknowledgments
The results presented in this paper were developed during the InCarITS (Analysis, Detection and Mitigation of In-Car GNSS Jammer Interference in Intelligent Transport Systems, Grant No. 50NA1001) and InCarITS II (Interference Localization and Cooperative GNSS Signal Processing Algorithms for Intelligent Transport Systems, Grant No. 50NA1219) projects, funded by the German Federal Ministry of Economics and Technology (BMWi) and administered by the Project Management Agency for Aeronautics Research of the German Space Agency (DLR) in Bonn, Germany.

Additional Resources
[1] Bauernfeind, R., and I. Kramer, H. Beckmann, B. Eissfeller, and V. Vierroth, “In-Car Jammer Interference Detection in Automotive GNSS receivers and localization by means of vehicular communication,” IEEE Forum on Integrated and Sustainable Transportation System (FISTS), 2011, vol., no., pp.376-381, June 29, 2011–July 1, 2011
[2] Bauernfeind, R. and T. Kraus, A. Sicramaz Ayaz, D. Dötterböck and B. Eissfeller, “Analysis, Detection and Mitigation of In-car GNSS jammer Interference in Intelligent Transport Systems,” Deutscher Luft-und Raumfahrtkongress, Berlin, Germany, 2012
[3] Brown, A., and D. Reynolds, and D. Roberts, “Jammer and Interference Location System – Design and Initial Test Results,” ION GNSS 1999, Nashville, Tennessee USA, 1999
[4] Butsch, F., Untersuchungen zur elektromagnetischen Interferenz bei GPS, Stuttgart: Universität Stuttgart, 2001
[5] Butsch, F., O.Weber and W. Dunkel , “GNSS Interference Monitoring System GIMOS,” 12th International Flight Inspection Symposium, Rome, Italy, 2002
[6] CEN, “CWA 16390 – Interface control document for provision of EGNOS CS/EDAS based services for tracking and tracing of the transport of goods,“ 2012.
[7] Dunkel, W. and F. Butsch, “GNSS Monitoring and Information Systems at Frankfurt Airport,” ION GNSS, Salt Lake City, UT, 2000
[8] Directive 2004/52/EC of the European Parliament and Council (on the interoperability of electronic road toll systems in the Community), April 29, 2004
[9] ETSI, TS 102 637-2; Intelligent Transport Systems (ITS); Vehicular Communications; Basic Set of Applications; Part 2: Specification of Cooperative Awareness Basic Service. France, 2010-04
[10] ETSI, TR 102 638; Intelligent Transport Systems (ITS); Vehicular Communications; Basic Set of Applications; Definitions, 2009-06
[11] European Union, “Standardization Mandate M/453 of the European Commission addressed to CEN, CENELEC and ETSI in the field of information and communication technologies to support the interoperability of co-operative systems for intelligent transport in the European Community,” October 2009, (retrieved May 8, 2013)
[12] Evensen, K. and A. Csepinszky, ITS Standardisation Handbook, 2011: iCarSupport
[13] “GPS Jamming — No Jam Tomorrow,” The Economist, March 2011
[14] Grabowski, J., “Personal Privacy Jammers: Locating Jersey PPDs Jamming GBAS Safety-of- Life Signals,” GPS World, April 2012
[15] Grant, A., and P. Williams, N. Ward, and S. Basker, GPS Jamming and the Impact on Maritime Navigation, GLA, 2008
[16] ICAO, DOC 8071 Manual on Testing of Radio Navigation Aids – Vol II Testing of Satellite-based Radio Navigation Systems Ed 5, 2007
[17] IEEE 802.11p-2010: Part 11: Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications: Amendment 6: Wireless Access in Vehicular Environments, DOI: 10.1109/ IEEESTD.2010. 5514475, July 15, 2010
[18] “Jammer Location Gets NGA Attention,” GPS World, pp. 12–14, July 2008
[19] Kraus, T., R. Bauernfeind, and B. Eissfeller, “Survey of In-Car Jammers — Analysis and Modeling of the RF Signals and IF Samples,” Proceedings of ION GNSS 2011, Portland, Oregon USA, September 2011
[20] Lee, J. H. and R. M. Buehrer, “Location Estimation Using Differential RSS with Spatially Correlated Shadowing,” Proceedings IEEE Global Communications Conference (GLOBECOM), 2009
[21] Merrill, J., “PatriotWatch, Vigilance Saveguarding America,” Workshop on Synchronization in Telecommunication Systems, 2012
[22] Patwari, N., and J. N. Ash, S. Kyperountas, A. O. Hero, R. L. Moses, and N. S. Correal, “Locating the Nodes: Cooperative Localization in Wireless Sensor Networks,” Signal Processing Magazine, IEEE, Vol. 22, No. 4, pp. 54–69, July 2005
[23] Proctor, A. G., and C. W. Curry, J. Tong, M. Greaves, and P. Cruddance, “Protecting the UK Infrastructure: A System to Detect GNSS Jamming and Interference,” Inside GNSS, September/October 2011
[24] Pullen, S. and G. Gao, G., “GNSS Jamming in the Name of Privacy,” Inside GNSS, March/April 2012
[25] Pullen, S., and G. Gao, C. Tedeschi, and J. Warburton, “The Impact of Uninformed RF Interference on GBAS and Potential Mitigations,” ION International Technical Meeting 2012, Newport Beach, California USA, 2012
[26] Rocchia, V., “Airborne RFI Detection: Examples of Solved Cases,” 17th International Flight Inspection Symposium, Braunschweig, Germany, 2012
[27] Ströber, C., and M. Anghileri, A. Ayse Sicramaz, D. Dötterböck, I. Kramer, V. Kropp, J.-H. Won, B. Eissfeller, D. S. Güixens, and T. Pany, , “ipexSR: A Real-Time Multi-Frequency Software GNSS Receiver,” ELMAR-2010 Proceedings, September 2010
[28] Thompson, R. J., and A. T. Balaei, and A. G. Dempster, A. G., “Dilution of Precision for GNSS Interference Localization Systems,” Proceedings of ENC-GNSS, 2009

Download this article (PDF)

Related Posts: