Performance Analysis of the Anti-Spoofing Array Antenna with Eigenvector Nulling Algorithm

Abstract

The public open signals from Global Navigation Satellite System (GNSS) including Global positioning system (GPS) are used widely by many peoples in the world except for the public regulated restriction signals which are encrypted. Nowadays there are growing concerns about GNSS signal spoofing which can deceive the GNSS receivers by abusing these open services. To counter these spoofing threats, many researches have been studied including array antenna techniques which can detect the direction of arrival by means of Multiple Signal Classification (MUSIC) algorithm. Originally the array antenna techniques were developed to countermeasure the jamming signal in electronic warfare by using the nulling or beamforming algorithm toward a certain direction. In this paper, we study the anti-spoofing techniques using array antenna to overcome the jamming and spoofing issues simultaneously. First, we will present the theoretical analysis results of spoofing signal response of Minimum Variance Distortionless Response (MVDR) algorithm in array antenna. Then the eigenvector algorithm of covariance matrix is suggested and verified to work with the existing anti-jamming method. The modeling and simulation are used to verify the effectiveness of the anti-spoofing algorithm. Also, the field test results show that the array antenna system with the proposed algorithms can perform the anti-spoofing function. This anti-spoofing method using array antenna is very effective in the view point of solving both the jamming and spoofing problems using the same array antenna hardware.

1. INTRODUCTION

The recent advances in civil autonomous systems and military weapon systems have been achieved based widely on the precise position and timing information provided by Global Navigation Satellite System (GNSS) like global positioning system (GPS) of USA (Spilker, Jr. et al. 1996, Kaplan & Hegarty 2006).

As these sophisticated systems rely heavily on GNSS, the threat to GNSS becomes a growing concern, because GNSS signals are vulnerable due to lower power than the noise floor in general. There are two types of threats to GNSS discussed in this paper:

     A. Jamming: it disturbs reception of signals by just emitting malicious interferences (usually uncorrelated to authentic GNSS signals) with high power;
     B. Spoofing: it also disturbs reception of signals.  But, unlike jamming, it is performed by emitting genuine-like signals so that an anonymous attacker can mislead an innocent user to where he wants it to be.

Spoofing is usually more severe than jamming because not only is it disruptive, but also it forces recipients to act according to the attacker’s intentions (Pullen et al. 2012, Akos 2012, Humphreys et al. 2008, Psiaki & Humphreys 2016, Bhatti & Humphreys 2017).

It is well-known that, when using multiple number of antennas, signals from different directions have distinct signatures in spatial domain. So, by handling spatial signatures properly, it is possible to detect/classify signals and even more to enhance /eliminate them. With the growing importance of PNT information in modern society, this array signal processing has been attracted as the key to develop GNSS receivers robust against threats (Di & Tian 1984, Schmidt 1986, Jafarnia-Jahromi et al. 2012, Appel et al. 2015, Broumandan & Curran 2017, Broumandan & Lachapelle 2018, Seo et al. 2020, Park & Seo 2020, Lee et al. 2021).

Since the jamming signals are easy to detect due to their high power, anti-jamming technique based on array signal processing have been well-studied (Fante & Vaccaro 2000, Moore 2002, Berefelt et al. 2003, Haefner et al. 2003, Monzingo & Miller 2004, De Lorenzo et al. 2005, Vo el al. 2007). It is done by steering null to the estimated direction of jammer while forming a beam to each GNSS satellite. Herein, thanks to the high power of jamming signals, it is possible to estimate the direction to a jammer easily.

But, it is difficult to estimate direction of a spoofed signal because its power is not as high as a jamming signal. Fortunately, due to the complexity of building a spoofing system, it is reasonable to assume that a single spoofer emits multiple number of spoofing signals at the same time. Under the assumption, multiple number of spoofing signals come from the same direction. As a result, the total power of signals from that direction becomes much higher than before, and hence, it is also possible to detect and to eliminate spoofing signals.

In this paper, we study the anti-spoofing techniques using array antenna to overcome the jamming problem and the spoofing issue simultaneously. First, we will present the theoretical analysis results of spoofing signal response of Minimum Variance Distortionless Response (MVDR) algorithm in array antenna. Then the new eigenvector algorithm of covariance matrix is suggested and verified to work with the existing anti-jamming method. The modeling and simulation technique is used to confirm the effectiveness of the combined algorithm. Also, the field test results show that the array antenna system with the proposed algorithms can perform the anti-spoofing function.

2. CONVENTIONAL ANTI-SPOOFING ALGORITHM

The GNSS receiver receives a variety of signals, besides the real satellite signals, and other signals can be considered as interference signals. Natural interference always exists in the electromagnetic environment, but has small effect on the receiver and man-made interference has certain threats to the receiver. In addition, man-made interference can be divided into suppressed interference and spoofing interference. This paper will focus on spoofing interference mainly. Spoofing interference is to induce the receiver to lock the spoofing signal by transmitting the generated false signal or the related real satellite signal to the target device, so that the misleading target obtains the wrong time, position, speed and other information which indicates that the spoofer have achieved the purpose of interfering.

The various anti-spoofing methods have been proposed to alleviate the threats from the malicious spoofing attacks of GNSS (Jafarnia-Jahromi et al. 2012, Konovaltsev et al. 2014, Broumandan et al. 2016, Dempster & Cetin 2016, Konovaltsev et al. 2019, Li et al. 2019). Table 1 shows the comparison of the spoofing detection technologies. Presently, many progresses have been made in the research of anti-spoofing technology, but these methods of anti-spoofing technology for most part usually based on the detection only and the characteristics of signals such as doppler shift, carrier-to-noise ratio (C/N0), signal correlation peak. Many researchers have analyzed GNSS spoofing detection technologies from different perspectives, such as signal power, direction of arrival, delay detection, encryption authentication, and other navigation methods. The anti-spoofing interference detection technology that has been proposed can be summarized into three categories, namely, the spoofing detection technology based on navigation data, the fraud detection technology based on signal feature and the fraud detection technology based on inertial information assistance (Li et al. 2019).

Table 1. Comparison of spoofing detection techniques (Li et al. 2019).

Method	Characteristics	Capabilities required	Implementation difficulty	Effectiveness	Applicability
Signal encryption recognition	Unencrypted signal	Decryption ability	High	High	High
Ephemeris/Almanac check	Discontinuous ephemeris/almanac changes	Store ephemeris and almanac	Low	Medium	High
Satellite clock check	Discontinuous ephemeris/almanac changes	Store clock information	Low	Medium	Medium
C/N0 detection	Higher signal to noise ratio	C/N0 monitoring	Low	Medium	Medium
Absolute power monitoring	Higher amplitude	Standardized absolute power	Low	Medium	High
Direction of arrival detection	Same signal direction	Multiple antennas array	High	High	High
Doppler shift detection	Unchanged Doppler frequency	Known satellite Doppler	Medium	Medium	Medium
Code/carrier consistency detection	Inconsistent code/carrier rates	With Code/carrier Doppler	Low	Low	Low
Dual frequency power comparison	Spoofing single frequency	Dual frequency signals	Medium	Low	Low
AGC detection	Power greater than noise	Calibrated AGC gain	Low	High	Medium
Signal quality monitoring	Signal correlation peak distortion	With multiple correlators	Medium	Medium	Low
Auxiliary information comparison detection (INS, sensors, etc.)	Inconsistent with the measurement results	With related auxiliary equipment	High	High	High
RAIM	Only for the few spoofing signals	Autonomous integrity detection	Medium	Medium	Medium

 

Table 1 shows that some effective anti-spoofing techniques are as the signal encryption recognition, the direction of arrival detection, and the auxiliary information comparison detection (such as inertial navigation, sensors, etc.) The most effective anti-spoofing method is to use the encrypted signal like GPS P(Y) code. But the encrypted signal is under the control of the government who own the navigation satellite system. Therefore, most civilian or some military applications are limited considerably. Another effective method is to detect the direction of arrival of the spoofing signals using the array antenna. This method is difficult to implement because of the multiple antennas, RF channels, and the high speed digital signal processor. But the array antenna technique has been widely used in the field of anti-jamming system. So the use of the array antenna is feasible for the anti-spoofing function addition to the existing anti-jamming system.

The representative spoofing detection algorithm of the direction of arrival is the Multiple Signal Classification (MUSIC) algorithm (Schmidt 1986). The main idea of the MUSIC algorithm is to conduct eigen decomposition for the covariance matrix of the array input data. In this paper, our goal is to research not only the detection but also the elimination for the spoofing signal with the array antenna.

A typical GNSS array antenna schematic for anti-jamming is shown in Fig. 1. GNSS satellite and spoofing signals are collected by antenna element 1 to K, and then converted to low-frequency signals by a RF down-converter. After digital sampling using an analogue-to-digital converter (ADC), the signals are processed using an anti-jamming algorithm, such as a nullifying or beamforming algorithm in a field-programmable gate array (FPGA). The array antenna system generates the final output by multiplying the number of input signals by a weight vector and adding them together. In the next section, we will assume this digital signal processing architecture, and propose the anti-spoofing algorithm which can eliminate the spoofing signal securely.

Fig. 1. Signal processing block diagram of array antenna system.

3. EIGENVECTOR ANTI-SPOOFING ALGORITHM

3.1 Received Signal Model

Before we begin, we fix the following notation for convenience:

     Any symbol expressed in boldface implies a vector or a matrix;
     All the vectors are column vectors;
     The identity matrix of order K is denoted by I_K;
     The Hermitian (or conjugate) transpose of a vector of a matrix is denoted by (⋅)^H.

Let us consider a reception of signals by using an array of K antennas. The received signal vector at the receiver is

\(r(t)=\sum\limits_{i=1}^L s_i (t)a(\boldsymbol{\theta}_i)+\pmb{n}(t)\)                                                                     (1)

where \(s_i (t)\) is the i-th incoming signal, \(a(\boldsymbol{\theta}_i)\) is the steering vector for the direction \(\boldsymbol{\theta}_i\) toward source of the \(i\)-th signal, and \(\pmb{n}(t)\) is the receiver noise vector. For positive integers N,P,M such that \(L=N+P+M\), we assume that, among those \(L\) signals, the first \(N\) signals are interferences, the following \(P\) signals are spoofed, and the rest \(M\) signals are authentic. Then, Eq. (1) can be expressed as

\(\pmb{r}(t)={\sum\limits_{i=1}^N s_i (t) a(\boldsymbol{\theta}_i) \atop interferences}+{\sum\limits_{j=N+1}^{N+P} s_j (t) a(\boldsymbol{\theta}_j) \atop spoofed signals}+{\sum\limits_{k=N+P+1}^L s_k (t) a(\boldsymbol{\theta}_k) \atop authentic signals}+\pmb{n}(t).\)                                   (2)

In the literature of array signal processing with GNSS signals, a general assumption is that each interference has much higher power than that of any authentic one. Furthermore, when spoofed signals considered, one more reasonable assumption is usually considered: All the spoofing signals comes from a single direction. That is, by letting \(\boldsymbol{\phi}\) direction of the spoofer, we have

\(a(\boldsymbol{\theta}_i )=a(\boldsymbol{\theta}_j )=a(\boldsymbol{\phi})\)                                                                          (3)

for any \( N ≤ i < j ≤ N + D \). This is because, to deceive a GNSS receiver, anonymous attacker may use a single spoofer that emits lots of spoofing signals at the same time. As a consequence, the total power of signals comes from a spoofer is also much higher than that of any authentic one. Under these two assumptions, we may approximate the covariance of the received signal vector as

\(\pmb{R}=E\{\pmb{r}(t) \pmb{r}^H (t)\}≈\sum\limits_{i=1}^N \sigma_i^2 a(\boldsymbol{\theta}_i) a^H (\boldsymbol{\theta}_i)+\sigma_p^2 a(\boldsymbol{\phi}) a^H (\boldsymbol{\phi})+\sigma_n^2 \pmb{I}_K,\)                                 (4)

where \(a(\boldsymbol{\phi})\) is the steering vector toward the spoofer. And, \(\sigma_p^2=\sum\limits_{j=N+1}^{N+P} \sigma_j^2\) is the total power of spoofing signals emitted by the spoofer; \( \sigma_i^2 ~~{\rm for}~~ i=1,2,…,N\) is power of the i-th interference signal; \( \sigma_n^2\) is the noise power.

Herein, we would like to note that a covariance matrix is positive semi-definite. That is, any eigenvalue of a covariance matrix is always greater than or equal to zero.

For the sake of simplicity, in the remaining of this paper, we assume that there is only a single spoofer. Note that, when there are more than one spoofer, all the results of this paper can be easily extended in the similar fashion.

3.2 Eigenspace of the Covariance Matrix and Signal Space

To enhance reception of desired GNSS signals, it is usual to eliminated unwanted signals, e.g., interferences and spoofed signals. Such an elimination is performed by forcing spatial response to the space of unwanted signals be zero.

Before we discuss anti-spoofing technique in detail, we would like to discuss the relationship between eigenspace of the covariance matrix \(\pmb{R}\) and signal space of unwanted signals. Let \(v_1,v_2,…,v_K\) be eigenvectors of \(\pmb{R}\) with corresponding eigenvalues \(\lambda_1, \lambda_2, …, \lambda_K\), respectively. Without loss of generality, we may arrange all the eigenvalues in descending order, i.e.,

    \(\lambda_1\geq\lambda_2\geq ⋯ \geq\lambda_K. \)                                                                                     (5)

Denote by

\(\pmb{V}= {\rm span}\{a(\boldsymbol{\theta}_1), a(\boldsymbol{\theta}_2),…,a(\boldsymbol{\theta}_N),a(\boldsymbol{\phi})\}\)

the space of unwanted signals in spatial domain with dimension \(D\) = dim⁡ \(\pmb{V}\). Then, eigenspace of the covariance matrix \(\pmb{R}\) and the signal space \(\pmb{V}\) have the following relationship:

\(\pmb{V}= {\rm span}\{v_1, v_2, …, v_D \}.\)                                                                           (6)

This can be directly come from Eq. (4). Denote by \(\pmb{\bar{R}}\) the sum of the first two terms in RHS of Eq. (4). Then, we have

\(\pmb{R}=\bar{\pmb{R}} + \sigma_n^2 \pmb{I}_K,\)                                                                                           (7)

which yields that \(\pmb{R}\) and \(\pmb{\bar{R}}\) have the same eigenvectors. Here, only \(D\) eigenvectors in the eigenspace of \(\pmb{\bar{R}}\) are corresponding to non-zero eigenvalues. Obviously, those \(D\) eigenvectors will be the same to \(v_1, v_2,…,v_D\) with some proper ordering since \(\pmb{\bar{R}}\) is positive semi-definite.

This leads us to an important aspect: instead using exact steering vectors, it is possible to eliminate unwanted signals by suppressing spatial response to \(v_1,v_2,…,v_D\). This aspect will be used in the next section to eliminate spoofed signals.

3.3 Integrated Anti-spoofing and Anti-jamming Algorithm

The array antenna system generates the final output by multiplying the number of input signals \(\pmb{r}\) by a weight vector \(\pmb{w}\) and adding them together. The input vector signal \(\pmb{r}\) measured at the In-phase and Quadrature-phase channel of an array antenna is defined as a complex number vector. Because the output of the array antenna is \(f(\pmb{w})=\pmb{w}^H \pmb{r}\), the expected value of the output power can be expressed as Eq. (8),

\(Output~Power=E\{ |\pmb{w}^H \pmb{r}|^2 \}=\pmb{w}^H \pmb{Rw}\)                                                           (8)

Using Eq. (8), the constrained optimization problem can be expressed as Eq. (9),

\({\textrm{min} \atop \pmb{w}}\pmb{w}^H \pmb{Rw} ~ subject~ to~ \pmb{C}^H \pmb{w}=\pmb{c}\)                                                                           (9)

where \(\pmb{C}\) represents the constraint matrix, and \(​​\pmb{c}\) represents the constraining column vector. In this expression, it is important that \(\pmb{C}\) and \(​​\pmb{c}\) can have any value and the interference cancellation performance depends on those values. Also to eliminate the spoofing signal it is need to replace the covariance matrix \(\pmb{R}\) as following Eq. (10),

\(\hat{\pmb{R}}=\pmb{R}+ \alpha \cdot \pmb{R}_V\)                                                                                     (10)

where \(\alpha\) represents the constant to adjust the nulling depth, and \(\pmb{R}_V\) represents the covariance matrix of eigenvectors subject to the spoofing signals. If the value α is 0, then the effect is to turn off the anti-spoofing function and is equal to the just anti-jamming algorithm.

The final weight vector solution to the above constrained optimization problem is one of the stationary points of the Lagrangian and can be obtained using a Lagrangian multiplier. Using this, the optimal weight vector \(\pmb{w}_o\) can be calculated as shown in Eq. (11).

\(\pmb{w}_o=\hat{\pmb{R}}^{-1} \pmb{C}(\pmb{C}^H \hat{\pmb{R}}^{-1} \pmb{C})^{-1} \pmb{c}\)                                                                           (11)

As mentioned before, the spoofing and jamming signal cancellation performances depend on the constraint conditions of Eq. (9). One of the constraint conditions is the beamforming which is to maintain the gain of satellite directions and to null the direction of spoofing and jamming signals. The beamforming constraint matrix is that the vector of \(\pmb{C}\) is equal to the steering vector of the satellite direction.

4. SIMULATION

In this section, simulations are performed to verify the anti-spoofing algorithm designed for the GNSS array antenna system as described in the previous section. A very small array antenna with four elements is modelled and the distance between adjacent elements is 3 cm as shown in Fig. 2. The more detailed simulation conditions are summarized in Table 2. One satellite signal is generated as CN₀ 40 dB-Hz power after 1ms integration time. One spoofer generating the spoofing signals which are consisted of 8 faked satellite signals is located in certain directions. The one spoofing signal power is generated as CN₀ 45 dB-Hz which is 5 dB stronger than the authentic satellite signal to pull off surely. All signals are generated in baseband of 0 Hz IF frequency and noises are considered as the normal distribution.

Table 2. Simulation conditions.

Conditions	Description
Satellite signal CN0 Spoofer: CN0 (per 1 satellite) Spoofer: satellite number Antenna element number Array type Array radius IF frequency Sampling frequency	40 dB 45 dB 8 4 Circular 4.24 cm 0 Hz (baseband) 20 MHz

 

Fig. 2. Small circular array antenna diagram.

The basic performance of the array antenna without the anti-spoofing algorithm is equal to Minimum Variance Distortionless Response (MVDR) algorithm. The MVDR algorithm works to minimize the interference power above the thermal noise. Thus, even the spoofing signal can also be suppressed normally by the MVDR algorithm. Fig. 3 shows the effect of the spoofing signal’s self-suppression by the array antenna. Even 0 dB spoofing signal which is equal to the noise power is suppressed by amount of -7 dB. But it is notable that the spoofing signal is increased reversely if the spoofing power is below the -8 dB because the array antenna algorithm cannot detect any meaningful signal power.

Fig. 3. Basic performance of spoofing signal suppression with array antenna.

Another simulation is performed to confirm the benefit of anti-spoofing algorithm. The authentic satellite direction is at the azimuth 270 degree and the elevation 45 degree. The spoofing direction is at the azimuth 90 degree and the elevation 5 degree. Fig. 4 shows the result of conventional MVDR beamforming algorithm. The left of Fig. 4 shows the power spectrum of input and output signals. Very little difference can be seen because the input spoofing signal’s power is almost same to noise power and cannot be detected significantly by the MVDR algorithm. The right of Fig. 4 shows the gain pattern. The nulling depth by the MVDR algorithm is about -7 dB as expected.

Fig. 4. Power spectrum and gain pattern using the general beamforming algorithm.

As contrast, Fig. 5 shows the effect of anti-spoofing algorithm. The left of Fig. 5 is the power spectrum of the input and output signals, which show the significant difference below 1 MHz where the spoofing signal exists. The right of Fig. 5 is the gain pattern which shows the deep nulling in the direction of the spoofing signal about 30 dB. This effect means the possibility of the elimination of the spoofing signal and anti-spoofing performance.

Fig. 5. Power spectrum and gain pattern using the eigenvector beamforming algorithm.

5. EXPERIMENT

5.1 Spoofing System Setup

To test the performance of anti-spoofing algorithm it is needed to setup the spoofing system. Therefore, we have developed the spoofing system based on the Spirent’s Simsafe device. Fig. 6 shows the spoofing system and our implemented 4 elements array antenna system. The spoofing system has the capability of GPS, Galileo, Glonass spoofing with about 50 ns time synchronization accuracy. For the safety, we used the directional antenna and the very weak signal with a few meter distance between the antenna and the array antenna system.

Fig. 6. Experimental environment setup of the anti-spoofing algorithm.

Fig. 7 shows the spoofing test result of Ublox receiver by the spoofing system. The spoofing signal power was J/S 30 dB which S is assumed as the nominal satellite power of -160 dBW. At the spoofing power level, the measured signal power was around 40 dB-Hz. It can be seen that the altitude and horizontal position data were moving even though the receiver was stationary. From this experiment we can confirm the normal operation of the spoofing system.

Fig. 7. The result of Ublox receiver spoofing experiment.

5.2 Anti-spoofing Experiment Results

The anti-spoofing algorithm test was implemented with above spoofing system and 4 elements array antenna system. Fig. 8 shows the captured control and display program of the 4 elements array antenna system without anti-spoofing algorithm. Without the anti-spoofing algorithm, the array antenna system executes the MVDR beamforming algorithm only. When the spoofing signal power was J/S 30 dB, the array antenna system in static position was spoofed, which meant the position and speed data was manipulated by the spoofing system as shown in Fig. 8. At some time, the array antenna’s navigation data shows the spike as the mixed usage of the spoofing and authentic satellite signals.

Fig. 8. Test result of the array antenna with no anti-spoofing algorithm: Spoofed at J/S 30 dB.

On the other hand, the array antenna system with the anti-spoofing algorithm could output the correct position and speed data as shown in Fig. 9. The spoofing signal power has varied from J/S 30 ~ 40 dB. Even under the stronger power, the anti-spoofing algorithm has worked as designed. One satellite of PRN 28 was unhealthy in the satellite navigation data. The others satellites were tracked properly and used in the PVT solution.

vFig. 9. Test result of the array antenna with anti-spoofing algorithm: Not spoofed at J/S 30 ~ 40 dB.

6. CONCULUSION

To counter the spoofing threats, we have researched the anti-spoofing algorithm of the array antenna to overcome the jamming and spoofing issues simultaneously. We presented the theoretical analysis results of the spoofing signal response of MVDR algorithm in array antenna. Then the eigenvector algorithm using the covariance matrix is suggested and verified to work with the modified anti-jamming method. The modeling and simulation are used to confirm the effectiveness of the anti-spoofing algorithm. Also, the field test results show that the array antenna system with the proposed algorithms can perform the anti-spoofing function. Even at the stronger spoofing signal, the anti-spoofing algorithm of the array antenna can output the correct position and speed data. This anti-spoofing method using array antenna is very effective in the point of solving both the jamming and spoofing problems using the same array antenna hardware. To apply this algorithm for the real products, it is needed to make the faster digital signal processor to calculate the complex eigenvector information in the future.

AUTHOR CONTRIBUTIONS

Conceptualization, K. Lee. and M. Song.; methodology, K. Lee, M. Song, and J. Lee.; validation, K. Lee. and M. Song.; writing-original draft preparation, K. Lee.; writing-review and editing, M. Song, and J. Lee.

CONFLICTS OF INTEREST

The authors declare no conflict of interest.