4 ms·
GNSS jamming isn't hard. The frequencies and bands are well known. And the signal is extremely weak, so it's relatively easy to generate your own noise on those
by bradknowles 3y ago
GNSS jamming isn't hard. The frequencies and bands are well known. And the signal is extremely weak, so it's relatively easy to generate your own noise on those frequencies and bands and drown out the legitimate signal. Of course, those jamming transmitters can be easily found with triangulation and eliminated.
Spoofing is harder. Again, the downlink protocol is well known and unencrypted.
But for receivers, it's easy to simply say that you will ignore all transmissions that are too close to the horizon -- say 15 degrees or so. That should eliminate all ground-based spoofing attacks. Antennas that can do this can be bought commercially and are not ITAR restricted, and probably only cost about a thousand dollars or so. Additional capabilities beyond just ignoring signals too close to the horizon gets you into military grade technology, and is likely to be ITAR restricted, and cost tens of thousands of dollars per antenna -- or more.
Tallysman is a well known vendor for GNSS antennas, including some that have the ability to ignore signals too close to the horizon. Check their catalog.
When a GPS receiver gets a lock, it should normally see something like about ten satellites at the same time (if it has a clear view of the skies). You only need four to get a lock on your position, and the others can be used to help narrow down the error in your great circle calculations. If you're a full multi-band GNSS receiver (GPS, Galileo, Glonass, BeiDou, QZSS, IRSS, etc...), you might see dozens of satellites all at once, and be capable of tracking 500 or more simultaneous satellites.
Of course, we're not talking about GNSS position augmentation systems like WAAS, or GNSS RTK systems. That's a different set of methods for detecting errors in the GNSS signals that are sent from the satellites and then transmitting those corrections via another medium or frequency band, so that receivers can get much more accurate position calculations -x to the centimeter or better.
For each satellite you track, you can detect or calculate their azimuth and right ascension, which is their polar coordinates relative to your location.
Each of the satellites is numbered within their own constellation, and the GNSS protocols have each satellite transmitting the almanac information that tells you where all the satellites are (roughly). So, if you see GPS-17 suddenly transmitting from a new location that doesn't match the almanac, you can ignore it.
Likewise, the strength of each signal can be relatively easily calculated, based on location and distance, so even if you see GPS-17 transmitting from roughly the right location but with a much stronger signal, then you can ignore that.
Beyond that, each antenna is an analog device, and therefore has a unique transmission fingerprint. If you see GPS-17 suddenly transmitting from roughly the right location with roughly the right signal strength but the transmission fingerprint has changed, then you can probably safely ignore that. Of course, they do sometimes change out satellites, so a change in transmission fingerprint might be legitimate, but that's a relatively rare occurrence, and they don't change out all the satellites at once.
If you're going to be successful at spoofing, you're going to have to have your transmitters aloft. They're going to have to know the full almanac of the satellites they're spoofing. They're going to have to know the location of the target you want to spoof. They're going to have to calculate what position(s) they need to be in so that their signal comes from roughly the right direction and velocity relative to the target. They're going to need to be able to calculate what signal strength they should be broadcasting with so that they don't seem suddenly much louder or much weaker. And then I have no idea how they would replicate the transmission fingerprint of another antenna, but I guess they have enough time to study the problem and come up with solutions.
So, jamming is relatively easy. But true spoofing all the way down the line, that is pretty tough. I'm sure that at least some nation states can do it, and they're probably using some classified tools that have been developed by some companies, so presumably those companies could also do it.
But it's not easy.
Frankly, I'd be more concerned that someone could breach the uplink control-plane protocol for the satellites and cause them to actually move to other locations or otherwise take over part or all of the constellation and do other things with them.
- bradknowles 3y agoNow, for commercial aircraft, they might not have military grade GPS antenna systems that can detect and avoid the kinds of spoofing we're talking about here. But a lot of that is just in the software. So, if they can get the information they need from the antennas, then they might be able to get their systems upgraded through a simple software update.