GNSS Jammers: how vulnerable are Consumer grade Satellite

European Journal of Navigation14

Heidi Kuusniemi | Esa Airos | Mohammad Zahidul H. Bhuiyan | Tuomo Kröger

GNSS Jammers: how vulnerable are Consumer grade Satellite Navigation Receivers?

1 Introduction

In late 2009, as discussed in e.g. (The Economist, 2011) and (Pullen & Gao, 2012), engineers noticed that satellite-positioning receivers for navigation aiding in airplane landings at Newark airport in US were suf-fering from brief daily breaks. It took two months for investigators from the Federal Aviation Authority to track down the problem: a driver who passed by on the nearby highway each day had a cheap GPS jammer in his truck. The jammer prevented a tracking device in his vehicle from determining and reporting location and speed, but it also disrupted GPS signals for oth-ers nearby. The driver objected his employers tracking his every move and thus perhaps unknowingly ended up causing substantial danger to the whole airport. Recently, (Humphreys, 2012) has brought to attention the topical question about privacy versus GNSS integ-rity.

Satellite based positioning has an essential role in modern society. Reliable navigation functionality is imperative in more and more applications nowadays on land, sea, and air. A major dependency to reli-able localization has been emerging, especially within safety-critical applications. Satellite positioning sig-nals, as well as many other radio frequency signals, are however extremely susceptible to unintentional and intentional, malicious interference. In satellite naviga-tion, in particular, recovery from interference is espe-cially difficult since the signals are exceptionally low in power after travelling the distance of about 20000 km from the satellite to the Earth and thus particularly vulnerable.

Applications using satellite positioning for road tolling, insurance billing, or logistics have increased recently in quantity. Simultaneously, despite being illegal, intentional jamming of the related satellite navigation receivers has become temptingly easy. Affordable jam-mer devices can easily be purchased online or building a jammer according to widely attainable online recipes is a fairly effortless task to a professional. The increase in the amount of satellite navigation jammers is alarm-ing, especially due to the serious damage they may cause. Because satellite positioning is in such a vital role in many applications, jammers may cause great damage if not detected and the effects mitigated. The typical usage environment of jammers is in cars, where they transmit a jamming signal usually on the civil-ian L1/E1-band where the accessible GPS C/A and the upcoming civilian Galileo codes are located. Civilian in-car jammers are a severe threat to the trustworthiness of Global Navigation Satellite System (GNSS) receivers. High-power jammers may not only hinder the usage of GNSS in the vicinity of the jammer but paralyze GNSS usage over a larger coverage area.

The jamming signal may deteriorate the position solu-tion or induce total loss of lock of the satellite signals. Different receivers react differently to jamming - also the effect depends on the properties of the jamming signal. The basic principles of GNSS receivers are however fairly similar, but the internal processes and algorithms vary and certain filtering may mitigate the effect of the jammer on the positioning accuracy and availability. In all receivers, intentional GNSS jamming affects the signal-to-noise-ratio (SNR) of the received signals. The effect can be observed somewhat simi-

ABSTRACT This paper discusses the effects of GNSS jammers that are increasingly sold on mostly online markets despite the fact that it is illegal to use them in many countries across the world. The effects of typical jammers on consumer grade GNSS receivers are presented with particular focus on measurement quality, percentage of signals lost, as well as positioning accuracy and availability. Both a single-frequency and a dual-frequency jam-mer are analyzed and the effects assessed. Jamming detection and mitigation methods for the civilian GNSS receivers are also overviewed and suggestions are made on how to recover from and cope with the presence of jammer signals.

Research I Evaluation I Development

Volume 10 I Number 2 I August 2012 15

2.1. Covert GPS L1 JammerThe first jammer to be assessed is the Covert GPS L1 jammer shown in Figure 1. The output power of the Covert GPS L1 jammer was measured to be +13 dBm. The purchase price of the Covert was below 20 USD. Figures 2 and 3 present the transmitted signal charac-teristics of the Covert GPS L1 jammer in more detail.

From the signal analysis presented in Figures 2 and 3 it can be observed that the Covert GPS L1 jammer trans-mits a chirp signal with multi saw-tooth functions.

larly as the phenomenon perceived in the context of multipath propagation or general signal attenuation due to for example foliage: the SNR decreases and the signals become weaker. When the signal is weak enough, the receiver cannot anymore generate rang-ing measurements and the position solution cannot be computed.

This paper discusses GNSS jammers and their effects on consumer grade receivers. Section II presents the analysis of two jammers, a single-frequency and a dual-frequency jammer. The jammer signals have been vectorized and analysed in more detail to provide an insight into the jammer signal proper-ties. Section III presents the test setup performed for analysing the effects of the jammers on consumer grade receivers. Section IV presents and discusses the results. Particular focus is given on measure-ment quality, percentage of signals lost, as well as positioning accuracy and availability. In section V, jamming detection and mitigation methods for typi-cal civilian GNSS receivers are also overviewed and suggestions are made on how to recover from and cope with jammers. Section VI provides concluding remarks.

2. Jamming

Affordable jammer devices can easily be purchased in various online stores. The increase in the amount of satellite navigation jammers is alarming, especially due to the serious damage they may cause. The typical usage environment of jammers is in cars, where they transmit a jamming signal usually on the civilian L1/E1-band. The accessible GPS C/A and the upcoming civilian Galileo codes are located in the L1/E1 frequency band. Civilian in-car jammers typically transmit chirp signals. A chirp signal (also termed as sweep signal) is a signal in which the frequency increases (‘up-chirp’) or decreases (‘down-chirp’) with time. The output power of online-available jammers varies, but is typically over 10 dBm. High-power jammers may not only hinder the usage of GNSS in the vicinity of the jammer but para-lyze GNSS usage over a large coverage area. Two jam-mers were analyzed and their properties are presented in the following. I/Q samples of the jamming signals were obtained with an Agilent 89600B Vector Signal Analyzer to derive the jammer characteristics from the recorded data. For the two jammers, usage permission within the laboratory of the Finnish Geodetic Institute was obtained from the Finnish Communications Regu-latory Authority.

Figure 1. Covert GPS L1 jammer

Figure 2. Power spectrum of the Covert GPS L1 jammer.


Figure 3. Instantaneous frequency of the Covert GPS L1 jammer.

Figure 4. GPS L2-L5 jammer

Figure 5. Power spectrum of the GPS L2-L5 jammer.

Figure 6. Instantaneous frequency of the GPS L2-L5 jammer.

The centre frequency is approximately at 1.577 GHz with a spectrum bandwidth of about 16.3 MHz. The signal consists of five saw-tooth sweeps each about 9 microseconds long. The pattern of the five sweeps is repeated in every 44.6 microseconds. The results of jammer signal analysis coincides with the findings of (Kraus et al, 2011) and (Mitch et al., 2011).

2.2. GPS L2-L5 JammerThe second jammer to be assessed was the GPS L2-L5 jammer shown in Figure 4. The output power of the GPS L2-L5 jammer was measured to be +33 dBm. The pur-chase price of the GPS L2-L5 was 130 USD. Figures 5 and

6 present the transmitted signal characteristics of the GPS L2-L5 jammer in more detail near the L2 frequency.

From the signal analysis presented in Figures 5 and 6 it can be observed that the GPS L2-L5 jammer transmits

a chirp signal as well, with a rounded saw-tooth func-tion. The centre frequency is at 1.196 GHz with a spec-trum bandwidth of about 201 MHz. The signal sweep time is around 9 microseconds.

3. Test setup for jammer effect analysis

The effects of the jammers on consumer grade GPS receivers were analyzed in a confined navigation labo-ratory at the Finnish Geodetic Institute. Authorization was obtained to use the jammers in the confined space with a maximum output of -30 dBm. Positioning solutions were analyzed with and without the jam-


mers on 24 hours consecutively in the single-frequency case, and in shorter time steps with a dual-frequency receiver.

The jamming-to-signal (J/S) ratio, usually expressed in dB, is the ratio of the power of a jamming signal to that of a desired GNSS signal at a given point such as the antenna of a positioning receiver. The maxi-mum J/S ratios of around 15 and 25 dB were utilized in two test cases in addition to a no jamming test scenario. The maximum J/S was estimated based on the jammer signal transmission power, distance between the jammer antenna and the GNSS antenna (free space loss), and the estimated received GNSS signal power from the repeater. The jammer signals were also constantly monitored with a spectrum analyzer during the testing. The test setup is shown in Figure 7. A more detailed picture of the single-frequency jammer and the GPS antennas is shown in Figure 8. Figure 9 presents the single-frequency and dual-frequency jammers used for the dual-jammer test scenario.

the OEM4 used a high-grade NovAtel GPS-702 antenna.

Dual-frequency: � L1 and L2 jamming effects were analyzed on the

NovAtel OEM4 DL-4plus (code-only processing) receiver with both the GPS L2-L5 and the Covert GPS L1 jammers simultaneously switched on with max J/S ≈ 15 dB and max J/S ≈ 25 dB in 1-hour time-step along with a no jamming test case where both the jammers were switched off for about 1-hour time duration.

Figure 7. Test setup in the navigation laboratory.

Figure 8. Single-frequency jammer, a GPS L1 repeater and the antennas.

Figure 9. Dual-frequency test setup with two jammers and a dual-frequency repeater and GPS antenna.

Single-frequency: � L1 jamming effects were analyzed on 6 receivers

with the Covert GPS L1 jammer:uBlox 5H, uBlox 5T, Fastrax IT500, Fastrax IT600, GPS receiver inside the Nokia N8 smartphone, and the NovAtel OEM4. The datasets were obtained for 24-hour test duration in three different cases: i. with no jamming, ii. with max J/S ≈ 15 dB, and iii. with max J/S ≈ 25 dB. The uBlox and the Fastrax receivers had L1 GPS patch antennas connected to them, the Nokia N8 had a built-in antenna, and


4. Results and discussion

The results of the 24-hour single-jammer and 1-hour dual-jammers tests are shown in the following. All the receivers had decreased performance in the presence of jamming, but the amount varied. Receivers react differently to the presence of jamming signals due to

their internal processes and filtering techniques. All of the tested receivers suffered from degraded perfor-mance when the jamming signals were present

Single-frequency results:Table 1 presents the performance of all the six GPS receivers. The maximum horizontal error

Table 1. Performance results with single-frequency jamming: mean standard deviation and maximum values of horizontal error, and positioning solution availability.

Mean (m) Std (m) Max (m) %

uBlox 5H

no jam 1.0 0.6 3.8 100

max J/S≈15 dB 1.4 0.7 4.6 100

max J/S≈25 dB 9.2 8.7 129.3 16

uBlox 5T

no jam 1.0 0.6 4.0 100

max J/S≈15 dB 1.5 0.8 6.5 100

max J/S≈25 dB 4.2 5.5 94 26

Fastrax IT500

no jam 2.2 1.0 5.3 100

max J/S≈15 dB 2.3 1.0 6.5 100

max J/S≈25 dB 3.7 5.2 85.4 16

Fastrax IT600

no jam 1.3 0.6 3.2 100

max J/S≈15 dB 1.3 0.7 3.2 100

max J/S≈25 dB 5.9 3.6 16.4 100

Nokia N8 GPS

no jam 2.6 2.4 32.4 100

max J/S≈15 dB 3.1 3.8 34.0 100

max J/S≈25 dB 3.9 2.2 22.4 16

NovAtel

no jam 1.0 0.7 4.8 100

max J/S≈15 dB 2.4 3.9 90.5 30

max J/S≈25 dB 5.4 7.3 92.1 8

Figure 9. Positioning result around the true coordinates of the uBlox 5H receiver in the single-frequency jamming test.

Figure 10. Horizontal error of the uBlox 5H receiver in the single-frequency jamming test. (The solution availability when the maximum J/S was around 25 dB was only 16%.)


(2D) was increased and positioning solution avail-ability decreased when the jamming signal power was increased by about 10 dB. As an example, Figures 9 and 10 present in more detail the positioning accuracy of the uBlox 5H receiver in all three test cases. Simi-lar accuracy degradation can be observed for other receivers as well.

The impact of jamming on the receiver can also be seen from the estimated Carrier-to-Noise density ratios (C/N0). Figure 11 illustrates the attenuation in GPS signal power in the receiver antenna of the IT600 GNSS receiver due to the interference from the jam-mer. Similar performances were observed for the other tested receivers.

Figure 11. Cumulative distribution of the C/N0 of the Fas-trax IT600 receiver in the single-frequency jamming test.

Table 2. Performance results with dual-jammers: mean standard deviation and maximum values of horizontal error, and positioning solution availability.

Mean (m) Std (m) Max (m) %

NovAtel

no jam 0.8 0.4 2.8 100

max J/S≈15 dB 3.4 6.0 78.9 100

max J/S≈25 dB 3.5 2.6 26.6 11

Figure 12. Cumulative distribution of the C/N0 of the NovA-tel receiver in the dual-jammer test.

position computation. The maximum horizontal (2D) error was increased and positioning solution avail-ability decreased when the jamming signal power was increased by about 10 dB. Figure 12 shows the degra-dation in the C/N0 of the dual-frequency signals in the dual-jammer test with the NovAtel receiver.

Dual-frequency results:Table 2 presents the performance of the NovAtel OEM4 dual-frequency receiver when both of the jammers were switched on, with a maximum J/S of around 15 dB and 25 dB in two consecutive tests, respectively. The NovAtel position solutions were ana-lyzed. In the dual-jammer test, only 1-hour datasets and code measurements only were, however, used in

5. Potential mitigation approaches

Although mitigation approaches are not the focus of this study, a summary is given below about what types of approaches are typical for jamming resistance improvement.

Typical mitigation approaches for civilian jamming alleviation include both antenna-based solutions and receiver-based solutions. Receiver manufacturers have their own implementations depending on the require-ments of the target applications. According to (Kraus et al., 2011), the following anti-jamming technologies are typical as shown in Table 3:

Table 3. Typical mitigation approaches for jamming.

Antenna Solutions Receiver Solutions

Controlled radiation pat-tern antenna

Adaptive Notch filtering (with respect to time or signal amplitude)

Adaptive beam-forming

Switching frequencies in a multi-GNSS case

Integrating GNSS with INS

Implementing an Interfer-ence Suppression Unit (ISU)


Naturally, however, the higher the power of the jammer signal, the more difficult it is to successfully mitigate its effects. As concluded in (Bauernfeind et al, 2011), the interference range of a jammer is very dependent on the receiver architecture and of course, the surrounding environment. (Jones, 2011) also provides an overview on the protection solutions against GPS jammers.

The future GNSS signal designs (GPS, Galileo, GLO-NASS) are combating against unintentional and inten-tional interference with, for example, longer codes, dataless pilot signals, and higher transmission powers, and overall, it is much more complicated and expen-sive to jam multiple frequencies at the same time.

Systems all over the world have been created to detect jamming/interference. For example, in Britain, the Senti-nel research project used 20 roadside monitors to detect the use of jammer (Vallance, 2012) and the GAARDIAN

project monitors the integrity, reliability, continuity and accuracy of the locally received GPS and eLoran Radio Navigation signals creating an alarm network (GAARD-IAN, 2012). The National Geospatial Intelligence Agency in the US runs the JLOC (GPS Jammer LOCation System). The JLOC system uses various sensors and reporting systems to collect information about GPS jamming and interference (NGIA, 2012). It has also been suggested that legislation is changed so that all smartphones would be required to search for jammers nearby and warn others in the vicinity, e.g. (Scott, 2011). This type of crowd-sourcing for interference detection would be highly effective since the amount of smartphones in use is immense. Also terrestrial beacons, back-ups to GNSS, are gaining importance as a solution to be protected against interference effects.

6. Conclusions

In-car, civilian jammers have a threatening effect on the performance of consumer grade GPS receivers as presented in this paper. All the consumer-grade receiv-ers suffer from performance degradation in the vicinity of a jammer. The higher the jamming power, the more degradation it causes. The tests conducted with two dif-ferent J/S ratios (i.e., max 15 dB and 25 dB, respectively) illustrated the fact that accuracy and signal availability was considerably compromised when jamming was pre-sent. Therefore, steps must be taken against the use of jammers. As a first step, an interference detection unit can be implemented to facilitate the GNSS users with the integrity of the offered solution.

Acknowledgement

This research has been conducted within the project DETERJAM (Detection, analysis, and risk management of satellite navigation jamming) funded by the Scientific Advisory Board for Defence of the Finnish Ministry of Defence and the Finnish Geodetic Institute, Finland. The paper was presented at the European Navigation Con-ference (ENC) 2012, Gdansk, Poland, 25-27 April, 2012.

ReferencesThe Economist, “GPS jamming: No jam tomorrow”, 2011, http://www.economist.com/node/18304246

Kraus, T., R. Bauernfeind, B. Eissfeller, ”Survey of In-Car Jammers – Analysis and Modeling of the RF signals and IF samples (suitable for active signal cancellation)”, Proceedings of ION GNSS 2011, Portland, OR, USA, 19-23 Sept., 2011, 430-435.


Mitch, R. H., R. C. Dougherty, M. L. Psiaki, S. P. Powell, B. W. O’Hanlon, J. A. Bhatti, T. E. Humphreys, ”Signal Characteristics of Civil GPS Jammers”, Proceedings of ION GNSS 2011, Portland, OR, USA, 19-23 Sept., 2011, 1907-1919.

Jones, M, “The Civilian Battlefield – Protecting GNSS Receivers from Inter-ference and Jamming“, Inside GNSS, March/April 2011, 40-49.

S. Pullen, G. Gao, “GNSS Jamming in the Name of Privacy, Potential Threat to GPS Aviation”, Inside GNSS, March/April 2012, 34-43.

T. Humphreys, “The GPS Dot and its Discontents, Privacy vs. GNSS Integ-rity”, Inside GNSS, March/April 2012, 44-48.

R. Bauernfeind, T. Kraus, D. Dötterböck, B. Eissfeller, E. Löhnert, E. Witt-mann, “Car Jammers: Interference Analysis”, GPS World, Oct 2011, 28-35.

Authors

Heidi Kuusniemi is a Research Manager at the Department of Navigation and Positioning at the Finnish Geodetic Institute, where she leads the re-search group on satellite and radio navigation. She is also a Lecturer at the Department of Surveying Sciences at Aalto University, Finland. She received her M.Sc. degree in 2002 and D.Sc.(Tech.) degree in 2005 from Tampere University of Technology, Finland. Her doctoral studies on personal satellite navigation were partly conducted at the Department of Geomatics Engineering at the University of Calgary, Canada. Her research interests cover various aspects of GNSS navigation, quality control, software defined receivers, multi-sensor fusion algorithms for seamless outdoor/indoor positioning, and GNSS interference mitigation methods. Dr. Kuusniemi is the President of the Nordic Institute of Navigation since May 2011.Esa Airos received his M.Sc degree in electrical engineering from the University of Lappeenranta. He is currently working as a research scientist at the Defence Forces Technical Research Centre. His research interests cover various electronic warfare applications including also GNSS.Mohammad Zahidul H. Bhuiyan received his M.Sc. degree in 2006 and Ph.D. degree in 2011 from the Department of Communications Engineer-ing, Tampere University of Technology, Finland. Dr. Bhuiyan joined the Department of Navigation and Positioning at the Finnish Geodetic Institute in October 2011 as a Senior Research Scientist with research interests covering various aspects of GNSS receiver design and sensor fusion algorithms for seamless outdoor/indoor positioning.Tuomo Kröger received his M.Sc. degree in Electronics from the University of Kuopio. He is a research scientist at the Finnish Geodetic Institute. His research interests include especially sensor based indoor/outdoor navigation.

C. Vallance, Sentinel project research reveals UK GPS jammer use, BBC news, 22 February 2012, http://www.bbc.co.uk/news/technol-ogy-17119768, accessed 16 April, 2012

The GAARDIAN project, http://www.gps-world.biz/index.php/en/gaardian, accessed 16 April, 2012

NGIA, GPS Support, https://www1.nga.mil/ProductsServices/GeodesyandG-eophysics/GPSPreciseEphemeris/Pages/default.aspx, accessed 16 April, 2012

L. Scott, “J911: The Case for Fast Jammer Detection and Location Using Crowdsourcing Approaches”, Proceedings of ION GNSS 2011, Portland, OR, USA, 19-23 Sept., 2011, 1931-1940.

Documents

GNSS Jammers: how vulnerable are Consumer grade Satellite