Low Budget GNSS Jammer · • Low budget jammer analysis and modeling • Continuous wave (CW) jammer • Chirp signal jammer • Jamming Coverage / Harmful Interference • Overview:

11.07.2012

1

„Low Budget GNSS Jammer“ - 02.07.2012

Low Budget GNSS Jammer (PPD – Personal Privacy Devices)

Kolloquium Satellitennavigation TU München, Raum BV 2609 – 2. Juli 2012

Thomas Kraus

Institute of Space Technology and Space Applications

University FAF Munich, Germany


Table of contents

• Motivation • Who is using low budget jammers?

• Legal Situation

• Measurement Setup

• Low budget jammer analysis and modeling • Continuous wave (CW) jammer

• Chirp signal jammer

• Jamming Coverage / Harmful Interference

• Overview: Mitigation Technologies • IDM-Module of the software receiver

• Polarization Nulling

• Active Signal Cancellation

2

11.07.2012

2


• Low Budget GNSS Jammer (Personal Privacy Devices)

• can be purchased from abroad

• small size and cheap (~ 40 to 60 dollar)

• power supply (battery or cigarette lighter of a car)

• Reasons for using them (primary market) … • People who fear being tracked or monitored by GNSS

In particular, freight and delivery trucks (monitored by their dispatch centers)

Example: Newark International Airport in New Jersey [S. Pullen, G. Gao: GNSS Jamming in the Name of Privacy – Potential Threat to GPS Aviation, InsideGNSS, March/April 2012] [J.C. Grabowski: Personal Privacy Jammers – Locating Jersey PPDs Jamming GBAS Safety-of-Life Signals, GPS World, April 2012

• (cont.) …

Situation (Jammer in civil domain) [1]


• (cont.) Reasons for using them (primary market) … • …

• Car thieves using GPS jammer (reported in press)

• Future: “Toll collect” and distance based charging (DBC) systems, pay-as-you drive compromise these systems for not paying any fees

• Historically, signal jamming and the design of equipment to protect against it has been considered primarily a military problem • As our dependence on GNSS grows, protection technology that was

once only available to the military is now becoming available to the commercial world

Situation (Jammer in civil domain) [2]

11.07.2012

3


• Purchased low-budget jammers

PPD Overview


Legal Situation

• Legal Situation on Jammer in Germany: • Sale is forbidden (§ 6 Abs. 1 Satz 1 EMVG)

• Operation is forbidden (§ 149 Abs. 1 Nr. 10 TKG)

• Ownership is not forbidden (§ 90 TKG)

• Penalty: • Operation: 400 – 1.000 €

• Sales after multiple reminder: > 10.000 €

• USA: “FAA moves against online retailers of GPS jammers (Nov. 2011)

11.07.2012

4


Table of contents


• Legal Situation








7


Measurement Setup

(for the time-domain analysis)

• Down-conversion (heterodyne) with COTS-Products from • Mini-Circuits®

• LORCH Microwave

• SDR-Card: GE ICS-572 • Signal Recorder from EHS

Signalrecording (RAID-Harddisk):

14 bit resolution

Input: fc,max = 105 MHz @1 Channel

Input: fc,max = 50 MHz @2 Channels

Output: fc,max= 50 MHz @2 Channels

max. recording time: 1 hour

• Analysis with Matlab® • Oversampling factor of 10 (for a better time resolution)

8

11.07.2012

5


Example: Measurement Setup

9


Table of contents

• Motivation • How is using low budget jammers?

• Legal Situation








10

11.07.2012

6


In-car jammer (Classification)

Class I: Continuous wave (CW) signal Jammer No. 1 and 4

Class II: Chirp signal with one saw-tooth function Jammer No. 2, 3 and 7

Class III: Chirp signal with multi saw-tooth functions Jammer No. 5

Class IV: Chirp signal with frequency bursts Jammer No. 6


• Jammer 1 • fcenter = 1.5747594 GHz

• PPeak = -12.1 dBm

• BW3dB = 0.92 kHz

• BW20dB = 2.58 kHz

• Jammer 4 • fcenter = 1.5744400 GHz

• PPeak = -25.6 dBm

• BW3dB = 0.92 kHz

• BW20dB = 2.51 kHz

• Center frequency is temperature dependent!

Class I – in-car jammer

(continuous wave)

f [GHz]

P [

dB

m]

11.07.2012

7


• Jammer 2, 3 and 7 can be considered as a positive unidirectional sweep chirp • Because of the very high negative slope

• Parameters of • Jammer 2: BW(3dB) = 11.82 MHz @ fcenter = 1.57507 GHz, tsw = 11.71 µsec

• Jammer 3: BW(3dB) = 44.9 MHz @ fcenter = 1.58824 GHz, tsw = 18.97 µsec

• Jammer 7: BW(3dB) = 10.72 MHz @ fcenter = 1.57194 GHz, tsw = 8.62 µsec

Class II – in-car jammer

f [GHz]

P [

dB

m]

f [M

Hz]

t [µs]


• Class II • Jammer 2: BW(3dB) = 11.82 MHz

• Jammer 3: BW(3dB) = 44.9 MHz

• Jammer 7: BW(3dB) = 10.72 MHz

Belongs a Class II jammer to

narrowband or wideband category?

f [GHz]

P [

dB

m]

f [GHz]

P [

dB

m]

• Class I • Jammer 1: BW(3dB) = 0.92 kHz

BW(20dB) = 2.58 kHz

• Jammer 3: BW(3dB) = 0.92 kHz BW(20dB) = 2.51 kHz

11.07.2012

8


E. D. Kaplan and C. J. Hegarty, “Understanding GPS Principles and Applications. Second Edition”, Artech House, USA, 2006

Types of Jammers / Interferences

Low budget

GNSS jammers

are defined as

narrowband

interference

NOTE: But, chirp signals with a very high sweep time could be also

considered as broadband interferences!


Class III – in-car jammer

16

• Jammer 5 compared to No. 2, 3 and 7 does have a 2nd oscillator for the VCO input • which does have a negative sawtooth function with is four times longer than the basic oscillator

• Parameters of Jammer 5

• BW(3dB) = 10.02 MHz @ fcenter = 1.5713 GHz, BWsweep = 8.97 MHz

• 1st osc. : tsw,total = 8.7 µs (tsw,up = 6.8 µs, tsw,down = 1.9 µs) [pos. sawtooth func.]

• 2nd osc.: tsw = 34.8 µs [neg. sawtooth func.]

f [M

Hz]

t [µs]

f [M

Hz]

t [µs]

11.07.2012

9


Class IV – in-car jammer

17

• Jammer 6 is the most complex In-Car jammer • with three input functions for the VCO plus a frequency burst

• Parameters of No.6 • BWmax=19.43MHz @fc,max=1.57723GHz; BWprimary=11.31MHz @fc,prim=1.57317GHz, BWmin=6.39MHz • 1st osc.: tsw1 = 8.7408µs, BWsweep = 6.39 MHz • 2nd osc.: tsw2 = 43.78µs • 3nd osc.: tsw3 = 139.9 – 183.7µs • Freq. burst: tsw4,1=1.1215ms; tsw4,2 = 1.3557ms; tsw4,3 = 2.2825ms


Class IV – in-car jammer

18

normalized

11.07.2012

10


In-car jammer (Classification)

No. Class Center frequency Bandwidth Sweep time(s) PPeak [dBm]

1 I 1.5747594 GHz 0.92 kHz - -12.1 dBm

2 II 1.57507 GHz 11.82 MHz TSW =11.71µs -14.4 dBm


4 I 1.5744400 GHz 0.92 kHz - -25.6 dBm

5 III 1.57130 GHz 10.02 MHz TSW1 = 8.7 µs (TSW1,up = 6.8µs, TSW1,down = 1.9µs) TSW2 = 34.8µs

-19.3 dBm

6 IV 1.57317 GHz (1.57723 GHz)

11.31 MHz (– 19.43 MHz)

TSW1 = 8,7408µs TSW4,1 = 1.1215 ms TSW2 = 43.78µs TSW4,2 = 1.3557 ms TSW3 = 139.9–183.7µs TSW4,3 = 2.2825 ms

-9.5 dBm


Class I: Continuous wave (CW) signal Jammer No. 1 and 4

Class II: Chirp signal with one saw-tooth function Jammer No. 2, 3 and 7

Class III: Chirp signal with multi saw-tooth functions Jammer No. 5

Class IV: Chirp signal with frequency bursts Jammer No. 6


VIDEO

• Video • Spectrum of IOV-1 (UFAF 2.4m dish antenna) and

• Spectrum of PPDs (splitter with Novatel GPS-704-X)

Jammer 1

Jammer 2

Jammer 3

Jammer 5

Jammer 7

• E1-Band only

• 1 GHz bandwidth, center frequency = 1.4 GHz

Jammer 6 only

20

11.07.2012

11


• An In-Car jammer is usually constructed by a voltage controlled oscillator (VCO) with a specific voltage input function describing the frequency change over time, which can be described by

• For a uni-directional linear chirp signal the instantaneous frequency f(t) varies linearly over time as

In-car jammer (Chirp) - Model


Modeling (General Description)

11.07.2012

12


Table of contents


• Legal Situation








23


What signal power does a low

budget jammer really transmit?

24

No. Class PPeak [dBm]

1 I -12.1 dBm

2 II -14.4 dBm

3 II -9.6 dBm

4 I -25.6 dBm

5 III -19.3 dBm

6 IV -9.5 dBm

7 II -30.8 dBm

http://www.jammer-store.com http://www.thejammerworld.de

http://www.jammerall.com

11.07.2012

13


Jamming (Rauschleistung im Basisband)

25

CS/N0 = ungestörter Träger-Rauschabstand des empfangenen Signals im Basisband [dimensionslos]

CL/CS = Verhältnis zur Jamming- und Empfangsleistung im Basisband [dimensionslos]

Q = Gütefaktor der Jammerwirksamkeit, berechnet für vielzählige Jammertypen und Signalmodulationen [dimensionslos]

RC = Rate des Spreizcodes des PRN Codegenerators [chips/s]

𝐶𝑆𝑁0 𝑒𝑓𝑓

=1

1𝐶𝑆/𝑁0

+𝐶𝐿/𝐶𝑆𝑄𝑅𝐶

Die Rauschleistung im Empfänger kann auch künstlich

erhöht werden. Das aktive Stören durch Jammer ist eine

Möglichkeit!


Transmitted Signal Power

• SiRFstarIII (chipset)

• Jammer 6

The measurement (outdoor) and simulation match with an in-band signal power of -11.5 dBm (average). In the lab we measured -9.5 dBm (peak) [see table before]

Transmitted jammer power is usually significantly lower as most of the retailers/publications saying

26

11.07.2012

14


What is harmful interference (HI)?

• Definition by negotiation with LightSquared • Ref: Final Report 30.06.2011

• HI is defined by a 1 dB degradation in C/N0 (GPS position)

equates by Jammer 6 at approx. 1000 meters distance

• LightSquared states that 6 dB degradation is the appropriate threshold for HI

equates by Jammer 6 at approx. 500 meters distance

• Loss of Lock (Tracking) • with Jammer 6 at approx. 23 meters distance

and a C/N0 of 15 dBHz

27


Table of contents


• Legal Situation








28

11.07.2012

15


Common interference suppression, mitigation and anti-jam technologies are

• Antenna Solutions

• CRPA (Controlled Radiation Pattern Antenna) null steering or sidelobe cancellation

• Adaptive Beamforming beamforming the receiver antenna towards GPS satellites

• Receiver Solutions

• DSP mitigation techniques (e.g. Adaptive Notch Filtering)

• Switching Frequencies (multi-GNSS / multi-frequency)

• Integrating GNSS with INS (inertial navigations systems)

• ISU (Interference Suppression Unit) nulling interference with use of electric field vector cancellation

• ASC (Active Signal Cancellation)

Anti-jammer Technologies

Ref:

Jones, M.; „The Civilian Battlefield – Protecting GNSS Receivers from Interference and Jamming“, Inside GNSS, March/April 2011

Casabona, M, Rosen, M.; „Discussion of GPS Anti-Jam Technology, GPS Solutions, Vol 2, Number 3, 1999


Outline (still under development):

IDM Module of the UFAF Software Receiver

• IDM (Interference Detection and Mitigation Module) • Automatic Detection and Identification of the present of interference

and characterization

• Selection of the appropriate mitigation algorithm

• Algorithms for • Detection/Identification

AGC, Checking of Distribution Functions, FFT, STFT

KLT (Karhunen-Lòeve-Transform)

• Mitigation

Clipping/Zeroing

FFT (for time-stationary interferences)

STFT, FrFT (for time-varying interferences)

Wavelet (for pulsed interferences)

FIR or IIR filter (for time-stationary “standard” for time-varying “adaptive”)

30

11.07.2012

16


RF-FE Design! Challenges?

Hardware (Frond-End) requirements for the previous mentioned digital signal processing algorithms

• High ADC resolution (at least 8-bit)

• But also, increased signal dynamic in the complete RF-Chain

• Future systems needs to deal with “upcoming” communication systems (like LightSquared) • Improved out-of-band hardware filtering required

Mass-market receivers might not reach all these requirements. Potential market: high-performance receiver like needed for GNSS monitoring networks

31


Military Products (Examples)

• Novatel GAJT (Anti-Jam Antenna) • Seven antenna elements

• Signal processing is integrated

• Interference suppression 40 dB (typical)

• Maximal 6 interferers simultaneous

• Honeywell ISU (Interference Suppression Unit) • nulling interference with use of electric field vector cancellation

• greater than 25 dB suppression of wideband noise interference

• greater than 46 dB suppression of narrowband / CW interference

• Military product from Honeywell

Uses a 2 port single patch antenna

32

11.07.2012

17


Polarization Nulling

Key Idea :

Interference Suppression via Polarization Nulling with the use of Electric Field Vector Cancellation

Steps :

1. A dual polarized patch antenna, whose input signal ( RHCP ) is splitted in Horizontal and Vertical Components.

2. Orthogonal Projection

3. Two ADC Converters

4. Algorithm to distinguish between GNSS signal and interference


Algorithm Implementation

Algorithm Steps :

1. Interference Detection based on polarization diversity only.

2. Splitting the incoming signal (e.g. RHCP) in horizontal and vertical components.

3. a) Interference Mitigation based on Circular Leakage LMS algorithm b) or ???

Ongoing work of M.Sc. Enik Shytermeja (internship)

11.07.2012

18


Active Signal Cancellation (ASC)

• Active Signal Cancellation • Detection of In-Car jammers

Models description for well-known jammers types are available

• Next step: find the parameters for the replica jammer signal

Only a few needed (for chirp): freq. (start and stop), sweep time, phase, amplitude

• Suppression with the 180° phase shifted jammer replica

35



36

11.07.2012

19



Recorded Signal

• fsample = 105 MHz

• 14 bit

• OSF = 10 (Matlabsimulation)

Estimated Parameters: (green graph)

• fstart,est = 2.7000 MHz

• kest = 1.1751 MHz/µs

Optimized Parameters: (black graph)

• fstart,opt= 2.7277 MHz

• kopt = 1.1719 MHz/µs

Suppression (optimized):

• Min: 13 dB

• Max: 37 dB

37


Summary

• Low-budget jammers are defined as narrowband interference • Continuous wave signal (few of them)

• Chirp signal (majority)

• It’s not allowed to sell and use them, but it’s allowed to own them (in each country different)

• They are harmful interference for GNSS within a one kilometer range

• Several antenna and receiver solutions to mitigate these jammer signals have been presented • But, there is still a lot of work to do ;-)

38

Documents

Low Budget GNSS Jammer · • Low budget jammer analysis and modeling • Continuous wave (CW) jammer • Chirp signal jammer • Jamming Coverage / Harmful Interference • Overview: