11.07.2012
1
„Low Budget GNSS Jammer“ - 02.07.2012
Low Budget GNSS Jammer (PPD – Personal Privacy Devices)
Kolloquium Satellitennavigation TU München, Raum BV 2609 – 2. Juli 2012
Thomas Kraus
Institute of Space Technology and Space Applications
University FAF Munich, Germany
„Low Budget GNSS Jammer“ - 02.07.2012
Table of contents
• Motivation • Who is using low budget jammers?
• Legal Situation
• Measurement Setup
• Low budget jammer analysis and modeling • Continuous wave (CW) jammer
• Chirp signal jammer
• Jamming Coverage / Harmful Interference
• Overview: Mitigation Technologies • IDM-Module of the software receiver
• Polarization Nulling
• Active Signal Cancellation
2
11.07.2012
2
„Low Budget GNSS Jammer“ - 02.07.2012
• Low Budget GNSS Jammer (Personal Privacy Devices)
• can be purchased from abroad
• small size and cheap (~ 40 to 60 dollar)
• power supply (battery or cigarette lighter of a car)
• Reasons for using them (primary market) … • People who fear being tracked or monitored by GNSS
In particular, freight and delivery trucks (monitored by their dispatch centers)
Example: Newark International Airport in New Jersey [S. Pullen, G. Gao: GNSS Jamming in the Name of Privacy – Potential Threat to GPS Aviation, InsideGNSS, March/April 2012] [J.C. Grabowski: Personal Privacy Jammers – Locating Jersey PPDs Jamming GBAS Safety-of-Life Signals, GPS World, April 2012
• (cont.) …
Situation (Jammer in civil domain) [1]
„Low Budget GNSS Jammer“ - 02.07.2012
• (cont.) Reasons for using them (primary market) … • …
• Car thieves using GPS jammer (reported in press)
• Future: “Toll collect” and distance based charging (DBC) systems, pay-as-you drive compromise these systems for not paying any fees
• Historically, signal jamming and the design of equipment to protect against it has been considered primarily a military problem • As our dependence on GNSS grows, protection technology that was
once only available to the military is now becoming available to the commercial world
Situation (Jammer in civil domain) [2]
11.07.2012
3
„Low Budget GNSS Jammer“ - 02.07.2012
• Purchased low-budget jammers
PPD Overview
„Low Budget GNSS Jammer“ - 02.07.2012
Legal Situation
• Legal Situation on Jammer in Germany: • Sale is forbidden (§ 6 Abs. 1 Satz 1 EMVG)
• Operation is forbidden (§ 149 Abs. 1 Nr. 10 TKG)
• Ownership is not forbidden (§ 90 TKG)
• Penalty: • Operation: 400 – 1.000 €
• Sales after multiple reminder: > 10.000 €
• USA: “FAA moves against online retailers of GPS jammers (Nov. 2011)
11.07.2012
4
„Low Budget GNSS Jammer“ - 02.07.2012
Table of contents
• Motivation • Who is using low budget jammers?
• Legal Situation
• Measurement Setup
• Low budget jammer analysis and modeling • Continuous wave (CW) jammer
• Chirp signal jammer
• Jamming Coverage / Harmful Interference
• Overview: Mitigation Technologies • IDM-Module of the software receiver
• Polarization Nulling
• Active Signal Cancellation
7
„Low Budget GNSS Jammer“ - 02.07.2012
Measurement Setup
(for the time-domain analysis)
• Down-conversion (heterodyne) with COTS-Products from • Mini-Circuits®
• LORCH Microwave
• SDR-Card: GE ICS-572 • Signal Recorder from EHS
Signalrecording (RAID-Harddisk):
14 bit resolution
Input: fc,max = 105 MHz @1 Channel
Input: fc,max = 50 MHz @2 Channels
Output: fc,max= 50 MHz @2 Channels
max. recording time: 1 hour
• Analysis with Matlab® • Oversampling factor of 10 (for a better time resolution)
8
11.07.2012
5
„Low Budget GNSS Jammer“ - 02.07.2012
Example: Measurement Setup
9
„Low Budget GNSS Jammer“ - 02.07.2012
Table of contents
• Motivation • How is using low budget jammers?
• Legal Situation
• Measurement Setup
• Low budget jammer analysis and modeling • Continuous wave (CW) jammer
• Chirp signal jammer
• Jamming Coverage / Harmful Interference
• Overview: Mitigation Technologies • IDM-Module of the software receiver
• Polarization Nulling
• Active Signal Cancellation
10
11.07.2012
6
„Low Budget GNSS Jammer“ - 02.07.2012
In-car jammer (Classification)
Class I: Continuous wave (CW) signal Jammer No. 1 and 4
Class II: Chirp signal with one saw-tooth function Jammer No. 2, 3 and 7
Class III: Chirp signal with multi saw-tooth functions Jammer No. 5
Class IV: Chirp signal with frequency bursts Jammer No. 6
„Low Budget GNSS Jammer“ - 02.07.2012
• Jammer 1 • fcenter = 1.5747594 GHz
• PPeak = -12.1 dBm
• BW3dB = 0.92 kHz
• BW20dB = 2.58 kHz
• Jammer 4 • fcenter = 1.5744400 GHz
• PPeak = -25.6 dBm
• BW3dB = 0.92 kHz
• BW20dB = 2.51 kHz
• Center frequency is temperature dependent!
Class I – in-car jammer
(continuous wave)
f [GHz]
P [
dB
m]
11.07.2012
7
„Low Budget GNSS Jammer“ - 02.07.2012
• Jammer 2, 3 and 7 can be considered as a positive unidirectional sweep chirp • Because of the very high negative slope
• Parameters of • Jammer 2: BW(3dB) = 11.82 MHz @ fcenter = 1.57507 GHz, tsw = 11.71 µsec
• Jammer 3: BW(3dB) = 44.9 MHz @ fcenter = 1.58824 GHz, tsw = 18.97 µsec
• Jammer 7: BW(3dB) = 10.72 MHz @ fcenter = 1.57194 GHz, tsw = 8.62 µsec
Class II – in-car jammer
f [GHz]
P [
dB
m]
f [M
Hz]
t [µs]
„Low Budget GNSS Jammer“ - 02.07.2012
• Class II • Jammer 2: BW(3dB) = 11.82 MHz
• Jammer 3: BW(3dB) = 44.9 MHz
• Jammer 7: BW(3dB) = 10.72 MHz
Belongs a Class II jammer to
narrowband or wideband category?
f [GHz]
P [
dB
m]
f [GHz]
P [
dB
m]
• Class I • Jammer 1: BW(3dB) = 0.92 kHz
BW(20dB) = 2.58 kHz
• Jammer 3: BW(3dB) = 0.92 kHz BW(20dB) = 2.51 kHz
11.07.2012
8
„Low Budget GNSS Jammer“ - 02.07.2012
E. D. Kaplan and C. J. Hegarty, “Understanding GPS Principles and Applications. Second Edition”, Artech House, USA, 2006
Types of Jammers / Interferences
Low budget
GNSS jammers
are defined as
narrowband
interference
NOTE: But, chirp signals with a very high sweep time could be also
considered as broadband interferences!
„Low Budget GNSS Jammer“ - 02.07.2012
Class III – in-car jammer
16
• Jammer 5 compared to No. 2, 3 and 7 does have a 2nd oscillator for the VCO input • which does have a negative sawtooth function with is four times longer than the basic oscillator
• Parameters of Jammer 5
• BW(3dB) = 10.02 MHz @ fcenter = 1.5713 GHz, BWsweep = 8.97 MHz
• 1st osc. : tsw,total = 8.7 µs (tsw,up = 6.8 µs, tsw,down = 1.9 µs) [pos. sawtooth func.]
• 2nd osc.: tsw = 34.8 µs [neg. sawtooth func.]
f [M
Hz]
t [µs]
f [M
Hz]
t [µs]
11.07.2012
9
„Low Budget GNSS Jammer“ - 02.07.2012
Class IV – in-car jammer
17
• Jammer 6 is the most complex In-Car jammer • with three input functions for the VCO plus a frequency burst
• Parameters of No.6 • BWmax=19.43MHz @fc,max=1.57723GHz; BWprimary=11.31MHz @fc,prim=1.57317GHz, BWmin=6.39MHz • 1st osc.: tsw1 = 8.7408µs, BWsweep = 6.39 MHz • 2nd osc.: tsw2 = 43.78µs • 3nd osc.: tsw3 = 139.9 – 183.7µs • Freq. burst: tsw4,1=1.1215ms; tsw4,2 = 1.3557ms; tsw4,3 = 2.2825ms
„Low Budget GNSS Jammer“ - 02.07.2012
Class IV – in-car jammer
18
normalized
11.07.2012
10
„Low Budget GNSS Jammer“ - 02.07.2012
In-car jammer (Classification)
No. Class Center frequency Bandwidth Sweep time(s) PPeak [dBm]
1 I 1.5747594 GHz 0.92 kHz - -12.1 dBm
2 II 1.57507 GHz 11.82 MHz TSW =11.71µs -14.4 dBm
3 II 1.58824 GHz 44.9 MHz TSW =18.97µs -9.6 dBm
4 I 1.5744400 GHz 0.92 kHz - -25.6 dBm
5 III 1.57130 GHz 10.02 MHz TSW1 = 8.7 µs (TSW1,up = 6.8µs, TSW1,down = 1.9µs) TSW2 = 34.8µs
-19.3 dBm
6 IV 1.57317 GHz (1.57723 GHz)
11.31 MHz (– 19.43 MHz)
TSW1 = 8,7408µs TSW4,1 = 1.1215 ms TSW2 = 43.78µs TSW4,2 = 1.3557 ms TSW3 = 139.9–183.7µs TSW4,3 = 2.2825 ms
-9.5 dBm
7 II 1.57194 GHz 10.72 MHz TSW =8.62µs -30.8 dBm
Class I: Continuous wave (CW) signal Jammer No. 1 and 4
Class II: Chirp signal with one saw-tooth function Jammer No. 2, 3 and 7
Class III: Chirp signal with multi saw-tooth functions Jammer No. 5
Class IV: Chirp signal with frequency bursts Jammer No. 6
„Low Budget GNSS Jammer“ - 02.07.2012
VIDEO
• Video • Spectrum of IOV-1 (UFAF 2.4m dish antenna) and
• Spectrum of PPDs (splitter with Novatel GPS-704-X)
Jammer 1
Jammer 2
Jammer 3
Jammer 5
Jammer 7
• E1-Band only
• 1 GHz bandwidth, center frequency = 1.4 GHz
Jammer 6 only
20
11.07.2012
11
„Low Budget GNSS Jammer“ - 02.07.2012
• An In-Car jammer is usually constructed by a voltage controlled oscillator (VCO) with a specific voltage input function describing the frequency change over time, which can be described by
• For a uni-directional linear chirp signal the instantaneous frequency f(t) varies linearly over time as
In-car jammer (Chirp) - Model
„Low Budget GNSS Jammer“ - 02.07.2012
Modeling (General Description)
11.07.2012
12
„Low Budget GNSS Jammer“ - 02.07.2012
Table of contents
• Motivation • Who is using low budget jammers?
• Legal Situation
• Measurement Setup
• Low budget jammer analysis and modeling • Continuous wave (CW) jammer
• Chirp signal jammer
• Jamming Coverage / Harmful Interference
• Overview: Mitigation Technologies • IDM-Module of the software receiver
• Polarization Nulling
• Active Signal Cancellation
23
„Low Budget GNSS Jammer“ - 02.07.2012
What signal power does a low
budget jammer really transmit?
24
No. Class PPeak [dBm]
1 I -12.1 dBm
2 II -14.4 dBm
3 II -9.6 dBm
4 I -25.6 dBm
5 III -19.3 dBm
6 IV -9.5 dBm
7 II -30.8 dBm
http://www.jammer-store.com http://www.thejammerworld.de
http://www.jammerall.com
11.07.2012
13
„Low Budget GNSS Jammer“ - 02.07.2012
Jamming (Rauschleistung im Basisband)
25
CS/N0 = ungestörter Träger-Rauschabstand des empfangenen Signals im Basisband [dimensionslos]
CL/CS = Verhältnis zur Jamming- und Empfangsleistung im Basisband [dimensionslos]
Q = Gütefaktor der Jammerwirksamkeit, berechnet für vielzählige Jammertypen und Signalmodulationen [dimensionslos]
RC = Rate des Spreizcodes des PRN Codegenerators [chips/s]
𝐶𝑆𝑁0 𝑒𝑓𝑓
=1
1𝐶𝑆/𝑁0
+𝐶𝐿/𝐶𝑆𝑄𝑅𝐶
Die Rauschleistung im Empfänger kann auch künstlich
erhöht werden. Das aktive Stören durch Jammer ist eine
Möglichkeit!
„Low Budget GNSS Jammer“ - 02.07.2012
Transmitted Signal Power
• SiRFstarIII (chipset)
• Jammer 6
The measurement (outdoor) and simulation match with an in-band signal power of -11.5 dBm (average). In the lab we measured -9.5 dBm (peak) [see table before]
Transmitted jammer power is usually significantly lower as most of the retailers/publications saying
26
11.07.2012
14
„Low Budget GNSS Jammer“ - 02.07.2012
What is harmful interference (HI)?
• Definition by negotiation with LightSquared • Ref: Final Report 30.06.2011
• HI is defined by a 1 dB degradation in C/N0 (GPS position)
equates by Jammer 6 at approx. 1000 meters distance
• LightSquared states that 6 dB degradation is the appropriate threshold for HI
equates by Jammer 6 at approx. 500 meters distance
• Loss of Lock (Tracking) • with Jammer 6 at approx. 23 meters distance
and a C/N0 of 15 dBHz
27
„Low Budget GNSS Jammer“ - 02.07.2012
Table of contents
• Motivation • Who is using low budget jammers?
• Legal Situation
• Measurement Setup
• Low budget jammer analysis and modeling • Continuous wave (CW) jammer
• Chirp signal jammer
• Jamming Coverage / Harmful Interference
• Overview: Mitigation Technologies • IDM-Module of the software receiver
• Polarization Nulling
• Active Signal Cancellation
28
11.07.2012
15
„Low Budget GNSS Jammer“ - 02.07.2012
Common interference suppression, mitigation and anti-jam technologies are
• Antenna Solutions
• CRPA (Controlled Radiation Pattern Antenna) null steering or sidelobe cancellation
• Adaptive Beamforming beamforming the receiver antenna towards GPS satellites
• Receiver Solutions
• DSP mitigation techniques (e.g. Adaptive Notch Filtering)
• Switching Frequencies (multi-GNSS / multi-frequency)
• Integrating GNSS with INS (inertial navigations systems)
• ISU (Interference Suppression Unit) nulling interference with use of electric field vector cancellation
• ASC (Active Signal Cancellation)
Anti-jammer Technologies
Ref:
Jones, M.; „The Civilian Battlefield – Protecting GNSS Receivers from Interference and Jamming“, Inside GNSS, March/April 2011
Casabona, M, Rosen, M.; „Discussion of GPS Anti-Jam Technology, GPS Solutions, Vol 2, Number 3, 1999
„Low Budget GNSS Jammer“ - 02.07.2012
Outline (still under development):
IDM Module of the UFAF Software Receiver
• IDM (Interference Detection and Mitigation Module) • Automatic Detection and Identification of the present of interference
and characterization
• Selection of the appropriate mitigation algorithm
• Algorithms for • Detection/Identification
AGC, Checking of Distribution Functions, FFT, STFT
KLT (Karhunen-Lòeve-Transform)
• Mitigation
Clipping/Zeroing
FFT (for time-stationary interferences)
STFT, FrFT (for time-varying interferences)
Wavelet (for pulsed interferences)
FIR or IIR filter (for time-stationary “standard” for time-varying “adaptive”)
30
11.07.2012
16
„Low Budget GNSS Jammer“ - 02.07.2012
RF-FE Design! Challenges?
Hardware (Frond-End) requirements for the previous mentioned digital signal processing algorithms
• High ADC resolution (at least 8-bit)
• But also, increased signal dynamic in the complete RF-Chain
• Future systems needs to deal with “upcoming” communication systems (like LightSquared) • Improved out-of-band hardware filtering required
Mass-market receivers might not reach all these requirements. Potential market: high-performance receiver like needed for GNSS monitoring networks
31
„Low Budget GNSS Jammer“ - 02.07.2012
Military Products (Examples)
• Novatel GAJT (Anti-Jam Antenna) • Seven antenna elements
• Signal processing is integrated
• Interference suppression 40 dB (typical)
• Maximal 6 interferers simultaneous
• Honeywell ISU (Interference Suppression Unit) • nulling interference with use of electric field vector cancellation
• greater than 25 dB suppression of wideband noise interference
• greater than 46 dB suppression of narrowband / CW interference
• Military product from Honeywell
Uses a 2 port single patch antenna
32
11.07.2012
17
„Low Budget GNSS Jammer“ - 02.07.2012
Polarization Nulling
Key Idea :
Interference Suppression via Polarization Nulling with the use of Electric Field Vector Cancellation
Steps :
1. A dual polarized patch antenna, whose input signal ( RHCP ) is splitted in Horizontal and Vertical Components.
2. Orthogonal Projection
3. Two ADC Converters
4. Algorithm to distinguish between GNSS signal and interference
„Low Budget GNSS Jammer“ - 02.07.2012
Algorithm Implementation
Algorithm Steps :
1. Interference Detection based on polarization diversity only.
2. Splitting the incoming signal (e.g. RHCP) in horizontal and vertical components.
3. a) Interference Mitigation based on Circular Leakage LMS algorithm b) or ???
Ongoing work of M.Sc. Enik Shytermeja (internship)
11.07.2012
18
„Low Budget GNSS Jammer“ - 02.07.2012
Active Signal Cancellation (ASC)
• Active Signal Cancellation • Detection of In-Car jammers
Models description for well-known jammers types are available
• Next step: find the parameters for the replica jammer signal
Only a few needed (for chirp): freq. (start and stop), sweep time, phase, amplitude
• Suppression with the 180° phase shifted jammer replica
35
„Low Budget GNSS Jammer“ - 02.07.2012
Active Signal Cancellation (ASC)
36
11.07.2012
19
„Low Budget GNSS Jammer“ - 02.07.2012
Active Signal Cancellation (ASC)
Recorded Signal
• fsample = 105 MHz
• 14 bit
• OSF = 10 (Matlabsimulation)
Estimated Parameters: (green graph)
• fstart,est = 2.7000 MHz
• kest = 1.1751 MHz/µs
Optimized Parameters: (black graph)
• fstart,opt= 2.7277 MHz
• kopt = 1.1719 MHz/µs
Suppression (optimized):
• Min: 13 dB
• Max: 37 dB
37
„Low Budget GNSS Jammer“ - 02.07.2012
Summary
• Low-budget jammers are defined as narrowband interference • Continuous wave signal (few of them)
• Chirp signal (majority)
• It’s not allowed to sell and use them, but it’s allowed to own them (in each country different)
• They are harmful interference for GNSS within a one kilometer range
• Several antenna and receiver solutions to mitigate these jammer signals have been presented • But, there is still a lot of work to do ;-)
38