Multi antenna techniques for detection of spoofing attack against GNSS

Detection of jamming and spoofing can be introduced as a subcomponent for increased robustness in GNSS receivers. In this report a number of techniques using multiple antennas for detection of a spoofing attack against GNSS receivers are evaluated. The following detection algorithms have been evaluated: ? Energy detection. ? Eigenvalue detection, which exploits the correlation properties of the received signal before acquisition. ? Estimation of phase difference (double difference) which exploits properties of the received signal after acquisition. A GPS simulator was developed in order to enable evaluation of the detectors under controlled circumstances. Results from previously performed simulations using a Spirent GSS 7700 GPS simulator and a u-Blox GPS receiver were also used for validation of energy detection and a modified version of the double difference detector. The three situations that are assessed are jamming attack with broadband noise, meaconing attack using a retransmitted signal and a spoofing attack with a simulator generated signal. ? Jamming attack with broadband noise: Under ideal circumstances the energy detector will be the most effective in this case although the eigenvalue detector might be effective for small distances between the receive antennas. In practical applications, where the decision threshold for the energy detector is set with a margin to the noise level, the eigenvalue detector might however have the best performance. ? Meaconing attack using a retransmitted signal: All of the analyzed detectors are effective. If the receiver have more than two antennas, the eigenvalue detector is probably the most effective detector under realistic conditions. ? Spoofing attack with a generated signal: The spoofing signal does not contain any noise in this case, and is therefore more difficult to detect with the energy detector and to a certain degree also with the eigenvalue detector. The double difference detector will however show increased performance as the signal-to-noise ratio is higher, which makes it easier for the receiver to lock on to the false satellite signals. If only two antennas are used, the distance between these will have a significant impact on the eigenvalue detector which have decreased performance for large distances between the antennas. When four antennas are used the distance between these have no significant impact on the performance of the detectors. As the evaluated detectors show different advantages and disadvantages for different types of jamming- and spoofing attacks it is probable that a combination of these is necessary in order to be able to detect a jamming- or a spoofing attack. How such a combination should be designed is an area that should be investigated further.