mitigating jamming and meaconing attacks using direct gps

6
1 Mitigating Jamming and Meaconing Attacks Using Direct GPS Positioning Yuting Ng, Student Member, IEEE and Grace Xingxin Gao, Senior Member, IEEE BIOGRAPHIES Yuting Ng is a graduate student in the Aerospace Engi- neering Department at the University of Illinois at Urbana- Champaign. She received her B.S. degree in electrical engi- neering, graduating with university honors, from the same uni- versity. Her research interests are in advanced signal tracking algorithms, navigation, control, RADAR and UAVs. Grace Xingxin Gao received her B.S. degree in mechanical engineering and her M.S. degree in electrical engineering from Tsinghua University, Beijing, China in 2001 and 2003. She received her PhD degree in electrical engineering from Stanford University in 2008. From 2008 to 2012, she was a research associate at Stanford University. Since 2012, she has been an assistant professor in the Aerospace Engineering Department at University of Illinois at Urbana-Champaign. Her research interests are systems, signals, control, and robotics. She is a senior member of IEEE and a member of ION. Abstract—Direct GPS Positioning (DP) is a robust method that estimates the GPS navigation solution directly from the received GPS signal. In contrast, traditional methods, such as scalar tracking and vector tracking, compute intermediate channel range and range residual measurements independently, then use these as inputs into the navigation filter to estimate the navigation solution. However, a brute force implementation of DP is not computationally efficient. Our research contribution is to evaluate the robustness of DP using our more computationally efficient DP implementation. Our novel and effective DP receiver architecture initializes the navigation solution guesses as two groups: guesses varying in position and clock bias, guesses varying in velocity and clock drift. We then perform vectorized calculations to get the expected delay and doppler between the receiver and each satellite in view. Following that, we perform batch calculations using Fast Fourier Transforms (FFTs) to obtain the vector correlation and vector spectrum. The navigation solution residual derived from the vector correlation and vector spectrum is then used as input into the navigation filter. We implemented our receiver architecture using our research platform - PyGNSS. We then evaluated the robustness of our DP receiver architecture by subjecting it to simulated jamming and meaconing attacks. We demonstrate through our experiments the robustness of our DP receiver architecture. Yuting Ng and Grace Xingxin Gao are with the Department of Aerospace Engineering at the University of Illinois at Urbana-Champaign, Urbana, IL 61801, USA. http://gracegao.ae.illinois.edu/ I. I NTRODUCTION Direct GPS Positioning (DP) directly estimates and tracks the navigation solution from the received raw GPS signal [1], [2]. This is unlike traditional scalar tracking which estimates channel range and range rate measurements independently, then solves for the navigation solution via trilateration [3]– [7]. Similarly, traditional vector tracking also produces the channel range and range rate residuals independently [8]–[11]. Channel measurements estimated using traditional methods are degraded under signal multipath and obstruction [12], [13], leading to errors in the navigation solution. On the other hand, the shape of the vector correlation in DP is robust to signal multipath and obstruction, leading to a more robust navigation solution [14], [15]. In our prior work, we have implemented a different DP receiver architecture from the DP receiver architecture pre- sented in this paper. That architecture uses coherent vector correlator measurements with the Unscented Kalman Filter (UKF). Scalar tracking provided the carrier phase measure- ments to enable the coherent vector correlator. Live experi- ments were conducted and the results were analyzed for both static and dynamic scenarios. In addition, we have provided a theoretical proof that direct acquisition is more robust than scalar acquisition under meaconing scenarios. We also showed that direct positioning is more robust to jamming than scalar positioning using simulated noise [1]. Work by other researchers can be grouped into two cate- gories: direct acquisition and tracking. Direct acquisition, also known as collective detection can be further separated into coherent and noncoherent direct acquisition [2], [14]–[18]. Co- herent direct acquisition is too costly [2]. Noncoherent direct acquisition has lower gain than coherent direct acquisition. However, the noncoherent method involved less computation and was shown to have superior detection to scalar acquisition [14], [15]. MATLAB implementations of direct acquisition was provided in [16], [17]. Simulations were used to compare the performance of direct acquisition against scalar acquisition by [19], [20]. A mathematical treatment was provided by [21]– [23]. With regards to tracking, a tracking loop for the vector correlation was devised by [24], based on prior work [25]. Also basing their work on a tracking loop was [26], [27]. Many of the above implementations were computationally intensive, did not estimate and track the full navigation pa- rameters and did not provide a dedicated evaluation of DP’s robustness. Therefore, using our computationally efficient im- plementation of DP, we provide a dedicated evaluation of DP’s robustness through simulated jamming and meaconing attacks.

Upload: others

Post on 24-Dec-2021

9 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Mitigating Jamming and Meaconing Attacks Using Direct GPS

1

Mitigating Jamming and Meaconing AttacksUsing Direct GPS Positioning

Yuting Ng, Student Member, IEEE and Grace Xingxin Gao, Senior Member, IEEE

BIOGRAPHIES

Yuting Ng is a graduate student in the Aerospace Engi-neering Department at the University of Illinois at Urbana-Champaign. She received her B.S. degree in electrical engi-neering, graduating with university honors, from the same uni-versity. Her research interests are in advanced signal trackingalgorithms, navigation, control, RADAR and UAVs.

Grace Xingxin Gao received her B.S. degree inmechanical engineering and her M.S. degree in electricalengineering from Tsinghua University, Beijing, Chinain 2001 and 2003. She received her PhD degree inelectrical engineering from Stanford University in 2008.From 2008 to 2012, she was a research associate atStanford University. Since 2012, she has been an assistantprofessor in the Aerospace Engineering Department atUniversity of Illinois at Urbana-Champaign. Her researchinterests are systems, signals, control, and robotics. Sheis a senior member of IEEE and a member of ION.

Abstract—Direct GPS Positioning (DP) is a robust method thatestimates the GPS navigation solution directly from the receivedGPS signal. In contrast, traditional methods, such as scalartracking and vector tracking, compute intermediate channelrange and range residual measurements independently, then usethese as inputs into the navigation filter to estimate the navigationsolution. However, a brute force implementation of DP is notcomputationally efficient. Our research contribution is to evaluatethe robustness of DP using our more computationally efficientDP implementation.

Our novel and effective DP receiver architecture initializesthe navigation solution guesses as two groups: guesses varyingin position and clock bias, guesses varying in velocity and clockdrift. We then perform vectorized calculations to get the expecteddelay and doppler between the receiver and each satellite inview. Following that, we perform batch calculations using FastFourier Transforms (FFTs) to obtain the vector correlation andvector spectrum. The navigation solution residual derived fromthe vector correlation and vector spectrum is then used as inputinto the navigation filter.

We implemented our receiver architecture using our researchplatform - PyGNSS. We then evaluated the robustness of our DPreceiver architecture by subjecting it to simulated jamming andmeaconing attacks. We demonstrate through our experiments therobustness of our DP receiver architecture.

Yuting Ng and Grace Xingxin Gao are with the Department of AerospaceEngineering at the University of Illinois at Urbana-Champaign, Urbana, IL61801, USA. http://gracegao.ae.illinois.edu/

I. INTRODUCTION

Direct GPS Positioning (DP) directly estimates and tracks thenavigation solution from the received raw GPS signal [1],[2]. This is unlike traditional scalar tracking which estimateschannel range and range rate measurements independently,then solves for the navigation solution via trilateration [3]–[7]. Similarly, traditional vector tracking also produces thechannel range and range rate residuals independently [8]–[11].Channel measurements estimated using traditional methods aredegraded under signal multipath and obstruction [12], [13],leading to errors in the navigation solution. On the other hand,the shape of the vector correlation in DP is robust to signalmultipath and obstruction, leading to a more robust navigationsolution [14], [15].

In our prior work, we have implemented a different DPreceiver architecture from the DP receiver architecture pre-sented in this paper. That architecture uses coherent vectorcorrelator measurements with the Unscented Kalman Filter(UKF). Scalar tracking provided the carrier phase measure-ments to enable the coherent vector correlator. Live experi-ments were conducted and the results were analyzed for bothstatic and dynamic scenarios. In addition, we have provideda theoretical proof that direct acquisition is more robust thanscalar acquisition under meaconing scenarios. We also showedthat direct positioning is more robust to jamming than scalarpositioning using simulated noise [1].

Work by other researchers can be grouped into two cate-gories: direct acquisition and tracking. Direct acquisition, alsoknown as collective detection can be further separated intocoherent and noncoherent direct acquisition [2], [14]–[18]. Co-herent direct acquisition is too costly [2]. Noncoherent directacquisition has lower gain than coherent direct acquisition.However, the noncoherent method involved less computationand was shown to have superior detection to scalar acquisition[14], [15]. MATLAB implementations of direct acquisitionwas provided in [16], [17]. Simulations were used to comparethe performance of direct acquisition against scalar acquisitionby [19], [20]. A mathematical treatment was provided by [21]–[23]. With regards to tracking, a tracking loop for the vectorcorrelation was devised by [24], based on prior work [25].Also basing their work on a tracking loop was [26], [27].

Many of the above implementations were computationallyintensive, did not estimate and track the full navigation pa-rameters and did not provide a dedicated evaluation of DP’srobustness. Therefore, using our computationally efficient im-plementation of DP, we provide a dedicated evaluation of DP’srobustness through simulated jamming and meaconing attacks.

Page 2: Mitigating Jamming and Meaconing Attacks Using Direct GPS

2

The rest of the paper is organized as follows. Section II ofthe paper describes our computationally efficient DP receiverarchitecture used in this paper, with focus on obtaining thevector correlator and vector spectrum measurements, followedby subsequent tracking using a navigation filter. Section IIIof the paper discusses our implementation and experimentsbased on field data. We subjected our DP receiver to simulatedjamming and meaconing through post-processing using ourresearch platform - PyGNSS. We then compare the robustnessof DP against scalar tracking, in Section IV. Finally, SectionV summarizes the paper.

II. DIRECT GPS POSITIONING

DP estimates and tracks the underlying signal and nav-igation state parameter set of receiver position, clock bias,velocity and clock drift directly from the received raw GPSsignal. In other words, we are searching for the underlyingreceiver parameter set X that most likely generated the ob-served received GPS signal Y .

X : state vector of GPS receiver (1)

=

⇥x, y, z, c�t, x, y, z, c ˙�t

⇤T

Xi

: state vector of ith satellitex, y, z, c�t : 3D position coordinates, clock bias (m)x, y, z, c ˙�t : 3D velocity coordinates, clock drift (ms�1)

c : speed of light, 299792458 (ms�1)

Y : model of received GPS signal (2)=

XDi

(t)Gi

(f i

code

t+ �i

code

)ej2⇡(fi

carr

t+�

i

carr

)

Di

(t) : databit sequence of the ith satelliteGi

(t) : L1 C/A code sequence of the ith satellitef i

code

: code frequency of the ith satellite (3)

= fC/A

+

fC/A

fL1

⇥ f i

dcarr

�i

code

: code phase of the ith satellite (4)

=

�fC/A

c(

��Xx,y,z,ECI

�Xi

x,y,z,ECI

��

+(Xc�t

�Xi

c�t

))

f i

carr

: carrier frequency of the ith satellite (5)= f

IF

+ f i

dcarr

fIF

: intermediate frequency (IF), (Hz)f i

dcarr

: carrier doppler frequency of the ith satellite (6)

=

�fL1

c(�losi

x,y,z

· (Xx,y,z,ECI

�Xi

x,y,z,ECI

) + (Xc�t

�Xi

c�t

))

losix,y,z

: line of sight vector in ECI coordinates (7)

=

Xi

x,y,z,ECI

�Xx,y,z,ECI���X

x,y,z,ECI

�Xi

x,y,z,ECI

���

�i

carr

: carrier phase of the ith satellitefC/A

: frequency of C/A code, 1.023 (MHz)

fL1 : frequency of L1 carrier, 1575.42 (MHz)

The received GPS signal Y is a superposition of signalsY i received from satellites in view (2). Representing eachsatellite as a channel, the received GPS signal of each channelis governed by the channel delay and doppler parameters(�i

code

, f i

carr

). As shown, the channel parameters are a func-tion of the unknown receiver state X and the known satellitestates Xi through expected delay and doppler calculations (3-7). Thus, the received GPS signal Y can also be expressed asa function of the unknown receiver state X . The objective isthen to search for the best estimate of the receiver state X thatmost likely led to the received signal Y .

A. Efficient Search for Best Guess Navigation Solution

To speed up the search process, we first split the underlyingparameter set into two subsets:

Xxyz,c�t

: 3D position and clock bias parameters (8)

=

⇥x, y, z, c�t

⇤T

Xxyz,c�t

: 3D velocity and clock drift parameters (9)

=

⇥x, y, z, c ˙�t

⇤T

The parameters within each subset are interdependent. Theparameters across subsets are first order related in time andthus can be independently estimated at an instant in time. Wesearch for the 3D position and clock bias residual given thecurrent 3D velocity and clock drift. We also search for the 3Dvelocity and clock drift residual given the current 3D positionand clock bias. This was respectively achieved through carrierand code wipeoff of the received GPS signal on a per channelbasis. In addition, databit wipeoff, involving the removal of180 degrees carrier phase flips due to the navigation data bits,was performed using our research platform - PyGNSS.

Y i

carr wipeoff

= Y i

code only

⇡ Gi

(f i

code

t+ �i

code

) (10)

Y i

code wipeoff

= Y i

carr only

⇡ ej2⇡(fi

carr

t+�

i

carr

) (11)

After performing carrier and code wipeoff on the receivedGPS signal, estimation of the X

xyz,c�t

and Xxyz,c�t

parametersubsets then occur independently and in parallel, drasticallyreducing computational complexity and time.

Estimation of the Xxyz,c�t

parameter subset was achievedthrough performing one correlation per channel. The codephase of the signal replica, which the received signal wascorrelated against, was first shifted by an amount determinedby the current 3D position and clock bias parameters. Seeequation (4) for the relationship between the code phase andthe 3D position and clock bias parameters. This shift allowsus to directly estimate the 3D position and clock bias residual�X

xyz,c�t

.Estimation of the X

xyz,c�t

parameter subset was achievedthrough performing one fourier transform per channel. Thecarrier frequency of the received signal was first shifted

Page 3: Mitigating Jamming and Meaconing Attacks Using Direct GPS

3

Fig. 1. Plot of normalized correlation amplitude against residual code phaseshift (left); magnitude spectrum against residual carrier frequency shift (right).

by an amount determined by the current 3D velocity andclock drift parameters. See equation (6) for the relationshipbetween the carrier frequency and the 3D velocity and clockdrift parameters. This shift allows us to directly estimate thevelocity and clock drift residual �X

xyz,c�t

.For each channel, the normalized correlation magnitude

and frequency spectrum is shown in Fig.1. The triangularcorrelation peak and sinc spectrum peak would be shiftedproportional to �X

xyz,c�t

and �Xxyz,c�t

residuals. The widthof the triangular correlation is related to the code chip durationwhile the width of the sinc mainlobe is related to the coherentprocessing interval. The mathematical expressions describingthe correlation and spectrum peak is given as follows:

RY

i

code only

8<

:

(1 + (����)) , �1 < (����) 0

(1� (����)) , 0 < (����) 1

⇡ 0 , otherwise(12)

FY

i

carr only

⇡ Tcoh

sinc(⇡(f ��f)Tcoh

) (13)

=

sin(⇡(f ��f)Tcoh

)

⇡(f ��f)�� : residual code phase shift due to �X

xyz,c�t

�f : residual carrier frequency shift due to �Xxyz,c�t

Tcoh

: coherent integration period, 0.020s

To reiterate, the correlations help search through the firstparameter set, (x, y, z, c�t), while the frequency spectrumshelp search through the second parameter set, (x, y, z, c� ˙t). Assuch, carrier wipeoff is performed before the correlations andcode wipeoff is performed before the Fourier transform. OurDP implementation in this paper utilized a coherent integrationperiod of 20ms. The second step is generating the candidatereceiver state error vectors, with two sets, fixed velocityand fixed position. The third step is assigning correlationamplitudes and spectrum magnitudes from the correlationsand spectrums to the respective candidate receiver state errorvectors. The noncoherent sum of the correlation amplitudesand spectrum magnitudes across each channel forms the vectorcorrelation and vector spectrum. The fourth step estimates theerror input vector e as the weighted mean of the candidatereceiver state error vectors. The weights are determined fromthe vector correlation and vector spectrum. In this effective andefficient manner, the input to the joint tracking and navigationfilter is generated.

Fig. 2. DP process flow, obtaining the error input vector e and error noisecovariance matrix W . The number of 3D position and clock bias candidatescan differ from the number of 3D velocity and clock drift candidates. In thefigures above, they are labeled as M and N with indexes j and k respectively.

B. Estimation and Filtering

The joint tracking and navigation filter used in our effec-tive and computationally efficient implementation of DP is aKalman Filter (KF) [28], [29]. Since we are obtaining directmeasurements of the state parameters, the geometry matrixis an identity matrix and the equations can be drasticallysimplified.

Page 4: Mitigating Jamming and Meaconing Attacks Using Direct GPS

4

The KF measurement update at epoch k:

e : error input vector (14)= e(�X

x,y,z,c�t

,�Xx,y,z,c�t

)

= [�x,�y,�z,�c�t,�x,�y,�z,�c ˙�t]T

W : error noise covariance input matrix (15)= W (W�X

x,y,z,c�t

,W�X

x,y,z,c�t

)

K : Kalman gain matrix (16)=

ˆ

k

HT

(H ˆ

k

HT

+W )

�1

�X : state error vector (17)= Ke

ˆ

k

: predicted state error covariance matrixH : geometry matrix (18)

= I8, 8x8 identity matrixX

k

: corrected state vector (19)=

ˆXk

+�X

k

: corrected state error covariance matrix (20)= (I �KH)

ˆ

k

The error noise covariance input matrices are estimatedusing 20 past error input vectors. The KF update interval �Tis set to be the same as the coherent integration interval T

coh

.Having �T = T

coh

removes the need for measurement inter-polation. Using our flexible research platform - PyGNSS, weare not limited to a T

coh

of 20 milliseconds, as shown in ourwork on joint GPS and vision direct positioning [30]. A T

coh

of 20 milliseconds was selected for this paper as it allows usto conveniently compare our results against literature. A T

coh

of 20 milliseconds was also used in our work on Direct TimeEstimation [31]. We performed navigation bit wipe-off suchthat the KF update interval and coherent integration period issynchronous across channels and can straddle navigation bitboundaries.

The KF time update equations at epoch k + 1:

ˆXk+1 : predicted state vector (21)

= FXk

ˆ

k+1 : predicted state error covariance matrix (22)= F⌃

k

FT

+Qk

F : state propagation matrix (23)= F (�T )

=

2

66666666664

1 0 0 0 �T 0 0 0

0 1 0 0 0 �T 0 0

0 0 1 0 0 0 �T 0

0 0 0 1 0 0 0 �T0 0 0 0 1 0 0 0

0 0 0 0 0 1 0 0

0 0 0 0 0 0 1 0

0 0 0 0 0 0 0 1

3

77777777775

�T : update interval, 0.020 (s) (24)

Qk

: state process noise covariance matrix (25)

= F

0 0

0 Qv,k

�FT

Qv,k

: velocity and clock drift component of Qk

(26)

=

2

664

f(vk

) 0 0 0

0 f(vk

) 0 0

0 0 f(vk

) 0

0 0 0 (c⇥ �⌧

)

2

3

775

�⌧

: allan deviation of the frontend oscillator, (s)f(v

k

) : saturation function for velocity vk

(27)= 1 + 250/(min(max(v2

k

, 52), 252))

The initial predicted state error covariance matrix ˆ

⌃0 isinitialized using 20 past state vectors and should be similar inorder of magnitude to the initial state process noise covariancematrix Q0. In addition, since we are using a constant accel-eration model, for dynamic scenarios such as that on a roadvehicle, vehicle accelerations are addressed through a time-varying state process noise covariance matrix, Q

k

[32], [33],set using a saturation function f(v

k

) on a 20 sample runningaverage amplitude of the receiver’s velocity v = ||x, y, z||. Thecoefficients of the saturation function were determined from aleast squares fit to acceleration time data of a generic vehicleby [33]. The allan deviation of the frontend oscillator can beobtained through the manufactorer’s datasheet [34].

III. IMPLEMENTATION AND EXPERIMENT SETUP

This paper evaluates the robustness of DP under stressfulconditions. We do so using simulated jamming and meaconinginput signals and our research platform - PyGNSS.

We generated the input signals in the following manner:1) A “clean” signal is first collected under an ideal, open-

sky environment, jamming and meaconing is absent.2) The “clean” signal is then processed to simulate two

significant forms of attacks, jamming and meaconing.The methods used to simulate these attacks are discussedbelow. In addition, in order to provide a deeper analysis,the “severity” of the attacks is adjusted by changing theamplitude of the attacking signal.

3) The attacked signal is then fed into both DP and scalartracking receiver architectures. A comparison of thetracking results is then provided.

We simulated the following two attacks on the clean signal:• Jamming: A random complex voltage V = A cos� +

jA sin� is added to each sample, where A ⇠ N (0,�A

)

and � ⇠ U(0, 2⇡). In other words, a white noisesignal with Gaussian distributed amplitude and Uniformdistributed phase is superposed onto the original cleansignal to simulate the jamming effect. In addition, byincreasing the standard deviation of the amplitude �

A

,we are effectively simulating a stronger jamming source.

• Meaconing: Another signal collected at a separate lo-cation and/or a separate time, known as the meaconingsignal is superposed on the clean signal. The meaconingsignal attempts to deceive the receiver into an incorrectnavigation solution by “covering” the original received

Page 5: Mitigating Jamming and Meaconing Attacks Using Direct GPS

5

Fig. 3. DP remains robust while scalar tracking is degraded by jamming.The different jamming scenarios are color-coded and superposed on the sameplot. Without loss of generality, shown are the estimated code and carrierfrequencies for one of the satellites in view.

signal. In our simulation, the meaconing signal is col-lected from a receiver location 1.25 miles away from theoriginal signal.

IV. RESULTS AND ANALYSIS

During a regular tracking scenario where there is neithermeaconing nor jamming, both DP and scalar tracking receiverarchitectures easily track both code and carrier frequencies,fc

and fi

, successfully. We then evaluate how jamming andmeaconing attacks impact the performance of DP as well asscalar tracking.

1) Jamming: As the noise floor is raised by increasing thejamming amplitude through the parameter �

A

, DP remainsrobust whereas the tracking performance of scalar trackingis degraded. This is shown in Fig.3 where the results fromdifferent jamming scenarios are color-coded and superposed.

2) Meaconing: A meaconing signal from 1.25 miles awayis unable to significantly deceive the DP receiver that is alreadytracking onto the authentic signal. In order to deceive theDP receiver, the meaconing signal has to first fall within themain lobe then have similar process parameters. As such, itis expected for the DP receiver to remain robust to the abovementioned meaconing signal. The meaconing signal then actslike a jamming signal. Results are shown in Fig.4.

V. CONCLUSION

Direct Positioning (DP) has the potential to outperformtraditional methods, such as scalar tracking and vector track-ing, in terms of robustness. This is because it utilizes in-formation from the entire raw received signal to generatedirect measurements of the navigation solution. However, itis not widely implemented as previous implementations ofDP are not computationally efficient. To shake up the status-quo, we proposed and implemented a novel, effective andcomputationally efficient DP receiver architecture and wenton to provide a dedicated evaluation of its robustness.

We subjected our DP receiver architecture to simulatedjamming and meaconing attacks. We did so by collecting GPS

Fig. 4. DP remains robust while scalar tracking is degraded by meaconing.The different meaconing strengths of no meaconing, 5:1 meaconing and 10:1meaconing are color-coded and superposed on the same plot. Without loss ofgenerality, shown are the estimated code and carrier frequencies for one ofthe satellites in view.

signals in benign environments then post-processing them intoattacked signals using our research platform - PyGNSS. Weinput the attacked signals into our DP receiver architecture,benchmarking the tracking results against scalar tracking.We demonstrated with our DP receiver architecture, DP’srobustness, as compared to scalar tracking, with respect tojamming and meaconing attacks.

ACKNOWLEDGMENT

Special thanks to Ganshun Lim for his continuous support,Arthur Hsi-Ping Chu for running the jamming and meaconingsimulations, Sri Ramya Bhamidipati for kindly proofreadingthe paper.

REFERENCES

[1] A. Ramesh Kumar, “Direct position tracking in GPS using vectorcorrelator,” Master’s thesis, University of Illinois at Urbana-Champaign,2015.

[2] R. DiEsposti, “GPS PRN code signal processing and receiver designfor simultaneous all-in-view coherent signal acquisition and navigationsolution determination,” in Proceedings of the 2007 National TechnicalMeeting of The Institute of Navigation, 2001, pp. 91–103.

[3] E. Kaplan, C. Hegarty, P. Ward, and J. Betz, Understanding GPS: Princi-ples and applications 2nd ed. Boston: Artech House, 2006, ch. Chapter5: Satellite Signal Acquisition, Tracking, and Data Demodulation, pp.153–240.

[4] P. Misra and P. Enge, Global Positioning System: Signals, Measurementsand Performance Second Edition. Lincoln, MA: Ganga-Jamuna Press,2006.

[5] P. Ward, “The natural measurements of a GPS receiver,” in Proceedingsof the 51st Annual Meeting of the Institute of Navigation, 1995, pp.67–85.

[6] B. W. Parkinson, Progress in Astronautics and Aeronautics: GlobalPositioning System: Theory and Applications. Aiaa, 1996, vol. 2.

[7] M. S. Braasch and A. Van Dierendonck, “GPS receiver architecturesand measurements,” Proceedings of the IEEE, vol. 87, no. 1, pp. 48–64,1999.

[8] Y. Ng and G. X. Gao, “Advanced multi-receiver vector tracking forpositioning a land vehicle,” in Proceedings of the 26th InternationalTechnical Meeting of the Satellite Division of the Institute of Navigation(ION GNSS+ 2014), Tampa, Florida, 2015.

[9] S. Bhattacharyya, “Performance and integrity analysis of the vectortracking architecture of GNSS receivers,” Ph.D. dissertation, Universityof Minnesota, 2012.

Page 6: Mitigating Jamming and Meaconing Attacks Using Direct GPS

6

[10] J. J. Brewer, “The differential vector phase-locked loop for globalnavigation satellite system signal tracking,” Ph.D. dissertation, Air ForceInstitute of Technology, 2014.

[11] J. J. Spilker Jr, “Vector delay lock loop processing of radiolocationtransmitter signals,” Mar. 14 1995, uS Patent 5,398,034.

[12] P. W. Ward, “Performance comparisons between FLL, PLL and anovel FLL-assisted-PLL carrier tracking loop under RF interferenceconditions,” in Proceedings of the 11th International Technical Meetingof the Satellite Division of The Institute of Navigation (ION GPS 1998),1998, pp. 783–795.

[13] P. W. Ward and T. D. Fuchser, “Stability criteria for GNSS receivertracking loops,” Navigation, vol. 61, no. 4, pp. 293–309, 2014.

[14] P. Axelrad, B. K. Bradley, J. Donna, M. Mitchell, and S. Mohiuddin,“Collective detection and direct positioning using multiple GNSS satel-lites,” Navigation, vol. 58, no. 4, pp. 305–321, 2011.

[15] P. Axelrad, J. Donna, and M. Mitchell, “Enhancing GNSS acquisition bycombining signals from multiple channels and satellites,” in Proceedingsof the 22nd International Technical Meeting of The Satellite Division ofthe Institute of Navigation (ION GNSS 2009), 2001, pp. 2617–2628.

[16] J. W. Cheong, J. Wu, A. G. Dempster, and C. Rizos, “Efficientimplementation of collective detection,” in IGNSS symposium, 2011, pp.15–17.

[17] ——, “Assisted-GPS based snap-shot GPS receiver with FFT-accelerated collective detection: Time synchronisation and search spaceanalysis,” in 25th International Technical Meeting of the satellite Divi-sion of the Institute of Navigation (ION GNSS 2012), Nashville USA.Citeseer, 2012, pp. 2357–2370.

[18] L. R. Paulo Esteves, Mohamed Sahmoudi, “Collective detection of multi-gnss signals,” InsideGNSS, pp. 54–65, may 2014.

[19] O. Bialer, D. Raphaeli, and A. J. Weiss, “Maximum-likelihood directposition estimation in dense multipath,” Vehicular Technology, IEEETransactions on, vol. 62, no. 5, pp. 2069–2079, 2013.

[20] A. J. Weiss, “Direct position determination of narrowband radio fre-quency transmitters,” Signal Processing Letters, IEEE, vol. 11, no. 5,pp. 513–516, 2004.

[21] P. Closas, C. Fernandez-Prades, J. Fernandez-Rubio et al., “Maximumlikelihood estimation of position in GNSS,” Signal Processing Letters,IEEE, vol. 14, no. 5, pp. 359–362, 2007.

[22] P. Closas, C. Fernandez-Prades, J. Fernandez-Rubio et al., “Cramer–raobound analysis of positioning approaches in GNSS receivers,” SignalProcessing, IEEE Transactions on, vol. 57, no. 10, pp. 3775–3786, 2009.

[23] ——, “A bayesian approach to multipath mitigation in GNSS receivers,”Selected Topics in Signal Processing, IEEE Journal of, vol. 3, no. 4, pp.695–706, 2009.

[24] J. Liu, X. Cui, M. Lu, and Z. Feng, “Direct position tracking loopbased on linearised signal model for global navigation satellite systemreceivers,” IET Radar, Sonar & Navigation, vol. 7, no. 7, pp. 789–799,2013.

[25] ——, “Vector tracking loops in GNSS receivers for dynamic weaksignals,” Systems Engineering and Electronics, Journal of, vol. 24, no. 3,pp. 349–364, 2013.

[26] F. D. Nunes, J. Marcal, and F. M. Sousa, “Low-complexity VDLLreceiver for multi-GNSS constellations,” in Satellite Navigation Tech-nologies and European Workshop on GNSS Signals and Signal Process-ing (NAVITEC), 2010 5th ESA Workshop on. IEEE, 2010, pp. 1–8.

[27] T. Lin, J. T. Curran, C. ODriscoll, and G. Lachapelle, “Implementationof a navigation domain GNSS signal tracking loop,” in Proceedings ofION GNSS, 2011, pp. 3644–3651.

[28] R. E. Kalman, “A new approach to linear filtering and predictionproblems,” Journal of Fluids Engineering, vol. 82, no. 1, pp. 35–45,1960.

[29] R. E. Kalman et al., “Contributions to the theory of optimal control,”Bol. Soc. Mat. Mexicana, vol. 5, no. 2, pp. 102–119, 1960.

[30] Y. Ng and G. X. Gao, “Joint GPS and vision direct position estimation,”in Proceedings of the 2016 IEEEION Position Location and NavigationSymposium (IEEEION PLANS 2016), Georgia, Savannah, 2016.

[31] ——, “Robust GPS-based direct time estimation for PMUs,” in Proceed-ings of the 2016 IEEEION Position Location and Navigation Symposium(IEEEION PLANS 2016), Georgia, Savannah, 2016.

[32] F. D. Busse, J. P. How, and J. Simpson, “Demonstration of adaptiveextended Kalman filter for low-earth-orbit formation estimation usingCDGPS,” Navigation, vol. 50, no. 2, pp. 79–93, 2003.

[33] Mathworks. (2015, jun) State estimation us-ing time-varying kalman filter. [Online]. Avail-able: http://www.mathworks.com/help/control/getstart/estimating-states-of-time-varying-systems-using-kalman-filters.html

[34] Microsemi. (2015, jun) Quantum chip scale atomic clock productinfo. [Online]. Available: http://www.microsemi.com/products/timing-synchronization-systems/csac#product-info