options for mitigating potential gps vulnerabilities · options for mitigating potential gps...

WHITE PAPER

Options for Mitigating Potential GPS Vulnerabilities

of 5

GPS receivers have been widely used in communications infrastructure to provide precise time and frequency required to synchronize wireless base stations to ensure seamless call handoff, quality streaming video and location based services such as car navigation systems and most notably E911 services in the US. However, recent events have shown that GPS is susceptible to interference from deliberate spoofing and jamming techniques which can seriously disrupt or even completely disable GPS dependent applications and natural outages as with urban canyons.

GPS jamming is a deliberate attempt to disrupt GPS services. Service disruption can occur at local, regional and national levels. Locally, fleet truck drivers and car thieves often use jamming devices to avoid tracking and detection. One notable example of national level jamming occurred on March 5th, 2011, when North Korea jammed South Korea’s wireless communications infrastructure knocking out many base stations.

GPS spoofing occurs when a GPS signal appears to the receivers to be a valid signal but the frequency, position, and/or Time of Day content is altered. Increased availability of low-cost, commercially available jamming and spoofing devices that can be purchased at local electronics stores has greatly increased GPS vulnerabilities.

This white paper will discuss mitigation options for interference to GPS installations and introduce a new packet-based primary reference source from Symmetricom® called TimeProvider® 1500 as a viable alternative to protect from GPS vulnerabilities.

WHITE PAPER

LightSquaredThe FCC recently approved use of satellite L-band spectrum (1525-1559 MHz and 1626.5-1660.5 MHz) for terrestrial mobile services. Due to the proximity of the L-band spectrum to the GPS band (1560-1610 MHz), questions have been raised regarding potential interference to existing GPS Antenna installations.

If a LightSquared L-band transmitter is installed at or near the location of an existing GPS antenna the GPS signal can be affected. Care must therefore be taken to assure that the GPS antenna is not in the direct beam of the L-band transmitter if located within 1200 meters. The potential impact is greatest for sites where the antennas are colocated such as base station sites.

There are 3 mitigation options available to protect GPS vulner-abilities :1. Locate the GPS antenna such that it is not in the direct beam of

the LightSquared L-band transmitter,

2. Replace the GPS antenna with a model incorporating enhanced narrow band filtering (not available in all cases), or

3. Install a packet-based primary reference source (PRS) that has rubidium to guarantee holdover to deliver precise frequency and timing.

GPS Antenna Relocation Option:Primary Reference Sources (PRS), which typically use GPS to distribute precise synchronization to all network elements, are typically located at telecom central offices or mobile switching centers. These locations are usually the primary synchronization source for those locations.

For sites where near-proximity to a LightSquared transmitter is a major concern, there are a number of options to facilitate antenna placement in a location not in the direct beam of the LightSquared transmitter:

• Roof top antenna

• Wall-mount antenna

• Window antenna

With flexible antenna mounting and location options, it is generally possible to select an antenna mounting location that is safe from potential near-proximity direct beam interference. However, this solution is viewed as temporary and the interference issue can reappear as new sites are installed by LightSquared.

GPS Antenna Filtering Option:For sites where antenna relocation is not a viable option, some commercial GPS antenna manufacturers are offering special L1 antennas with enhanced filtering to mitigate potential L-Band interference. It must be noted that the filtering option may reduce

but not necessarily eliminate potential interference with GPS signals as a result of close proximity to a LightSquared L-Band antenna.

This is especially true in applications using wall-mount antennas, since there are no enhanced filtering capabilities available for these antennas.

Packet PRS Option:The optical solution is the implementation of a packet-based PRS synchronization such as the TimeProvider 1500 (TP1500) which utilizes IEEE 1588-2008 to deliver a Stratum 1 frequency and timing source without requiring a GPS antenna.

The TimeProvider 1500 Packet PRS, is the first non-GPS, non-Cesium primary reference source, combining the power of Rubidium holdover technology with advanced IEEE 1588-2008 soft clock algorithms to provide a Stratum 1 PRS in compliance with industry PRS standards.

TimeProvider 1500 meets or exceeds the most stringent test criteria required to claim Stratum 1 level PRS performance: it fully complies with the ITU-T G.811 Stratum 1 and GR 2830 PRS performance specifications and also meets the ITU-T G.8261 specification for providing precise timing over IP, packet-based networks. TimeProvider 1500 is ideal for situations where antenna relocation or filtering is not sufficient to eliminate the threat of GPS signal interference. The TP1500 Packet PRS locks to an IEEE 1588-2008 grandmaster located at a primary reference clock site equipped with protected GPS and/or Cesium standards. Symmetricom’s advanced IEEE 1588 locking algorithms and miniature atomic clock technologies combine to enable the TP1500 Packet PRS to deliver PRS level synchronization without the need for a GPS antenna.

LTE Network Architecture Favors IEEE 1588-2008Mobile network architecture is undergoing changes to prepare for the deployment of 4G/LTE infrastructure to deliver higher bandwidth solutions and services to subscribers. First, backhaul networks are transitioning from TDM to Ethernet to efficiently deliver higher bandwidth services and lower overall operating costs. With the transition to Ethernet, the physical layer synchronization chain is broken when access to the legacy TDM reference inputs are removed.

Secondly, 4G/LTE mobile infrastructure is shifting towards small cells/femtocells making it economically prohibitive to deploy GPS receivers at every base station.

Lastly, with GPS known vulnerabilities to jamming and spoofing, networks require an alternative to deliver precise timing and synchronization to ensure service delivery across the network.


of 5

WHITE PAPER

of 5


To future proof networks and ensure optimal reliability throughout the network, there is a compelling need for a stable, cost-effective, and robust packet PRS that will provide synchronization for packet networks.

Until recently, there have only been two types of primary reference (PRS) available:

• Cesium

• GPS

Standalone Cesium PRS atomic clocks are simple to install and robust because they do not receive timing based on an external signal but generate it internally. However, they in practice are restricted to core sites of the network.

GPS-based PRS on the other hand may be lower cost initially, but can have high set up costs because deployment requires the installation of a GPS receiver, an antenna, and cables, and requires roof and cable run access. GPS systems are also limited to locations with “line of sight” visibility to the satellites from which they derive timing, and so cannot operate in urban “canyons.”

There is now a third PRS option from Symmetricom utilizing packet-based technology based on IEEE1588-2008 that does not use a GPS antenna. Based on a Precision Timing Protocol (PTP) reference derived from a centralized IEEE 1588 PTP grandmaster clock, Packet PRS provides Stratum 1 quality clock timing input over an Ethernet infrastructure to a Synchronization Supply Unit (SSU) and is ideal to use in core and colocation sites as standalone PRS or as a backup to GPS as displayed in the Primary Reference Source Hierarchy shown in Figure 1.

Traditional Network SynchronizationAll nodes in a synchronized communications network must be referenced, or traceable, to a PRS that offers Stratum 1 performance in accordance with recognized industry standard ITU-T G.811. In traditional Time Division Multiplexed (TDM) digital communications networks, sync was maintained by employing two types of synchronization element, Primary Reference Clocks (PRC) and distribution clocks, over a physical circuit. The PRC or PRS (using either Cesium or GPS) provides the reference frequency signal for the synchronization of other clocks within a network, or section of a network. Distribution clocks (called BITS, SSU or SASE depending on configuration, region deployed, and the specific standards body) select one of the external synchronization links coming into a station as the active synchronization reference. The synchronization from a PRS site to the SSU/BITS is carried over SONET/SDH networks using derived T1/E1 signals from the optical line rate. The high availability requirement of SDH-based networks mandates the use of multiple site PRS preferably located in different geographical regions. As displayed in the Current TDM Network in Figure 2.

SSU/BITS

Master Site ASSU/BITS at the Remote Site C uses DerivedT1/E1 input references line timed fromSONET/SDH rings.

SONET/SDH RING

SONET/SDH RING

DACS

SSU/BITS

Master Site B

Line Timed DS1

TDM

TDM

DACS

SSU/BITS

Remote Site C

TDM

TDM

TDM

OC-48

OC-48

OC-192

OC-192

DeliveredT1/E1

Figure 1: Primary Reference Source Hierarchy

Figure 2: Current TDM Network

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

PrimaryReference Sources

GPSPacket-based

Cesium

GPS

• Standalone Atomic PRC• Fully autonomous• Core Sites – Pinnacle

of sync hierarchy• Frequency Accuracy

± 1 x 10-12

• Flatten sync hierarchy• Distributed in core and edge• Requires GPS antenna installation• Frequency Accuracy ± 1 x 10-12

• IEEE 1588 PTP based PRS• Standalone PRC or backup to GPS• No external GPS antenna• Requires PTP grandmaster• Frequency Accuracy ± 1 x 10-12

WHITE PAPER

of 5


The Synchronization of Packet–Based NetworksThe migration of TDM networks to packet-based Carrier Ethernet or IP/MPLS networks will cause the synchronization chain to break; the Ethernet network elements cannot deliver frequency synchronization when T1/E1 input references are removed. As displayed in New Ethernet Network in Figure 3, the SSU/BITS can be front-ended with an IEEE 1588 PTP slave clock—the Packet PRS—which delivers PRS quality T1/E1 to the SSU clocks. The Packet PRS receives timing from one or more central IEEE 1588 grandmaster clocks co-located with a GPS or cesium PRS. When using such a Packet PRS the network should be setup to deploy IEEE 1588 grandmaster (or 1588 PTP grandmaster Blades in the SSU/BITS) in geographically redundant Central Offices (CO) for diversity based risk mitigation as displayed in PRS Distribution in Rubidium Performance in Packet PRS in Figure 4.

How Packet PRS WorksUsing a rubidium miniature atomic clock combined with a state of the art Soft Clock 2.0 algorithm, Packet PRS reconstructs a PRS Stratum 1 quality clock from the IEEE 1588 PTP packets coming from a grandmaster in a central site, thus maintaining the synchronization chain that is otherwise missing in the packet network. The 1588 packets are converted into T1/E1 signals that meet the G.811/ST1 PRS mask.

To function in this capacity, Packet PRS must comply with industry standards and follow the specifications for a Stratum 1 clock as defined in ITU-G.811. Symmetricom test results show that even after losing PTP reference for up to 48 hours (bridging + holdover), the wander in output in the Packet PRS is still within the MTIE mask. These results meet and exceed Telcordia GR 2830 requirement section 6.4.2: “Upon losing reference, output shall maintain PRS performance for at least 6 hours and unacceptable region should not be entered for the first 48 hours after the allowed impairment,” as displayed in Rubidium Performance in Packet PRS in Figure 4.

SSU/BITS

Master Site A

Problem• Ethernet NE no longer requires

Frequency Synchronization

• Loss of Derived T1/E1 Input referenceto SSU/BITS at Remote Site C

• Building restricts antenna installation

• Cesium too expensive, single reference solution

Metro Ethernet

Metro Ethernet

DACS

SSU/BITS

Master Site A

Ethernet

TDM

TDM

DACS

SSU/BITS

Remote Site C

TDM

TDM

TDM

MSPP

MSPP

MSPP

MSPP

Ethernet

X

X

X

X

Figure 3: New Ethernet Network

Figure 4: Rubidium Performance in Packet PRS

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

WHITE PAPER

2300 Orchard Parkway San Jose, California 95131-1017 tel: 408.433.0910 fax: 408.428.7896 www.symmetricom.com

©2011 Symmetricom. Symmetricom and the Symmetricom logo are registered trademarks of Symmetricom, Inc. All specifications subject to change without notice.

WP/MitigatingGPSVulnerabilities/051411


Packet PRS BenefitsTimeProvider 1500 applications include, but are not limited to, GPS difficult sites with no roof access, sites with an unreliable GPS signal as in urban canyons or tunnels, sites vulnerable to GPS interference due to jamming and spoofing, and as a back-up to GPS supporting frequency and time services. The ability to synchronize to another non-colocated grandmaster clock over a packet-based network ensures 24/7/365 availability in the event of GPS service interruption.

As Ethernet replaces TDM, creating a hybrid network, some SSU/BITS will lose their synchronization source. Front-ending these downstream clocks with TimeProvider 1500 Packet PRS will enable them to continue supplying synchronization to both SDH/SONET and Synchronous Ethernet infrastructure environments in the hybrid network that will be the reality for most operators for a considerable time.

Moreover, TimeProvider 1500 can serve as a tool for carriers seeking to provide accurate one-way Service Level Agreement (SLA) measurements to their enterprise account customers. The IEEE 1588 is a server/client time transfer protocol allowing client engines to be embedded in network endpoints for accurate time synchronization enabling accurate one-way SLA measurements.

Both innovative and unique, the TimeProvider 1500 delivers the precise and accurate synchronization that networks require as they migrate from TDM to next generation synchro nous-aware packet-based technologies, as displayed in the PRS Deployment Chart shown in Figure 5.

Conclusion Packet PRS solutions, like the TimeProvider 1500, not only mitigate but totally eliminate potential GPS interference from LightSquared antenna sources since there is no GPS required at Packet PRS locations. Carriers now have a new choice for deployment and diversity of primary reference sources in their networks to overcome GPS vulnerabilities. The TimeProvider 1500 provides a secure and cost effective solution to support rapid migration to Carrier Ethernet in the core, and is immune to potential GPS antenna vulnerabilities such as interference or jamming. Symmetricom has combined the innovative technologies of its Rubidium oscillator and IEEE1588 PTP Soft Clock algorithm to deliver the stable robust timing required by today’s evolving networks.

Figure 5: PRS Deployment Chart

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Type of Primary Reference Source Antenna Type Telecom Outputs Equipment

CostsInstall Complexity Main Applications

Standalone Cesium Atomic Clock None T1 (DS1) /E1

10MHz/1PPS High Low• Pinnacle of the sync hierarchy; used in core sites• Source of sync for SSU/BITS SONET/SDH Hubs

and ADMS class 5/End office

GPS-Based Reference Clocks

Window Wall Rooftop

T1 (DS1) /E1 10MHz/1PPS TOD

Medium High

• Offices with line of sight visibility to satellite • Decentralized synchronization nodes in a

distributed sync network • SONET/SDH Hubs and ADMS• Synchronous Ethernet

IEEE 1588 PTP Packet-Based Clock None T1 (DS1) /E1

10MHz/1PPS TOD Low Medium

• Used in core and colocation sites as standalone PRS or as a backup to GPS-based PRS

• Provides sync input to an SSU/BITS based on an external PTP reference from a GMC in a master site

• GPS difficult sites• SONET/SDH Hubs and ADMS• Synchronous Ethernet

options for mitigating potential gps vulnerabilities · options for mitigating potential gps...

Documents