Feasibility of CSAC-Assisted GNSS Receiver Fingerprinting in Dynamic Environments

Interference and jamming of Global Navigation Satellite System (GNSS) signals can lead to inaccurate Position, Velocity and Time (PVT) information which will result in crucial integrity and even security problems. The poor stability and accuracy of the GNSS receivers’ internal clocks, i.e. quartz oscillators, additionally impact the situation since the receiver is not able to detect the spoofing signals due to the low-quality oscillator. High-precision atomic clocks have been utilized to enhance GNSS PVT results. However, its large size, heavy weight and high-power consumption limit its deployment scenarios. Miniature atomic clock (MAC) is a promising alternative that trades off between the frequency stability and the limitations of an atomic clock.

This paper investigates the potential of chip-scale atomic clocks (CSACs) as external clocks of GNSS receivers for fingerprinting the receivers. Fingerprinting is referred to unique receiver clock features and it is characterized by receiver clock’s physical behavior like Allan Deviation (ADEV), Time Interval Error (TIE) and correlation between time series. Thus, derivation from this clock behavior can be used as an indicator for abnormal signal reception, e.g. by spoofing or jamming [1]. We gathered GNSS data observed in various scenarios. A kinematic car experiment was executed on a cart road of the south of Hannover surrounded by farmland six times [2]. About two-hours measurement data was received in 1Hz sampling rate. Another fast-driving experiment was conducted along the route consisting of a highway, an urban area in city Siegen, three tunnels and a small road with plaster, and an about 1.5 hours dataset was collected in 10Hz sampling rate. Then, a flight experiment was realized in Dortmund, with the same equipment setup and receiving about 2.5 hours data in 10Hz sampling rate [3]. For each kinematic experiment, a reference trajectory was obtained from high-quality Inertial Measurement Unit (IMU) and GNSS carrier phase measurements. Correspondingly, the operation setup of the same clocks was tested in a static condition. Each GNSS receiver of the same type (Javad TRE_G3T DELTA) either uses its internal clock, or is connected to one of the five CSACs or an atomic clock. The five CSACs, in chronological order of production, are Microsemi SA.45s CSAC, Jackson Labs CSAC, Jackson Labs OCXO, Spectratime LCR900, Microsemi MAC SA.35m. Besides, the high-precision atomic clock Standard Research Systems (SRS) PRS10 and the high-stability ovenized quartz oscillator SRS SC10 are treated as the reference. The combinations of the features, derived from the above three metrics which relate to the frequency stability of the clocks, are explored. We will show the feasibility of receiver fingerprinting with CSACs in different dynamic environments, and investigate the number of necessary features and the shortest data period to fingerprint the receivers.

 

[1] Borio, Daniele, et al. "Gnss receiver fingerprinting for security-enhanced applications." Proceedings of the 29th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2016). 2016.

[2] Krawinkel, Thomas. “Improved GNSS navigation with chip-scale atomic clocks.” München: Verlag der Bayerischen Akademie der Wissenschaften, 2018. 2018.

[3] Jain, Ankit, and Steffen Schön. "Influence of Receiver Clock Modeling in GNSS-based Flight Navigation: Concepts and Experimental Results." 2020 IEEE/ION Position, Location and Navigation Symposium (PLANS). IEEE, 2020.