Demonstrating Single Element Null Steering Antenna Direction Finding for Interference Detection

Use of Global Navigation Satellite Systems (GNSS) in safety of life applications such as aircraft navigation, railway control and autonomous vehicles is increasing as these technologies become more necessary or mainstream. To serve these applications, GNSS must provide high integrity, even in the face of deliberate attacks such as spoofing. The Stanford dual polarization antenna (DPA) is a technology that uses a single patch antenna but with two feeds to examine both left and right hand circularly polarized (LHCP and RHCP, respectively) signals. Proper design and installation allows the DPA to use polarization of the incoming signal to determine direction of arrival (DOA) and elevation. These measures can be used to discriminate a genuine from a bogus broadcast. The technology can also null out some interference signals. This paper examines the continued development and field tests of our DPA. Test with genuine on-air signals have shown the ability to determine DOA and elevation. Field test in on-air spoofing and jamming conditions were also conducted. These scenarios allow us to demonstrate the performance of the DPA processing, DOA and elevation estimates. INTRODUCTION The openness of Global Navigation Satellite Systems (GNSS) satellite signals has enabled its rapid adoption worldwide. It allows a variety of manufacturers to develop and improve receiver designs enabling a variety of applications. However, this openness also makes GNSS vulnerable to attacks such as spoofing. This threat will only increase in the future. The means of conducting such an attack are becoming more obtainable. For example, security experts with basic GNSS knowhow were able Proceedings of the 2018 International Technical Meeting, ION ITM 2018, Reston, Virginia, January 29-February 1, 2018 240 to develop a low cost, flexible spoofer [1]. Furthermore, the incentives for such attacks increase due to increased economic and safety uses of GNSS. Indeed, deliberate GNSS spoofing attacks are no longer theoretical or purely in the military domain. In the past year, spoofing attacks have been seen in the Kremlin and Black Sea [2] [3]. Given the severity of spoofing on safety of life and economic activities, some anti-spoofing (A/S) mechanism is desirable in any critical GNSS receiver. One important A/S function is to detect the presence of spoofing. Such detection is usually based on finding telltale signatures left by a spoofing signal that differ from the genuine. Different categories of detection techniques have been devised [4][5][6]. In this paper, we develop and analyze detection using a dual polarization antenna (DPA) to examine the signal in space properties. Specifically the DPA provides right and left-hand circularly polarized (RHCP and LHCP, respectively) components of the received signals. For a good DPA design and installation and a ground-based (i.e. low elevation) spoofer, these properties will often differ between the genuine and spoofed signal. These differences allows for determining the direction of arrival (DOA) and the rough elevation of the incoming signal. A single antenna spoofer can thus be detected as all its spoofed satellite signals will come from the same direction. Miniaturized versions of our DPA suitable for field-testing were developed [7]. These are built on a printed circuit board (PCB) and utilize surface mount components to combine the signals from the two feeds to a hybrid coupler to create both a RHCP and LHCP output. The design provides a small form factor antenna, suitable for aircraft installation that has elevation dependent sensitivity to an incoming signal. To demonstrate and quantify performance, these antennas were tested in several on-air scenarios. Tests with nominal, genuine GNSS signals only as well as with on-air spoofing and jamming were conducted. The paper details the signal processing and algorithms used by our DPA to determine DOA for spoof detection system. It also demonstrates the performance in various scenarios including on-air jamming and spoofing. Specifically, it shows the ability of the DPA in determining DOA. BACKGROUND One means to detect spoofing is to examine the physical properties of the incoming signal. Genuine GNSS signals have specified directions of arrival and specific polarizations (RHCP). Multi-antenna techniques have been suggested to examine DOA to detect spoofing [7][8][9]. Single spoofing antennas can only generate one DOA whereas the genuine satellite signals come from many DOAs. DOA-based spoof detection can be powerful but such techniques require either spatially separated antennas or multi-element antenna arrays. Large spatial separations require additional space and are more costly to install. For aviation installations, each antenna would need a separate hole and cable run through the aircraft body. Multi-element arrays have similar drawbacks as well as being restricted by International Traffic in Arms Regulations (ITAR) should there be four or more elements. An antenna sensitive to polarization to detect non-RHCP signals as being not genuine or multipath. Mayflower communications proposed such a concept for aviation spoof detection in the 1990s. However a spoofer can, with a little more work, replicate the polarization. The Stanford DPA concept addresses these limitations. It is small, utilizes a patch antenna and may be installed like a standard GNSS antenna. While it measures polarization, it does not rely on the spoofer using non-RHCP signals. Instead, it uses the measurements to determine DOA for spoof detection. The Stanford DPA design generates and uses the RHCP and LHCP components of a signal to determine the presence of interference and spoofing. GNSS signals are RHCP and generally come from above the antenna. The spoofing signal needs to be also seen as RHCP to be consistent. However, just generating a RHCP signal is not enough to fool the Stanford DPA if installed properly. This is because signals that impact the antenna ground plane before entering the antenna becomes linearly polarized regardless of their initial polarization. A linearly polarized signal has equal RHCP and LHCP components; the antenna can use this to determine and cancel spoofing. So any spoofing signal that comes in from the level of the vehicle (automobile, aircraft) or below will impact on the ground plane first. Hence, their orientation from below the horizon will be detectable by the DPA and this information can be used to detect spoofing. The concept is detailed in [10] and shown in Figure 1. This forces the attacker to take a position above the vehicle, perhaps using an unmanned aerial vehicle (UAV), which is much more challenging. Static spoofing placements such as on rooftops may be used but are limited in range.