In this paper, a Multi-Frequency and Multi-Purpose antenna is presented. The antenna is resonant at the “L5/E5a/b/E6” and “L1/E1bands”. GAMMA antenna will be Galileo compliant, able to use Galileo NMA signal for detecting spoofing signals and a closed loop for cancelling the interferers. Moreover, the spoofing detector will also use a 9 axis IMU to compare the inertial dynamic of the antenna with the GNSS dynamic and further detecting spoofing attacks. The antenna pattern will be monitored and controlled to point nulls in case of jamming.
GNSS receivers are widely used in the society today in several fields such as transportation, aviation, maritime, land resources and construction industry, daily life but also safety-critical applications. For many years jamming (intentional interference targeting the unavailability of the system) as well as spoofing (faking of a false position/time towards a target GNSS receiver) was no concern for nearly all users except the military. However, the scenario is changing in recent years. Several examples, in literature, can be mentioned over last decades when jammers have been used and affected GNSS receivers, both purposely and accidentally. In this context, a Galileo-based Multi-purpose and Multi-frequency Antenna (GAMMA) is under development by the consortium composed by Amphenol SAA KE of the EUSPA R&D funding programme “Fundamental Elements” which supports the development of EGNSS-enabled chipsets, receivers, and antennas. GAMMA is expected to provide spoofing detection and anti-jamming capabilities, able to counteract the effect of such threats on the GNSS signal, and thus significantly improve the performance of the receivers connected to the antenna and the whole system (in terms of continuity, availability, robustness, integrity). The antenna system uses signals from Galileo and GNSS constellations (with possible extension to other constellations such as Beidou, QZSS), providing multi-frequency capability on L1/E1, L2, L5/E5a/E5b and E6 frequency bands. The antijamming is implemented through antenna radiation pattern control to point nulls in the Direction of Arrival (DoA) of the Radio Frequency (RF) interference signal, thus mitigating negative effects. The processing is improved using of additional sensors and exploiting innovative feature of Galileo, such as Open Service – Navigation Message Authentication (OS-NMA), for detecting spoofing, and an IMU
2022 Copyright for this paper by its authors. completes the anti-interferences antenna capability by comparing the inertial dynamic of the antenna with the GNSS dynamic, further detecting spoofing attacks. In order to cope with the need of multipurpose antenna for different potential Stakeholders, different external interfaces are provided such as the RF-OUT (for professional users equipped with high-end GNSS Rx), the Data Serial interface (for professional users that want to use a PC/data logger to receive and process data) and the Bluetooth Interface (for mass-market applications to process raw data). With the aim to devise a market-driven product, the Consortium went through an extensive Stakeholder consultation phase (ahead of the design and development phases), in order to collect as much data as possible from the scientific and industrial community (with particular focus to the European one). During this process more than 80 market players were contacted, of which about 20 provided information and indications on the necessary specifications and needs. The outcomes of this study pointed out that GNSS RF signal vulnerabilities are well known by the GNSS community, but jamming and spoofing events are still not perceived as real threats due to their limited occurrences, likelihood and impacts which can be managed through available fallback mechanisms. On the other hand, the situation could change and cyberattacks leveraging on GNSS vulnerabilities may take place more often, leading to a limited effectiveness of fallback solutions (e.g. high stable time and synchronization, precise positioning, etc). Hence, improvements of GNSS signal resilience and robustness are deemed necessary to guarantee a high degree of continuity of service and performance of the overall system linked to GNSS devices. With the aim to deal with external threats, preserving the GNSS signal coming from the space, GAMMA antenna system is composed by the following subsystems: 1. Antennas Beamforming & Null Steering subsystem (A-BFNS); 2. Array Receiving Board (ARB) 3. Spoofing Detector (SD); 4. Antenna enclosure.
The A-BFNS is the first block of the receiving chain, aimed to preserve and enhance the weak incoming GNSS signal from the space among potential jamming and spoofing signal. The main characteristics of this subsystem are: • Multi-frequency band radiating antenna elements (1164-1300MHz, 1559-1608MHz) • Right Hand Circular Polarized • Low Axial Ratio • Extremely low noise amplification • High Gain • Extremely low group delay • High out of band signal rejection • Limited phase centre offset • Stable phase centre variation • Controllable beam-null steering
2.1.
The antenna array is the first receiving block aimed to maximise the GNSS signal of 4 Multiband (E1/L1, E6 and E5a/E5b/L5) Right Hand Circular Polarization (RHCP) radiating elements (Figure 2). The array is placed on a round ground plane ensuring radiation symmetry, and each single radiator contributes to shape the overall radiation pattern of the array. In Figure 3 the S-parameters versus frequency of a single radiating element is reported.
The Antenna Front-End (AFE) is located between the radiating elements and the beamforming network. As the power levels of GNSS satellite signals received by a receiver are as low as -130 dBm, a Low-Noise Amplifier (LNA) with exceptionally low Noise Figure (NF) and good gain is used to boost the sensitivity of the system. The RF signal from the antenna is pre-filtered by a bandpass filter (BPF) to suppress the signals out of the reception band, and then the signal is amplified at the Low-Noise Amplifier (LNA) stage. AFE gain and NF characteristics are shown in Figure 4 and Figure 5. 2.3.
The BFNS is the adaptive adjustment of the radiation pattern of the antenna array according to a specific scene [1]. The incoming RF GNSS is processed by the ARB unit, which detects any potential in band Jamming signal, and then controls the radiation pattern adjustment through the BFNS block. By adjusting the phase and the gain of each radiating element, an angular filtering on a particular defined radiating (receiving) direction is superimposed. In Figure. 6, 7, 8 the effect of different phase shifting on the radiation pattern characteristics of the array antenna are shown. The current proposed angular resolution to mitigate an unwanted jamming signal is of 5.625 degrees, this is due to a 6-bit phase shifter. In Figure 6, the nominal (no jamming) radiation characteristic of the antenna array is shown. Error! Reference source not found. and Error! Reference source not found. represent the radiation characteristic of the array antenna in case of jamming signal coming from 30 degree in elevation and 10 degrees in azimuth. The angular filtering is performed mitigating the unwanted signal by reducing the antenna gain in the defined direction. A variable Gain Amplifier is used to adjust signal dynamic range and stabilise the signal power.
This amplifier is in the post stage of the AFE link; hence it should have very high compression point. A 6-bit serial control amplifier is chosen in this design; gain range is from 0.5dB to 31.5dB.
ARB main goal is to pilot the BFNS for nulls generation in Radiation Pattern in correspondence of estimated jamming DoA increasing the system robustness against jamming. The ARB consists of a board hosting resources to manage RF signals down-conversion and advanced signal processing solutions to accomplish anti-jamming functionality through null-steering algorithms which dynamically modify the array radiating patterns. The performance of null-steering and DoA finding algorithms are enhanced by a self-calibration process managed automatically, autonomously, and periodically by the unit. ARB implements a Direct-Sampling architecture which offers good performance, high flexibility, high precision and stability, low size and limited power consumption w.r.t. a standard heterodyne approach where many filters are needed, the circuital complexity is significant and the thermal drift can be considerable. The RF Front-End design, a mixed analogue and digital solution provided by the Antenna and the Array Rx board, shapes two “extended” RF frequency bands: • •
Extended band #1 (so called “Upper band”), including L1, E1 and any other GNSS signal in the frequency region [1560; 1610] MHz Extended band #2 (so called “Lower band”), including L5, E5a, E5b, E6 and any other GNSS signal in the frequency region [1160; 1300] MHz
These two operating bands are combined on a single RF path from each antenna element. At RF Front-End (RFFE) outputs, single operating frequency bands are finally separated by the digital processing stages. The Digital Down-Conversion (DDC) structure is shown in Error! Reference source not found. though a dedicated lane. A total of 8 lanes are available on board. This architecture is therefore suited to down-converting two distinct spectrum regions (the pair of “extended bands”) for each RF signal produced by the four antenna elements. Upon the reception of the 8 high speed lanes, the FPGA estimates the covariance matrix for both Lower and Upper bands. As the GNSS signal cannot be detected before correlation, the correlation matrix of the antenna array contains the DoA and power information of the jammers. Once the covariance matrix is estimated, it is decomposed in Eigen values and Eigen vectors. The Eigen value decomposition of the correlation matrix will give a perfect interference detector. Indeed, without interference, i.e. without correlated signal on the antenna array, the correlation of the array matrix will be close to diagonal and the Eigen value will then correspond to the noise power. In presence of one interference, one Eigen value will increase to represent the power of this interference. The Eigen values ratios are examined to estimate number of jammers and their JNR. If no jammers are detected, pre-defined optimal weights are used to drive variable gain amplifiers and phase shifters. Different anti-jamming algorithms have been investigated, then the final comparison has focused on
Minimum
( ) = ∑ =1 ∗ = ( ) Where: w=[ w1, w2, . . . ,wK]T is a complex weighting vector, which determines the radiation pattern, x denotes a vector of dimensions K × 1 consisting of received signals xk
The array output samples y(
=1 ( ) ( ) = Where SX is the spatial correlation (covariance) matrix for the N number of snapshots.
The goal of the MVDR method is to minimize power contributed by noise and any signals coming from other direction than desired [3]. Therefore:
min( )
( , ) = 1
(
− ( , ) ( , ) − ( , ) ( , ) =
1
( , )
− ( , )
(
Whereas, the MUSIC algorithm is based on the eigen-decomposition of the Hermitian correlation matrix Sx. Indicating
with (λi, ui) (i=1,…,K) the eigenvalue/eigenvector pairs Sx, the spectral decomposition of Sx can be expressed as [3]:
= ∑ =1 =
+
Where Λ = diag(λ1,…, λI), = [u1,…, uI] represent the signal subspace eigenvalues and eigenvectors respectively, and analogously, Λ = diag(λI+1,…, λK), = [uI+1,…, uK] represent the noise subspace eigenvalues and eigenvectors respectively. The eigenvalues satisfy the property: λ1 ≥ λ2 ≥… λI ≥ λI+1 =…= λK = σ2. The signal eigenvectors corresponding to the I largest eigenvalues span the same subspace as the steering matrix A(θ,φ). The noise eigenvectors corresponding to the remaining (K − I) eigenvalues are orthogonal to the signal subspace, therefore any vector a(θ,φ) ∈ sp(A(θ,φ)) satisfies: ( , ) = 0 ( , ) = ( , ) ( , ) 1
Therefore, any one of the (K − I) noise eigenvectors can be chosen to be the MUSIC weight vector [4]. The MUSIC spectrum can be expressed as:
As per MVDR case, the output spectrum is evaluated over an as fine as possible grid of (θ, φ) and, assuming I signals are present in the wavefield, the I largest maxima of P are chosen as DOA estimates.
Between the two presented techniques, the MVDR is the one with the easiest implementation and its performance enhances with the increasing of the Jammer to Noise Ratio (JNR or J/N). On the other hand, MUSIC algorithm is expected to improve DoA estimation accuracy with respect to MVDR. However, in the presence of correlated source signals, it degrades dramatically as the signal subspace suffers from rank deficiency. The comparison is hereunder presented addressing DoA estimation and null realization accuracies.
DoA estimation error has been studied performing several simulations in presence of 1 and 2 interferences, considering antenna elements gain and phase patterns, different jammer powers and DoA. The following plots show the MVDR cumulative distributions of DoA Root Mean Square Error (RMSE) obtained considering errors on both azimuth and elevation in 1 and 2 jammers scenarios respectively. A too limited number of MUSIC errors have been experimented to achieve a considerable statistic.
Eventually, MUSIC proved its greater efficacy w.r.t. MVDR in DoA estimation in both 1 and 2 jammers cases and for all the jammer powers tested. Therefore, it is selected as baseline choice for DoA finding algorithm implementation.
The second figure of merit, after DoA estimation, focus on the weights computation and nulls
realization capability of the two algorithms under test. While MVDR weights are directly computed
according to (
The RF output of the GAMMA antenna is also processed by an internal Commercial Off-the-Shelf (COTS) based GNSS receiver, Septentrio Mosaic X5. The PCB board shown in Figure 16 also integrates the power distribution function and all the external interfaces, these are the following: RS232 Serial, USB, Ethernet, Bluetooth, LEDs, PPS. The processing of raw measurements generated by the Mosaic X5 is assigned to a Linux based embedded computer module.
• Provide the user with Position Velocity Time (PVT) and raw measurements by Bluetooth and
Serial Interface • Process Galileo OS-NMA • Detect any residual spoofing attacks The spoofing detector subsystem will use data from a triple band/triple constellation (GPS L1, L2, L5, Galileo E1, E5a, E5b, Glonass G1, G2) COTS GNSS chipset to verify, if an interferer coming from a spoofer, is not detected from the analogue anti-jamming chain and could come to the RF-OUT. The internal GNSS receiver will also perform a spectral analysis of output signal in order to identify any residual narrowband (or even wideband) interferers. This information will be sent to the users (via Serial Interface) and to the ARB subsystem for further processing. There are two kinds of threats related to spoofing, the first one is GNSS signal emulator, the second is the receiver-based spoofer. The first one is certainty more diffused and easier to implement. This spoofing signal is not usually synchronised with the real GNSS signal and the victim receiver could track some of the spoofed satellites because the power level is higher than the real satellites. On the other hand, the second spoofer uses real GNSS signals to extract the ephemeris and GNSS time, in order to generate a GNSS signal close to the real one. Moreover, some very sophisticated spoofer can try to extract the 3D pointing vector between its transmitting antenna and the victim antenna, in order to better emulate signal strength and delay. The strategies for verifying the spoofer existence are multiple and work in parallel (detections’ fusion paradigm), to maximise the probability of spoofer detection. All the techniques use raw data and navigation message as the main source of information, and the Automatic Gain Controller parameters as secondary one. At least two signal frequencies and two constellations will be processed simultaneously and separately. Hence, the following techniques [5] [6] will be implemented in real time for each frequency and for each constellation. In addition, some techniques need additional sensors, such as IMU or an external clock. 1. Consistency check of the GNSS dynamic with IMU dynamic 2. Comparison of the PVT solutions of each frequency and constellation 3. Comparison of the GNSS clock with an internal generated clock 4. Signal Power Monitoring (C/N0) of each satellite 5. Absolute Power Monitoring 6. Multi-band power Level Comparison 7. Multi-band Signals Relative Delay 8. Code and Phase Rates Consistency Check 9. Received Ephemeris Consistency Check
All these algorithms rely on the processing of the raw measurements and the integration with internal additional components. In fact, the board also includes a high-end accelerometer (Analog devices ADXL355) and a gyroscope. The detected attacks are notified to the user via the serial interface.
The test approach of GAMMA will follow the classical V-cycle for the assembly, integration and test part.
Collection of test credits Collection of test credits
Performance
Tests
System performance tests Functional
Tests
System functional tests
System integration
System internal interfaces tests Subsystem assembly
Functional and Performance
tests at subsystem level Each phase of the testing activities will contribute to the collection of testing credits for the final qualification of the GAMMA Solution.
The test requirements are different for each phase but are mainly devoted grant the testability of the elements involved in the testing activities.
As it is possible to see, the Subsystem assembly activities are providing the initial and fundamental inputs to the system level testing activities. In fact, a great part of the system requirements can be fully allocated to subsystems and, therefore, their testing activities and the relevant collected testing credits are performed at subsystem level during the Subsystem assembly (testing) activities.
The verification phase at subsystem level will be conduct at laboratory subsystem owners ‘place, as follow: • A-BFNS in Amphenol laboratory • ARB in TASi laboratory •
SD & PD in SpaceExe laboratory
The system level testing activities are performed incrementally with the following approach (as depicted in Error! Reference source not found.): 1. System integration: in this initial phase, the system internal interfaces between the subsystems are tested in order to grant that all the elements are correctly connected as per the system design. These interface testing activities will lead to the system integration that is the starting point to perform the tests on the integrated system 2. System Functional Tests: the first set of tests at system level aims to verify that all the functional chains are correctly implemented. The pass/fail criteria of these tests are a Boolean check of the correct implementation. Most of the functional requirements at system level can usually be verified by collecting testing credits of the tests performed at subsystem level of the relevant apportioned part of the requirement. 3. System Performance Tests: these tests are the final stage of the system qualification, and they aim to verify that the integrated and functioning system is able to meet the specified and required performance. Also in this phase, since many performance requirements can be directly allocated to subsystem level, tests credits can be collected from subsystem assembly activities.
At System level the verification will be done at Amphenol laboratories, especially for the environmental tests (i.e. the Functional Tests in the Error! Reference source not found.).
The foreseen verification flow will include the following actions: • Set-up of the specific laboratory test environments (preparation of instruments, RF simulators, data sets, scenarios and interface HW/SW tools); • Measurements data collection over test duration; • Analysis of data through off-line processing scripts or dedicated SW tools; • Verification of results against requirements/expected outputs and provision of test reports. • The adequate generation of test vectors will be the key for successful AoA estimation algorithm design and implementation and therefore several options will be considered, for instance: • Generation of synthetic I/Q samples using Matlab: During AoA algorithms development, a Matlab module capable of simulating inputs for estimation algorithms will be used. These inputs should be I/Q samples with sampling frequency consistent and representative w.r.t. the real signals resulting from the combination of GNSS SiS, Gaussian white noise, and interference. These samples need to be adapted for use in an FPGA, as the double format will not be handled. These synthetic signals might not reproduce all antenna and RF front-end non-ideality but could be used for early validation matters; • Digitization of real signals from the four-element antenna array through a 4-channel digitizer.
In this case also the embedded RX board could be adapted to outputs I/Q samples on a USB3.0 port for easy storage on a companion computer. The obtained samples are then used for post processing activities.
The Anti-jamming functionality will be tested using different jamming scenarios. The main scenarios will emulate a case of static or quasi static jamming scenario with a multi-frequency capability
The spoofing detector will be tested using a combiner between a real signal coming from an external antenna and a spoofed signal coming from an emulator. An additional GNSS receiver will be used for calibrating the power of the spoofer injected into the anti-spoofing detector, in order to verify which is the limit where the two signals (real and spoofed) can be tracked indifferently by the receiver.
The validation activities of the GAMMA Solution aim at verifying its compliance with the quality in terms of construction (correctly built) and in terms of relevance for reaching design objectives and stakeholders’ as foreseen and reported in the ARS and URRJ. The Validation process will be carried out in 2 steps:
Validation Campaign at Amphenol premises to test the fundamental characteristics of the antenna and its components.
Validation Campaign at JRC premises to test the integrated GAMMA solution performance in a controlled environment
The antenna platform validation and performance assessment, carried out at JRC premises (see Figure 18), will be based on the following steps to cover different scenarios: • • • • •
Nominal operative condition (No Jammer, No Spoofer) Static multi direction multi frequency Jammer Quasi static multi direction multi frequency Jammer Static multi direction multi frequency Spoofer Quasi static multi direction multi frequency Spoofer
After the Validation Activities, Demonstration tests will be carried out on the field in the proximity of real RFI sources (e.g. in the proximity of a DME / TACAN interference, affecting L5 band), both in dynamic or static configuration. Being a live scenario (see Figure 19), availability / control over RFI sources is not possible, but they can be monitored over time e.g. by using a spectrum analyzer to correlate presence of RF interference source w.r.t. platform behavior. Being these tests not under a controlled environment, they are considered for characterization purposes to assess the performance of the GAMMA solution in a real environment.
The development of the GAMMA solution aims to promote the use of Galileo and its performanceenhancing features for GNSS-based applications. The antenna is able to detect spoofing attacks and to mitigate jamming interference events, thus boosting system performance. As described in §3, implemented null-steering and DoA estimation algorithms are both based on MUSIC which results to overcome MVDR performance in terms of null accuracy, rejection capability and DoA finding precision. As reported in §2.3, null-steered pattern is achieved analogically in BFNS section through 6bit phase shifters and attenuators with range from 0.5dB to 31.5dB. GAMMA solution development started in Q3 2020 and is foreseen to complete in Q2 2022 with a Technology Readiness Level 7 equipment. The total power consumption is less than 70 watts. The test campaign will run during the second half of 2022 to demonstrate the antenna capabilities under different scenarios. An industrialization of the product will follow and will target the static and low-dynamic applications belonging mainly (but not only) to Mapping and Surveying, Critical Infrastructures, Agriculture and Autonomous machinery, Reference Stations, Static Monitoring, Aviation (Ground Segment) and EGNOS & Galileo Ground Stations.