ATIS 0900005-2017 GPS Vulnerability.pdf

1、 TECHNICAL REPORT ATIS-0900005 GPS Vulnerability As a leading technology and solutions development organization, the Alliance for Telecommunications Industry Solutions (ATIS) brings together the top global ICT companies to advance the industrys most pressing business priorities. ATIS nearly 200 memb

2、er companies are currently working to address the All-IP transition, 5G, network functions virtualization, big data analytics, cloud services, device solutions, emergency services, M2M, cyber security, network evolution, quality of service, billing support, operations, and much more. These prioritie

3、s follow a fast-track development lifecycle from design and innovation through standards, specifications, requirements, business use cases, software toolkits, open source solutions, and interoperability testing. ATIS is accredited by the American National Standards Institute (ANSI). The organization

4、 is the North American Organizational Partner for the 3rd Generation Partnership Project (3GPP), a founding Partner of the oneM2M global initiative, a member of the International Telecommunication Union (ITU), as well as a member of the Inter-American Telecommunication Commission (CITEL). For more i

5、nformation, visit www.atis.org. Notice of Disclaimer GPS-SDR-Sim. Rare More robust GPS receiver technology, GPS enhancement, alternative timing sources. GPS anomalies 2016 UTC-offset error, January 2004 and July 2001 satellite clock failures. Rare Alternative timing sources. Licensed adjacent band t

6、ransmitters No N/A More robust GPS Receiver technology, alternative timing sources, minimize out-of-band emissions from the licensed adjacent band transmitters. Environmental factors GPS antenna installations, multipath interference, tropospheric impacts, ionospheric scintillation, solar weather. Co

7、mmon Improve training of the technicians who install antennas, alternative timing sources. Today, Radio Frequency (RF) interference seen by GPS receivers is commonly caused by jamming devices in vehicles intended to block fleet tracking systems or bypass toll collection by disabling the GPS receiver

8、. These jammers are generally not intended to degrade performance of other receivers, but do so incidentally due to their high transmit powers and disregard for other systems performance. From the effects of incidental jamming events caused by relatively low power ( 3 km radius). Maximum absolute de

9、viation in frame start timing between any pair of cells on the same frequency that have overlapping coverage areas. b-3GPP TS 36.133) section 7.4.2 ATIS-0900005 12 Application/ Technology Accuracy Specification LTE-TDD (home-area base station) 1) 3 s for small cell ( 500 m radius), 1.33 + Tpropagati

10、on s time difference between Base Stations, where Tpropagation is the propagation delay between the Home base station and the cell selected as the network listening synchronization source. In terms of the network listening synchronization source selection, the best accurate synchronization source to

11、 GNSS should be selected. If the Home base station obtains synchronization without using network listening, the small cell requirement applies. 2) The requirement is 3.475 s but in many scenarios a 3 s sync requirement can be adopted. b-3GPP TS 36.133 section 7.4.2 b-3GPP TR 36.922 section 6.4.1.2 L

12、TE-TDD to CDMA 1xRTT and HRPD handovers eNodeB shall be synchronized to GPS time. With external source of CDMA system time disconnected, the eNodeB shall maintain the timing accuracy within 10 s with respect to CDMA system time for a period of not less than 8 hours. b-TS 3GPP TS 36.133 section 7.5.2

13、.1 LTE Advanced (LTE-A) Phase/Time requirements for the applications listed below are currently under study: Carrier Aggregation (CA) Coordinated Multipoint Transmission (also known as Network- Multiple Input, Multiple Output MIMO) Relaying function b-TR 3GPP TS 36.814 IP network delay monitoring Th

14、e requirement depends on the level of quality that shall be monitored. As an example, 100 s with respect to a common time reference (e.g., UTC) may be required. 1 ms has also been mentioned. Note 3 Intra-band non-contiguous carrier aggregation with or without MIMO or TX diversity, and inter-band car

15、rier aggregation with or without MIMO or TX diversity (Notes 4,7,8) 260 ns b-3GPP TS 36.104 section 6.5.3.1 Intra-band contiguous carrier aggregation, with or without MIMO or TX diversity (Notes 4,7,8) 130 ns b-3GPP TS 36.104 section 6.5.3.1 Location Based Services using Observed Time Difference Of

16、Arrival (OTDOA) (Notes 4,6,7) 100 ns MIMO or TX diversity transmissions, at each carrier frequency (Notes 4,7,8) 65 ns b-3GPP TS 36.104 section 6.5.3.1 More emerging LTE-A features that require multiple antenna co-operation within a cluster. (Notes 4,5,7) x ns NOTE 1: In the case of mobile applicati

17、ons, the requirements are generally expressed in terms of phase error between base stations. In the case of a centralized master, the requirement could be expressed as half of the accuracy requirement applicable to the specific technology. ATIS-0900005 13 Application/ Technology Accuracy Specificati

18、on NOTE 2: The requirements are generally valid during normal conditions. The applicable requirements during failure conditions are for further study. NOTE 3: For IP network delay monitoring, there is no standard requirement yet. Requirements are operator dependent (depending on the application). NO

19、TE 4: The requirement is expressed in terms of relative error with respect to another base station, both of which have the same reference. NOTE 5: The performance requirements of the LTE-A features are under study. The value for x is for further study. NOTE 6: 100 ns supports approximately 30-40m of

20、 location accuracy when using OTDOA with a minimum of three base stations. There is currently no published specification. NOTE 7: The requirements are expressed in terms of relative error between antennas (i.e., base station sectors), both of which have the same timing reference. Although phase/time

21、 accuracy requirements for CA and Coordinated Multi-Point (CoMP) are generic and are not defined for any particular network topology, this level of phase error budget implies that the antennas for which the requirements apply are typically co-located with or connected to the same Baseband Unit (BBU)

22、 via direct links. NOTE 8: Note that the three items in the table referring to MIMO may not translate to a synchronization requirement as they refer to timing within a particular base station rather than between base stations. These are Time Alignment Errors (TAE) expressed as minimum requirements.

23、Time accuracy requirements have become tighter in recent years. ITU-T Study Group 15, Question 13 establishes time and frequency standards for international telecom systems. ITU-T G.8272 2 sets the requirement for a Precision Reference Time Clock (PRTC) at 100 ns against UTC. A new standard, G.8272.

24、1 3 has developed an enhanced Precision Reference Time Clock (ePRTC), which requires 30 ns accuracy against UTC. 5G systems will have new timing requirements that may be more difficult to maintain. These requirements make stringent limits on the performance of GPS. Testing to show conformance has si

25、gnificant implications. Timing receivers have a direct dependency on the delay through the antenna, cable, and receiver system, in direct contrast to positioning and navigation receivers, which only need differential satellite delays to be stable. In addition to the delay of the GPS time code throug

26、h individual elements of the receiver system, reflections in the elements add internal multi-path delays that can cause timing changes in the 10s of ns (see 15). Hence timing receivers have special needs for testing. The spectrum for wireless systems is valuable, and there is a desire to use bands a

27、djacent to GPS signals for wireless services. In addition, if other GNSS are approved for U.S. telecom timing references, there will be other bands of the spectrum that will be vulnerable to interference. The telecommunications industry supports efforts to maximize the bandwidth available for wirele

28、ss services, but it cannot support these efforts at the expense of degrading existing network operations, in particular the dependence on GPS or GNSS timing for system operations. As industries propose the use of bands for wireless data adjacent to approved GNSS, results of testing must be considere

29、d to show that proposed transmissions do not interfere with required timing performance. ATIS SYNC has a number of recommendations with regard to testing that are discussed in the recommendations section. These recommendations discuss: 1) open testing, 2) the consideration of testing results in deci

30、ding adjacent band signal transmissions, and 3) various specifics of testing that are relevant to timing receivers and telecom networks. ATIS-0900005 14 7 GPS Vulnerability Mitigation these solutions could continue to operate to deliver time and phase sync even if there were a total failure of the G

31、PS system, as long as the master clock for any of these systems was independent of GPS. All proposals with the exception of #1 provide an independent or semi-independent timing mechanism to a receiver. These methods all have the additional benefit of being immune from inherent localized sources of G

32、PS degradation ATIS-0900005 15 such as multipath and GPS antenna installations. Proposals such as #1 that harden the GPS signal itself, or make the GPS receiver more robust to false or degraded signals, are still sensitive to GPS-wide failure modes. ATIS SYNC notes that there are a number of mitigat

33、ion strategies for GPS receivers to resist interference. A number of bodies including ATIS SYNC are considering establishing standards addressing these. 1. Navigational Message Authentication (NMA) on L2C and L5 There are currently no signal-side security features available on Civil GPS civil signal

34、s that could be used to mitigate intentional or unintentional spoofing events. The addition of Navigational Message Authentication (NMA) to some, or all, of the modernized GPS signals would provide a tool GPS civil signal receivers could use to mitigate spoofing events. ATIS SYNC has spent a conside

35、rable amount of time discussing the merits of NMA, and notes that the telecom sector is presently using only L1 C/A GPS receivers for timing and synchronization. Telecom sector use of NMA on L2C or L5 would require the deployment of additional receivers, or replacement or enhancement of existing L1

36、receivers with a dual frequency version supporting L1 and L2, or L5, operation. ATIS SYNC further notes that NMA does not help mitigate jamming, GPS interference, or the other vulnerabilities identified in Table 5.1. While NMA on L2C would not be immediately usable by current telecom receivers, the

37、long-term application of NMA on GPS civilian signals may become an important defense against a spoofing attack. 2. Atomic Clock Time Holdover The use of a high-stability atomic clock provides a means of maintaining precise time in the event of loss of GPS. One example of this is the ePRTC defined in

38、 ITU-T G.8272.1 3, which couples GNSS with an autonomous primary reference atomic clock. In the event of a GNSS outage, the ePRTC provides two weeks of time holdover better than 100 ns to UTC. The use of a highly stable clock, in addition to providing for time holdover, also provides a mechanism for

39、 detecting spoofing, as it functions as an independent source of stable time. 3. Sync over Fiber Private sector companies and National Institute of Standards and Technology (NIST) are conducting a proof of concept trial of transporting very high precision time and phase synchronization over fiber us

40、ing IEEE-1588v2 PTP (see 5). PTP packetizes time and phase information for delivery over a packet-based network such as Ethernet, which is in turn transported over fiber. PTP is susceptible to impairments due to packet delay variation and asymmetry in the forward versus reverse transmission paths. S

41、YNC finds the results to date of this trial encouraging; 18 ns deviation was held in a measurement lasting 3 months of PTP over Dense Wavelength Division Multiplexing (DWDM) using commercial optical fiber connecting UTC (NIST) and UTC (United States Naval Observatory USNO) over a span of 150 km. The

42、re is a need, however, to determine if PTP can be used to transport very high precision time and phase sync over the vast distances required to cover the continental U.S.; this is to be investigated in a follow-on experiment. For further information on this experiment, see 16. Figure 7.2 10s of ns h

43、eld in a 3-month measurement over commercial fiber (150 km link) ATIS SYNC notes that there is a second proposal for sync over fiber that may develop in the future. ITU-T standard J.211 4 describes a two way protocol transported over the physical layer that includes a mechanism to correct for transp

44、ort delay and asymmetry. It is not packet based and thus is not impaired by delay variation. ATIS SYNC has ATIS-0900005 16 been advised that this technology could be adapted to fiber transport using telecom industry standard Wave Division Multiplexing (WDM) technology. 4. eLoran In October 2014, SYN

45、C reviewed presentations on a joint government and private sector proposal that addresses the development of a new eLoran type system in the U.S. for delivering very high precision time and phase sync. This type of signal is very long wavelength, very high powered, would be very difficult to jam and

46、 spoof, and penetrates buildings well. In 2016 an eLoran receiver coupled with a Rb oscillator demonstrated the ability to independently track UTC within 30 ns of a reference in the New York Stock Exchange 17. The receiver used an eLoran broadcast from Wildwood, NJ. Though still under development an

47、d consideration in the United States, ATIS SYNC notes that eLoran is already available and used as a GNSS alternative in Europe, and that areas that experience regular GPS-denial in Southeast Asia are implementing eLoran as an APNT system 18. ATIS SYNC also notes that there is a Russian terrestrial

48、low frequency navigation system, CHAYKA, which is similar to Loran-C. 5. WWVB ATIS SYNC notes that it is technologically feasible to develop a very high precision timing reference similar to WWVB that would operate in RF spectrum. Such a solution has been discussed in ATIS SYNC. Sub-1 GHz RF spectru

49、m signals penetrate buildings very well, and a timing source in that spectrum could be a viable backup to GPS for timing references. This proposal would require development to determine how best to provide the accuracies required for telecom needs. 6. Terrestrial Beacons ATIS SYNC also notes that it is technologically feasible to develop a very high precision timing reference based on terrestrial beacons. Such a solution has been discussed in ATIS SYNC. At least one Terrestrial Beacon System is being deployed in the U.S. to