Signals of opportunity could provide alternative to GPS

What do the eastern Mediterranean, Middle East, Black Sea, Norway, Finland, South China Sea, and Russia all have in common?

They’ve all been or continue to be hotspots for global navigation satellite system (GNSS) disruption known as jamming and spoofing. Jamming is defined as locally overpowering GNSS satellite signals so that a receiver can no longer function. Spoofing is the process of tricking a GNSS receiver into calculating a false position.

Over the past decade, as electronic warfare gains prevalence, in particular jamming and spoofing, concerns have been raised about the vulnerability of aviation systems to disturbance.

Since 2018, pilots flying over the Eastern Mediterranean, near Syria, Lebanon, Israel and Cyprus, have reported GPS disruptions. These outages are so frequent and disruptive, some pilots have resorted to compass and map, switching off the global positioning system (GPS) entirely.

After Russia’s annexation of Crimea in 2014, GNSS interference has become common in the Black Sea region. Suspected to be Russian military, multiple airliners have reported unexpected changes in coordinates, a hallmark of spoofing attacks.

The disputed territories in the South China Sea are another example. Pilots and maritime vessels have reported GNSS anomalies, including unexpected position shifts and loss of signal. The Chinese military, which has taken significant steps to militarise the disputed territories in the sea, is suspected of strategically using GNSS jamming and spoofing.

The vast majority of aircraft now reroute around these hotspots or have ceased impacted flight operations all together (with a few exceptions such as those with the muscle memory to go back to old school methods). This directly effects operating economics for the airline and choice for the passenger.

Last month, EASA issued a safety bulletin entitled “Global Navigation Satellite System Outage and Alterations Leading to Communication / Navigation / Surveillance Degradation”. Within the bulletin the regulator makes a number of recommendations for flight crews, operators and authorities in the event of GNSS jamming or spoofing. These include: ensuring non-GNSS based navigation infrastructure such as instrument landing systems and distance measuring equipment stations are kept operational, issue NOTAMS upon discovery of a jamming or spoofing event and encouraging civil and military coordination prior to testing of GNSS disturbance systems.

As incidents continue to rise several regulatory bodies have also made calls for research into alternatives to GNSS. In 2023, IATA invited ICAO to develop a global strategy on Alternative Positioning, Navigation and Timing (PNT) to ensure continuity of flight and air traffic management operations during GNSS interruptions.

As it happens the Autonomous Systems Perception, Intelligence and Navigation (ASPIN) Laboratory based out of The Ohio State University was already working on an alternative back in March 2020. The team involved just had to wait a few years to validate and publish their findings before they could tell anyone.

SNIFFER campaign

ASPIN’s research, published earlier this year, took the form of a campaign known as the Signals of opportunity for Navigation In Frequency-Forbidden EnviRonments (aka SNIFFER). Undertaken with the help of the US Air Force, the SNIFFER campaign saw a team of pilots fly a series of test flights in a Beechcraft C-12 Huron (aka Ms Mabel) outfitted with a novel navigation system that utilised cellphone signals from T-Mobile, AT&T and Verizon to determine its position in the skies above California.

Signals of opportunity is a well chosen term. They are radio frequency signals – digital tv, satellite or cellular – not intended for Positioning, Navigation and Timing that provide the opportunity to be used as such. Signals of this kind, particularly cellular, are suitable for aircraft navigation because “absolute position” can be extracted and they are common in almost all areas of interest with respect to live operations.

The technique of using these signals – which Zak Kassas (pictured below right), director of ASPIN, calls radio simultaneous localisation and mapping (SLAM) – proved a success. On a test flight lasting about 43km, the navigation system was able to pinpoint the aircraft’s position with a statistically calculated error of only 7m (22ft). Also, even though cellular network infrastructure is designed for users on the ground, the ASPIN team found signals remained stronger than expected up to altitudes of 23,000ft and as far as 100km from the cell tower.

Progress to the SNIFFER campaign in Spring 2020 began a little while earlier when the ASPIN team gained a world record for the world’s most accurate drone flight using cellular signal navigation technology.

The radio SLAM system works by detecting constant signal emission from surrounding cellular towers. With signals often in the hundreds, spread out in a complex array of omnidirectional radio subsignals the radio SLAM system can use these to create a signal landscape of its surroundings. The system builds that map through analysis of code and observation of each signal’s carrier phases. In combination with a measurement of the Doppler effect, the data produced can be calculated to reveal the aircraft’s live position with no requirement for GNSS.

Solving key challenges

The system proved effective in ground-based and drone flight experiments, but doing the same thing in a conventional aircraft was a different ball game, Zak Kassas tells us.

“There are two key challenges when using the system in a high altitude aircraft,” he tells us. “If you are in a low altitude drone, or even if you are on your phone, you will easily hear the signal, you can sense it, you can lock to it. It is powerful. Ultimately, you are close enough to the towers and they are down tilted for your benefit. However, they are not designed for aircraft.”

An aircraft at 5,500ft will be able to pick up signal but at a much more erratic state, because at that height it is no longer in the main beam of the transmitter, instead it is listening to the side lobes which emit a weaker signal.

“So one of the big challenges was the higher you go, the weaker the signal. We just can’t hear anything. It is like when you turn your phone on when flying commercial. There is a signal but your phone is not sensitive to pick it up. So we developed a high sensitivity receiver that was able to lock the signal even from altitude,” says Kassas.

The second key challenge relates to Doppler effect. “You need a very good estimate of Doppler because if you are far off from a tower in a fast-moving, high altitude platform your estimate will become poorer as the Doppler spread becomes larger. If you don’t have a sensitive receiver that can work with those bad estimates, the system will not be able to track the signal.”

The receiver Kassas and his team developed is the cornerstone of the system. While previous receivers could pick up no more than a dozen signals at high altitudes, their system can detect upwards of 100 signals simultaneously.

The one task remaining before any potential entry into service is to develop a software system that can process the navigational data in real time, up to now it has been analysed post flight.

Logic prevails that the novel radio SLAM system works more effectively in areas with a higher density of cell phone masts. The team flew three trials in varying areas of urbanisation: a remote location in the Mojave Desert, a semi-urban location near Edwards Air Force Base and an urban region near the City of Riverside. Whilst the city setting provided the highest density of signals, because the sensitive receiver can pick up a signal from 100km the system proved effective in all three locations.

Listening to LEO satellites

But what happens when an aircraft is flying over a vast mountain range or the Pacific Ocean for example? Luckily, Kassas has developed a solution for that too. “In those areas I don’t expect you to pick up signals at any meaningful depth,” says Kassas. “That is why another part of my research has focused on developing a similar system that listens to low earth orbit [LEO] satellites. Using that system we have been able to navigate using Starlink, OneWeb, Iridium, Orbcomm and NOAA satellites to metre-level accuracy. What is great about satellites is they cover the whole planet.”

Today’s GNSS systems rely on a network of around 30 satellites in Earth’s medium orbit at altitudes around 20,000km. The system Kassas and his team tested on a ground vehicle locks into the 5,000 or so LEO satellites currently in orbit (this is due to hit tens of thousands in the next decade). These systems orbit at altitudes of 500-1,500km creating stronger signals for the receiver to pick up and therefore making them less susceptible to jamming and spoofing.

“We are not cooperating with these satellites. Like we did with cellular signals, we simply listen to the synchronisation signals, then we lock to them and from that we know how far the satellite is away.”

The issue Kassas and his team had to overcome is that while data from GNSS satellites is publicly available, LEO satellites are privately owned and their beacon signals are kept under wraps. So researchers had to develop an algorithm that can unlock the beacon signal of a private satellite.

“With cell phone towers, we know the structure of the signal they transmit. This is specified in 3GPP documents. This means cell phone operators have to abide by a certain protocol and we can design our receivers accordingly. With proprietary satellites constellations, they don’t have to tell you. Some have semi-open access knowledge but most are completely closed. So that is where we developed a cognitive radio that can listen to a completely unknown signal and still make sense of it.”

The other key challenge related to navigation via LEO satellite signal is the constant moving nature of the satellite. A cell phone tower doesn’t move, LEO satellites do a lot (more than 7km pr second). That is why Kassas and his team developed another algorithm called simultaneous tracking and navigation (STAN).

“You can get an estimate of a satellite’s location which can be about one to 10 kilometres off from its actual location – in the space world that is not bad. But to navigate, you need to know where the satellite is located to a much higher degree of accuracy. So we had to develop STAN which can detect the presence of a LEO satellite, track the signal and simultaneously estimate the satellite’s position, allowing us to estimate the receiver’s distance to the satellite.”

“This was our answer to: if you are over the Pacific and have no access to cellular signals, use these satellites instead,” says Kassas.

What next?

Ultimately, Kassas would like to see the GPS and LEO satellite navigation systems commercialised to offer a backup for today’s GNSS. “Not all pilots are capable of resorting back to compass and map, they shouldn’t have to either. The objective of developing these systems is to give pilots a backup should they encounter spoofing or jamming. You’re not going to fly over the Atlantic tomorrow using this system. Think of it rather like a Swiss cheese, this system can patch up the holes for you,” he says.

Kassas believes there is potential to use the system in low altitude economy aircraft such as UAVs and air taxis too. During research and development with ASPIN for the cellular network navigation system, his team had a UAV crash due to GPS failure. “It flew for about a mile after we lost contact with it. When we recovered it, we looked at the data log and it said GPS failure. We don’t know if it was jammed or if the components failed. The UAV is supposed to return to home in event of a failure, but how can it return home if it no longer knows where it is?” 

Austrian software firm, Dimetor has developed a platform it calls AirborneRF that provides automated analytics of cellular connectivity in the airspace. Specifically designed for drones and low altitude economy aircraft the solution brings together live radio network data from terrestrial mobile network operators with UAV airspace control systems. Using computational technologies and Inmarsat’s communications spectrum, AirborneRF aggregates 4G and 5G data for flight planning, risk assessment, flight clearing and operation.

Some GNSS providers have also developed mitigation systems in response to cybersecurity threats. Galileo GNSS has a function called Open Service Navigation Message Authentication (OSNMA) for cybersecurity threats. Developed for 10 industries including search and rescue, drones and civil aviation and maritime, OSNMA provides receivers with the assurance that the received Galileo navigation message has not been modified and comes from the system itself. It can be added to a Galileo receiver via software update. Galileo’s OSNMA authenticates the data using a digital signature, but the company says authentication does not prevent all occurrences of spoofing. It also does not protect against jamming.

Given his extensive work in developing the system Kassas is banking on signals of opportunity systems – using cellular networks and LEO satellites – to be the alternative solution to GNSS in the event of disturbance. “There is resistance because people like to control things, but think about it like this. Uber versus taxis, who would have thought 20 years ago that a stranger would pull up in their car to give you a ride. The same goes for Airbnb versus hotels. Communications is moving the same way, why should we build new infrastructure and allocate additional spectrum, when we can repurpose what is already there?

“The same goes for space. Why put a navigation-dedicated satellite constellation in LEO? A bad actor can still take it down for you. There is no point in adopting the old thinking that created the problems to solve the problems. I say: let the mega constellations – OneWeb, Starlink, Amazon Kuiper – be born, and whether they transmit a navigational signal or not we can use them. Now we have a redundant, dual-purposed system that significantly reduces the risk in the event of a GNSS disturbance,” Kassas concludes.

Subscribe to our free newsletter

For more deep dives from SAF Investor, subscribe to our email newsletter.