@inproceedings{,
    author = {Maier, Daniel Simon; Frankl, Kathrin; Pany, Thomas},
    title = {The GNSS-Transceiver : Using vector-tracking approach to convert a GNSS receiver to a simulator; implementation and verification for signal authentication},
    editor = {},
    booktitle = {31th International Technical Meeting of The Satellite Division ot the Institute of Navigation (ION GNSS+ 2018)},
    series = {},
    journal = {},
    address = {},
    publisher = {},
    edition = {},
    year = {2018},
    isbn = {},
    volume = {},
    number =  {},
    pages = {4231-4244},
    url = {https://doi.org/10.33012/2018.16083},
    doi = {10.33012/2018.16083},
    keywords = {},
    abstract = {Research in the field of GNSS signal performance under spoofing, jamming and multipath comes along with the need of reproducing this channels, signals, and scenarios as good as possible. The performance of currently used signals can be analyzed quite easily as it is possible to use the genuine transmitted signals or use state of the art commercial signal generators for the recreation of the setup under investigation. This becomes, however, much more difficult if new signals, channel structures or navigation massages are under trail. Some commercial signal generators give the possibility to implement new signals and use its own navigation message but in a very limited and restricted extent.
To overcome this restrictions it would be necessary to implement its own signal generator [1] to have all the possibilities in creation and testing the signals in all desired scenarios. Implementing a sophisticated signal generator from scratch is a huge, difficult and time consuming task.
To avoid this task, a way is presented to extent and modify a software receiver (SR) into a GNSS software transceiver (ST), to track and generate GNSS signals. With this approach it is possible to reuse the sophisticated and optimized infrastructure of the SR for the signal generator. We exploit the fact that each SR has to create an estimated replica of code and carrier for the correlation. The key element in our approach is the usage of the software receiver vector-tracking architecture (Figure 1) to create the desired line-of-sight parameters for updating the NCO (Numerically Controlled Oscillator) and therefore the code and carrier replica generation. In Figure 2 the schematic modifications are shown to obtain the signal generator architecture.
Feeding the Line-of-Sight module with the position, velocity and time of a defined receiver trajectory gives an easy opportunity to manipulate the vector tracking loop to generate replicas as needed to recreate the receiver movements. In addition, the desired symbols and amplitudes have to be provided to the tracking loops. Multiplying the replica signal with amplitude and symbol gets a new channel IF signal patch. Adding up all channels results in an IF signal stream for a total or even multiple constellations. If required additional Gaussian white noise can be added before the IF signal patch is written into the output file. Ionospheric and tropospheric influences are simulated as the line-of-sight parameters are calculated using ionospheric- and tropospheric-models. However, the line-of-sight calculation perform a quadratic extrapolation from one trajectory point to another, which is in the time scale of 0.1s. This is of course just an approximation and a possible error source which has to be studied and improved.
The above described GNSS-transceiver is implemented on the base of the ipexSR [2] software receiver, the software packet is now renamed into Multi Sensor Navigation Analyzing Tool (MuSNAT). MuSNAT was used to implement and verify Navigation Message Authentication (NMA) based Galileo signals. Therefore, real Galileo satellite signals were recorded and processed by the MuSNAT to extract the symbol-stream (navigation massage) and satellite ephemeris for each satellite with in sight. In the second step, the spare bits in the Galileo E1B INAV navigation massage are replaced by the authentication bits. Thereafter, the symbol stream, the satellite ephemeris and the desired C/N0 values for the tracked satellites were read into the GNSS-Transceiver to recreate an IF sample-stream file, which is again processed by the MuSNAT-Transceiver to extract the bits to verify the authentication. An In- and Quadrature-Phase analysis for the generated signal is plotted in Figure 3. Also the Doppler shift, C/N0, code minus carrier, DLL, FLL and PLL were examined to validate the integrity of the generated signals.
The above described process was repeated including wrong navigation symbols to analyze the influence of symbol errors to the authentication process. Also the receiver behavior under a symbol estimation attack was studied, by setting the symbol value to zero for the first fraction of each symbol.
The MuSNAT-Transceiver will be tested by means of several case studies aiming the detection of spoofing attacks by employing NMA authentication.},
    note = {},
    institution = {Universität der Bundeswehr München, Fakultät für Luft- und Raumfahrttechnik, LRT 9 - Institut für Raumfahrttechnik und Weltraumnutzung, Professur: Pany, Thomas},
    
    
}