Safety of GNSS-like Underwater Positioning Systems: Article
Safety of GNSS-like Underwater Positioning Systems: Article
Safety of GNSS-like Underwater Positioning Systems: Article
v1
1 Article
7 t.abramowski@am.szczecin.pl
8 2 Maritime University of Szczecin, Faculty of Navigation, Szczecin, Poland; m.bilewski@am.szczecin.pl
9 3 West Pomeranian University of Technology, Faculty of Computer Science and Information Technologies,
15
16 Abstract: The formal transfer of GNSS under water is not possible. It probably makes sense to talk
17 only about the transformation of GPS into LPS, that is, in the Local Position System. However, the
18 basic methods that are used to solve the problem of Spoofing Detection above water can be used
19 under water. It should be understood that engineering problems are significantly different, since
20 the nature of the propagation of acoustic waves in water and electromagnetic waves in the
21 atmosphere are fundamentally different. In this article, we will limit the navigation with
22 acoustically passive receiver. The receiver “listens” to the buoys and solves the problem of finding
23 its own position based on the coordinates of the buoys (such systems are called GNSS-like
24 Underwater Positioning Systems or GNSS-like UPS). Depending on the scale of system service
25 areas, GNSS-like UPS are divided into global, regional, zonal and local system. In this article, we
26 will limit ourselves to considering only local GNSS-like UPS. The acoustic signal generator
27 transmits a signal simulation of several satellites. If the level of the simulated signal exceeds the
28 signal strength of real satellites, the receiver of UPS will “capture” the fake signal and calculate the
29 false position based on it.
33 I. Introduction
34 The increased likelihood of terrorist acts led to the adoption in 2002 of Chapter XI-2 of the SOLAS-74
35 Convention and the International Ship and Port Facility Security Code (ISPS Code) 1. In the 20th century
36 electronic devices such as radar and Loran were widely adopted for use in navigation. Today most vessels use
37 an automatic pilot, an electronic device for controlling a vehicle without constant human intervention. The use
38 of GNSS (GPS Navstar, GLONASS, BejDou 2, GALILEO) has become standard in navigation.
39 There are many manufacturers of underwater positioning systems in the world including iXblue [1],
40 EvoLogics [2], Sonardyne [3] and Charles Stark Draper Laboratory [4]. The Positioning System for Deep
2 of 12
41 Ocean Navigation (POSYDON) program [5] aims to develop an undersea system that provides omnipresent,
42 robust positioning across ocean basins.
43 Guided by sonar beacons located on the ocean bed, the robots will be able to accurately determine their
44 own location down to millimeters and exchange data with air, water and ground-based control stations in real
45 time. Buoys have three modes of operation. At the first, the product receives information via satellite
46 communication channels, memorizes it and, at the request of the robot, transmits it. In the second mode -
47 “dialogue” - the buoy connects the coastal, aerial, sea control centers with underwater robots over the VHF
48 radio channel in real-time mode. Such data exchange allows not only knowing where the robot is and what tasks
49 it solves, but also to continuously control it. The third mode is the easiest. The robot operates completely
50 autonomously and only checks its coordinates with buoys, adjusting the course. In an emergency, the drone can
51 give an SOS signal, reporting the termination of a deep-sea mission.
52 Note the four main methods used in determining underwater positioning, which largely coincide with the
53 methods of measuring the coordinates of mobile objects in radio networks.
54 1. Received Signal Strength (RSS) – distance to the object is estimated by the power of the signal. This
55 method works well at short distances.
56 2. Angle of Arrival (AoA) – the location of the object is determined within the area of a triangle formed
57 by the intersection of the axes of the antenna patterns of the sectors of three base stations (modified
58 trilateration method).
59 3. Round TripTime (RTT) – the object sends a signal to the transceiver and waits for a response. The
60 half-difference between the time of sending a signal by an object and receiving a signal by an object
61 multiplied by the speed of light gives the distance to the object.
62 4. Time of Arrival (ToA) is a technique, in which the time of arrival of a specific signal with precisely
63 synchronized time of sent, are calculated (this method requires time synchronization at the sender and
64 recipient).
67
68 Figure 1. Wire buoyant GNSS UAV: Ɛ – position error
Preprints (www.preprints.org) | NOT PEER-REVIEWED | Posted: 5 September 2019 doi:10.20944/preprints201909.0052.v1
3 of 12
69 A GNSS receiver mounted on a buoy is towed on the surface by the underwater targets such as underwater
70 vehicles (Fig. 1). This technique is named as wired underwater GNSS [8, 9]. Positioning accuracy determined
71 by cable length, therefore, this type of positioning is sometimes called the “false” GNSS-like UPS [10].
73 The wireless (acoustic) buoyant underwater GNSS (Fig. 2) also does not give the true position of the target.
74 Positioning accuracy determined by the distance Underwater Positioning Systems from the buoy.
75
76
77 Figure 2. Wireless (acoustic) buoyant GNSS UAV
79 In 1992, Youngberg inspired a direct transposition of GNSS signal to underwater world [11-12](Fig. 3).
80 Acoustic waves directly go from surface buoys replacing satellites to the underwater receivers. Then, the
81 underwater platform computes its own position locally [13].
82 The surface buoys determines the XY coordinates (Z = 0) and time T, based on which the receiver of
83 GNSS-like signals determines the own XYZ coordinates. In some applications for an underwater vessel, only
84 the XY coordinates are significant, since the depth Z of the dive can be determined by a depth gauge, so we will
85 focus only on the calculations of the XY coordinates.
86 In this case (2D) without loss of generality (3D) it can be shown that the system of equations (1)
(1)
87 describing the relationship of buoy coordinates and UAV coordinates has the following solution (2)
Preprints (www.preprints.org) | NOT PEER-REVIEWED | Posted: 5 September 2019 doi:10.20944/preprints201909.0052.v1
4 of 12
88
89 Figure 3. Direct GNSS-like UPS: B1, B2 and B3 – sonar transponders of GNSS signals (2D case simulation result
90
91 Figure 4. The main strategy of spoofing (2D case simulation result):, ̶ the distances from a sonar
92 transponders to spoofer; ̶ the distance from the spoofer to UAV; {x1,y1,t1}, {x2,y2,t2} and {x3,y3,t3} – the coordinates of
93 sonar transponders and the exact time received from navigation satellites; the red continuous circle shows the boundary of the
94 effect of spoofing
(2)
96 The easiest way to mess with a GNSS receiver is to just put in radio interference or create a false noise signal
97 (Jamming), which will be stronger than the real signal. However, in this case, the GNSS receiver simply stops
98 working and the victim switches to INS positioning. In the more “intelligent” Spoofing, the victim does not
99 know that the signal received by the GNSS receiver is incorrect. The spoofer creates a false signal and the
100 victim determines the wrong time and location [14-20]. Initially, the term “spoofing” was used as a term for
101 network security, implying the successful falsification of certain data in order to gain unauthorized access to a
102 particular network resource (Spoofing TCP/IP & UDP). Over time, this term began to be used in other areas of
103 information security:
104 Caller ID spoofing – substitution of the calling phone number in VoIP-networks.
Preprints (www.preprints.org) | NOT PEER-REVIEWED | Posted: 5 September 2019 doi:10.20944/preprints201909.0052.v1
5 of 12
105 E-mail address spoofing – substitution of the email address of the sender.
106 Extension Spoofing – file extension spoofing.
107 File Name Spoofing – clone of file name.
108 Source Code Spoofing – substitution of page content and source code.
109 GNSS Spoofing – substitution of navigation data from satellites in order to deceive the victim. Initially, the spoofer
110 sends the correct coordinates, but gradually rejects the signal to the side. Doing this slowly is necessary so that the
111 GNSS receiver does not block all signals due to an abrupt change in location.
112 Underwater Spoofing – formally, it is not much different from telecommunications spoofing. The principal difference
113 is the use of acoustic signals, often for military applications (Mortimer, 2016).
114 Underwater GNSS Spoofing – substitution of navigation data from surface radio-acoustic or underwater acoustic
115 buoys in order to deceive the victim. Spoofer can be a surface or underwater manned or unmanned vehicle.
116 Notations and definitions
117 z0(x, y) – the known depth.
120
~ ~ ~
{ x v , yv , z v } – coordinates, measured by the spoofer.
124 At the moment of the victim’s capture, the false coordinates coincide with the real ones and then simulate the
125 movement of the victim along a certain trajectory. As a spoofer, we will use an acoustic signal repeater
126 (highlighted in red). It can be shown that by solving the system of equations
(3)
127 by analogy with (2) are the coordinates of the spoofer . In this case, the system of equations
(4)
128 describing the relationship between the coordinates of buoys, the repeater of acoustic signals and the
129 coordinates of the UAV has the only solution (4) under the condition (Fig. 5), that is, all the UAVs
130 that are in the range of the spoofer (acoustic repeater) define their coordinates as .
Preprints (www.preprints.org) | NOT PEER-REVIEWED | Posted: 5 September 2019 doi:10.20944/preprints201909.0052.v1
6 of 12
131
132 Figure 5. The relationship of the coordinates of the buoys, the spoofer (follower of acoustic signals) and the coordinates of the
133 UAV has a unique solution (2) under the condition
135 The motion’s law of the mass center of a UAV in general may be represented by the system of two equations
(5)
136 The UAV autopilot implements the discrete path calculation process (Fig. 6)
(6)
137 where ̶ current position of the mass center of the UAV; ̶ estimated route correction values.
138
139 Figure 6. Estimated route correction values
(8)
143 Suppose a UAV performs underwater circulation of a radius with speed with
144 discretization on time . In this case
(9)
7 of 12
148
149 Figure 7. Normal circulation of UAV (2D case simulation result); ; the red continuous circle with
150 radius 1900 m shows the boundary of the effect of spoofing. On the UAV movement trajectory (marked in blue), we see the
151 divergence of the one-step calculated and observational coordinates of the UAV in normal driving. The direction of the
152 discrepancy is determined from the calculated UAV location to the observational coordinates.
153
154 Figure 8. Truncated (restricted) circulation of UAV as a result of spoofing (2D case simulation result);
155 ; the red continuous circle with radius 2800 m shows the boundary of the effect of spoofing. On
156 the UAV movement trajectory (marked in blue), we see the divergence of the one-step calculated and observational
157 coordinates of the UAV in the spoofing mode.
159 Solving the system of equations (1) allows us to calculate the victim’s coordinates
xv , yv , zv xi xv yi yv zi zv
2 2 2
cTi , i 1, N (10)
160 where Ti – measured propagation time of a real signal from a buoy Bi to the victim.
161 The system of equations (10) is written as
N
ε xv , yv , zv xi xv yi yv zi zv cTi
2 2 2
(11)
i 1
162 In the general case, the solution (11) is carried out by numerical methods of minimization (12):
xv , yv , zv arg xmin
, y ,z
ε xv , yv , zv (12)
v v v
Preprints (www.preprints.org) | NOT PEER-REVIEWED | Posted: 5 September 2019 doi:10.20944/preprints201909.0052.v1
8 of 12
163 To determine {xv, yv, zv}, there is enough data from three buoys, however, as the software simulation of
164 GNSS-like UPS shows, due to the approximate nature of the measurement of pseudoranges (ρi ≈ cTi, i 1, N )
165 the positioning accuracy {xv, yv, zv} will depend on the number of buoys N.
166 If the victim uses a barometric depth gauge for determining zv, the system of equations (1) takes the form
xi xv yi yv
2 2
cTi , i 1, N (13)
N
xv , yv arg min xi xv yi yv cTi
2 2
(14)
x ,y v v
i 1
168 Solving the system of equations (15) allows us to calculate the spoofer’s coordinates {xs, ys}.
N
xs , ys arg min xi xs yi ys cTi
2 2
(15)
x ,y s s
i 1
169 To determine the coordinates {xs, ys} there is enough data from three buoys or three GNSS satellites if the
170 spoofer is on the surface of the sea.
171 Suppose we know the victim’s coordinates {xv, yv, zv}, for example, using a sonar range finder and a
172 measured direction to the victim. If the victim does not use barometric depth gauge for determining zv, then in
173 this case it is possible to determine the corrections ΔTi for measured time Ti so that the receiver of the victim
174 would calculate the fake coordinates equal to the true ones (16).
N
xv , yv , zv arg xmin xi xv yi yv zi zv cTi Ti
2 2 2
(16)
v , y ,z
v v
i 1
175 If the power of the spoofer’s signal exceeds the power of the buoys signals, the victim’s receiver switches to
176 receiving a false signal. Further, the spoofer applies an escaping spoofing strategy in accordance with the
177 equation system
178 where {Δxv, Δyv, Δzv} – amendment of victim’s coordinates, taking away the victim from its route. In this
179 situation, the spoofer is in an active state on the sea surface and the values zi = 0, i.e. correspond to zero sea
180 level.
181 The algorithm of finding ΔTi, i 1, N with given vectors {xv, yv, zv} and {Δxv, Δyv, Δzv} this article is not
182 considered.
184 In two next sections, we will mainly follow the results obtained in [15, 16, 20] and own research results [17-19,
185 21] and will discuss the two methods of spoofing detection:
186 1) the method of measuring coordinates of a moving victim at two points on the route using a single
187 hydrophone (in this case we use a conventional hydrophone, that is, the problem of practical implementation
188 of spoofing detection of GNSS-like UPS is reduced only to programming);
189 2) the method of measuring coordinates of a victim at two points of space using a dual hydrophone.
Preprints (www.preprints.org) | NOT PEER-REVIEWED | Posted: 5 September 2019 doi:10.20944/preprints201909.0052.v1
9 of 12
190 We install a fixed single hydrophone on the spoofing detector. Note that the victim may be in motion.
191 A. The measurement of spacing between two positions of the single hydrophone in navigation mode
192 The spoofing detector measures the coordinates of the hydrophone H, based on real signal from buoys:
N
xˆv , yˆv , zˆv arg x min cTi
xi xv yi yv zi zv
2 2 2
(18)
i 1
v , y ,z
v v
193 where (xv', yv', zv') – unknown precise coordinates of the hydrophone H at the time t', ( xˆv , yˆ v , zˆv ) – calculated
194 coordinates of the hydrophone H at the time t'.
195 The spoofing detector again measures the XYZ of the hydrophone H at the time t":
N
xˆv , yˆv , zˆv arg x min xi xv yi yv zi zv cTi
2 2 2
(19)
v , y ,z
v
v
i 1
196 where (xv", yv", zv") – unknown precise coordinates of the hydrophone H at the time t", ( xˆv , yˆ v , zˆv ) –
197 calculated coordinates of the hydrophone H at the time t".
198 The measured distance between the hydrophone at the times t' and t"
199 must be commensurate with the distance traveled by the vehicle over time (t" − t), i.e.
Dˆ 12 V t t (21)
200 B. The measurement of spacing between two positions of the single hydrophone in spoofing mode
201 The spoofing detector measures the coordinates of the hydrophones , based on false signal from spoofer:
N
xˆv , yˆv , zˆv arg x min cTi
xi xv yi yv zi zv
2 2 2
(22)
i 1
v , y ,z
v v
202 where (xv', yv', zv') – unknown precise coordinates of the hydrophone H at the time t', ( xˆv , yˆ v , zˆv ) – calculated
203 coordinates of the hydrophone H at the time t'.
204 The spoofing detector again measures the XYZ of the hydrophone H at the time t"
N
xˆv , yˆv , zˆv arg x min xi xv yi yv zi zv cTi
2 2 2
(23)
v , yv , zv
i 1
205 where (xv", yv", zv") – unknown precise coordinates of the hydrophone H at the time t", ( xˆv , yˆ v , zˆv ) –
206 calculated coordinates of the hydrophone H at the time t".
207 The measured distance between the hydrophone H at the time t' and the hydrophone Y at the time t"
208 ˆ
because all hydrophones in the spoofing zone calculate the same false coordinates and D 1 2 must be
209 incommensurable with the distance traveled by the vehicle over time (t" – t'), i.e.
Dˆ 12 V t t (25)
211 Comparing (24) and (25), we can write down the decisive rule for detecting spoofing
10 of 12
212 where D – discriminant, determined on the basis of statistical studies at the stage of designing a real detection
213 system. At present, we are carrying out theoretical studies and relevant real sea tests at various speeds V and
214 various values Δt = (t" – t') in order to find acceptable values D .
215 Note that the spoofing detector may be in motion. During the time Δt = (t" – t'), the parameters of the
216 spoofer’s signals may change, therefore solving the problem of optimizing the parameters of the spoofing
217 detector, it is necessary to minimize the parameter Δt. From the point of view of detecting spoofing, it is
218 necessary to maximize the parameter Δt. To resolve this contradiction, minimax methods of parametric
219 optimization are used [22]. Minimax is a kind of backtracking algorithm that is used in decision making and
220 game theory to find the optimal move for a player, assuming that your opponent also plays optimally. It is
221 widely used in two player turn-based games such as Tic-Tac-Toe, Backgammon, Mancala, Chess, etc.
223 We install a fixed two hydrophones H' and H" on the spoofing detector at distance D from each other. Note that
224 the spoofing detector may be in immobile or in motion.
225 The measurement the distance between hydrophones in navigation mode
226 The spoofing detector measures the coordinates of the hydrophone H':
N
xˆv , yˆv , zˆv arg x min xi xv yi yv zi zv cTi
2 2 2
(27)
v , y ,z
v
v
i 1
227 where (xv', yv', zv') – unknown precise coordinates of the hydrophone H', ( xˆv , yˆ v , zˆv ) – calculated coordinates
228 of the hydrophone H'.
229 The spoofing detector measures the coordinates of the hydrophone H":
N
xˆv , yˆv , zˆv arg x min xi xv yi yv zi zv cTi
2 2 2
(28)
v , y ,z
v v i 1
230 where (xv", yv", zv") – unknown precise coordinates of the hydrophone H" at the time t', ( xˆv , yˆ v , zˆv ) –
231 calculated coordinates of the hydrophone H".
232 The measured distance between H' and H" is
11 of 12
242 The formal transfer of GNSS under water is not possible. It probably makes sense to talk only about the
243 transformation of GPS into LPS, that is, in the Local Position System. However, the basic methods that are used
244 to solve the problem of Spoofing Detection above water can be used under water. It should be understood that
245 engineering problems are significantly different, since the nature of the propagation of acoustic waves in water
246 and electromagnetic waves in the atmosphere are fundamentally different.
247 References
12 of 12
291 [18] L. Dobryakova, Ł. Lemieszewski, and E. Ochin, The analysis of the detecting algorithms of
292 GNSS-spoofing. Scientific Journals of the Maritime University of Szczecin 36(108) 2013 z. 2, pp. 30–36.
293 [19] L. Dobryakova, Ł. Lemieszewski, E. Lusznikov and E. Ochin, The study of the spoofer’s some properties
294 with help of GNSS signal repeater. Scientific Journals of the Maritime University of Szczecin 36 (108) 2013
295 z.2, pp. 159–165.
296 [20] P. Zalewski, Real-time GNSS spoofing detection in maritime code receivers. 2014, 38(110) pp. 118–124
297 [21] L. Dobryakova, Ł. Lemieszewski, and E. Ochin, Design and Analysis of Spoofing Detection Algorithms for
298 GNSS Signals. Scientific Journals of the Maritime University of Szczecin 40 (112), 2014 pp. 47–52.
299 [22] M. Ehrgott, J. Ide & A. Schöbel, Minmax robustness for multi-objective optimization. European Journal of
300 Operational Research 239, 1, 2014, pp. 17–31.
301 [23] International Maritime Organization. "December 2000 amendments" // https://clck.ru/GwEbz [Accessed:
302 January 5, 2019]
303 [24] Federal Standard 1037C, August 7, 1996: transducer//
304 https://www.its.bldrdoc.gov/fs-1037/dir-037/_5539.htm [Accessed: January 5, 2019]