Resilience and Validation of GNSS PNT Solutions

Humphreys, Todd E.; Chen, Qi Alfred; Ozguner, Umit; Toth, Charles · 2023 · ROSA P / Center for Automated Vehicles Research with Multimodal Assured Navigation (CARMEN+) Tier-1 University Transportation Center (UTC)

archive: archived pipeline: cataloged verified

Get this paper ↗ (full text — opens at the source; we link to it, we don't host it)

Summary

This report addresses the critical vulnerability of Global Navigation Satellite System (GNSS) positioning, navigation, and timing (PNT) solutions in highly automated vehicles (HAVs). While GNSS provides essential global coverage and meter-level accuracy, it is fragile in urban environments due to multipath interference and susceptible to deliberate spoofing attacks. The research focuses on developing resilient, low-cost anti-spoofing techniques for ground vehicles, specifically leveraging the tight coupling of carrier-phase differential GNSS (CDGNSS) with inertial measurement units (IMUs). The primary motivation is to ensure HAVs can detect subtle spoofing attacks rapidly and reliably without relying on expensive multi-antenna systems or tactical-grade sensors. The study develops a single-antenna spoofing detection method based on the "windowed fixed-ambiguity residual cost" (WFARC). This statistic measures discrepancies between GNSS carrier-phase measurements and predictions derived from IMU data. The core premise is that while a spoofer can mimic general vehicle motion, they cannot predict high-frequency, sub-centimeter movements caused by road irregularities, which are accurately captured by the IMU. The method was validated using the TEX-CUP dataset, collected in Austin, Texas, featuring diverse multipath environments (open sky, shallow urban, and deep urban). The experiments utilized both industrial-grade (LORD MicroStrain) and consumer-grade (Bosch) IMUs. To evaluate worst-case scenarios, the researchers employed "timestamp spoofing," an observation-domain attack that shifts measurement timestamps to create plausible but inconsistent signals, effectively nulling authentic signals without detectable power anomalies. Results demonstrate that the WFARC-based detector is highly effective in identifying spoofing attacks within two seconds. In shallow urban environments, the industrial-grade IMU detected all tested timestamp shifts within one second, while the consumer-grade IMU detected them within two seconds. The detection sensitivity is environment-dependent; deep urban areas exhibit higher baseline noise due to severe multipath, which can mask subtle attacks. However, the method successfully distinguished spoofing-induced discrepancies from natural multipath effects in most scenarios. The study also highlights that consumer-grade IMUs, despite higher noise variance, remain viable for this detection strategy, supporting the goal of mass-market applicability. The significance of this work lies in providing a cost-effective, single-antenna solution for GNSS spoofing detection that integrates seamlessly with existing tightly-coupled navigation architectures. By exploiting the physical impossibility of spoofers replicating high-frequency inertial dynamics, the method offers a robust defense against sophisticated cyber-physical attacks. This contributes to the broader field of PNT resilience by demonstrating that low-cost sensors can achieve high-security performance, thereby enhancing the safety and reliability of autonomous transportation systems in challenging urban environments.

Key finding

A tightly coupled carrier-phase GNSS and low-cost IMU system can detect worst-case GNSS spoofing attacks within two seconds by identifying discrepancies between IMU-predicted and measured carrier phase values caused by road-induced vehicle motion.

Methodology

on_road

Provenance

The full processing record for this entry. Every stage of this paper's journey through the pipeline is logged — what ran, with which tool and model, how many attempts it took, and when it last completed. Discovered via bulk_ingest_rosap on 2026-05-23 (6 acquisition events logged).

Summary generated by qwen3.6-27b-prismaquant on 2026-06-10; verification: verified.

Topics

Ranked by relevance to this paper. Hover a topic for its definition.

• dms validation