GPS tells phones, cars, ships and power grids where they are and what time it is. That signal is easy to drown out or to imitate. GPS Shield watches a receiver around the clock and raises the alarm when something is wrong — before a false position or a false time does any harm.
A multi-constellation (GPS · Galileo · GLONASS · BeiDou), dual-band (L1/L2) detection system built on a u-blox ZED-F9P: 15 detectors (14 of them run on the F9P) over raw observables, the MON-RF jamming indicator, the receiver clock and Galileo OSNMA cryptographic authentication, plus a 30-second guard loop with push alerts and an external dead-man's switch.
Every number is measured on recorded or live data — not estimated.
Navigation satellites orbit about 20,000 km up and send a signal that arrives weaker than the background noise. A receiver only hears it because it knows exactly what to listen for. That leaves two simple ways to fool it:
The minimum received power of GPS L1 C/A is about −128.5 dBm, below the thermal noise floor in 2 MHz (~−111 dBm); it is recovered only through correlation gain. Two attack classes follow: jamming raises the noise floor beyond the link margin, and spoofing transmits consistent counterfeit signals with a few dB of power advantage and drags the receiver's tracking loops onto them.
A transmitter fills the frequency with noise and the receiver can no longer hear the satellites. The position is lost. It is noticeable, but dangerous if the system does not understand why the position disappeared.
A wideband or sweep jammer shifts the AGC operating point and raises MON-RF jamInd; C/N0 drops uniformly across SVs, low-elevation SVs drop out first, then the fix is lost. The AGC reacts before the fix is lost, which makes it an early warning.
A transmitter imitates the satellites and is slightly louder. The receiver believes it and shows a false position or time — while everything looks fine. That is far more insidious.
Takeover (lift-off/pull-off): the spoofer aligns code phase and Doppler, raises power, then drags position or time. Tells: a C/N0 jump and collapsing spread (one transmit antenna), L1/L2 inconsistency (L1-only spoofer), a change in clock drift, and Galileo navigation-message authentication failures.
Click a block to see what it does.
The guard can only send an alert while it is running. If the computer loses power or network, the silence would go unnoticed. So a second server checks every 5 minutes that the guard is still writing — and raises the alarm itself if it stopped.
An external dead-man's switch on another machine: every 5 min it checks the age of the latest history record; if it is older than 300 s on two consecutive rounds, it pushes "guard silent". Reminders every 6 h, a separate recovery notice, and a timed mute for field tests.
All receiver measurements go to disk and are backed up hourly to another machine. Later you can see exactly what happened, and where.
Hourly UBX files (NAV-PVT, RXM-RAWX, MON-RF, NAV-CLOCK, RXM-SFRBX) kept for 30 days. Incremental backup orchestrated by a third machine with no new trust relationship: manifest diff, snapshot of files still being written, verification after copy. Backup pauses on mobile networks so a field test does not pull gigabytes.
Pick a scenario and watch how the signal changes and which detectors react. The attack starts at second 30. The curves are illustrative, but their shapes and the detector behaviour match the real tests.
No single signature catches every attack. Each detector produces a score from 0 to 1 and the verdict is the highest score: above 0.35 is a warning, above 0.70 an attack. That lets every detector be narrow and precise without having to know everything. 14 detectors run on the real F9P receiver; correlator shape (SQM) needs a software receiver.
Europe's Galileo system adds a digital signature to its navigation messages (OSNMA). Satellite data can be checked like the signature on a bank transfer: a spoofer can imitate the signal, but cannot produce the right signature. GPS Shield checks these signatures continuously.
OSNMA uses a TESLA key chain: authentication tags are computed with a key disclosed later, whose chain root (KROOT) is signed with ECDSA P-256; the public key is bound to a Merkle tree. We verified that public key PKID 2 and the Merkle root match the official European GNSS Service Centre files byte for byte. Verification runs with OSNMAlib on the F9P's raw SFRBX subframes as a persistent process.
Chain of trust: each link vouches for the next.
| Signatures verified | 205 |
| Signatures failed | 0 |
| Satellites authenticated | 8 |
| Cold start, indoor antenna | ~27 min |
| Expected outdoors | ~5 min |
| During the field-test drive | 252 ✓ · 0 ✗ |
Why does it matter? Two of the simulator's attacks — the navigation-message forgery and part of the takeover — move no physical signature at all. Only the signature catches them.
The synthetic corpus's two nav_corrupt af0 misses (a corrupted clock parameter in the navigation message) are a textbook authentication problem; OSNMA covers them without heuristics. OSNMA absent for 30 min is a warning; a failed tag is an attack.
Attack recordings processed with the GNSS-SDR software receiver: takeovers, drifts, time pushes, blinding.
0/9 clean recordings raised a false alarm (max score 0.25, threshold 0.35).
Changes injected into a real F9P recording: overpower, drop, loss of lock, flat signal, selective, 5 jamming types.
| Attack | Main detector | Verdict |
|---|
A real sky is different from a lab: satellites rise and set, the receiver clock occasionally jumps and the computer reboots. After the first day every false alert was analysed and its cause fixed — then we checked that real attacks were still caught. The next three days: 9,650 checks, zero false alerts.
Causes: the F9P lets its clock offset run to −1 ms and then resets it (every 7–10 h; previously read as a time spoof — the rule now targets exactly that shape with a 10 µs tolerance); C/N0 uniformity and absolute-level thresholds tuned on a short baseline; OSNMA "no tags" right after a restart; a recording gap inside the window. After each change, 1 ms time jumps were re-injected — a looser rule let 60% of them through and was rejected.
Detection became its own standalone project and codebase. Clean baseline: every detector at 0.000.
Signal-level detectors (10/10), synthetic regression 98/129, first Galileo authentication, L1/L2 and clock detectors, push alerts.
About 20 false alerts analysed and fixed. The guard now alerts even when it fails to start.
9,650 check rounds, 0 false alerts. External watchdog and automatic backup added.
System in the car, a dedicated drive view on the phone. Everything recorded to map where the interference occurred.
Measuring attacks on real radio signals — only over cable or in a shielded room, and with a frequency licence.
The same detection that runs at a fixed station today, in one box with a screen, battery and buzzer. Put it on the dashboard or carry it, and it tells you continuously whether the satellite signal can be trusted.
A receiver with one omnidirectional antenna cannot see direction, but while moving it sees where the jammer is stronger. Place a jammer on the map (click), let the device drive the streets and see where the calculation puts the source. In “Direction finding” mode you take bearings instead, as with a directional antenna. Everything runs in your browser, in a made-up town.
Illustrative simulation. The demo uses synthetic data: jammer strength falls with distance, with noise added as from building reflections. Real accuracy is tens of metres in the open and up to a few hundred among buildings. A precise location also needs a stationary reference station or a directional antenna.
GNSS jamming is an everyday fact around the Baltic Sea. Below are the use cases where a handheld gives more than a gut feeling: time-stamped evidence of when and where the signal could not be trusted.
Interference has caused flights in the region to be diverted and temporarily suspended. With the device you can drive around an airport and map where and when the interference occurred. Afterwards you can show air traffic control data, not just pilot reports.
Under spoofing, a ship's GPS shows a position where the ship is not. A device on the bridge or the pilot boat tells you continuously whether the position can be trusted, and records the incident for investigation.
Cell towers, the power grid and data centres take precise time from GPS. During installation or an audit, the handheld checks whether the antenna site is clean. For permanent monitoring, the same software runs on a fixed unit.
Cheap in-car jammers, used to hide a vehicle from tracking, disrupt every receiver nearby. In a moving car the device shows where the interference is strongest and narrows the search down to a street or a car park.
A unit sees continuously whether its navigation is being jammed or spoofed, and the logs give a shared picture of where interference occurred. The device emits nothing, so it does not give away its user's position.
Drone and RTK survey quality depend on clean GNSS. Five minutes on site with the device tells you whether you can fly and measure today, or should treat the results with caution.
Concept. The handheld is at the prototype stage and the screens are design mockups with sample values. The detection itself works and has been tested; see the results above.
The project generates and transmits no signals. Attacks are tested on recorded and synthetic data. Real radio tests are planned only over cable or in a shielded environment, with the appropriate licence.
If a spoofer shifts the position by less than ~30 m, it hides inside normal measurement noise. Raising the sensitivity would bring false alarms, so we have deliberately left it.
4 synthetic takeovers with a 5–30 m final offset stay below threshold (settled offset <12 m vs 1–2 m clean for a static receiver). takeover_offset lifted 96 → 98, but lowering its floor would endanger zero-FP.
The system sees where interference was felt, not where it came from. Direction can only be estimated from movement.
A single isotropic antenna has no AoA. Source estimates come from the jamInd/C/N0 gradient along a moving platform's track, or from multi-station TDOA. The F9P does not output correlator shape, so SQM runs only on the SDR.
The position-drift detectors assume a stationary antenna. While driving they are left out and the verdict comes from signal, band, clock and crypto signatures, plus whether position change matches speed — which is what the drive view is for.
Under spoofing, the counterfeit position is what gets recorded. The true position has to be reconstructed later from the trustworthy points around it.
All attack figures come from recordings and injection. Measuring cable-conducted attacks (latency, detection rate, false alarms) is the next stage.
Global Navigation Satellite System — the umbrella term for GPS (USA), Galileo (EU), GLONASS (Russia) and BeiDou (China). GPS Shield listens to all four at once, because spoofing all of them consistently is much harder.
How strongly a satellite stands out from the noise, in dB-Hz. Under open sky typically 35–50. A sudden uniform drop suggests jamming; a sudden uniform rise with suspiciously similar values suggests spoofing.
The receiver's automatic gain control. With a lot of noise on air, the receiver turns its gain down. The F9P reports this as a 0–255 jamming indicator. It often rises before the position is lost.
Two frequency bands the satellites transmit on simultaneously. A simple spoofer usually imitates only L1. If L1 and L2 tell different stories about the same satellite, something is wrong.
A cryptographic signature on Galileo navigation messages. Free and open. Proves a message really came from Galileo.
The spoofer starts exactly aligned with the real signal, gets louder, then slowly pulls the receiver away — so slowly that no jump stands out.
An alarm when there was no attack. For a guard, it is as bad as a miss: alarms that come too often stop being taken seriously.
u-blox's binary receiver message format. Carries position, raw per-satellite measurements, RF front-end state, the clock, and raw data broadcast by the satellites.