The Joint Research Center's GNSS laboratory has capabilities for testing receivers including GNSS simulators generating multiple constellations, a shielded room, and portable simulators creating various signal anomalies. They can perform spoofing and meaconing attacks by aligning simulated signals and have record and playback equipment. The laboratory supports projects on Galileo testing and qualification.

1. JRC GNSS Rx Testing Capabilities
Unit Technology Innovation in Security
Directorate Space, Security and Migration)
Joint Research Center (JRC)
European Commission
Ispra, Italy
The European Commission’s
in-house science service
Info Day Galileo Fundamental Elements
Galileo Team
J. Fortuny

2. 2
EMSL
Originally conceived for remote sensing and
automotive applications
• Two “sleds” – positionable antenna mounts
• Ultra-Wide Frequency Range:
0.2 – 26.5 GHz
State of the art wireless comms
• Vector network analysers
• Wideband digital oscilloscopes
• Real time spectrum analysers
• Spectrum monitoring stations
• Vector signal generators
GNSS Testing Equipment
• Several GNSS Rx: CS, timing, professional
• Generation of GNSS signal simulation attacks
• 16-bit QuadBand Record&Playback Platform
Spirent GSS9000: E1/E5/E6 and L1/L2/L5
• Spectracom GSG-6: L1/E1/G1/B1, L2/G2/B2,
L5/E5
GNSS Testing Facilities (1/3)

3. 319 March 2018
GNSS Testing Facilities (2/3)

4. 419 March 2018
GNSS Testing Facilities (3/3)
RF Shielded Room

5. Portable GNSS Simulator
Portable simulator featuring:
• All constellations available: GPS, GLONASS,
Galileo, BeiDou, QZSS, IRNSS
• 64 channels (comprehensive of satellites,
interference, multipath)
• Multi-frequency: L1/E1/G1/B1, L2/G2/B2,
L5/E5
Test various GNSS signal
anomalies as
• multi-path and fading
• interference and jamming
• spoofing
• atmospheric effects
User-defined scenarios can
be specified:
• via Trimble Sketchup &
Google Maps
• in real-time from a
TCP/IP data stream
• from recorded data
(such as NMEA)

6. Pedestrian Reference System
Features:
• FOG and MEMS accelerometers
• Dual frequency GPS, Glonass,
SBAS, L-band and RTK support
• 100 Hz GNSS/INS integrated
solution (RT and post mission)
Specs:
• Pos accuracy:
• <1 cm RTK
• 0.02 m (10 sec outage)
• 0.12 m (30 sec outage)
• 0.23 m (60 sec outage)
Backpack with battery and
antenna post
Novatel SPAN-CPT bundled with Inertial Explorer

7. • One GNSS Simulator generating E1BC in accordance with Galileo
OSNMA Authentication Scheme
 Spirent GSS9000 with 6x Signal Banks: GAL E1/E5/E6 + GPS L1/L2/L5
- Up to 16 channels in all signal banks
- Generation of GAL E1BC with pre-computed INAV navigation data
symbols in accordance with current GAL OS NMA scheme
- SW tool calculating INAV data symbols for a given set of satellite
ephemeris and time window will be made available
GNSS Simulation Capabilities (1/3)

8. GNSS Simulation Capabilities (2/2)
INAV Message Symbol Data

9. • One GNSS Simulator to be used for meaconing and spoofing
attacks with coarse time alignment
 Spectracom GSG-64 with GPS L1/L2/L5, GAL E1/E5
- Up to 8 channels per constellation
- Beidou B1/B2 and GLONASS G1/G2 also avalable
GNSS Simulation Capabilities (3/3)

10. • Two possible solutions:
1. Using record and playback platform and a GNSS simulator:
- Spoofing attacks on the GPS/Galileo OS in L1 implemented pre-
recording sequentially two scenarios (baseline and spoofing) and
combining them off-line into one IF dataset to be played back.
- Sharing 10 MHz reference and a TRIG signal allows a very precise
time alignment (<1 ns) of the two scenarios.
2. Using two GNSS simulators currently available at the JRC: a Spirent
GSS9000 and a Spectracom GSG-64.
- Time alignment of the two GNSS signals is much coarser in this case
- However it can be seen as a more realistic attack
Spoofing & Meaconing Attacks

11. PXI Chasis Record and Playback
• PXI 18 slot Chasis with 1x RF Signal Generator
(PXIe-5673), 1x RF Signal Analyser (PXIe-5663),
2x 3.8 TB SSD Raid Storage
• Maximum sampling frequency of 50 MSamples/sec
with 16-bit I&Q Samples (8-bit I&Q also possible)
• Duration of the streaming to/from raid storage
limited only by its capacity
• Possibility to use external TRIG and 10 MHz ref
• Control SW in NI LabView

12. AsteRx4 Rx Tracking 4 GAL SVs (E1+E6) at
50 MS/sec Using PXI Record and Playback

13. • 2x NI USRP 2943R: Record and playback of IF data with
4,8, or 16 bit depth
• Up to two bands simultaneously recorded/played back at
a sustained sampling rate up to 100 Msmp/sec
• IF data streamed to/from an SATA SSD disk drive on the
host PC running the control software
One NI USRP 2943R playing back two bands (L1/L2) at 50 MS/sec
with 8 bit depth and Septentrio PolaRx4 tracking the signals

14. Concluding Remarks
• JRC’s GNSS Laboratory: State of the art laboratory with the
capabilities of generating complex coexistence and interference
scenarios
• JRC is presently supporting projects sponsored by DG ENTR and GSA
in the context of the EGNSS Programmes, through the H2020 and
GFE R&D Actions
• JRC is working closely with GSA and facilitating testing GNSS
receivers, underpinning the market uptake of Galileo
14