Options for Mitigating Potential GPS Vulnerabilities

Transcription

1 Options for Mitigating Potential GPS Vulnerabilities GPS receivers have been widely used in communications infrastructure to provide precise time and frequency required to synchronize wireless base stations to ensure seamless call handoff, quality streaming video and location based services such as car navigation systems and most notably E911 services in the US. However, recent events have shown that GPS is susceptible to interference from deliberate spoofing and jamming techniques which can seriously disrupt or even completely disable GPS dependent applications and natural outages as with urban canyons. GPS jamming is a deliberate attempt to disrupt GPS services. Service disruption can occur at local, regional and national levels. Locally, fleet truck drivers and car thieves often use jamming devices to avoid tracking and detection. One notable example of national level jamming occurred on March 5 th, 2011, when North Korea jammed South Korea s wireless communications infrastructure knocking out many base stations. GPS spoofing occurs when a GPS signal appears to the receivers to be a valid signal but the frequency, position, and/or Time of Day content is altered. Increased availability of low-cost, commercially available jamming and spoofing devices that can be purchased at local electronics stores has greatly increased GPS vulnerabilities. This white paper will discuss mitigation options for interference to GPS installations and introduce a new packetbased primary reference source from Symmetricom called TimeProvider 1500 as a viable alternative to protect from GPS vulnerabilities. Page 1 of 5

2 LightSquared The FCC recently approved use of satellite L-band spectrum ( MHz and MHz) for terrestrial mobile services. Due to the proximity of the L-band spectrum to the GPS band ( MHz), questions have been raised regarding potential interference to existing GPS Antenna installations. If a LightSquared L-band transmitter is installed at or near the location of an existing GPS antenna the GPS signal can be affected. Care must therefore be taken to assure that the GPS antenna is not in the direct beam of the L-band transmitter if located within 1200 meters. The potential impact is greatest for sites where the antennas are colocated such as base station sites. There are 3 mitigation options available to protect GPS vulnerabilities : 1. Locate the GPS antenna such that it is not in the direct beam of the LightSquared L-band transmitter, 2. Replace the GPS antenna with a model incorporating enhanced narrow band filtering (not available in all cases), or 3. Install a packet-based primary reference source (PRS) that has rubidium to guarantee holdover to deliver precise frequency and timing. GPS Antenna Relocation Option: Primary Reference Sources (PRS), which typically use GPS to distribute precise synchronization to all network elements, are typically located at telecom central offices or mobile switching centers. These locations are usually the primary synchronization source for those locations. For sites where near-proximity to a LightSquared transmitter is a major concern, there are a number of options to facilitate antenna placement in a location not in the direct beam of the LightSquared transmitter: Roof top antenna Wall-mount antenna Window antenna With flexible antenna mounting and location options, it is generally possible to select an antenna mounting location that is safe from potential near-proximity direct beam interference. However, this solution is viewed as temporary and the interference issue can reappear as new sites are installed by LightSquared. GPS Antenna Filtering Option: For sites where antenna relocation is not a viable option, some commercial GPS antenna manufacturers are offering special L1 antennas with enhanced filtering to mitigate potential L-Band interference. It must be noted that the filtering option may reduce but not necessarily eliminate potential interference with GPS signals as a result of close proximity to a LightSquared L-Band antenna. This is especially true in applications using wall-mount antennas, since there are no enhanced filtering capabilities available for these antennas. Packet PRS Option: The optical solution is the implementation of a packet-based PRS synchronization such as the TimeProvider 1500 (TP1500) which utilizes IEEE to deliver a Stratum 1 frequency and timing source without requiring a GPS antenna. The TimeProvider 1500 Packet PRS, is the first non-gps, non- Cesium primary reference source, combining the power of Rubidium holdover technology with advanced IEEE soft clock algorithms to provide a Stratum 1 PRS in compliance with industry PRS standards. TimeProvider 1500 meets or exceeds the most stringent test criteria required to claim Stratum 1 level PRS performance: it fully complies with the ITU-T G.811 Stratum 1 and GR 2830 PRS performance specifications and also meets the ITU-T G.8261 specification for providing precise timing over IP, packet-based networks. TimeProvider 1500 is ideal for situations where antenna relocation or filtering is not sufficient to eliminate the threat of GPS signal interference. The TP1500 Packet PRS locks to an IEEE grandmaster located at a primary reference clock site equipped with protected GPS and/or Cesium standards. Symmetricom s advanced IEEE 1588 locking algorithms and miniature atomic clock technologies combine to enable the TP1500 Packet PRS to deliver PRS level synchronization without the need for a GPS antenna. LTE Network Architecture Favors IEEE Mobile network architecture is undergoing changes to prepare for the deployment of 4G/LTE infrastructure to deliver higher bandwidth solutions and services to subscribers. First, backhaul networks are transitioning from to Ethernet to efficiently deliver higher bandwidth services and lower overall operating costs. With the transition to Ethernet, the physical layer synchronization chain is broken when access to the legacy reference inputs are removed. Secondly, 4G/LTE mobile infrastructure is shifting towards small cells/femtocells making it economically prohibitive to deploy GPS receivers at every base station. Lastly, with GPS known vulnerabilities to jamming and spoofing, networks require an alternative to deliver precise timing and synchronization to ensure service delivery across the network. Page 2 of 5

3 To future proof networks and ensure optimal reliability throughout the network, there is a compelling need for a stable, cost-effective, and robust packet PRS that will provide synchronization for packet networks. Until recently, there have only been two types of primary reference (PRS) available: Cesium GPS Cesium Primary Reference Sources Standalone Atomic PRC Fully autonomous Core Sites Pinnacle of sync hierarchy Frequency Accuracy ± 1 x Standalone Cesium PRS atomic clocks are simple to install and robust because they do not receive timing based on an external signal but generate it internally. However, they in practice are restricted to core sites of the network. GPS-based PRS on the other hand may be lower cost initially, but can have high set up costs because deployment requires the installation of a GPS receiver, an antenna, and cables, and requires roof and cable run access. GPS systems are also limited to locations with line of sight visibility to the satellites from which they derive timing, and so cannot operate in urban canyons. There is now a third PRS option from Symmetricom utilizing packet-based technology based on IEEE that does not use a GPS antenna. Based on a Precision Timing Protocol (PTP) reference derived from a centralized IEEE 1588 PTP grandmaster clock, Packet PRS provides Stratum 1 quality clock timing input over an Ethernet infrastructure to a Synchronization Supply Unit (SSU) and is ideal to use in core and colocation sites as standalone PRS or as a backup to GPS as displayed in the Primary Reference Source Hierarchy shown in Figure 1. Traditional Network Synchronization All nodes in a synchronized communications network must be referenced, or traceable, to a PRS that offers Stratum 1 performance in accordance with recognized industry standard ITU-T G.811. In traditional Time Division Multiplexed () digital communications networks, sync was maintained by employing two types of synchronization element, Primary Reference Clocks (PRC) and distribution clocks, over a physical circuit. The PRC or PRS (using either Cesium or GPS) provides the reference frequency signal for the synchronization of other clocks within a network, or section of a network. Distribution clocks (called BITS, SSU or SASE depending on configuration, region deployed, and the specific standards body) select one of the external synchronization links coming into a station as the active synchronization reference. The synchronization from a PRS site to the is carried over SONET/SDH networks using derived T1/E1 signals from the optical line rate. The high availability requirement of SDH-based networks mandates the use of multiple site PRS preferably located in different geographical regions. As displayed in the Current Network in Figure 2. GPS Packet-based IEEE 1588 PTP based PRS Standalone PRC or backup to GPS No external GPS antenna Requires PTP grandmaster Frequency Accuracy ± 1 x Figure 1: Primary Reference Source Hierarchy Master Site B OC-48 OC-192 Figure 2: Current Network SONET/SDH RING Line Timed DS1 SONET/SDH RING at the Remote Site C uses Derived T1/E1 input references line timed from SONET/SDH rings. OC-48 Delivered T1/E1 OC-192 Remote Site C GPS Flatten sync hierarchy Distributed in core and edge Requires GPS antenna installation Frequency Accuracy ± 1 x Page 3 of 5

4 The Synchronization of Packet Based Networks The migration of networks to packet-based Carrier Ethernet or IP/MPLS networks will cause the synchronization chain to break; the Ethernet network elements cannot deliver frequency synchronization when T1/E1 input references are removed. As displayed in New Ethernet Network in Figure 3, the can be front-ended with an IEEE 1588 PTP slave clock the Packet PRS which delivers PRS quality T1/E1 to the SSU clocks. The Packet PRS receives timing from one or more central IEEE 1588 grandmaster clocks co-located with a GPS or cesium PRS. When using such a Packet PRS the network should be setup to deploy IEEE 1588 grandmaster (or 1588 PTP grandmaster Blades in the ) in geographically redundant Central Offices (CO) for diversity based risk mitigation as displayed in PRS Distribution in Rubidium Performance in Packet PRS in Figure 4. How Packet PRS Works Using a rubidium miniature atomic clock combined with a state of the art Soft Clock 2.0 algorithm, Packet PRS reconstructs a PRS Stratum 1 quality clock from the IEEE 1588 PTP packets coming from a grandmaster in a central site, thus maintaining the synchronization chain that is otherwise missing in the packet network. The 1588 packets are converted into T1/E1 signals that meet the G.811/ST1 PRS mask. Figure 3: New Ethernet Network Metro Ethernet Ethernet Ethernet Metro Ethernet Remote Site C Problem Ethernet NE no longer requires Frequency Synchronization Loss of Derived T1/E1 Input reference to at Remote Site C Building restricts antenna installation Cesium too expensive, single reference solution To function in this capacity, Packet PRS must comply with industry standards and follow the specifications for a Stratum 1 clock as defined in ITU-G.811. Symmetricom test results show that even after losing PTP reference for up to 48 hours (bridging + holdover), the wander in output in the Packet PRS is still within the MTIE mask. These results meet and exceed Telcordia GR 2830 requirement section 6.4.2: Upon losing reference, output shall maintain PRS performance for at least 6 hours and unacceptable region should not be entered for the first 48 hours after the allowed impairment, as displayed in Rubidium Performance in Packet PRS in Figure 4. Figure 4: Rubidium Performance in Packet PRS Page 4 of 5

5 Packet PRS Benefits TimeProvider 1500 applications include, but are not limited to, GPS difficult sites with no roof access, sites with an unreliable GPS signal as in urban canyons or tunnels, sites vulnerable to GPS interference due to jamming and spoofing, and as a back-up to GPS supporting frequency and time services. The ability to synchronize to another non-colocated grandmaster clock over a packet-based network ensures 24/7/365 availability in the event of GPS service interruption. As Ethernet replaces, creating a hybrid network, some SSU/ BITS will lose their synchronization source. Front-ending these downstream clocks with TimeProvider 1500 Packet PRS will enable them to continue supplying synchronization to both SDH/ SONET and Synchronous Ethernet infrastructure environments in the hybrid network that will be the reality for most operators for a considerable time. Moreover, TimeProvider 1500 can serve as a tool for carriers seeking to provide accurate one-way Service Level Agreement (SLA) measurements to their enterprise account customers. The IEEE 1588 is a server/client time transfer protocol allowing client engines to be embedded in network endpoints for accurate time synchronization enabling accurate one-way SLA measurements. Both innovative and unique, the TimeProvider 1500 delivers the precise and accurate synchronization that networks require as they migrate from to next generation synchro nous-aware packetbased technologies, as displayed in the PRS Deployment Chart shown in Figure 5. Conclusion Packet PRS solutions, like the TimeProvider 1500, not only mitigate but totally eliminate potential GPS interference from LightSquared antenna sources since there is no GPS required at Packet PRS locations. Carriers now have a new choice for deployment and diversity of primary reference sources in their networks to overcome GPS vulnerabilities. The TimeProvider 1500 provides a secure and cost effective solution to support rapid migration to Carrier Ethernet in the core, and is immune to potential GPS antenna vulnerabilities such as interference or jamming. Symmetricom has combined the innovative technologies of its Rubidium oscillator and IEEE1588 PTP Soft Clock algorithm to deliver the stable robust timing required by today s evolving networks Type of Primary Reference Source Antenna Type Telecom Outputs Equipment Costs Install Complexity Main Applications Standalone Cesium Atomic Clock None 10MHz/1PPS High Low Pinnacle of the sync hierarchy; used in core sites Source of sync for SONET/SDH Hubs and ADMS class 5/End office GPS-Based Reference Clocks Window Wall Rooftop 10MHz/1PPS TOD Medium High Offices with line of sight visibility to satellite Decentralized synchronization nodes in a distributed sync network SONET/SDH Hubs and ADMS Synchronous Ethernet IEEE 1588 PTP Packet- Based Clock None 10MHz/1PPS TOD Low Medium Used in core and colocation sites as standalone PRS or as a backup to GPS-based PRS Provides sync input to an based on an external PTP reference from a GMC in a master site GPS difficult sites SONET/SDH Hubs and ADMS Synchronous Ethernet Figure 5: PRS Deployment Chart 2300 Orchard Parkway San Jose, California tel: fax: Symmetricom. Symmetricom and the Symmetricom logo are registered trademarks of Symmetricom, Inc. All specifications subject to change without notice. WP/MitigatingGPSVulnerabilities/051411