Home > Resources > Military Timing: Surviving GPS Denial

Military Timing: Surviving GPS Denial

Technical Interview: Military Timing - Surviving GPS Denial

Interviewer: Alexei Petrov, Chief Engineer, BRIDZA Systems

Expert: Dr. Elena Vance, Lead Systems Engineer, Aegis Defense Solutions

Date: 24 October 2023

Location: BRIDZA Secure Teleconference

---

**Introduction: Setting the Scene**

Alexei Petrov (BRIDZA): Dr. Vance, thank you for joining us. At BRIDZA, our core mission is delivering resilient systems for contested environments. The "assured PNT" (Position, Navigation, and Timing) problem, particularly timing, is at the heart of modern warfare. GPS isn't just about location; its precision timing signal underpins everything from secure communications and network synchronization to missile guidance and coordinated artillery. When an adversary denies or degrades that signal, the entire digital battlefield can unravel. Today, we want to explore the engineering of survival in that scenario. What does a systems architect need to know?

Dr. Elena Vance (Aegis): Thank you, Alexei. It's a critical discussion. You're absolutely right to frame it as a system-level problem, not just a GPS problem. In a peer conflict, we must assume GPS is the first thing to be attacked. My career has spanned the shift from designing systems that used GPS to designing systems that survive without it. The mantra is: "Never be a single point of failure." If your timing and navigation rely on a single, fragile signal, you have a design flaw, not an adversary problem.

---

**Technical Discussion: Architecting for Resilience**

#### 1. Understanding the Threat Landscape

Alexei: Let's start with the adversary's playbook. Beyond brute-force jamming, what are the more insidious threats we need to guard against in our designs?

Dr. Vance: The threat is layered.

  • **Jamming (Denial):** Overpowering the weak GPS signal with noise. This is the crudest form but effective and cheap. Commercially available jammers can blanket tens of kilometers.
  • **Spoofing (Deception):** This is far more dangerous. Generating counterfeit GPS signals to feed a receiver false time and position data. We've seen sophisticated spoofing in the Black Sea and Eastern Europe, where entire ship navigation systems were led astray by kilometers. Your system could think it's perfectly synchronized and operational while being utterly compromised.
  • **Kinetic/Physical Denial:** Targeting the satellite constellation itself or ground control stations. While extreme, it's a consideration in extreme conflict scenarios.
  • **Cyber/Side-Channel Attacks:** Corrupting the firmware in a GPS receiver or exploiting vulnerabilities in the software that processes the signals.

    • The key engineering insight is that threats are asynchronous. An adversary might use low-level jamming to mask a targeted, sophisticated spoofing attack on a high-value asset. Your defensive architecture must handle all these modes, often concurrently.

    #### 2. The Hierarchy of Backup Timing Sources

    Alexei: So, if GPS is compromised, we need fallbacks. Walk us through the timing hierarchy you design into a modern defense system. What's the engineering trade-off between precision, availability, and SWaP-C (Size, Weight, Power, and Cost)?

    Dr. Vance: We design to a "Precision Hierarchy." The system doesn't just fail over; it intelligently degrades while maintaining mission-essential functions. The goal is to keep the timing uncertainty as low as possible for as long as possible.

    Primary: GPS/GNSS. Still the source of choice when available due to its global coverage and nanosecond-level accuracy. The first rule is to harden the receiver: use Controlled Reception Pattern Antennas (CRPA) to null out jamming sources and advanced signal processing to detect spoofing (e.g., correlating signals with expected power levels and consistency with inertial data).

    Secondary: Inertial Navigation System (INS) with Precision Oscillator. This is your critical bridge. An INS provides continuous, unjammable position and velocity data by integrating accelerations and rotations. Its fatal flaw is drift. But for timing, the key component is the oscillator that clocks the INS computer. This is where we integrate a Rubidium (Rb) or Cesium (Cs) atomic clock, or a high-stability Oven-Controlled Crystal Oscillator (OCXO). When GPS is lost, we enter a "holdover" mode. The atomic clock's stability allows the system to maintain time with extraordinary precision.

  • **Example:** A high-quality Chip-Scale Atomic Clock (CSAC) has a stability of ~10⁻¹¹, or about 1 second of error in 3,000 years. In a tactical scenario where GPS is denied for, say, 24 hours, this introduces less than **3 microseconds** of timing error. For most systems, that's more than enough to maintain synchronization.
  • **Trade-off:** A full-size rubidium clock for a ship or aircraft is one thing. For a soldier's radio or a small UAV? That's where the CSAC revolution comes in—radically smaller SWaP, though at a higher cost per unit.

    • Tertiary: Network Time Synchronization & Alternative Signals of Opportunity. If a platform can communicate with a secure, trusted node that does have good time (e.g., a distant aircraft with clear GPS, a ground station), it can re-sync using secure network time protocols like Precision Time Protocol (PTP) IEEE 1588 over a tactical data link. Furthermore, we exploit other RF signals:

  • **eLoran (Enhanced Long-Range Navigation):** A modernized, encrypted Loran-C. It's ground-based, powerful, difficult to jam regionally, and provides 30-100ns accuracy. It's the classic backup many militaries are reinvesting in.
  • **Signals of Opportunity (SoOP):** Using the timing embedded in commercial signals like terrestrial TV or cellular networks. The challenge is these are not secure or guaranteed, but they can provide a coarse timing fix to bound the INS drift.

    • Quaternary: Platform-Specific & Emerging Tech. For a nuclear submarine, the timing source is tied to its mission: the ship's master clock, often a suite of multiple atomic clocks with voting logic to detect failure. For strategic systems, Two-Way Satellite Time Transfer (TWSTT) provides a secure, jam-resistant method to compare clocks with a ground station.

    The system's software must manage this hierarchy constantly, weighting confidence levels from each source and fusing them.

    #### 3. Sensor Fusion: The Core of Resilience

    Alexei: This "intelligent fusion" you mention is where the real systems engineering magic happens. How do you architect the sensor fusion to handle conflicting data in a GPS-denied, spoofed environment?

    Dr. Vance: This is the heart of the problem. A well-fused system is greater than the sum of its parts. The architecture must be heterogeneous and redundant. We don't fuse two identical GPS receivers; we fuse fundamentally different sensors.

  • **INS + GPS:** The classic loose/tight coupling. The INS provides high-bandwidth, smooth data, while GPS provides boundless accuracy to correct INS drift. In GPS denial, the INS carries the load.
  • **Adding Visual/Inertial Odometry (VIO):** Cameras (or LiDAR) fused with the INS. As the platform moves, visual features are tracked to estimate motion. This is spectacularly effective for UAVs and ground vehicles. In Ukraine, we've seen commercial drones using basic VIO to complete missions in GPS-denied urban canyons. It provides a relative position fix that can reset the INS drift error.
  • **Magnetometers & Barometers:** Provide heading and altitude references, respectively. Crucially, they are independent physics from inertial measurement.
  • **Celestial Navigation (CELNAV):** Modern, automated star trackers can provide a geo-fix with meter-level accuracy at night. It's slow, but it's an absolute, unjammable reference. For long-endurance assets, this is a priceless reset.

    • The fusion algorithm, typically a Kalman Filter or its non-linear variants (EKF, UKF), is constantly running a hypothesis: "Given all my sensor inputs, what is my most probable state (time, position, velocity)?" When GPS is spoofed, the filter's innovation sequence (the difference between predicted and measured GPS) will suddenly show a large, consistent error that contradicts the other sensors. A robust filter will start to down-weight or reject the GPS input as "faulty" and rely more heavily on the INS and, say, VIO.

    The practical advice: You must model and test for adversarial sensor injection. What if the spoofer is very good and gradually drifts the GPS signal? The filter needs integrity monitoring. This is where techniques like Receiver Autonomous Integrity Monitoring (RAIM) on steroids come in, using the cross-checks from disparate sensors to detect subtle anomalies.

    #### 4. Real-World Case Study: The Ukraine Conflict

    Alexei: You mentioned Ukraine. This conflict has become a live laboratory for GPS-denied operations. What have we learned from an engineering perspective?

    Dr. Vance: It's validated the entire premise. The lessons are stark:

  • **Commercial Resilience is Surprising:** The widespread use of commercial DJI drones on the front lines, modified for warfare, is a testament to basic VIO and visual SLAM. They are operating in an environment saturated with jamming. They don't have atomic clocks, but their fusion of IMU and cameras provides a "good enough" relative navigation for the mission.
  • **eLoran is Being Revived:** Reports indicate both sides are working to re-establish or exploit eLoran signals as a primary backup. It's a powerful, proven system that had fallen out of favor.
  • **The "Time Bomb" of Spoofing:** There are documented cases of GPS spoofing causing artillery rounds to miss their targets by hundreds of meters because the initial GPS fix for the fire mission was false. This underscores that timing isn't just for the weapon's guidance; it's for the *initial targeting* and *network sync* of the firing platform. A spoofed coordinate fed into the fire control computer is catastrophic.
  • **Resilience is a Spectrum:** The conflict shows that no single solution works. Success comes from a layered approach: a drone might use VIO for flight control, while its encrypted datalink uses a high-stability OCXO to maintain communication sync, and its artillery coordination uses an eLoran-backed unit on the ground.

    • #### 5. Practical Design Advice for Engineers

    Alexei: For the engineers in our audience designing the next generation of defense systems, what are the non-negotiables?

    Dr. Vance:

  • **Assume Denial from Day One:** Don't bolt on resilience. It must be a core requirement in the System Requirements Document. Specify timing holdover performance in GPS-denied conditions.
  • **Invest in the Clock:** The precision oscillator is the single most important component for timing holdover. Allocate budget and SWaP for a quality Rb clock or CSAC. For platforms where that's impossible, design for robust network time sync.
  • **Embrace Heterogeneous Redundancy:** Fuse *different* types of sensors. Use physics-based (INS), signal-based (eLoran, SoOP), and scene-based (VIO, CELNAV) sources.
  • **Secure the Timing Source:** This is critical. Your atomic clock's stability is meaningless if an adversary can reset it via a network breach. The timing source must be physically and logically secured, with authenticated interfaces.
  • **Test Adversarially:** Your test plan must include scenarios with GPS jamming and spoofing injected. Does your fusion filter gracefully degrade? How long can it maintain required timing accuracy? What is its behavior when sensors give conflicting data? Use hardware-in-the-loop simulators to replicate contested electromagnetic environments.

    • #### 6. The Future: Quantum and Beyond

    Alexei: Looking ahead 5-10 years, what technologies will change this game?

    Dr. Vance: Two areas excite me:

  • **Quantum Sensing:** Quantum Inertial Sensors (using cold atoms) promise orders-of-magnitude improvements in INS drift rates. An INS that doesn't drift meaningfully over a mission would nearly eliminate the need for GPS for navigation and, by extension, would carry its precision time with it. These are still lab-sized, but miniaturization is advancing rapidly.
  • **M-Code and Next-Gen GNSS:** The military's M-Code signal is more jam-resistant and secure. Future constellations may incorporate better integrity monitoring and alternative signals.
  • **AI for Integrity Monitoring:** Using machine learning to model the expected behavior of a platform's sensor suite and detect the subtle, anomalous patterns of a sophisticated spoofing attack that might fool traditional algorithms.

    • The end state is a system that is Consciously Aware of its own PNT confidence, using every available resource to maintain it, and gracefully, predictably, and safely degrading its functions when absolute precision is no longer possible.

    ---

    **Conclusion**

    Alexei: Dr. Vance, this has been an incredibly insightful deep-dive. You've framed the problem perfectly: surviving GPS denial isn't about finding a single "magic bullet" replacement for GPS. It's about architecting a system of systems with diverse, redundant sources of time and navigation, fused intelligently by software that is as aware of potential deception as it is of sensor data.

    The key takeaways for our team at BRIDZA are clear: 1) Prioritize the precision oscillator, 2) Fuse heterogeneous sensors, 3) Design for intelligent degradation, and 4) Test relentlessly in adversarial conditions. The battlefield of tomorrow will be won not by those with the most satellites, but by those whose systems can think and adapt when those satellites go dark.

    Dr. Vance: Precisely, Alexei. It’s a profound shift from dependence on infrastructure to assured capability. Thank you for the focused discussion.

    Alexei: The pleasure was ours. Thank you for sharing your expertise.

    ---

    Interview Ends.

    ← Back to Resources