BroadShield

What is BroadShield?

BroadShield is an optional software module for SecureSync that is capable of detecting the presence of GPS jamming or spoofing in real time.

How BroadShield Works

BroadShield monitors the GPS signal frequency band by applying proprietary error detection algorithms. If a threshold signal monitoring value level is exceeded, SecureSync will emit a Major Alarm and – depending on your system configuration – invalidate the GPS reference causing SecureSync to either transition into Holdover mode (seeHoldover Mode), or go out of sync.

Even if you decide to turn off SecureSync's Auto Sync Control feature, which allows BroadShield to disable the GNSS reference, BroadShield will still add value to your overall system capability by telling you (a) if your GNSS receiver is being spoofed, and (b) in the event of a signal loss due to jamming, why the signal is lost.

Also, if a normally strong GNSS signal becomes weakened, BroadShield's algorithms are capable of discerning a jamming event from natural events causing the signal to weaken.

Note: For an effective jamming detection, and – to some extent – spoofing detection, a good antenna placement with optimal sky view resulting in a high signal-to-noise ratio is essential. A strong signal is required to discern between normal signal fluctuations and a non-natural divergence of signal strength.

BroadShield Requirements

In order for BroadShield to work on your SecureSync system, the following requirements must be met:

  1. The optional BroadShield software license needs to be enabled by applying the OPT-BSH BroadShield license key. For more information, contact your local Safran Sales Office. To determine if BroadShield has been activated on your SecureSync unit, navigate to TOOLS: SYSTEM > Upgrade/Backup. The center panel System Configuration will list the Options installed in your unit.

Activating the BroadShield License

If you have purchased the BroadShield license key and now want to activate it, please follow the instructions under Applying a License File.

To confirm that BroadShield has been activated on your SecureSync unit, navigate to TOOLS: SYSTEM > Upgrade/Backup. The center panel System Configuration will list the Options installed in your unit.

Enabling/Disabling the BroadShield Service

The Broadshield service can be run in two operating modes:

  • BroadShield only: In the event jamming or spoofing is detected, SecureSync will emit a Major Alarm, however it will continue to consider the GNSS reference as valid, i.e. it will NOT go out of sync.
  • Auto Sync Control: In the event jamming or spoofing is detected, SecureSync will emit a Major Alarm AND it will go into Holdover mode.

To configure these settings:

  1. Navigate to TOOLS: SYSTEM > Broadshield.
  2. In the BroadShield Service panel on the left, configure the desired setting:

    3. Note: Turning BroadShield OFF and Auto Sync Control ON is an invalid setting and will cause a "Failed to connect to the unit..." error.

  3. In the BroadShield Web UI on the right, navigate to SETTINGS > ALGORITHMS, and ensure that Jamming and/or Spoofing detection are enabled.

Configuring BroadShield

To configure BroadShield:

  1. Navigate to TOOLS: SYSTEM > Broadshield. The embedded Broadshield Web UI will open. If you cannot enable Broadshield from this screen, this license is not present.
  2. Click SETTINGS to open the following sub-menus:

BROADSIGHT

BroadSight is a service that allows collection of data from multiple BroadShield units and provides a dashboard view of the data.

Note: BroadSight for SecureSync is currently not supported.

HOME BASE

By setting the HOME BASE position you allow BroadShield to use this location as a reference position for spoofing detection: Should BroadShield detect that the geographic position reported by SecureSync's GPS receiver seems to move beyond the set Alarm Threshold (even though SecureSync does not move), an alarm will be triggered.

The standard use case is to make your GNSS 1 Position your HOME BASE:

  1. Should the position fields be populated (other than the Alarm Threshold), click CLEAR LOCATION (this will prevent BroadShield from issuing an alarm once you SAVEd the new position.)
  2. Click USE in the GNSS 1 Position box to apply the settings.
  3. The default Alarm Threshold is 50 m, i.e. any detected position shift beyond a 50-m circle around the HOME BASE position will cause an alarm. You can change this setting to adjust the sensitivity.
  4. Click SAVE to accept the entered values.

A less common use case may be that you want to pre-set the unit's position for later use e.g., if the SecureSync unit will be deployed in a different location: Set a position manually by entering lat/long (format: xx.xxxxxx degrees) and alt. Note, however, that this may cause a spoofing alarm, since BroadShield detects a difference between the HOME BASE position and the GNSS position.

ALGORITHMS

This menu option allows you to disaable/enable Jamming or Spoofing. Spoofing refers to impersonating the live-sky GNSS signal, thus "deceiving" the GNSS receiver, while Jamming refers to interference of the signal, i.e. making the live-sky GNSS signal unusable. Per default, both are Enabled.

ABOUT

The About menu displays Version and Build Date of the BroadShield software. Periodic updates are released with SecureSync system software updates, as they become available.

Monitoring BroadShield

You can use the BroadShield Web UI to monitor the jamming/spoofing status, or the SecureSync Web UI. In the latter case, you will be informed of a Major Alarm, as described below:

BroadShield Alarm

If BroadShield detects a jamming or spoofing event, SecureSync will emit a BroadShield Critical, Major Alarm (see illustration below). SecureSync will go into Holdover (yellow HOLD status light) and – depending on the BroadShield Service setting (see Enabling/Disabling the BroadShield Service) and your SecureSync settings – will either remain in sync (green SYNC status light), i.e. it will continue to output time and frequency signals considered valid, or it will go out of sync (red SYNC light).

You can also configure a notification alarm, see Enabling/Disabling the BroadShield Service.

BroadShield Web UI Monitoring

The BroadShield Web UI will also display real time signal status information, or a map status.

Note: If at any time you receive an error message Failed to connect to the unit, the SecureSync Web UI may have timed out (see Web UI Timeout). Refresh your browser page to log back in.

To open the BroadShield user interface:

  1. Navigate to TOOLS: SYSTEM > Broadshield.
  2. The embedded Broadshield Web UI will open, displaying the Dashboard and providing access to the following panels:

The Dashboard panel displays up to 7 days of history data, and a real-time amplitude frequency spectrum. The headline background color indicates the current jamming/spoofing status: red= jamming or spoofing detected; green = no alarms at this time

Top graph

The Dashboard top graph displays the past signal level over time, divided into a Normal and a Critical signal level (separated by a red line). A blue line in the Critical zone indicates a potential jamming incident, while a green line indicates that SecureSync may be subject to a spoofing attack.

You can change the time scale by clicking on any of the labels between 1 HOUR and 7 DAY.

Note: A SecureSync reboot will reset all history data (it can still be retrieved via LOGS.)

Bottom graph

The bottom graph labeled Spectrum visualizes the current signal over the GPS frequency band. Unusual amplitude spikes indicate a potential threat. If your system is equipped with more than one GNSS receivers, a green and an orange graph will indicate the signal level for additional receivers.

Note: The BroadShield GNSS1 reference refers to the SecureSync GNSS 0 reference.

Status information

  • GPS Time: Time and Day as provided by SecureSync's GNSS receiver.
  • Position: The position as determined by SecureSync's GNSS receiver.
  • Satellites Used: The number of satellites currently received by SecureSync. This number includes all satellites currently received for all enabled constellations (see Selecting GNSS Constellations). Note that BroadShield uses only GPS signals for jamming/spoofing detection.
  • Average C/No: Average signal to noise ratio. An average C/No value higher than 30 can be considered "good".

Skyplot graph

The center of the skyplot represents the antenna position. The skyplot shows all GPS satellites currently being tracked and – if enabled (under INTERFACES: REFERENCES > GNSS Reference: GNSS 0 > Edit button > Selected Constellations) – will also display all GLONASS satellites (numbered 65 and higher). Note, however, that GLONASS satellites will not be used by BroadShield. Galileo and Beidou satellites will not be displayed.

Note: Even though SecureSync may be configured to track multiple GNSS constellations (see Selecting GNSS Constellations), BroadShield only uses GPS.

Signal-to-noise bar graph

This graph visualizes the signal-to-noise ratio for up to 20 received satellites in real time. The satellites are numbered by their NMEA ID's (as in the skyplot mentioned above).

The map displays your current position, as reported by the GPS receiver. Should the displayed position differ from the actual antenna position, the GPS signal is likely spoofed.

Note that the map data is not part of the BroadShield software, but is downloaded from the Internet. Hence, this feature is only available if your SecureSync unit is connected to the Internet.

  • To clear all current logs stored on SecureSync, click CLEAR LOGS.
  • To start a new log session, click NEW LOG SESSION.
  • To download current logs, click DOWNLOAD LOGS.

Broadshield Notifications

You can setup Notifications to be sent if BroadShield detects or clears an alarm:

  • Navigate to MANAGEMENT: OTHER > Notifications, and under the GPS tab, locate the two BroadShield line items. For further information on how to configure Notifications, see Notifications.