Statistical test for GNSS spoofing attack detection by using multiple receivers on a rigid body

Abstract

Global navigation satellite systems (GNSS) are being the target of various jamming, spoofing, and meaconing attacks. This paper proposes a new statistical test for the presence of multiple spoofers based on range measurements observed by a plurality of receivers located on a rigid body platform. The relative positions of the receivers are known, but the location and orientation of the platform are unknown. The test is based on the generalized likelihood ratio test (GLRT) paradigm and essentially performs a consistency check between the set of observed range measurements and known information about the satellite topology and the geometry of the receiver constellation. Optimal spoofing locations and optimal artificial time delays (as induced by the spoofers) are also determined.Exact evaluation of the GLRT requires the maximum-likelihood estimates of all parameters, which proves difficult. Instead, approximations based on iterative algorithms and the squared-range least squares algorithm are derived. The accuracy of these approximations is benchmarked against Cramér-Rao lower bounds.Numerical examples demonstrate the effectiveness of the proposed algorithm and show that increasing the number of GNSS receivers makes the attack easier to detect. We also show that using multiple GNSS receivers limits the availability of optimal attack positions.

1 Introduction

Global navigation satellite system (GNSS) technology provides real-time positioning for various civil and military applications. Due to the low received power (about − 160 dBW), GNSS is highly susceptible to intentional and unintentional interference. In addition, the signal and modulation formats of civilian GNSS are publicly available. For these reasons, a wide range of attacks on GNSS are viable.

Attacks on GNSS are categorized into jamming, meaconing (replay), and spoofing [1]. In a jamming attack, the adversary overshadows the received GNSS signals with a higher power noise-like signal to make the receiver unable to decode the signal. In meaconing (replay), the adversary records the original GNSS signal and broadcasts it with a delay. In a spoofing attack, the attacker produces counterfeit GNSS signals that are similar to authentic ones, by modifying the original GNSS signals [2] in order to manipulate the victim receiver’s estimated position. This attack might be the most hazardous since it can take place without the victim being aware of being attacked. In the most sophisticated spoofing attacks, the adversary uses multiple, coordinated spoofers. Owing to the availability of inexpensive software-defined radios and GNSS modules, it has become relatively easy to implement such attacks. This paper is concerned with sophisticated spoofing attacks.

1.1 Taxonomy of existing GNSS spoofing mitigation methods

There has been research in the past on defense mechanisms against GNSS spoofing attacks. Here, we categorize these techniques into three groups.

1.1.1 Techniques using auto-correlation characteristics

The first group of techniques uses the received signal auto-correlation function characteristics to detect the presence of a spoofer. These methods detect the spoofer when it tries to take over the tracking loop of the GNSS receiver. There are in turn three main approaches:

• Methods that use the signal quality monitoring mechanism to measure the distortion in the auto-correlation function of the received signal and detect the spoofer [3–12]. The paper [12] studies the applicability of multi-path mitigation techniques for anti-spoofing purposes. A different approach is taken in [13], where the cross-correlation among the GNSS signal of multiple GNSS receivers is used as input to a machine-learning classifier (a support vector machine specifically) to detect the spoofing attack.

• Considering that the spoofer must use higher power than the original GNSS signals to make the receiver lock on the counterfeit signals, monitoring the received power level of the auto-correlation function can be used to detect the spoofing attack [14–19]. The dynamic process of taking over the victim tracking loop is used in [19] to detect a spoofing attack. As a new metric, [18] proposes to measure the variance of the signal quality to detect when the spoofer starts taking over the tracking loop of the victim.

• One may combine both power and distortion monitoring of the auto-correlation function to detect an attack [20, 21].

These approaches have a number of difficulties. First, multi-path fading can cause distortion and power level fluctuations in the auto-correlation function of the received GNSS signal similar to those caused by the spoofer. In addition, the spoofer can intelligently change its power level to mimic the power fluctuation of multi-path fading. Second, these techniques require access to the received raw GNSS signals.

1.1.2 Spatial signal processing techniques

The second group of methods use spatial signal processing techniques to detect the presence of spoofers. These techniques can be further subdivided as:

• Spoofing detection maybe based on estimated direction-of-arrival of the GNSS signals [22–31]. Considering a common source of spoofing signals, the work [29] uses the time difference of arrival of the GNSS signal to detect spoofing. The work in [30] uses array processing along with multi-path detection algorithms to estimate the direction of arrival to detect the presence of one spoofer. A statistical test is used in [31] to estimate the power and angle-of-arrival of the GNSS signal in order to detect spoofing. For example, carrier phase differences can be used to estimate this direction of arrival [22, 25, 27].

• One may exploit that counterfeit signals from a single spoofing source are spatially correlated and measure the spatial correlation between the received signals from different satellites [32–34]. The work [34] uses correlation at multiple receivers to separately classify authentic and spoofing signals; then, double differences of carrier phase measurements are used to detect the spoofer.

• Using rotating antennas to measure the spatial correlation of the received GNSS signals [35, 36]. The paper [35] uses rotating antennas to measure the correlation between the carrier phases, while [36] uses a single rotating antenna to perform spatial power measurements.

The techniques in [22–28, 35, 36] require modification of the GNSS receiver hardware. In addition, the methods [22–28, 35, 36] are based on the property that the signals coming from a single-antenna spoofer are correlated. Attacks using multiple spoofers can result in spatially uncorrelated spoofing signals, in which case these methods can fail.

1.1.3 Methods that use multiple GNSS receivers

The last category of spoofing mitigation methods uses multiple GNSS receivers to detect the presence of the spoofer. These works can be further grouped as follows:

• Using multiple GNSS receivers to detect the presence of a spoofer, exploiting the fact that all GNSS receivers show the same position while being spoofed [37–42].

• Range measurements may be used directly to detect the spoofing attack [43–47]. More specifically, [43] considers multiple vehicles where each of them is equipped with a GNSS receiver and a range measurement sensor. The range measurements and GNSS positions are fused to detect the presence of one spoofer while assuming that only one of the vehicles is subject to a spoofing attack. In [44], the range measurements from multiple GNSS receivers are used to detect a spoofer, assuming that all range measurements from a spoofer are the same. Considering the effect of clock knowledge, the authors in [45] develop a technique to detect a spoofer using range measurements of multiple GNSS receivers. The authors of [46] propose to use the time difference of arrival of the GNSS signals derived from pseudorange measurements to detect the presence of one spoofer. The technique is based on the fact that signals coming from a spoofer have similar time differences of arrival. The work [47] studies detection of one spoofer using differential pseudorange and carrier phase measurements by a double antenna receiver. The effect of synchronization between the measurements on spoofing detection is investigated.

All above methods except [41] consider the detection of a single-antenna spoofer. The paper [41] develops a technique for multi-antenna spoofer detection and presents implementation results.

1.2 Contributions

In this paper, we propose a signal processing approach that uses range measurements from multiple satellites to multiple GNSS receivers to detect the presence of multiple single-antenna spoofers. Each spoofer emulates one specific satellite. The GNSS receivers are assumed to be fixed on a rigid body platform (with known relative positions), and the range measurements gathered by all receivers are processed jointly to detect the presence of a spoofing attack. The technique developed here can work as a second layer of security to further strengthen methods that rely on properties of the auto-correlation function of the GNSS signal to detect spoofing attack (Section 1.1.1).

We make the following specific contributions:

• We cast the spoofing detection problem as a statistical hypothesis test, specifically a generalized likelihood ratio test (GLRT), based on a set of observed range measurements.

• We use squared range-least squares (SR-LS) approach [48] to approximately find maximum-likelihood estimates of the parameters under two hypotheses corresponding to spoofing and no spoofing, respectively. We also calculate the Cramér-Rao lower bound (CRLB) for the estimated parameters under both these hypotheses and compare the empirical results with these bounds.

• We determine optimal locations of the spoofers (from the adversary’s perspective) that best counteract the proposed defense mechanism.

We present and evaluate all methodology using a two-dimensional model of the world, leaving the extension to three dimensions—which incurs some nontrivial technicalities—to future work.

1.3 Notation

Uppercase and lowercase bold-faced letters are used to denote matrices and column vectors, respectively. The superscripts (·)^T, (·)^∗, (·)^H, and ${\left (\cdot \right)^{\dag } }$ denote the transpose, conjugate, Hermitian, and Moore-Penrose pseudo-inverse operators, respectively. I_N×N denotes an N by N identity matrix, diag(a) denotes a diagonal whose diagonal elements are the elements of the vector a, 0 is the all-zero vector, ∥·∥ is the Frobenius norm, and |·| represents the absolute value of a scalar. For a symmetric matrix A_n×n and a positive definite matrix B_n×n, the generalized eigenvalues of the matrix pair (A,B) are given by ${\lambda _{i}}\left ({\mathbf {A},\mathbf {B}} \right) \,=\, {\lambda _{i}}\left ({\mathbf {B}^{- {1 \left /\right. 2}}}\mathbf {A}{\mathbf {B}^{{{ - 1} \left /\right. 2}}} \right)$, i=1,...,n where ${\lambda _{i}}\left (\mathbf {M} \right)$ denotes the ith largest eigenvalue of M.

2 System model and problem description

We consider a two-dimensional scenario with N GNSS receivers and I satellites. The GNSS receivers are mounted on a rigid platform with fixed (and known) mutual distances. We assume that the clocks of the GNSS receivers are synchronized with those of the satellites. Spoofers may be present, and if so, each spoofer emulates one specific satellite. The emulation is done by receiving the GNSS signal of a satellite, modifying the ephemeris data, adding an artificial time delay, and re-transmitting the signal [49]. We assume that the spoofers use higher transmit power than the satellites, so that the GNSS receivers lock on the spoofing signals instead of the legitimate satellite signals. When the receivers are synchronized, they can operate as a virtual array to perform angle-of-arrival estimation [50]. This can be used for spoofing detection where emulated GNSS signals arrive from a specific direction. In contrast, our approach can detect a spoofing attack where multiple spoofers emulate GNSS signals originating from geographically different locations. In addition, performing array processing requires accessing to the baseband signal of the GNSS receivers, which requires hardware modifications and precludes the use of commercial off-the-shelf (COTS) receivers.

Let p_n be the position of the nth GNSS receiver. Since the GNSS receivers are fixed on a rigid body, we can parameterize their positions in terms of their locations relative to the platform, ${\mathbf {p}_{n_{0}^{}}}$, a translation vector (that determines the position of the platform), b₀, and a rotation matrix (that determines the orientation of the platform), T, according to

$$\begin{array}{*{20}l} \mathbf{p}_{n} = {\mathbf{b}_{0}} + \mathbf{T}{\mathbf{p}_{n_{0}^{}}}. \end{array} $$

(1)

The rotation matrix, T, is parameterized in terms of a rotation angle θ as

$$\begin{array}{*{20}l} \mathbf{T} = \left[ {\begin{array}{cc} {\cos \theta }&{ - \sin \theta }\\ {\sin \theta }&{\cos \theta } \end{array}} \right], \end{array} $$

(2)

and we write ${\mathbf {b}_{0}} = \left [ \begin {array}{l} {b_{01}} \\ {b_{02}} \\ \end {array} \right ].$ Hence, $\{ \mathbf {p}_{n_{0}^{}} \}$ are known a priori, while b₀ and T are not. Figure 1 illustrates the relation between the variables {p_n}, b₀, T, and $\{ {\mathbf {p}_{n_{0}^{}}}\}$ in (1).

Fig. 1

System model

Each GNSS receiver takes M range measurements to each satellite. To detect the possible presence of spoofers, we apply a binary hypothesis test to the so-obtained range measurements. In regular operation (no spoofing), the delay of a signal from a satellite to a receiver is entirely due to the physical distance. In contrast, in the presence of spoofing, the spoofer is generally located at a different position than the satellite, and it can add an artificial, a priori unknown, time delay to the GNSS signal to simulate a different physical distance. Therefore, the two hypotheses, regular operation (${{\mathcal {H}}_{0}}$) and spoofing (${{\mathcal {H}}_{1}}$) cases, can be formulated:

$$\begin{array}{*{20}l} &{{\mathcal{H}}_{0}}:{r_{\text{\textit{n,i,m}}}} = \left\| {{\mathbf{b}_{0}} + \mathbf{T}{\mathbf{p}_{n_{0}^{}}} - {\mathbf{s}_{i}}} \right\| + {n_{\text{\textit{n,i,m}}}}, \end{array} $$

(3)

$$\begin{array}{*{20}l} &{{\mathcal{H}}_{1}}:{r_{\text{\textit{n,i,m}}}} = \left\| {{\mathbf{b}_{0}} + \mathbf{T}{\mathbf{p}_{n_{0}^{}}} - \mathbf{s}_{i}^{'}} \right\| + \tau_{i} + {{{n}}_{\text{\textit{n,i,m}}}}. \end{array} $$

(4)

where 1≤n≤N, 1≤i≤I, and 1≤m≤M is the number of GNSS signal samples captured by each GNSS receiver. We assume that the rigid body does not move during the sampling. Here, n_n,i,m are measurement noise samples that we model as identically distributed zero-mean Gaussian random variables with variance σ², and we assume that these noise samples are independent among n, i, and m. Also, s_i is the true position of the ith satellite, $\mathbf {s}_{i}^{'}$ is the forged position of the ith satellite (when a spoofer is present), and τ_i is the artificial time delay caused by the ith spoofer. Note that the artificial time delay introduced by the spoofer is perceived by the GNSS receivers as an additional propagation distance. We assume that the noise power, σ² is known by the GNSS receivers (Table 1).

Table 1 Summary of model parameters

Under ${{\mathcal {H}}_{1}}$, the translation vector b₀ is the same for all measurements, and hence we can absorb b₀ into the unknown satellite positions $\mathbf {s}_{i}^{'}$ by rewriting (4) as

$$\begin{array}{*{20}l} {{\mathcal{H}}_{1}}:\,{r_{\text{\textit{n,i,m}}}} = \left\| {\mathbf{T}{\mathbf{p}_{n_{0}^{}}} + \mathbf{s}_{i}^{\prime\prime}} \right\| + \tau_{i} + {{{n}}_{\text{\textit{n,i,m}}}}, \end{array} $$

(5)

where

$$\mathbf{s}_{i}^{\prime\prime} = {\mathbf{b}_{0}} - \mathbf{s}_{i}^{'}.$$

To further simplify (5), we can factor out the rotation matrix T, exploiting that T^TT=I, to rewrite (5) as

$$\begin{array}{*{20}l} {{\mathcal{H}}_{1}}:\,{r_{\text{\textit{n,i,m}}}} = \left\| {{\mathbf{p}_{{n_{0}}}} + \mathbf{s}_{i}^{\prime\prime\prime}} \right\| + {\tau_{i}} + {n_{\text{\textit{n,i,m}}}}, \end{array} $$

(6)

where

$$\mathbf{s}_{i}^{\prime\prime\prime} = {\mathbf{T}^{- 1}}\mathbf{s}_{i}^{\prime\prime}.$$

We first average the M measurements taken by each GNSS receiver for each satellite, to obtain:

$${r_{n,i}} = \frac{1}{M}\sum\limits_{m = 1}^{M} {{r_{\text{\textit{n,i,m}}}}}.$$

Since under the Gaussian-noise assumption, {r_n,i} are sufficient statistics for localization [51], we have the equivalent hypothesis test based on averaged measurements:

$$\begin{array}{*{20}l} &{{\mathcal{H}}_{0}}:{r_{n,i}} = \left\| {{\mathbf{b}_{0}} + \mathbf{T}{\mathbf{p}_{n_{0}^{}}} - {\mathbf{s}_{i}}} \right\| + {n_{n,i}}, \end{array} $$

(7)

$$\begin{array}{*{20}l} &{{\mathcal{H}}_{1}}:\,{r_{n,i}} = \left\| {{\mathbf{p}_{{n_{0}}}} + \mathbf{s}_{i}^{\prime\prime\prime}} \right\| + {\tau_{i}} + {n_{n,i}}, \end{array} $$

(8)

where ${n_{n,i}} = \frac {1}{M}\sum \limits _{m = 1}^{M} {{n_{{n,i,m}}}}$ is averaged noise with zero mean and variance $\frac {\sigma ^{2}}{M}$. Averaging over the samples decreases $\frac {\sigma ^{2}}{M}$ and improves the signal-to-noise ratio. Under ${{\mathcal {H}}_{0}}$, the rotation matrix T and the translation vector b₀ are unknown, while under hypothesis ${{\mathcal {H}}_{1}}$, the vectors $\mathbf {s}_{1}^{\prime \prime \prime },...,\mathbf {s}_{I}^{\prime \prime \prime }$, and τ₁,...,τ_I are unknown. In the next section, we devise a statistical test that can discriminate between ₀ and ${{\mathcal {H}}_{1}}$.

3 Generalized likelihood ratio test for spoofer detection

We formulate a generalized likelihood ratio test (GLRT) to detect the presence of a spoofing attack. The GLRT compares the likelihoods of the data under ${{\mathcal {H}}_{0}}$ and ${{\mathcal {H}}_{1}}$, with all unknown parameters replaced by their maximum-likelihood estimates. The GLRT approach is appropriate for cases when there are unknown parameters under each hypothesis, and no prior knowledge of these parameters is available.

Since the measurements in (7) and (8) follow a normal distribution, and since all averaged noise samples are independent, the PDFs of the measurements under ${{\mathcal {H}}_{0}}$ and ${{\mathcal {H}}_{1}}$ are

$$\begin{array}{*{20}l} &p\left({\mathbf{r};{{{ \mathbf{b}}_{0}}},{ \mathbf{T}}}, {{{\mathcal{H}}_{0}}} \right) \\ &\,=\, \frac{1}{{{{\left({{{2{\sigma^{2}}} \left/\right. M}} \right)}^{\frac{{NI}}{2}}}}}{e^{- \frac{{\sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} { {{{\!\! \left({{r_{n,i}} - \left\| {{ \mathbf{b}_{0}} + {{ \mathbf{T}}}{\mathbf{p}_{n_{0}^{}}} - {\mathbf{s}_{i}}} \right\|} \right)}^{2}}}} } }}{{{{2{\sigma^{2}}} \left/\right. M}}}}}, \end{array} $$

(9)

and

$$\begin{array}{*{20}l} &p\left({\mathbf{r};{{ \mathbf{s}_{1}^{\prime\prime\prime}},...,{ \mathbf{s}_{I}^{\prime\prime\prime}}}}, {\tau_{1}},...,{\tau_{I}}, {{{\mathcal{H}}_{1}}} \right) \\ &= \frac{1}{{{{\left({{{2{\sigma^{2}}} \left/\right. M}} \right)}^{\frac{{NI}}{2}}}}}{e^{- \frac{{\sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {{{{ \left({{r_{n,i}} - \left\| {{\mathbf{p}_{n_{0}^{}}} + {{ \mathbf{s}_{i}^{\prime\prime\prime}}}} \right\|} - \tau_{i} \right)}^{2}}}} } }}{{{{2{\sigma^{2}}} \left/\right. M}}}}}. \end{array} $$

(10)

The GLRT can be written as

$$\begin{array}{*{20}l} \frac{{\frac{1}{{{{\left({{{2{\sigma ^{2}}} \mathord{\left/ {\vphantom {{2{\sigma ^{2}}} M}} \right. \kern-\nulldelimiterspace} M}} \right)}^{\frac{{NI}}{2}}}}}{e^{- \frac{{\sum\limits_{n = 1}^N {\sum\limits_{i = 1}^I { {{{\left({{r_{n,i}} - \left\| { {{\bf{p}}_{n_{0}^{}}} + {\hat{\mathbf{s}}_{i}^{\prime\prime\prime}}} \right\|} - \widehat {\tau}_i \right)}^{2}}} } } }}{{{{2{\sigma ^{2}}} \mathord{\left/ {\vphantom {{2{\sigma ^{2}}} M}} \right. \kern-\nulldelimiterspace} M}}}}}}}{{\frac{1}{{{{\left({{{2{\sigma ^{2}}} \mathord{\left/ {\vphantom {{2{\sigma ^{2}}} M}} \right. \kern-\nulldelimiterspace} M}} \right)}^{\frac{{NI}}{2}}}}}{e^{- \frac{{\sum\limits_{n = 1}^N {\sum\limits_{i = 1}^I { {{{\left({{r_{n,i}} - \left\| {{{\hat{\mathbf{b}}}_0} + \widehat {\bf{T}}{{\bf{p}}_{n_{0}^{}}} - {{\bf{s}}_i}} \right\|} \right)}^{2}}} } } }}{{{{2{\sigma ^{2}}} \mathord{\left/ {\vphantom {{2{\sigma ^{2}}} M}} \right. \kern-\nulldelimiterspace} M}}}}}}} \mathop {\gtrless}\limits_{{{\cal H}_0}}^{{{\cal H}_1}} {\gamma_{th}}, \end{array} $$

(11)

where

$$ \left({\hat{\mathbf{b}}_{0},\widehat{\mathbf{T}}} \right) = \arg \max p \! \left({\mathbf{r};{\mathbf{b}_{0}},\mathbf{T},{{\mathcal{H}}_{0}}} \right), $$

(12)

and

$$ \left({\hat{\mathbf{s}}^{\prime\prime\prime}_{i}, \hat{\tau}_{i}} \right) = \arg \max p \! \left({\mathbf{r};{\mathbf{s}^{\prime\prime\prime}_{i}},{{\tau}_{i}},{{\mathcal{H}}_{1}}} \right). $$

(13)

Taking the logarithm of (11) and simplifying yields

$$\begin{array}{*{20}l} &\sum\limits_{n = 1}^N {\sum\limits_{i = 1}^I {{{\left({{r_{n,i}} - f_{0}\left({{{\hat {\bf{b}}}_0},\widehat {\bf{T}}} \right)} \right)}^{2}}} } \\ &- \sum\limits_{n = 1}^N {\sum\limits_{i = 1}^I {{{\left({{r_{n,i}} - f_{1}\left({{\hat{\bf{s}}_{i}^{\prime\prime\prime}}}, {\widehat \tau _i} \right)} \right)}^{2}}} } \mathop {\gtrless}\limits_{{{\cal H}_0}}^{{{\cal H}_1}} {\frac{{2{\sigma ^{2}}}}{M}}\ln {\gamma_{th}}, \end{array} $$

(14)

where

$$f_{0}\left({{\hat{\mathbf{b}}_{0}},\hat{\mathbf{T}}} \right) = {\left\| {{\hat{\mathbf{b}}_{0}} + \hat{\mathbf{T}}{\mathbf{p}_{n}} - {\mathbf{s}_{i}}} \right\|},$$

and

$${f_{1}\left(\hat{\mathbf{s}}_{i}^{\prime\prime\prime}, {\widehat \tau_{i}} \right)=\left\| {{\mathbf{p}_{n_{0}^{}}} + \hat{\mathbf{s}}_{i}^{\prime\prime\prime}} \right\|} + \widehat {\tau}_{i}.$$

As we see in (14), GLRT calculates the difference between the measurements and the best fit assuming that ${\mathcal {H}}_{0}$ and ${\mathcal {H}}_{1}$, respectively, are true.

4 Approximate parameter estimation

Evaluation of the GLRT requires the maximum-likelihood estimates of the parameters in (12) and (13). However, finding these estimates is a non-tractable problem. As a remedy, we resort to using the SR-LS technique [48] as a building block in an iterative algorithm. SR-LS was originally devised as a source localization method that finds the best position estimate (in a least squares sense) based on squared range measurements. We are going to use estimates from SR-LS here as a substitute for maximum-likelihood estimates required in (12) and (13). In this context, it is important to stress that under a Gaussian assumption on the measurement errors, SR-LS is asymptotically equivalent (for large numbers of samples, which in our setting is equivalent to small σ²/M) to maximum-likelihood. The range-squaring idea in [48] in ingenious and has also been used by other authors for joint position and orientation estimation of a rigid body from range measurements [52, 53].

4.1 Estimation of parameters under ${{\mathcal {H}}_{0}}$

Under ${{\mathcal {H}}_{0}}$, as an approximation to (12), we formulate the following problem, defined in terms of the squared range measurements:

$$\begin{array}{*{20}l} \!\! \left({{{\widehat {\bf{b}}}_0},\widehat {\bf{T}}} \right) \,=\, \arg \mathop {\min }\limits_{{{\bf{b}}_0},{\bf{T}}} \sum\limits_{n = 1}^N {\sum\limits_{i = 1}^I {{{\left({{{\left\| {{{\bf{b}}_0} \,+\, {\bf{T}}{{\bf{p}}_{n_{0}^{}}} \,-\, {{\bf{s}}_i}} \right\|}^{2}} \,-\, r_{n,i}^{2}} \right)}^{2}}} }\!\!, \end{array} $$

(15)

We then solve (15) using cyclic optimization, alternating between minimization with respect to b₀ and with respect to T.

4.1.1 Minimization of (15) with respect to b₀

Considering the rotation matrix T to be given, we first minimize (15) with respect to b₀. Expanding the norm in (15) results in

$$ {}\begin{aligned} \hat{\mathbf{b}}_{0} &= \arg \mathop {\min }\limits_{{\mathbf{b}_{0}}} \sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {\left({\mathbf{b}_{0}^{T}{\mathbf{b}_{0}} + \mathbf{b}_{0}^{T}\mathbf{T}{\mathbf{p}_{n_{0}^{}}} - \mathbf{b}_{0}^{T}{\mathbf{s}_{i}} + \mathbf{p}_{n_{0}^{}}^{T}{\mathbf{T}^{T}}{\mathbf{b}_{0}}} \right.} } \\ &\quad{\left. { + \mathbf{p}_{n_{0}^{}}^{T}{\mathbf{T}^{T}}\mathbf{T}{\mathbf{p}_{n_{0}^{}}} \,-\, \mathbf{p}_{n_{0}^{}}^{T}{\mathbf{T}^{T}}{\mathbf{s}_{i}} \,-\, \mathbf{s}_{i}^{T}{\mathbf{b}_{0}} \,-\, \mathbf{s}_{i}^{T}\mathbf{T}{\mathbf{p}_{n_{0}^{}}} \,+\, \mathbf{s}_{i}^{T}{\mathbf{s}_{i}} \,-\, r_{n,i}^{2}} \right)^{2}}\!\!. \end{aligned} $$

(16)

Using the fact that T^TT=I and ordering (16) with respect to b₀ yields

$$\begin{array}{*{20}l} \hat{\mathbf{b}}_{0} =& \arg \mathop {\min }\limits_{{\mathbf{b}_{0}}} \sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {\left({\mathbf{b}_{0}^{T}{\mathbf{b}_{0}} + 2{{\left({\mathbf{T}{\mathbf{p}_{n_{0}^{}}} - {\mathbf{s}_{i}}} \right)}^{T}}{\mathbf{b}_{0}} + \mathbf{p}_{n_{0}^{}}^{T}{\mathbf{p}_{n_{0}^{}}}} \right.} } \\ &{\left. { - 2\mathbf{p}_{n_{0}^{}}^{T}{\mathbf{T}^{T}}{\mathbf{s}_{i}} + \mathbf{s}_{i}^{T}{\mathbf{s}_{i}} - r_{n,i}^{2}} \right)^{2}}. \end{array} $$

(17)

To write (17) as squared norm, we introduce an auxiliary variable α and a constraint:

$$\begin{array}{*{20}l} \hat{\mathbf{b}}_{0} = & \arg \mathop {\min }\limits_{{\mathbf{b}_{0}},\alpha \in R} \sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {\left({\alpha + 2{{\left({\mathbf{T}{\mathbf{p}_{n_{0}^{}}} - {\mathbf{s}_{i}}} \right)}^{T}}{\mathbf{b}_{0}} + \mathbf{p}_{n_{0}^{}}^{T}{\mathbf{p}_{n_{0}^{}}}} \right.} } \\ &{\left. { - 2\mathbf{p}_{n_{0}^{}}^{T}{\mathbf{T}^{T}}{\mathbf{s}_{i}} + \mathbf{s}_{i}^{T}{\mathbf{s}_{i}} - r_{n,i}^{2}} \right)^{2}} \\ & \,\, \text{s.t.} \,\,\, \mathbf{b}_{0}^{T}{\mathbf{b}_{0}} = \alpha. \end{array} $$

(18)

The optimization problem in (18) can be written in a compact form as

$$\begin{array}{*{20}l} & \hat{\mathbf{b}}_{0} = \arg \mathop {\min }\limits_{\mathbf{y}} \,\,{\left\| {{\mathbf{Ay}} - \mathbf{b}} \right\|{~}^{2}}\,\,\,\, \\ & \,\, \text{s.t.} \,\,\, {\mathbf{y}^{T}}{\mathbf{Dy}} + 2{\mathbf{f}^{T}}\mathbf{y} = 0, \end{array} $$

(19)

where

$$\begin{array}{*{20}l} \mathbf{A} = \left[ {\begin{array}{cc} {2{{\left({\mathbf{T}{\mathbf{p}_{1_{0}^{~}}} - {\mathbf{s}_{1}}} \right)}^{T}}}&1\\.&.\\ {2{{\left({\mathbf{T}{\mathbf{p}_{N_{0}^{~}}} - {\mathbf{s}_{1}}} \right)}^{T}}}&1\\ {2{{\left({\mathbf{T}{\mathbf{p}_{1_{0}^{~}}} - {\mathbf{s}_{2}}} \right)}^{T}}}&1\\.&.\\ {2{{\left({\mathbf{T}{\mathbf{p}_{N_{0}^{~}}} - {\mathbf{s}_{I}}} \right)}^{T}}}&1 \end{array}} \right],\,\,\,\mathbf{y} = \left[ \begin{array}{l} {\mathbf{b}_{0}}\\ \alpha \end{array} \right], \end{array} $$

(20)

$$\begin{array}{*{20}l} \mathbf{b} = \left[ {\begin{array}{cc} &{ \!\!\!\!- \left({\mathbf{p}_{1_{0}^{~}}^{T}{\mathbf{p}_{1_{0}^{~}}} - 2\mathbf{p}_{1_{0}^{~}}^{T}{\mathbf{T}^{T}}{\mathbf{s}_{1}} + \mathbf{s}_{1}^{T}{\mathbf{s}_{1}} - r_{1,1}^{2}} \right)}\\ &.\\ &{ \!\!\!\!- \left({\mathbf{p}_{N_{0}^{~}}^{T}{\mathbf{p}_{N_{0}^{~}}} - 2\mathbf{p}_{N_{0}^{~}}^{T}{\mathbf{T}^{T}}{\mathbf{s}_{1}} + \mathbf{s}_{1}^{T}{\mathbf{s}_{1}} - r_{N,1}^{2}} \right)}\\ &{ \!\!\!\!- \left({\mathbf{p}_{1_{0}^{~}}^{T}{\mathbf{p}_{1_{0}^{~}}} - 2\mathbf{p}_{1_{0}^{~}}^{T}{\mathbf{T}^{T}}{\mathbf{s}_{2}} + \mathbf{s}_{2}^{T}{\mathbf{s}_{2}} - r_{1,1}^{2}} \right)}\\ &.\\ &{ \!\!\!\!- \left({\mathbf{p}_{N_{0}^{~}}^{T}{\mathbf{p}_{N_{0}^{~}}} - 2\mathbf{p}_{N_{0}^{~}}^{T}{\mathbf{T}^{T}}{\mathbf{s}_{I}} + \mathbf{s}_{I}^{T}{\mathbf{s}_{I}} - r_{N,I}^{2}} \right)} \end{array}} \right]\!\!, \end{array} $$

(21)

and

$$\begin{array}{*{20}l} \mathbf{D} = \left[ {\begin{array}{cc} {{\mathbf{I}_{2 \times 2}}}&{{{\mathbf{0}}_{2 \times 1}}}\\ {{{\mathbf{0}}_{1 \times 2}}}&0 \end{array}} \right],\,\,\,\,\,\,\,\mathbf{f} = \left[ \begin{array}{l} {{\mathbf{0}}_{2 \times 1}}\\ - 0.5 \end{array} \right]. \end{array} $$

(22)

Note that A should have full column rank, i.e., A^TA should be non-singular for the solution to exist. The optimization problem in (19) is non-convex. However, its global optimum solution can be found using the result in [54] as

$$\begin{array}{*{20}l} \widehat {\bf{y}}\left(\lambda \right) = {\left({{{\bf{A}}^{T}}{\bf{A}} + \lambda {\bf{D}}} \right)^{- 1}}\left({{{\bf{A}}^{T}}{\bf{b}} - \lambda {\bf{f}}} \right), \end{array} $$

(23)

where λ is the unique solution of

$$\begin{array}{*{20}l} \phi \left(\lambda \right) = 0, \lambda \in V, \end{array} $$

(24)

and ϕ is defined as

$$\begin{array}{*{20}l} \phi \left(\lambda \right) \buildrel \Delta \over = \widehat {\bf{y}}\left(\lambda \right){\bf{D}}\widehat {\bf{y}}\left(\lambda \right) + 2{{\bf{f}}^{T}}\widehat {\bf{y}}\left(\lambda \right). \end{array} $$

(25)

The search interval for λ consists of the values for which the expression A^TA+λD is positive definite. As a result, the search domain V will be

$$\begin{array}{*{20}l} V = \left({ - \frac{1}{{{\lambda_{1}}\left({\mathbf{D},{\mathbf{A}^{T}}\mathbf{A}} \right)}},\infty} \right). \end{array} $$

(26)

Based on [54], the function $\phi \left (\lambda \right)$ is strictly decreasing over the domain V. Hence, we can use bisection to find the root of $\phi \left (\lambda \right)$.

4.1.2 Minimization of (15) with respect to T

To minimize (15) with respect to the rotation matrix T, for given b₀, we again write, similarly to (17):

$$\begin{array}{*{20}l} \widehat {\bf{T}} = & \arg \mathop {\min }\limits_{\bf{T}} \sum\limits_{n = 1}^N {\sum\limits_{i = 1}^I {\left({2{\bf{b}}_{0}^{T}{\bf{T}}{{\bf{p}}_{n_{0}^{~}}} - 2{\bf{s}}_{i}^{T}{\bf{T}}{{\bf{p}}_{n_{0}^{~}}} + {\bf{p}}_{n_{0}^{~}}^{T}{{\bf{p}}_{n_{0}^{~}}}} \right.} } \\ &{\left. { + {\bf{b}}_{0}^{T}{{\bf{b}}_0} - 2{\bf{s}}_{i}^{T}{{\bf{b}}_0} + {\bf{s}}_{i}^{T}{{\bf{s}}_i} - r_{n,i}^{2}} \right)^{2}}. \end{array} $$

(27)

Defining ${c_{n,i}} = \mathbf {p}_{n_{0}^{~}}^{T}{\mathbf {p}_{n_{0}^{~}}} + \mathbf {b}_{0}^{T}{\mathbf {b}_{0}} - 2\mathbf {s}_{i}^{T}{\mathbf {b}_{0}} + \mathbf {s}_{i}^{T}{\mathbf {s}_{i}} - r_{n,i}^{2}$ yields

$$\begin{array}{*{20}l} \widehat {\bf{T}} = \arg \mathop {\min }\limits_{\bf{T}} \sum\limits_{n = 1}^N {\sum\limits_{i = 1}^I {{{\left({2{{\left({{{\bf{b}}_0} - {{\bf{s}}_i}} \right)}^{T}}{\bf{T}}{{\bf{p}}_{n_{0}^{~}}} + {c_{n,i}}} \right)}^{2}}} }. \end{array} $$

(28)

Using the structure of the rotation matrix in (2) and defining b₀−s_i=[a_i1,a_i2]^T and ${\mathbf {p}_{{n_{0}}}} = {[ {{p_{{n_{01}}}},{p_{{n_{02}}}}} ]^{T}}$, we can expand $2{\left ({{\mathbf {b}_{0}} - {\mathbf {s}_{i}}} \right)^{T}}\mathbf {T}{\mathbf {p}_{n_{0}^{~}}}$ as

$$\begin{array}{*{20}l} &2 [ {\begin{array}{*{20}{c}} {{a_{i1}}}&{{a_{i2}}} \end{array}} ] \left[ {\begin{array}{*{20}{c}} {\cos \theta }&{ - \sin \theta }\\ {\sin \theta }&{\cos \theta } \end{array}} \right] \left[ \begin{array}{l} {p_{{n_{01}}}}\\ {p_{{n_{02}}}} \end{array} \right] \\ &= 2\left({{p_{{n_{01}}}}{a_{i1}} + {p_{{n_{02}}}}{a_{i2}}} \right)\cos \theta + 2\left({p_{{n_{01}}}}{a_{i2}} - {{p_{{n_{02}}}}{a_{i1}}} \right)\sin \theta \\ &= {\alpha_{n,i}}\cos \theta + {\beta_{n,i}}\sin \theta. \end{array} $$

(29)

Using (29), estimating T becomes equivalent to estimating θ as

$$\begin{array}{*{20}l} f\left(\theta \right) \!\! = \!\! \arg \mathop {\min }\limits_{\theta} \sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {{{\left({{\alpha_{n,i}}\cos \theta + {\beta_{n,i}}\sin \theta + {c_{n,i}}} \right)}^{2}}} }. \end{array} $$

(30)

Problem (30) is non-convex with respect to θ and may have multiple local minima. To find the global minimum, we calculate the derivative of (30) with respect to θ and find its roots. The derivative of the objective function in (30) is

$$\begin{array}{*{20}l} {f^{'}}\left(\theta \right) = & 2\sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {\left({ - {\alpha_{n,i}}\sin \theta + {\beta_{n,i}}\cos \theta} \right)} } \\ &\left({{\alpha_{n,i}}\cos \theta + {\beta_{n,i}}\sin \theta + {c_{n,i}}} \right), \end{array} $$

(31)

which can be simplified into

$$\begin{array}{*{20}l} {f^{'}}\left(\theta \right) \!\! = \!\! & \sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {\left({\beta_{n,i}^{2} \! -\! \alpha_{n,i}^{2}} \right)\sin \theta \cos \theta} } + {\alpha_{n,i}}{\beta_{n,i}}\left({2{{\cos }^{2}}\theta \! -\! 1} \right) \\ & - {\alpha_{n,i}}{c_{n,i}}\sin \theta + {\beta_{n,i}}{c_{n,i}}\cos \theta. \end{array} $$

(32)

Summation over the indexes n and i in (32) results in

$$\begin{array}{*{20}l} \!\!{f^{'}} \!\! \left(\theta \right) \!\! = \!\! {e_{1}}\sin \theta \cos \theta \! + \! {e_{2}} \! \left({2\cos^{2} {\theta} \!\! - \!\! 1} \right) \! + \! {e_{3}}\sin \theta \! + \! {e_{4}}\cos \theta, \end{array} $$

(33)

with

$$\begin{array}{*{20}l} {e_{1}} = \sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {\left({{\beta}_{n,i}^{2} - {\alpha}_{n,i}^{2}} \right)} },{e_{2}} = \sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {{{\alpha}_{n,i}}{\beta_{n,i}}} }, \\ {e_{3}} = - \sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} { {{\alpha}_{n,i}}{c_{n,i}}} },{e_{4}} = \sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {{{\beta}_{n,i}}{c_{n,i}}} }. \end{array} $$

(34)

The roots of $f^{'}\phantom {\dot {i}\!}$ in (33) are solutions to the equation

$$\begin{array}{*{20}l} {e_{2}}\left({2{{\cos }^{2}}\theta - 1} \right) + {e_{4}}\cos \theta = - \left({{e_{1}}\cos \theta + {e_{3}}} \right)\sin \theta. \end{array} $$

(35)

We square both sides and substitute ${\sin ^{2}}\theta = 1 - {\cos ^{2}}\theta$ to obtain

$$\begin{array}{*{20}l} &\left({e_{1}^{2} + 4e_{2}^{2}} \right){\cos^{4}}\theta + 2\left({{e_{1}}{e_{3}} + 2{e_{2}}{e_{4}}} \right){\cos^{3}}\theta \\ &+ \left({ -e_{1}^{2} - 4e_{2}^{2} + e_{4}^{2} + e_{3}^{2}} \right){\cos^{2}}\theta \\ &+ \left({ - 2{e_{2}}{e_{4}} - 2{e_{1}}{e_{3}}} \right)\cos \theta + e_{2}^{2} - e_{3}^{2} = 0, \end{array} $$

(36)

which is now a trigonometric function with only $\cos \theta$ terms (which are periodic with period 2π). Replacing $x = \cos \theta$ in (36) results in

$$\begin{array}{*{20}l} &\left({e_{1}^{2} + 4e_{2}^{2}} \right){x^{4}} + 2\left({{e_{1}}{e_{3}} + 2{e_{2}}{e_{4}}} \right){x^{3}} \\ &+ \left({ - e_{1}^{2} - 4e_{2}^{2} + e_{3}^{2} + e_{4}^{2}} \right){x^{2}} \\ &- 2\left({{e_{1}}{e_{3}} + {e_{2}}{e_{4}}} \right)x + e_{2}^{2} - e_{3}^{2} = 0. \end{array} $$

(37)

The fourth order equation in (37) has at most four roots, which can be found using the Ferrari’s method [55]. After solving (37), we can use $\theta = \arccos x$ to find the values of θ corresponding to the local optimums of (30). Note that since $\cos \theta$ in (36) is periodic with period 2π, we look for the solutions in the domain $\left [ {0,2\pi } \right ]$ when using $\theta = \arccos x$. The value of θ corresponding to the global optimum of (27), i.e., $\hat {\theta }$, is then

$$\begin{array}{*{20}l} \hat{\theta} = \arg \min f\left({{\theta_{i}}} \right). \end{array} $$

(38)

4.1.3 Iterative algorithm for minimization of (15)

Minimizing (15) jointly with respect to b₀ and θ (or equivalently, T) is not tractable in closed form. Instead, we propose an iterative optimization approach in Algorithm 1. Since the problem is highly non-convex with multiple local optima, the point obtained as solution could depend on the initialization values (especially of θ). To tackle this, we repeat Algorithm 1 with different initial values of θ.

It is shown in [48] that the SR-LS results in the global optimum to the approximated problem based on squared range measurements. Hence, in the minimization with respect to b₀, for given T, in each iteration inside of Algorithm 1, we find the global optimum. The same is true of θ, as its global solution is given by the root of (37). However, the overall problem is non-convex and the joint estimate of b₀ and T may be suboptimal.

4.2 Estimation of parameters under ${{\mathcal {H}}_{1}}$

Next, to find approximate solutions to (13), we consider again a cyclic optimization algorithm that alternates between minimization with respect to ${\mathbf {s}_{1}^{\prime \prime \prime }},...,{\mathbf {s}_{I}^{\prime \prime \prime }}$ and with respect to τ₁,...,τ_I and where SR-LS is used as a building block in the first-mentioned step.

4.2.1 Minimization with respect to ${\mathbf {s}_{1}^{\prime \prime \prime }},...,{\mathbf {s}_{I}^{\prime \prime \prime }}$

We first consider minimization with respect to ${\mathbf {s}_{1}^{\prime \prime \prime }},...,{\mathbf {s}_{I}^{\prime \prime \prime }}$ for given τ₁,...,τ_I. Using the SR-LS technique, the corresponding optimization problem to find ${\mathbf {s}_{1}^{\prime \prime \prime }},...,{\mathbf {s}_{I}^{\prime \prime \prime }}$ becomes

$$\begin{array}{*{20}l} {\left({{\hat{\mathbf{s}}_{1}^{\prime\prime\prime}},...,{\hat{\mathbf{s}}_{I}^{\prime\prime\prime}}} \right) \! =\! \arg \mathop {\min }\limits_{{\mathbf{s}_{1}^{\prime\prime\prime}},...,{\mathbf{s}_{I}^{\prime\prime\prime}}} \sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {{{\left({{{\left\| {{\mathbf{p}_{n_{0}^{~}}} + \mathbf{s}_{i}^{\prime\prime\prime}} \right\|}^{2}} - \overline r_{n,i}^{2}} \right)}^{2}}} }, } \end{array} $$

(39)

where $\overline r_{n,i}^{2} = {\left ({{r_{n,i}} - {\tau _{i}}} \right)^{2}}$. We expand the norm expression in (39) as

$$\begin{array}{*{20}l} {\left({{\hat{\mathbf{s}}_{1}^{\prime\prime\prime}},...,{\hat{\mathbf{s}}_{I}^{\prime\prime\prime}}} \right)} =& \arg \mathop {\min }\limits_{{{\mathbf{s}_{1}^{\prime\prime\prime}},...,{\mathbf{s}_{I}^{\prime\prime\prime}}}} \sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {\left({\mathbf{p}_{n_{0}^{~}}^{T}{\mathbf{p}_{n_{0}^{~}}} + 2\mathbf{p}_{n_{0}^{~}}^{T}{{\mathbf{s}_{i}^{\prime\prime\prime}}}} \right.} } \\ &{\left. { + {{\left({\mathbf{s}_{i}^{\prime\prime\prime}} \right)^{T}}{\mathbf{s}_{i}^{\prime\prime\prime}}} - \overline r_{n,i}^{2}} \right)^{2}}, \end{array} $$

(40)

and add the terms in (40) over index i to obtain

$$\begin{array}{*{20}l} &\!\! \left(\! {{{\hat{\mathbf{s}}_{1}^{\prime\prime\prime}},...,{\hat{\mathbf{s}}_{I}^{\prime\prime\prime}}}} \right) \!\! \\ =&\! \arg \mathop {\!\!\!\! \min }\limits_{{{\mathbf{s}_{1}^{\prime\prime\prime}},...,{\mathbf{s}_{I}^{\prime\prime\prime}}}} \!\! \sum\limits_{n = 1}^{N} \! {{{\left({ \!\! {{\left({\mathbf{s}_{1}^{\prime\prime\prime}} \right)^{T}}\!{\mathbf{s}_{1}^{\prime\prime\prime}}} \!\,+\,\! 2\mathbf{p}_{n_{0}^{~}}^{T}{{\mathbf{s}_{1}^{\prime\prime\prime}}} \,+\, \mathbf{p}_{n_{0}^{~}}^{T}{\mathbf{p}_{n_{0}^{~}}} - \overline r_{n,1}^{2}} \!\! \right) \!\!}^{2}}} \\ &\! + \!... \! + \! \sum\limits_{n = 1}^{N} {{{\left({ {{\left({\mathbf{s}_{i}^{\prime\prime\prime}} \right)^{T}}{\mathbf{s}_{I}^{\prime\prime\prime}}} + 2\mathbf{p}_{n_{0}^{~}}^{T}{{\mathbf{s}_{I}^{\prime\prime\prime}}} + \mathbf{p}_{n_{0}^{~}}^{T}{\mathbf{p}_{n_{0}^{~}}} - \overline r_{n,I}^{2}} \right)}^{2}}}. \end{array} $$

(41)

Problem (41) is a minimization of sum of I positive terms, where the ith term only depends on ${\mathbf {s}_{i}^{\prime \prime \prime }}$. Hence, the problem decouples and we can minimize each individual term separately. This results in I separate optimization problems, where the ith problem is

$$\begin{array}{*{20}l} {\hat{\mathbf{s}}_{i}^{\prime\prime\prime}} \,=\, \arg \mathop {\min}\limits_{{{\mathbf{s}_{i}^{\prime\prime\prime}}}} \sum\limits_{n = 1}^{N} {{{\left(\!\! { {\left({{\mathbf{s}_{i}^{\prime\prime\prime}}} \right)^{T}} {{\mathbf{s}_{i}^{\prime\prime\prime}}} \,+\, 2\mathbf{p}_{n_{0}^{~}}^{T}{{ \mathbf{s}_{i}^{\prime\prime\prime}}} \,+\, \mathbf{p}_{n_{0}^{~}}^{T}{\mathbf{p}_{n_{0}^{~}}} - \overline r_{n,i}^{2}} \right) \!}^{2}}}. \end{array} $$

(42)

Similar to the approach in Section 4.1.1, moving the quadratic term to a constraint results in

$$\begin{array}{*{20}l} &{\hat{\mathbf{s}}_{i}^{\prime\prime\prime}} = \arg \mathop {\min }\limits_{{{\mathbf{s}_{i}^{\prime\prime\prime}}},\alpha \in R} \sum\limits_{n = 1}^{N} {{{\left({\alpha + 2\mathbf{p}_{n_{0}^{~}}^{T}{{{ \mathbf{s}_{i}^{\prime\prime\prime}}}} + \mathbf{p}_{n_{0}^{~}}^{T}{\mathbf{p}_{n_{0}^{~}}} - \overline r_{n,i}^{2}} \right)}^{2}}} \\ & \, \text{s.t.} \,\,\, {\left({{\mathbf{s}_{i}^{\prime\prime\prime}}} \right)^{T}}{{\mathbf{s}_{i}^{\prime\prime\prime}}} = \alpha. \end{array} $$

(43)

By completing the square, we can cast (43) as

$$\begin{array}{*{20}l} &{\hat{\mathbf{s}}_{i}^{\prime\prime\prime}} = \arg \mathop {\min }\limits_{\mathbf{y}} {\mkern 1mu} {\mkern 1mu} {\left\| {{\mathbf{Ay}} - \mathbf{b}} \right\|^{2}} \\ & \, \text{s.t.} \,\,\, {\mathbf{y}^{T}}{\mathbf{Dy}} + 2{\mathbf{f}^{T}}\mathbf{y} = 0, \end{array} $$

(44)

where

$$\begin{array}{*{20}l} \mathbf{A} = \left[ {\begin{array}{*{20}{c}} {2\mathbf{p}_{1_{0}^{~}}^{T}}&1\\.&.\\ {2\mathbf{p}_{N_{0}^{~}}^{T}}&1 \end{array}} \right],\mathbf{b} = \left[ \begin{array}{l} \overline r_{1,i}^{2} - \mathbf{p}_{1}^{T}{\mathbf{p}_{1}}\\.\\ \overline r_{N,i}^{2} - \mathbf{p}_{N_{0}^{~}}^{T}{\mathbf{p}_{N_{0}^{~}}}, \end{array} \right], \end{array} $$

(45)

and

$$\begin{array}{*{20}l} \mathbf{y} = \left[ \begin{array}{l} {{\mathbf{s}_{i}^{\prime\prime\prime}}}\\ \alpha \end{array} \right],\mathbf{D} = \left[ {\begin{array}{*{20}{c}} \!\!\!\!\!\! {{\mathbf{I}_{2}}}&{{{\mathbf{0}}_{1 \times 2}}}\\ {{{\mathbf{0}}_{1 \times 2}}}& \!\!\!\!\!\!\!\!\! 0 \end{array}} \right],\mathbf{f} = \left[ \begin{array}{l} {\mathbf{0}}\\ - 0.5 \end{array} \right]. \end{array} $$

(46)

4.2.2 Minimization with respect to τ_i

Next, we find the artificial time delays caused by each spoofer for given values of ${\mathbf {s}_{1}^{\prime \prime \prime }},...,{\mathbf {s}_{I}}^{\prime \prime \prime }$. The problem is

$$\begin{array}{*{20}l} \left({{{\widehat \tau }_{1}},...,{{\widehat \tau }_{I}}} \right) = \arg \mathop {\min }\limits_{{\tau_{1}},...,{\tau_{I}}} \sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {{{\left({\left\| {{\mathbf{p}_{n_{0}^{~}}} +{\mathbf{s}_{i}^{\prime\prime\prime}}} \right\| \,+\, {\tau_{i}} \,-\, {r_{n,i}}} \right)}^{2}}} }\!. \end{array} $$

(47)

We expand (47) as

$$\begin{array}{*{20}l} \left({{{\widehat \tau }_{1}},...,{{\widehat \tau }_{I}}} \right) =& \arg \mathop {\min }\limits_{{\tau_{1}},...,{\tau_{I}}} \sum\limits_{n = 1}^{N} {{{\left({\left\| {{\mathbf{p}_{n_{0}^{~}}} + {\mathbf{s}_{1}^{\prime\prime\prime}}} \right\| + {\tau_{1}} - {r_{n,1}}} \right)}^{2}}} \\ &+... + \sum\limits_{n = 1}^{N} {{{\left({\left\| {{\mathbf{p}_{n_{0}^{~}}} + {\mathbf{s}_{I}^{\prime\prime\prime}}} \right\| + {\tau_{I}} - {r_{n,I}}} \right)}^{2}}}. \end{array} $$

(48)

The objective function in (48) is sum of positive and independent terms. Again, the problem decouples and we can find the minima with respect to τ₁,...,τ_I separately for i=1,...,I. The corresponding problem for the ith variable, τ_i, is

$$\begin{array}{*{20}l} {\widehat \tau_{i}} \,=\, \arg \mathop {\min }\limits_{{\tau_{i}}} \sum\limits_{n = 1}^{N} {{{\left({\left\| {{\mathbf{p}_{n_{0}^{~}}} + {\mathbf{s}_{i}^{\prime\prime\prime}}} \right\| + {\tau_{i}} - {r_{n,i}}} \right)}^{2}}}\!. \end{array} $$

(49)

and has the (s) solution

$$\begin{array}{*{20}l} {\tau_{i}} = \frac{{\sum\limits_{n = 1}^{N} {{r_{n,i}} - \left\| {{\mathbf{p}_{n_{0}^{~}}} + {\mathbf{s}_{i}^{\prime\prime\prime}}} \right\|} }}{N}. \end{array} $$

(50)

4.2.3 Iterative algorithm for approximate solution of (13)

The whole approach to estimate the parameters under ${{\mathcal {H}}_{1}}$ is summarized in Algorithm 2. Since the estimation problem is non-linear and can have multiple local optimum points, we need to repeat Algorithm 2 for different initialization points of τ₁,...,τ_I.

Similarly to the case under ${{\mathcal {H}}_{1}}$, the minimization with respect to ${\mathbf {s}_{1}^{\prime \prime \prime }},...,{\mathbf {s}_{I}}^{\prime \prime \prime }$ for given τ₁,...,τ_I in Algorithm 2 returns the global optimum. Also, for given ${\mathbf {s}_{1}^{\prime \prime \prime }},...,{\mathbf {s}_{I}}^{\prime \prime \prime }$, (50) yields the globally optimal values of τ₁,...,τ_I. However, the joint estimates ${\mathbf {s}_{1}^{\prime \prime \prime }},...,{\mathbf {s}_{I}}^{\prime \prime \prime }$ and τ₁,...,τ_I delivered by Algorithm 2 may be suboptimal. A more granular initialization range for the parameter θ increases the chance of finding the global optimum rather than a local optimum.

4.3 Complexity analysis of the proposed algorithms

In this section, we provide the Big-O complexity for each step of Algorithms 1 and 2, respectively. Algorithm 1 is comprised of two parts where b₀ is first estimated using (23) and θ is estimated using (37), which is solved using Ferrari’s method. Adding up the complexity of these two parts, the complexity of each iteration of Algorithm 1 is:

$$\begin{array}{*{20}l} &4O\left({3NI} \right) + O\left({9NI} \right) + O\left({{{\log }_{2}}\left(r \right)} \right), \end{array} $$

(51)

where $r = {\log _{2}}\left ({\frac {{{\varepsilon _{0}}}}{\varepsilon }} \right)$, ε₀ is the search domain of the bisection algorithm in (26), and ε is the required accuracy of the bisection algorithm. The overall complexity of (51) is the number of tested initial values of θ₀ multiplied by the complexity of each iteration provided in (51).

Similarly, Algorithm 2 is comprised of two parts. First, the values of ${\mathbf {s}_{1}^{\prime \prime \prime }},...,{\mathbf {s}_{I}^{\prime \prime \prime }}$ are estimated and then τ₁,...,τ_I are computed. Adding the complexity of these two parts, the complexity of each iteration of Algorithm 1 is:

$$\begin{array}{*{20}l} &I \times \left[ {4O\left({3N} \right) + O\left({9N} \right)} + {O\left({{{\log }_{2}}\left(r \right)} \right)} \right] \end{array} $$

(52)

5 Optimal design of attack parameters

As we develop signal processing methodology to detect an attack by multiple spoofers, it is expected that the adversary devises the best strategy to counteract the spoofing detection technique. In this section, we develop analytical solutions to design the optimal spoofing parameters. In this analysis, we assume that the adversary has perfect knowledge of the initial positions of the GNSS receiver nodes, $\mathbf {p}_{{n_{0}}}$.

To minimize the chance of detection, the adversary needs to satisfy two types of constraints. First, the adversary needs to find spoofed locations, $\mathbf {p}_{n}^{sp}$, such that the relative coordinates of the GNSS receivers is preserved after spoofing. To achieve this, the spoofer selects values of the spoofed translation vector, $\mathbf {b}_{0}^{sp}$, and spoofed rotation matrix, T^sp. Then, it uses the knowledge of $\mathbf {p}_{{n_{0}}}$ to calculate the values of the spoofed locations, $\mathbf {p}_{n}^{sp}$, as

$$\begin{array}{*{20}l} \mathbf{p}_{n}^{sp} = \mathbf{b}_{0}^{sp} + {\mathbf{T}^{sp}}{\mathbf{p}_{{n_{0}}}}. \end{array} $$

(53)

Second, the locations of the spoofers and forged positions of the satellites need to chosen such that the range measurements at all GNSS receivers result in the target spoofed location derived in (53), and the spoofed formation of the GNSS receivers is preserved. To satisfy this, the simulated distance by a specific spoofer, caused by its physical distance to a GNSS receiver and artificial delay, needs to be equal to the distance of forged satellite, provided in the simulated GNSS signal, to the estimated position of that GNSS receiver. To implement the former in the best way, the adversary first picks values for the forged positions of the satellites, $\mathbf {s}_{i}^{sp}$, and uses the values of $\mathbf {p}_{n}^{sp}$ derived in (53) to satisfy the following constrains:

$$\begin{array}{*{20}l} \left\| { \mathbf{p}_{i}^{A} - \mathbf{p}_{n}} \right\| + {\tau_{i}} = \left\| {\mathbf{p}_{n}^{sp} - \mathbf{s}_{i}^{sp}} \right\|, \end{array} $$

(54)

where $\mathbf {p}_{i}^{A}$ is the position of the ith spoofer, $\mathbf {p}_{n}^{sp}$ is the spoofed location of the nth GNSS receiver, $\mathbf {s}_{i}^{sp}$ is the forged position of the ith satellite, and τ_i is the artificial delay produced by the ith spoofer. The better the spoofers satisfy the corresponding equations in (54), the closer the estimated parameters in (3) to that set by the adversary. Consequently, this leads to a better fit between the measurements and the data model. As we see in the developed detection test in (14), this helps reducing the left hand side of the detection test and not reaching the detection threshold.

Each spoofer chooses values for $\mathbf {s}_{i}^{sp}$ since these values need to be in a specific range, e.g., GEO satellites, and then solves the related equations in (54) to get the optimal values of $\mathbf {p}_{i}^{A}$ and τ_i. To illustrate, the best position for the first attacker is illustrated in Fig. 2 for N=I=A=2. As we see, satisfying the set of constraints in (54) results in the optimal position for the spoofer being the intersection of two circles where the center of each circle is p_n for n=1,2. For N≥3, there are three circles which may not have a common intersection point. Therefore, the adversary needs to find the best point for each spoofer which best satisfies (54) for all GNSS receivers. One way is to use a least squares fit,

$$\begin{array}{*{20}l} \min \sum\limits_{n = 1}^{N} {{{\left[ {{{\left\| {\mathbf{p}_{i}^{A} - \mathbf{p}_{n}^{sp}} \right\|}^{2}} - {{\left({{\mu_{n,i}} - {\tau_{i}}} \right)}^{2}}} \right]}^{2}}}, \end{array} $$

(55)

Fig. 2

Spoofing attack illustration

where ${\mu _{n,i}} = \left \| {\mathbf {p}_{n}^{sp} - \mathbf {s}_{i}^{sp}} \right \|$. To solve (55), we do the following change of variables:

$$\begin{array}{*{20}l} \mathbf{p}_{n} = \left[ \begin{array}{l} p_{{n_{x}}}\\ p_{{n_{y}}} \end{array} \right], \,\,\,\, \mathbf{p}_{i}^{A} = \left[ \begin{array}{l} {x_{i}}\\ {y_{i}} \end{array} \right], \end{array} $$

(56)

and calculate the derivatives of the objective in (55) with respect to ${p_{{n_{x}}}}$, ${p_{{n_{y}}}}$, and τ_i. After algebraic simplifications, we get

$$\begin{array}{*{20}l} \frac{{\partial f}}{{\partial {x_{i}}}} =& Nx_{i}^{3} - 3\sum\limits_{n = 1}^{N} {{p_{{n_{x}}}}} x_{i}^{2} + \left({3\sum\limits_{n = 1}^{N} {{{\left({{p_{{n_{x}}}}} \right)}^{2}}} + \sum\limits_{n = 1}^{N} {{c_{n,i}}}} \right){x_{i}} \\ &+ \sum\limits_{n = 1}^{N} {\left({ - {{\left({{p_{{n_{x}}}}} \right)}^{3}} - {p_{{n_{x}}}}{c_{n,i}}} \right)}, \\ \frac{{\partial f}}{{\partial {y_{i}}}} =& Ny_{i}^{3} - 3\sum\limits_{n = 1}^{N} {{p_{{n_{y}}}}} y_{i}^{2} + \left({3\sum\limits_{n = 1}^{N} {{{\left({{p_{{n_{y}}}}} \right)}^{2}}} + \sum\limits_{n = 1}^{N} {{d_{n,i}}}} \right){y_{i}} \\ &+ \sum\limits_{n = 1}^{N} {\left({ - {{\left({{p_{{n_{y}}}}} \right)}^{3}} - {p_{{n_{y}}}}{d_{n,i}}} \right)}, \\ \frac{{\partial f}}{{\partial {\tau_{i}}}} =& N\tau_{i}^{3} - 3\sum\limits_{n = 1}^{N} {{\mu_{n,i}}} \tau_{i}^{2} + \sum\limits_{n = 1}^{N} {\left({3\mu_{n,i}^{2} - {e_{n,i}}} \right){\tau_{i}}} \\ &+ \sum\limits_{n = 1}^{N} { - \mu_{n,i}^{3} + {\mu_{n,i}}{e_{n,i}}}, \end{array} $$

(57)

where

$$\begin{array}{*{20}l} {c_{n,i}} = {\left({{y_{i}} - {p_{{n_{y}}}}} \right)^{2}} - {\left({{\mu_{n,i}} - {\tau_{i}}} \right)^{2}}, \\ {d_{n,i}} = {\left({{x_{i}} - {p_{{n_{x}}}}} \right)^{2}} - {\left({{\mu_{n,i}} - {\tau_{i}}} \right)^{2}}, \\ {e_{n,i}} = {\left({{x_{i}} - {p_{{n_{x}}}}} \right)^{2}} + {\left({{y_{i}} - {p_{{n_{y}}}}} \right)^{2}}. \end{array} $$

(58)

Relations (58) imply an intertwined system of non-linear equations in (57). This system of equations can be solved using classic approaches such as the Newton method. To find the optimal values of ${\mathbf {p}_{i}^{A}}$ and τ_i for each spoofer, we perform a coarse search over multiple initial guess points and choose the best one among them.

Nonetheless, in practice, it may not be possible for each spoofer to be in the optimal location at each moment. This is due to the fact that the GNSS receivers are installed on a moving platform and physical barriers as well as unknown velocity and speed can prevent the spoofers from being at the required positions. We quantify the spoofing detection performance with respect to the deviation from the optimal location of the spoofers in Section 6.

6 Simulation results

In this section, we present numerical examples to quantify the performance of the proposed spoofing detection mechanism. Unless otherwise stated, the parameters of the simulation setup are as in Table 2.

Table 2 Simulations parameters for the spoofing scenario

To initialize $\hat {\theta }$ for Algorithm 1, we select a set of coarsely spaced values within the range [0,2π]. We repeat Algorithm 2 for different initial values of τ₁,...,τ_I and then pick the estimated parameters which result in the least difference between the measurements and the data model. The values of ε in both Algorithms 1 and 2 are set to ε=10⁻³.

To demonstrate the accuracy of the parameter estimates used in lieu of the maximum-likelihood estimates required in (12)–(13), we first compare the empirical estimation variance to the Cramér-Rao lower bound (CRLB). The CRLBs under ${{\mathcal {H}}_{0}}$ and ${{\mathcal {H}}_{1}}$ are derived in Appendix Appendix A and Appendix Appendix B, respectively. Due to space constraints, we present these comparisons only for the parameters θ for ${{{\mathcal {H}}_{0}}}$ and $s_{31}^{\prime \prime \prime }$ for ${{{\mathcal {H}}_{1}}}$. Figures 3 and 4 show the results. As we can see, parameter estimates get close to their respective CRLBs as the noise variances decrease.

Fig. 3

Estimation variance for θ as function of the noise power σ², compared to the CRLB

Fig. 4

Estimation variance for $s^{\prime \prime \prime }_{31}$ as function of the noise power σ², compared to the CRLB

We next evaluate the performance of the proposed spoofing detection technique by plotting the probability of detection versus the probability of false alarm for various different values of M (or equivalently, different noise power $\frac {{{\sigma ^{2}}}}{M}$ in the averaged range measurements). To generate the simulation results and find the threshold of the GLRT, we proceed as follows. First, we run a case without spoofers and empirically calculate the probability of false alarm using the GLRT test in (14) for various values of γ_th. Next, we simulate the presence of spoofers and calculate the probability of detection using the GLRT test in (14) for various values of γ_th. Finally, we plot the so-obtained probabilities of detection and false alarm.

In the first simulation scenario, we investigate how the difference between the true and spoofed positions of the GNSS receivers affect the spoofing detection probability. We present the probability of detection versus false alarm in Figs. 5 and 6 for different values of the spoofed translation vector, $\mathbf {b}_{0}^{sp}$. The results show that as the adversary tries to mislead the victims more from their true locations, the chance to spot the spoofing attack increases.

Fig. 5

Probability of detection versus probability of false alarm for N=I=3 and $b_{0}^{sp} = {10^{3}} \times \left [ {0.5,0.5} \right ]$

Fig. 6

Probability of detection versus probability of false alarm for N=I=3 and $b_{0}^{sp} = {10^{3}} \times \left [ {5,5} \right ]$

In the next scenario, we quantify the performance of the proposed technique when the position of each spoofer deviates from the optimal designed positions. The probability of detection versus false alarm is shown in Fig. 7 when each spoofer is moved by ${{2\mathbf {p}_{i}^{A}} \left /\right. {\left \| {\mathbf {p}_{i}^{A}} \right \|}}$ from the optimal position. As we see, the probability of detection increases as the spoofers fail to occupy their optimal locations.

Fig. 7

Probability of detection versus probability of false alarm for N=I=3 and $\mathbf {b}_{0}^{sp} = {10^{3}} \times \left [ {0.5,0.5} \right ]$ when the spoofer locations deviate by $\frac {{2\mathbf {p}_{i}^{A}}}{{\left \| {\mathbf {p}_{i}^{A}} \right \|}}$

Finally, we investigate the effect of the number of GNSS receivers on the performance of the proposed algorithm. We consider the same satellite formation with I=3 and three spoofers, i.e., A=3, while increasing the number of GNSS receivers from three to five. The performance of the proposed algorithm when increasing the number of GNSS receivers is shown in Fig. 8. Compared to Fig. 5, we see that adding two extra GNSS receivers increases the detection performance of the proposed scheme considerably.

Fig. 8

Probability of detection versus probability of false alarm for N=5 and I=3 and $\mathbf {b}_{0}^{sp} = {10^{3}} \times \left [ {0.5,0.5} \right ]$

As we see in Figs. 5-8, increasing the number of samples taken by the GNSS receivers consistently increases the detection probability for a given false alarm probability.

7 Conclusions

We proposed an anti-spoofing approach for GNSS based on a statistical test. The test exploits multiple GNSS receivers mounted on a rigid-body platform (with a priori unknown position and orientation) and essentially performs a consistency check between all pairs of measured receiver-satellite distances and available prior knowledge about the relative positions of the receivers on the platform. Numerical simulations proved the feasibility of our method and specifically showed that the more the spoofers try to manipulate the estimated GNSS receiver positions from their nominal locations, the higher is the probability of attack detection. Also, the more GNSS receivers on the platform, the higher the probability of detecting a spoofing attack.

We furthermore showed that using multiple GNSS receivers limits the feasible attacker position to few locations, and we designed a framework for finding the optimal attack positions as well as the artificial time delays of the spoofers. Simulations showed that when the spoofers do not occupy their optimal locations, it is easier to detect them.

For analytical tractability and to achieve a first proof-of-concept of our statistical test methodology, we considered a two-dimensional geometry. Future work may include extensions to a three-dimensional world or combining our approach with anomaly detection in the autocorrelation function of the received signals, in order to enhance overall detection performance. In addition, new analysis can be performed by considering synchronization errors among the clocks of the GNSS receivers and the satellites. Also, the noise variance may be treated as an unknown parameter in the GLR tests.

It would be interesting to test our proposed approach in practice. We hope that this paper will stimulate both further theoretical research and experimental work.

8 Appendix A

8.1 Proof of CRLB for ₀

In this appendix, we calculate the CRLB for estimated parameters under hypothesis ${{\mathcal {H}}_{0}}$. Since the range measurements in (5) follow a normal distribution, we can use the Slepian-Bang formula [56] to calculate the CRLB as,

$$\begin{array}{*{20}l} {\left[ {\mathbf{I}\left(\boldsymbol{\alpha} \right)} \right]_{jk}} = {\left[ {\frac{{\partial \boldsymbol{\mu} \left(\boldsymbol{\alpha} \right)}}{{\partial {\alpha_{j}}}}} \right]^{T}}{\mathbf{C}^{- 1}}\left(\boldsymbol{\alpha} \right)\left[ {\frac{{\partial \boldsymbol{\mu} \left(\boldsymbol{\alpha} \right)}}{{\partial {\alpha_{k}}}}} \right], \end{array} $$

(59)

where

$$\begin{array}{*{20}l} \boldsymbol{\alpha} &= {\left[ {{b_{01}},{b_{02}},\theta} \right]^{T}}, \\ {\left[ {\mu \left(\boldsymbol{\alpha} \right)} \right]_{\text{\textit{n,i,m}}}} &= \left\| {{\mathbf{b}_{0}} + \mathbf{T}{\mathbf{p}_{n_{0}^{~}}} - {\mathbf{s}_{i}}} \right\|, \\ \frac{{\partial \mu \left(\boldsymbol{\alpha} \right)}}{{\partial {\alpha_{j}}}} &\,=\,\! {\left[ {\begin{array}{*{20}{c}} {\frac{{\partial {{\left[ {\mu \left(\boldsymbol{\alpha} \right)} \right]}_{1}}}}{{\partial {\alpha_{j}}}}},{\frac{{\partial {{\left[ {\mu \left(\boldsymbol{\alpha} \right)} \right]}_{2}}}}{{\partial {\alpha_{j}}}}},...,{\frac{{\partial {{\left[ {\mu \left(\boldsymbol{\alpha} \right)} \right]}_{{ NIM}}}}}{{\partial {\alpha_{j}}}}} \end{array}} \right]^{T}}, \end{array} $$

(60)

and ${\mathbf {C}^{- 1}}\left (\boldsymbol {\alpha } \right) = {\sigma ^{ - 2}}$ since the noises across the GNSS receivers and the measurements are assumed to be independent.

To calculate the CRLB for ${{\mathcal {H}}_{0}}$, first, we calculate the values of $\frac {{\partial \mu \left (\boldsymbol {\alpha } \right)}}{{\partial {\alpha _{j}}}}$ for j=1,2,3. After some algebraic calculations, these values are derived as

$$\begin{array}{*{20}l} \frac{{\partial {{\left[ {\mu \left(\boldsymbol{\alpha} \right)} \right]}_{\text{\textit{n,i,m}}}}}}{{\partial {b_{01}}}} &= \frac{{{b_{01}} + {p_{n1}}\cos \theta - {p_{n2}}\sin \theta - {s_{i1}}}}{{\left\| {{\mathbf{b}_{0}} + \mathbf{T}{\mathbf{p}_{n_{0}^{~}}} - {\mathbf{s}_{i}}} \right\|}}, \\ \frac{{\partial {{\left[ {\mu \left(\boldsymbol{\alpha} \right)} \right]}_{\text{\textit{n,i,m}}}}}}{{\partial {b_{02}}}} &= \frac{{{b_{02}} + {p_{n1}}\sin \theta + {p_{n2}}\cos \theta - {s_{i2}}}}{{\left\| {{\mathbf{b}_{0}} + \mathbf{T}{\mathbf{p}_{n_{0}^{~}}} - {\mathbf{s}_{i}}} \right\|}}, \\ \frac{{\partial {{\left[ {\mu \left(\boldsymbol{\alpha} \right)} \right]}_{\text{\textit{n,i,m}}}}}}{{\partial \theta }} &= \frac{{{A_{n,i}}\cos \theta + {B_{n,i}}\sin \theta }}{{\left\| {{\mathbf{b}_{0}} + \mathbf{T}{\mathbf{p}_{n_{0}^{~}}} - {\mathbf{s}_{i}}} \right\|}}, \end{array} $$

(61)

where

$$\begin{array}{*{20}l} {A_{n,i}} &= {b_{02}}{p_{n1}} - {b_{01}}{p_{n2}} - {s_{i2}}{p_{n1}} + {s_{i1}}{p_{n2}}, \\ {B_{n,i}} &= - {b_{02}}{p_{n2}} - {b_{01}}{p_{n1}} + {s_{i1}}{p_{n1}} + {s_{i2}}{p_{n2}}. \end{array} $$

(62)

By inserting the calculated values of (61) into the Slepian-Bang formula in (59), the elements of the Fisher information matrix are derived as

$$ \begin{aligned} {\left[ {\mathbf{I}\left(\boldsymbol{\alpha} \right)} \right]_{11}} =& M\sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {\frac{{{{\left({{b_{01}} + {p_{n1}}\cos \theta - {p_{n2}}\sin \theta - {s_{i1}}} \right)}^{2}}}}{{{{\left\| {{\mathbf{b}_{0}} + \mathbf{T}{\mathbf{p}_{n_{0}^{~}}} - {\mathbf{s}_{i}}} \right\|}^{2}}}}} }, \\ {\left[ {\mathbf{I}\left(\boldsymbol{\alpha} \right)} \right]_{12}} =& M\sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {\frac{{\left({{b_{01}} + {p_{n1}}\cos \theta - {p_{n2}}\sin \theta - {s_{i1}}} \right)}}{{{{\left\| {{\mathbf{b}_{0}} + \mathbf{T}{\mathbf{p}_{n_{0}^{~}}} - {\mathbf{s}_{i}}} \right\|}^{2}}}}} } \\ &\times \left({{b_{02}} + {p_{n1}}\sin \theta + {p_{n2}}\cos \theta - {s_{i2}}} \right), \\ {\left[ {\mathbf{I}\left(\boldsymbol{\alpha} \right)} \right]_{13}} =& M\sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {\frac{{\left({{b_{01}} + {p_{n1}}\cos \theta - {p_{n2}}\sin \theta - {s_{i1}}} \right)}}{{{{\left\| {{\mathbf{b}_{0}} + \mathbf{T}{\mathbf{p}_{n_{0}^{~}}} - {\mathbf{s}_{i}}} \right\|}^{2}}}}} } \\ &\times \left({{A_{n,i}}\cos \theta + {B_{n,i}}\sin \theta} \right), \\ {\left[ {\mathbf{I}\left(\boldsymbol{\alpha} \right)} \right]_{22}} =& M\sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {\frac{{{{\left({{b_{02}} + {p_{n1}}\sin \theta + {p_{n2}}\cos \theta - {s_{i2}}} \right)}^{2}}}}{{{{\left\| {{\mathbf{b}_{0}} + \mathbf{T}{\mathbf{p}_{n_{0}^{~}}} - {\mathbf{s}_{i}}} \right\|}^{2}}}}} }, \\ {\left[ {\mathbf{I}\left(\boldsymbol{\alpha} \right)} \right]_{23}} =& M\sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {\frac{{\left({{b_{02}} + {p_{n1}}\sin \theta + {p_{n2}}\cos \theta - {s_{i2}}} \right)}}{{{{\left\| {{\mathbf{b}_{0}} + \mathbf{T}{\mathbf{p}_{n_{0}^{~}}} - {\mathbf{s}_{i}}} \right\|}^{2}}}}} } \\ &\times \left({{A_{n,i}}\cos \theta + {B_{n,i}}\sin \theta} \right), \\ {\left[ {\mathbf{I}\left(\boldsymbol{\alpha} \right)} \right]_{33}} =& M\sum\limits_{n = 1}^{N} {\sum\limits_{i = 1}^{I} {\frac{{{{\left({{A_{n,i}}\cos \theta + {B_{n,i}}\sin \theta} \right)}^{2}}}}{{{{\left\| {{\mathbf{b}_{0}} + \mathbf{T}{\mathbf{p}_{n_{0}^{~}}} - {\mathbf{s}_{i}}} \right\|}^{2}}}}} }, \end{aligned} $$

(63)

and ${\left [ {\mathbf {I}\left (\boldsymbol {\alpha } \right)} \right ]_{21}} = {\left [ {\mathbf {I}\left (\boldsymbol {\alpha } \right)} \right ]_{12}}$, ${\left [ {\mathbf {I}\left (\boldsymbol {\alpha } \right)} \right ]_{31}} = {\left [ {\mathbf {I}\left (\boldsymbol {\alpha } \right)} \right ]_{13}}$, ${\left [ {\mathbf {I}\left (\boldsymbol {\alpha } \right)} \right ]_{32}} = {\left [ {\mathbf {I}\left (\boldsymbol {\alpha } \right)} \right ]_{23}}$. Using the calculated elements of the Fisher matrix, we can derive closed-form expressions for the CRLB by inverting the Fisher information matrix. For the sake of conciseness, here, we avoid showing these expressions.

9 Appendix B

9.1 Proof of CRLB for ₁

In this appendix, we calculate the CRLB for the parameters under hypothesis ${{\mathcal {H}}_{1}}$. Since the range measurements in (5) follow a normal distribution, we can use the Slepian-Bang formula [56] to calculate the CRLB.

Based on Algorithm 2, the first step is to find initial values of the parameters τ_i for i=1,..,I. As we see in (45), estimation of $\mathbf {s}^{\prime \prime \prime }_{i}$ depends on $\overline r_{n,i}^{2}$ for n=1,...,N where $\overline r_{n,i}^{2}$ depends on τ_i for n=1,...,N. Hence, only τ_i is used in (43) to estimate $\mathbf {s}^{\prime \prime \prime }_{i}$ for i=1,...I.

In the next step of Algorithm 2, calculated values of $\mathbf {s}^{\prime \prime \prime }_{i}$ are used to estimate τ_i for i=1,..,I. Based on (50), only $\mathbf {s}^{\prime \prime \prime }_{i}$ is used to estimate τ_i for i=1,..,I. According to the previous explanations, each pair $(\mathbf {s}^{\prime \prime \prime }_{i},\tau _{i})$ is estimated independently for i=1,...,I. In the following, we provide the details to calculate the CRLB for ${{\mathcal {H}}_{1}}$.

Similar to the calculations for ${{\mathcal {H}}_{0}}$, we use the Slepian-Bang relation (59) to calculate the CRLB for ${{\mathcal {H}}_{1}}$. The problem parameters and the mean of the hypothesis are defined as

$$\begin{array}{*{20}l} \boldsymbol{\alpha} &= \left[ {s_{11}^{\prime\prime\prime},s_{12}^{\prime\prime\prime},{\tau_{1}},...,s_{I1}^{\prime\prime\prime},s_{I2}^{\prime\prime\prime},{\tau_{I}}} \right], \\ {\left[ {\mu \left(\boldsymbol{\alpha} \right)} \right]_{n,i}} &= \left\| {{{\mathbf{p}}_{{n_{0}}}} + {\mathbf{s}}_{i}^{\prime\prime\prime}} \right\| + {\tau_{i}}, \end{array} $$

(64)

and ${\mathbf {C}^{- 1}}\left (\boldsymbol {\alpha } \right) = {\sigma ^{ - 2}}$ since the noises across the GNSS receivers and the measurements are assumed to be independent. As we see, α depends on different parameters of one specific satellite for each value of i. To avoid confusion, we can assume that for ${\left [ {\mu \left (\boldsymbol {\alpha } \right)} \right ]_{n,i}}$ the parameters with index i=1,...,i−1,i+1,...,I have coefficient zero. Hence, the FIM will be block diagonal and each block is 3×3 since three parameters from each satellite need to be estimated. Considering that M samples are captured from the same satellite by the same GNSS receiver, we factor out M.

The derivative of ${\left [ {\mu \left (\boldsymbol {\alpha } \right)} \right ]_{n,i}}$ with respect to the parameters related to the ith satellite are defined as

$$\begin{array}{*{20}l} \frac{{{{\left[ {\mu \left(\boldsymbol{\alpha} \right)} \right]}_{n,i}}}}{{\partial s_{i1}^{\prime\prime\prime}}} &= \frac{{{p_{{n_{01}}}} + s_{i1}^{\prime\prime\prime}}}{{\left\| {{{\mathbf{p}}_{{n_{0}}}} + {\mathbf{s}}_{i}^{\prime\prime\prime}} \right\|}}, \\ \frac{{{{\left[ {\mu \left(\boldsymbol{\alpha} \right)} \right]}_{n,i}}}}{{\partial s_{i2}^{\prime\prime\prime}}} &= \frac{{{p_{{n_{02}}}} + s_{i2}^{\prime\prime\prime}}}{{\left\| {{{\mathbf{p}}_{{n_{0}}}} + {\mathbf{s}}_{i}^{\prime\prime\prime}} \right\|}}, \\ \frac{{{{\left[ {\mu \left(\boldsymbol{\alpha} \right)} \right]}_{n,i}}}}{{\partial {\tau_{i}}}} &= 1. \end{array} $$

(65)

The elements of the FIM are calculated as

$$\begin{array}{*{20}l} &{\left[ {I\left(\alpha \right)} \right]_{11}} = \sum\limits_{n = 1}^{N} {\frac{{{{\left({{p_{{n_{01}}}} + s_{11}^{\prime\prime\prime}} \right)}^{2}}}}{{{{\left\| {{\mathbf{p}_{{n_{0}}}} + \mathbf{s}_{1}^{\prime\prime\prime}} \right\|}^{2}}}}}, \\ &{\left[ {I\left(\alpha \right)} \right]_{12}} = \sum\limits_{n = 1}^{N} {\frac{{\left({{p_{{n_{01}}}} + s_{11}^{\prime\prime\prime}} \right)\left({{p_{{n_{02}}}} + s_{12}^{\prime\prime\prime}} \right)}}{{{{\left\| {{\mathbf{p}_{{n_{0}}}} + \mathbf{s}_{1}^{\prime\prime\prime}} \right\|}^{2}}}}}, \\ &{\left[ {I\left(\alpha \right)} \right]_{13}} = \sum\limits_{n = 1}^{N} {\frac{{{p_{{n_{01}}}} + s_{11}^{\prime\prime\prime}}}{{{{\left\| {{\mathbf{p}_{{n_{0}}}} + \mathbf{s}_{1}^{\prime\prime\prime}} \right\|}}}}}, \\ &{\left[ {I\left(\alpha \right)} \right]_{14}},...,{\left[ {I\left(\alpha \right)} \right]_{1\left({3I} \right)}} = 0, \\ \\ &{\left[ {I\left(\alpha \right)} \right]_{21}} = {\left[ {I\left(\alpha \right)} \right]_{12}} \\ &{\left[ {I\left(\alpha \right)} \right]_{22}} = \sum\limits_{n = 1}^{N} {\frac{{{{\left({{p_{{n_{02}}}} + s_{12}^{\prime\prime\prime}} \right)}^{2}}}}{{{{\left\| {{\mathbf{p}_{{n_{0}}}} + \mathbf{s}_{i}^{\prime\prime\prime}} \right\|}^{2}}}}} \\ &{\left[ {I\left(\alpha \right)} \right]_{23}} = \sum\limits_{n = 1}^{N} {\frac{{{p_{{n_{02}}}} + s_{12}^{\prime\prime\prime}}}{{{{\left\| {{\mathbf{p}_{{n_{0}}}} + \mathbf{s}_{1}^{\prime\prime\prime}} \right\|}}}}} \\ &{\left[ {I\left(\alpha \right)} \right]_{24}},...,{\left[ {I\left(\alpha \right)} \right]_{2\left({3I} \right)}} = 0,\\ \\ &{\left[ {I\left(\alpha \right)} \right]_{31}} = {\left[ {I\left(\alpha \right)} \right]_{13}} \end{array} $$

$$\begin{array}{*{20}l} &{\left[ {I\left(\alpha \right)} \right]_{32}} = {\left[ {I\left(\alpha \right)} \right]_{23}} \\ &{\left[ {I\left(\alpha \right)} \right]_{33}} = N \\ &{\left[ {I\left(\alpha \right)} \right]_{34}},...,{\left[ {I\left(\alpha \right)} \right]_{3\left({3I} \right)}} = 0,\\ \\ &{\left[ {I\left(\alpha \right)} \right]_{41}} = {\left[ {I\left(\alpha \right)} \right]_{42}} = {\left[ {I\left(\alpha \right)} \right]_{43}} = 0 \\ &{\left[ {I\left(\alpha \right)} \right]_{44}} = \sum\limits_{n = 1}^{N} {\frac{{{{\left({{p_{{n_{01}}}} + s_{21}^{\prime\prime\prime}} \right)}^{2}}}}{{{{\left\| {{\mathbf{p}_{{n_{0}}}} + \mathbf{s}_{2}^{\prime\prime\prime}} \right\|}^{2}}}}}, \\ &{\left[ {I\left(\alpha \right)} \right]_{45}} = \sum\limits_{n = 1}^{N} {\frac{{\left({{p_{{n_{01}}}} + s_{21}^{\prime\prime\prime}} \right)\left({{p_{{n_{02}}}} + s_{22}^{\prime\prime\prime}} \right)}}{{{{\left\| {{\mathbf{p}_{{n_{0}}}} + \mathbf{s}_{2}^{\prime\prime\prime}} \right\|}^{2}}}}}, \\ &{\left[ {I\left(\alpha \right)} \right]_{46}} = \sum\limits_{n = 1}^{N} {\frac{{{p_{{n_{01}}}} + s_{21}^{\prime\prime\prime}}}{{{{\left\| {{\mathbf{p}_{{n_{0}}}} + \mathbf{s}_{2}^{\prime\prime\prime}} \right\|}}}}}, \\ &{\left[ {I\left(\alpha \right)} \right]_{47}},...,{\left[ {I\left(\alpha \right)} \right]_{4\left({3I} \right)}} = 0,\\ \\ &{\left[ {I\left(\alpha \right)} \right]_{51}} = {\left[ {I\left(\alpha \right)} \right]_{52}} = {\left[ {I\left(\alpha \right)} \right]_{53}} = 0 \\ &{\left[ {I\left(\alpha \right)} \right]_{54}} = {\left[ {I\left(\alpha \right)} \right]_{45}}, \\ &{\left[ {I\left(\alpha \right)} \right]_{55}} = \sum\limits_{n = 1}^{N} {\frac{{{{\left({{p_{{n_{01}}}} + s_{22}^{\prime\prime\prime}} \right)}^{2}}}}{{{{\left\| {{\mathbf{p}_{{n_{0}}}} + \mathbf{s}_{2}^{\prime\prime\prime}} \right\|}^{2}}}}}, \\ &{\left[ {I\left(\alpha \right)} \right]_{56}} = \sum\limits_{n = 1}^{N} {\frac{{{p_{{n_{01}}}} + s_{22}^{\prime\prime\prime}}}{{{{\left\| {{\mathbf{p}_{{n_{0}}}} + \mathbf{s}_{2}^{\prime\prime\prime}} \right\|}}}}}, \\ &{\left[ {I\left(\alpha \right)} \right]_{57}},...,{\left[ {I\left(\alpha \right)} \right]_{5\left({3I} \right)}} = 0,\\ \\ &{\left[ {I\left(\alpha \right)} \right]_{61}},..., {\left[ {I\left(\alpha \right)} \right]_{63}}=0 \\ &{\left[ {I\left(\alpha \right)} \right]_{64}} = {\left[ {I\left(\alpha \right)} \right]_{46}} \\ &{\left[ {I\left(\alpha \right)} \right]_{65}} = {\left[ {I\left(\alpha \right)} \right]_{56}} \\ &{\left[ {I\left(\alpha \right)} \right]_{66}} = N \\ &{\left[ {I\left(\alpha \right)} \right]_{67}},...,{\left[ {I\left(\alpha \right)} \right]_{6(3I)}}=0 \\ &{\left[ {I\left(\alpha \right)} \right]_{(3I-2)1}} = {\left[ {I\left(\alpha \right)} \right]_{(3I-2)(3I-3)}} = 0 \\ &{\left[ {I\left(\alpha \right)} \right]_{(3I-2)(3I-2)}} = \sum\limits_{n = 1}^{N} {\frac{{{{\left({{p_{{n_{01}}}} + s_{I1}^{\prime\prime\prime}} \right)}^{2}}}}{{{{\left\| {{\mathbf{p}_{{n_{0}}}} + \mathbf{s}_{I}^{\prime\prime\prime}} \right\|}^{2}}}}}, \\ &{\left[ {I\left(\alpha \right)} \right]_{(3I-2)(3I-1)}} = \sum\limits_{n = 1}^{N} {\frac{{\left({{p_{{n_{01}}}} + s_{I1}^{\prime\prime\prime}} \right)\left({{p_{{n_{02}}}} + s_{I2}^{\prime\prime\prime}} \right)}}{{{{\left\| {{\mathbf{p}_{{n_{0}}}} + \mathbf{s}_{I}^{\prime\prime\prime}} \right\|}^{2}}}}}, \\ &{\left[ {I\left(\alpha \right)} \right]_{(3I-2)(3I)}} = \sum\limits_{n = 1}^{N} {\frac{{{p_{{n_{01}}}} + s_{I1}^{\prime\prime\prime}}}{{{{\left\| {{\mathbf{p}_{{n_{0}}}} + \mathbf{s}_{I}^{\prime\prime\prime}} \right\|}}}}}, \\ &{\left[ {I\left(\alpha \right)} \right]_{(3I-1)1}} = {\left[ {I\left(\alpha \right)} \right]_{(3I-1)(3I-3)}} = 0 \\ &{\left[ {I\left(\alpha \right)} \right]_{(3I-1)(3I-2)}} = {\left[ {I\left(\alpha \right)} \right]_{(3I-2)(3I-1)}}, \\ &{\left[ {I\left(\alpha \right)} \right]_{(3I-1)(3I-1)}} = \sum\limits_{n = 1}^{N} {\frac{{{{\left({{p_{{n_{01}}}} + s_{I2}^{\prime\prime\prime}} \right)}^{2}}}}{{{{\left\| {{\mathbf{p}_{{n_{0}}}} + \mathbf{s}_{I}^{\prime\prime\prime}} \right\|}^{2}}}}}, \end{array} $$

$$\begin{array}{*{20}l} &{\left[ {I\left(\alpha \right)} \right]_{(3I-1)(3I)}} = \sum\limits_{n = 1}^{N} {\frac{{{p_{{n_{01}}}} + s_{I2}^{\prime\prime\prime}}}{{{{\left\| {{\mathbf{p}_{{n_{0}}}} + \mathbf{s}_{I}^{\prime\prime\prime}} \right\|}}}}}, \\ &{\left[ {I\left(\alpha \right)} \right]_{(3I)(1)}},...,{\left[ {I\left(\alpha \right)} \right]_{(3I)(3I-3)}}=0. \\ &{\left[ {I\left(\alpha \right)} \right]_{(3I)(3I-2)}} = {\left[ {I\left(\alpha \right)} \right]_{(3I-2)(3I)}}. \\ &{\left[ {I\left(\alpha \right)} \right]_{(3I)(3I-1)}} = {\left[ {I\left(\alpha \right)} \right]_{(3I-1)(3I)}}. \\ &{\left[ {I\left(\alpha \right)} \right]_{(3I)(3I)}} = N. \end{array} $$

(66)

Similar as in Appendix Appendix A, we can build the FIM matrix using the above derivations and calculate the inverse to derive the CRLB for the parameters $\mathbf {s}_{i}^{\prime \prime \prime }$ and τ_i for i=1,...,I.