Timing Properties of the Starlink Ku-Band Downlink

We develop signal capture and analysis techniques for precisely extracting and characterizing the frame timing of the Starlink constellation's Ku-band downlink transmissions. The aim of this work is to determine whether Starlink frame timing has sufficient short-term stability to support pseudorange-based opportunistic positioning, navigation, and timing (PNT). A second goal is to determine whether frame timing is disciplined to a common time scale such as GPS time. Our analysis reveals several timing characteristics not previously known that carry strong implications for PNT. On the favorable side, periods of ns-level jitter in frame arrival times across all satellite versions indicate that Starlink hardware is fundamentally capable of the short-term stability required to support GPS-like PNT. But there are several unfavorable characteristics that, if not addressed, will make GPS-like PNT impractical: (1) The v1.0 and v1.5 Starlink satellites exhibit once-per-second abrupt frame timing adjustments whose magnitude (as large as 100s of ns) and sign appear unpredictable. Similar discontinuities are also present in the v2.0-Mini frame timing, though smaller and irregularly spaced. (2) Episodic 15-s periods of high frame jitter routinely punctuate the nominal low-jitter frame arrival timing. (3) Starlink frame timing is disciplined to GPS time, but only loosely: to within a few ms by adjustments occurring every 15 s; otherwise exhibiting drift that can exceed 20 ppm. These unfavorable characteristics are essentially incompatible with accurate PNT. Fortunately, they appear to be a consequence of software design choices, not hardware limitations. Moreover, they could be compensated with third-party-provided corrections.

OFDM-Based Positioning with Unknown Data Payloads: Bounds and Applications to LEO PNT

This paper presents bounds, estimators, and signal design strategies for exploiting both known pilot resources and unknown data payload resources in time-of-arrival (TOA)-based positioning systems with orthogonal frequency-division multiplexing (OFDM) signals. It is the first to derive the Ziv-Zakai bound (ZZB) on TOA estimation for OFDM signals containing both known pilot and unknown data resources. In comparison to the Cramer-Rao bounds (CRBs) derived in prior work, this ZZB captures the low-signal-to-noise ratio (SNR) thresholding effects in TOA estimation and accounts for an unknown carrier phase. The derived ZZB is evaluated against CRBs and empirical TOA error variances. It is then evaluated on signals with resource allocations optimized for pilot-only TOA estimation, quantifying the performance gain over the best-case pilot-only signal designs. Finally, the positioning accuracy of maximum-likelihood and decision-directed estimators is evaluated on simulated low-Earth-orbit non-terrestrial-network channels and compared against their respective ZZBs.

Ziv-Zakai-Optimal OFDM Resource Allocation for Time-of-Arrival Estimation

This paper presents methods of optimizing the placement and power allocations of pilots in an orthogonal frequency-division multiplexing (OFDM) signal to minimize time-of-arrival (TOA) estimation errors under power and resource allocation constraints. TOA errors in this optimization are quantified through the Ziv-Zakai bound (ZZB), which captures error thresholding effects caused by sidelobes in the signal's autocorrelation function (ACF) which are not captured by the Cramer-Rao lower bound. This paper is the first to solve for these ZZB-optimal allocations in the context of OFDM signals, under integer resource allocation constraints, and under both coherent and noncoherent reception. Under convex constraints, the optimization of the ZZB is proven to be convex; under integer constraints, the optimization is lower bounded by a convex relaxation and a branch-and-bound algorithm is proposed for efficiently allocating pilot resources. These allocations are evaluated by their ZZBs and ACFs, compared against a typical uniform allocation, and deployed on a software-defined radio TOA measurement platform to demonstrate their applicability in real-world systems.

Signal Identification and Entrainment for Practical FMCW Radar Spoofing Attacks

This paper proposes a method of passively estimating the parameters of frequency-modulated-continuous-wave (FMCW) radar signals with a wide range of structural parameter values and analyzes how a malicious actor could employ such estimates to track and spoof a target radar. When radars are implemented to support automated driver assistance systems, an intelligent spoofer has the potential to substantially disrupt safe navigation by inducing its target to perceive false objects. Such a spoofer must acquire highly accurate estimates of the target radar's chirp sweep, timing, and frequency parameters while additionally tracking and compensating for time and Doppler shifts due to clock errors and relative movement. This is a difficult task for millimeter-wave radars due to severe Doppler shifts and fast sweep rates, especially when the spoofer uses off-the-shelf FMCW equipment. Algorithms and techniques for acquiring and tracking an FMCW radar are proposed and verified through simulation, which will help guide future decisions on appropriate radar spoofing countermeasures.