Anti-spoofing trusted clock module and method to enhance the security of satellite timing terminals

Abstract

This invention discloses an anti-spoofing trusted clock module and method for improving the security of satellite timing terminals. The module includes: a satellite timing receiving unit for receiving satellite timing signals and parsing them to obtain corresponding satellite timing time data; a local trusted clock unit for generating local trusted clock data; a deviation calculation unit for calculating time deviation data; a progressive spoofing identification unit for identifying whether progressive spoofing behavior exists in the satellite timing signal and outputting the spoofing identification result and spoofing confidence parameters; a self-calibration holding unit for calling a pre-established local trusted clock drift model to compensate for the drift of the local trusted clock unit's output when the spoofing identification result indicates an anomaly in the satellite timing signal, thereby generating and holding the timing time data; and a timing output control unit for selecting the corresponding timing output mode and outputting the target timing time data. This invention solves the problem that traditional mutation detection methods cannot identify progressive spoofing.

Description

Technical Field

[0001] This invention relates to the field of satellite timing security technology, and in particular to a reliable clock module and method for preventing spoofing and enhancing the security of satellite timing terminals. Background Technology

[0002] Satellite navigation systems provide wide-area, high-precision timing services for various critical infrastructures, serving as an indispensable time base for achieving highly reliable positioning. However, satellite timing signals reach the ground with very low power, making them highly vulnerable to deception and interference. One particularly sophisticated attack method is the gradual decoy attack, where the attacker applies a slowly, unidirectionally changing time offset far below the receiver's discipline loop time constant. This gradually drags the local clock away from the standard time over a long timescale, while the instantaneous amplitude of the time offset remains within the normal range. This renders traditional methods relying on absolute deviation thresholds or abnormal signal power detection completely ineffective.

[0003] Currently, defenses against progressive spoofing attacks face two major technical challenges: First, there is a lack of effective mechanisms to identify slow time dragging trends. Existing methods focus primarily on transient abrupt changes and cannot extract multi-dimensional statistical kinematic features such as drift rate, drift acceleration, and curve smoothness from long-term time deviation sequences, making it impossible to detect progressive spoofing attacks in their early stages. Second, even if some solutions switch to local clock hold mode after detecting anomalies, the output switching usually employs a hard switch, i.e., an instantaneous jump from satellite time data to hold time data. This abrupt mode change causes a phase step in the target time data, disrupting the strict time continuity requirements of external time-using devices, which is unacceptable for high-reliability positioning applications that rely on continuous time references. Summary of the Invention

[0004] The purpose of this section is to outline some aspects of embodiments of the present invention and to briefly describe some preferred embodiments. Simplifications or omissions may be made in this section, as well as in the abstract and title of this application, to avoid obscuring the purpose of these documents; however, such simplifications or omissions should not be construed as limiting the scope of the invention.

[0005] To solve the above-mentioned technical problems, the present invention provides the following technical solution: an anti-spoofing trusted clock module to enhance the security of satellite timing terminals, comprising:

[0006] The satellite timing receiving unit is used to receive satellite timing signals and parse them to obtain the corresponding satellite timing data.

[0007] Local trusted clock unit, used to generate local trusted clock data;

[0008] The deviation calculation unit is used to calculate the time deviation data between the satellite time synchronization data and the local reliable clock data.

[0009] The progressive deception identification unit is used to identify whether there is progressive deception behavior in the satellite timing signal based on the rate of change parameter, acceleration parameter and goodness of fit parameter of the time deviation data within a continuous time window, and output the deception identification result and deception confidence parameter.

[0010] The self-calibration and hold unit is used to call a pre-established local trusted clock drift model to compensate for the drift of the output of the local trusted clock unit when the deception identification result indicates that the satellite timing signal is abnormal, so as to generate and hold the timing data; the self-calibration and hold unit also controls the update rate of the local trusted clock drift model according to the deception confidence parameter, and freezes the model update when the deception confidence exceeds a preset threshold.

[0011] The timing output control unit is used to select a corresponding timing output mode between satellite timing data and the hold-time timing data based on the deception identification result and the credibility score result, and output the target timing data; the timing output mode includes a limiting tracking mode, in which the target timing data... ,in For the satellite timing data, To maintain the timing data, The mixing coefficient is dynamically adjusted based on the deception confidence parameter.

[0012] As a preferred embodiment of the anti-spoofing trusted clock module for enhancing the security of satellite timing terminals according to the present invention, the progressive spoofing identification unit includes a sliding window construction subunit, a trend fitting subunit, a residual analysis subunit, and an anomaly judgment subunit.

[0013] The sliding window construction subunit continuously acquires time deviation data at multiple moments according to a preset sampling period and constructs a continuous time window;

[0014] The trend fitting subunit performs a first-time and a second-time fitting on the time deviation data within the continuous time window to obtain the rate of change parameter and the acceleration parameter, respectively.

[0015] The residual analysis subunit calculates the residual sequence of the time deviation data relative to the first and second fitted curves, and calculates the root mean square error of the residual sequence as a goodness-of-fit parameter.

[0016] The anomaly judgment subunit compares the rate of change parameter, acceleration parameter, and goodness-of-fit parameter with their respective threshold intervals. When the goodness-of-fit parameter is less than the preset residual threshold, and the rate of change parameter continues to shift in the same direction, and the absolute value of the acceleration parameter is less than the preset acceleration threshold for multiple time windows, the subunit outputs the progressive deception identification result and the deception confidence parameter.

[0017] As a preferred embodiment of the anti-spoofing trusted clock module for enhancing the security of satellite timing terminals according to the present invention, the local trusted clock drift model is established through a learning method under normal satellite timing signal conditions;

[0018] The self-calibration holding unit collects the oscillation frequency parameters, operating temperature parameters, power supply voltage parameters, and historical time deviation data of the local trusted clock unit, and establishes a multivariate drift mapping model.

[0019] When the deception identification result indicates an anomaly in the satellite timing signal, the self-calibration holding unit freezes the parameter updates of the drift mapping model and records the multivariate parameter sequence during the anomaly period;

[0020] Once the satellite timing signal returns to normal, the drift mapping model is corrected by weighted incremental adjustment based on the multivariate parameter sequence recorded during the abnormal period and the satellite timing data.

[0021] As a preferred embodiment of the anti-spoofing trusted clock module for improving the security of satellite timing terminals as described in this invention, the trusted score result is calculated by the timing output control unit based on multi-dimensional evaluation parameters, which at least include time deviation amplitude parameters, rate of change parameters, acceleration parameters, goodness of fit parameters, carrier-to-noise ratio parameters, visible satellite quantity parameters, and solution stability parameters.

[0022] The timing output control unit normalizes each evaluation parameter and uses the entropy weight method to adaptively allocate weights to calculate the reliable score result.

[0023] The timing output control unit divides the timing output mode into normal tracking mode, amplitude limiting tracking mode, hold output mode and freeze alarm mode according to a preset threshold.

[0024] Among them, the mixing coefficient of the limiting tracking mode It is positively correlated with the deception confidence parameter.

[0025] As a preferred embodiment of the anti-spoofing trusted clock module for enhancing the security of satellite timing terminals according to the present invention, the satellite timing receiving unit simultaneously receives timing signals from at least two satellite navigation systems and generates first satellite timing time data and second satellite timing time data respectively; the first satellite timing time data and the second satellite timing time data correspond to different satellite navigation systems.

[0026] The deviation calculation unit further calculates the inter-satellite time difference data between different satellite navigation systems; the progressive deception identification unit determines whether there is a single constellation anomaly based on the inter-satellite time difference data, and performs credibility weight reduction processing on the abnormal satellite timing signals;

[0027] When the deception identification results of the two satellite navigation systems are inconsistent, the timing output control unit prioritizes the output of the time synchronization data and triggers a system self-test.

[0028] As a preferred embodiment of the anti-spoofing trusted clock module for enhancing the security of satellite timing terminals according to the present invention, the deviation calculation unit includes a time alignment subunit and a filtering subunit;

[0029] The time alignment subunit is used to align the satellite time synchronization data with the local trusted clock data to a unified time reference.

[0030] The filtering subunit performs adaptive median filtering and low-pass filtering on the time deviation data to obtain smoothed time deviation data.

[0031] The window size of the adaptive median filter is dynamically adjusted based on the local variance of the time deviation data.

[0032] As a preferred embodiment of the anti-spoofing trusted clock module for enhancing the security of satellite timing terminals according to the present invention, the local trusted clock unit includes a temperature-controlled crystal oscillator;

[0033] The self-calibration and hold unit inputs a control word to the local trusted clock unit through a frequency control interface to adjust the oscillation frequency;

[0034] The control word is generated in real time based on the local trusted clock drift model;

[0035] The self-calibration holding unit also monitors the discipline holding duration of the local trusted clock unit. When the discipline holding duration exceeds a preset lifetime threshold, a lifetime alarm flag is issued through the time synchronization output control unit.

[0036] As a preferred embodiment of the anti-spoofing trusted clock module for improving the security of satellite timing terminals according to the present invention, wherein: the timing output control unit generates status identification data, and the status identification data includes at least a timing output mode identifier, a trusted scoring interval identifier, a spoofing confidence level identifier, and a hold output duration identifier;

[0037] The target time synchronization data and the status identifier data are synchronously output to an external time-using device;

[0038] The status identification data is output after forward error correction coding.

[0039] As a preferred embodiment of the anti-spoofing trusted clock module for enhancing the security of satellite timing terminals as described in this invention, wherein:

[0040] This invention also provides a method for preventing spoofing and using a trusted clock to enhance the security of satellite timing terminals. This method is applied to the aforementioned trusted clock module for enhancing the security of satellite timing terminals and includes the following steps:

[0041] S1: Receive satellite timing signals and parse them to obtain satellite timing data, while generating local reliable clock data;

[0042] S2: Calculate time deviation data and perform time alignment and adaptive median filtering;

[0043] S3: Calculate the rate of change parameter, acceleration parameter, and goodness-of-fit parameter within a continuous time window. When the goodness-of-fit parameter is less than the residual threshold and the rate of change and acceleration satisfy the persistence constraint, it is identified as a gradual deception behavior, and a deception confidence parameter is generated.

[0044] S4: Generate a reliable score result based on the deception identification result and the deception confidence parameter, combined with the multi-dimensional evaluation parameters;

[0045] S5: Update the local reliable clock drift model when the satellite timing signal is normal, and freeze the model update when the deception confidence parameter exceeds the threshold;

[0046] S6: When the satellite timing signal is abnormal, perform drift compensation to generate time-keeping data and record the compensation parameter sequence during the abnormal period for use after model recovery;

[0047] S7: Switch the time synchronization output mode according to the reliability score result. In the amplitude limiting tracking mode, the target time synchronization data... satisfy: ;in, For target time synchronization data, For satellite time synchronization data, To maintain the time synchronization data, The mixing coefficient is dynamically adjusted based on the deception confidence parameter; and the target time synchronization data and status identification data are output.

[0048] The present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method for improving the security of satellite timing terminals by preventing spoofing and ensuring trusted clock functionality.

[0049] The beneficial effects of this invention are:

[0050] 1. This invention constructs a progressive deception recognition unit jointly determined by a rate-of-change parameter, a rate-of-change acceleration parameter, and a goodness-of-fit parameter, and dynamically adjusts the mixing coefficient based on the deception confidence parameter. The limited tracking mode forms a closed loop, which enables accurate identification and flexible isolation of slow time dragging decoy attacks. It can still output continuous and smooth target time synchronization data during the attack, solving the dual technical problems of traditional mutation detection methods being unable to identify gradual decoys and hard switching causing time synchronization phase jumps.

[0051] 2. This invention uses a trend fitting subunit to perform primary and secondary fitting on time deviation data within a continuous time window. The residual analysis subunit uses root mean square error as the goodness-of-fit parameter, and the anomaly detection subunit outputs decoy detection results when the goodness-of-fit parameter is less than a preset residual threshold, the rate of change parameter continuously shifts in the same direction, or the absolute value of the acceleration parameter is less than a preset acceleration threshold for multiple time windows. It utilizes the counterintuitive feature that the deterministic smoothing offset signal introduced by the progressive decoy attack abnormally reduces the residual of the time deviation curve to the low-order fitting. It can detect attack signs only by the statistical feature changes of the curve shape when the absolute amplitude of the time deviation has not exceeded the normal threshold, which significantly improves the sensitivity and anticipation of progressive decoy detection.

[0052] 3. This invention employs a three-stage mechanism: a self-calibrating holding unit freezes the parameter updates of the local trusted clock drift model when the deception confidence exceeds a threshold, records the multivariate parameter sequence during anomalies, and performs weighted incremental correction after the satellite timing signal is restored. This ensures that the drift mapping model is protected from deception signal contamination during attacks and rapidly self-heals based on the recorded compensation parameter sequence after the attack ends. As a result, the timekeeping accuracy under abnormal conditions and the long-term discipline accuracy under normal conditions do not degrade.

[0053] 4. This invention integrates seven-dimensional evaluation parameters through the timing output control unit and uses the entropy weight method to adaptively assign weights to generate reliable scoring results. Combined with the progressive deception identification unit for single-constellation anomaly discrimination and reliability weight reduction processing of inter-constellation time difference data, this invention achieves a three-dimensional timing reliability assessment from the signal layer to the solution layer and from single-constellation to multi-constellation. Multi-dimensional cross-validation significantly reduces the false alarm rate and the missed alarm rate. Attached Figure Description

[0054] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein:

[0055] Figure 1 This is an architecture diagram of the anti-spoofing trusted clock module for improving the security of satellite timing terminals according to the present invention.

[0056] Figure 2 The internal structure and signal flow diagram of the progressive deception identification unit of the anti-spoofing trusted clock module for improving the security of satellite timing terminals in this invention are shown.

[0057] Figure 3 This is a schematic diagram of the three-stage working process of the self-calibration and retention unit of the anti-spoofing trusted clock module for improving the security of satellite timing terminals according to the present invention.

[0058] Figure 4 This is a schematic diagram of the timing output control unit mode decision and hybrid output of the anti-spoofing trusted clock module for improving the security of satellite timing terminals according to the present invention. Detailed Implementation

[0059] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0060] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0061] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0062] Secondly, the present invention is described in detail with reference to the schematic diagrams. When detailing the embodiments of the present invention, for ease of explanation, the cross-sectional views illustrating the device structure may be partially enlarged, not according to the usual scale. Furthermore, the schematic diagrams are merely examples and should not limit the scope of protection of the present invention. In addition, actual fabrication should include three-dimensional spatial dimensions of length, width, and depth.

[0063] Example 1

[0064] Reference Figure 1-4 This first embodiment of the invention provides an anti-spoofing trusted clock module to enhance the security of satellite timing terminals. It aims to address the problem of satellite timing terminals being unable to effectively identify and maintain the precise time synchronization required for high-reliability positioning when facing progressive time spoofing attacks. For critical infrastructures such as power, communications, and finance that rely on high-precision time, the reliability of the timing signal is the cornerstone of achieving high-reliability positioning. The module specifically includes a satellite timing receiving unit, a local trusted clock unit, an offset calculation unit, a progressive spoofing identification unit, a self-calibration and hold unit, and a timing output control unit. The coordinated operation of these units ultimately ensures that reliable time can still be provided to external devices even in environments where satellite signals may be spoofed, guaranteeing the continuity of high-reliability positioning.

[0065] The specific implementation of each unit will be explained in detail below:

[0066] The implementation instructions for the satellite timing receiver unit are as follows:

[0067] A satellite timing receiving unit is used to receive satellite timing signals and parse them to obtain the corresponding satellite timing data. In one specific embodiment, the satellite timing receiving unit includes:

[0068] Multimode receiving antenna: Covering mainstream frequency bands such as GPS L1, BDS B1I, and GLONASS L1. In a preferred embodiment, the multimode receiving antenna integrates a low-noise amplifier (LNA) and a bandpass filter to pre-amplify the received weak satellite signals and suppress out-of-band interference, thereby improving the signal-to-noise ratio of the received signal.

[0069] RF front-end module: Connected to the multimode receiving antenna, it performs low-noise amplification, down-conversion, and analog-to-digital conversion on the received signal, outputting a digital intermediate frequency (IF) signal. Specifically, the RF front-end module includes a multi-stage mixer and a local oscillator, down-converting RF signals from various frequency bands to a unified IF or zero IF; subsequently, it performs sampling and quantization through a high dynamic range analog-to-digital converter (ADC) to obtain a multi-bit resolution digital IF signal for subsequent baseband processing.

[0070] Multi-constellation baseband processor: Used to receive digital intermediate frequency signals and capture and track signals from various satellite navigation systems. Specifically, the multi-constellation baseband processor internally has multiple parallel tracking channels. Each channel can be configured via software or hardware to load pseudo-code generators and carrier tracking loops corresponding to different satellite navigation systems. In a preferred embodiment, the baseband processor can simultaneously allocate independent tracking channels for GPS L1 C / A code, BDS B1I code, and GLONASS L1 code, enabling simultaneous reception and tracking of signals from at least two different satellite navigation systems. Each tracking channel performs a two-dimensional search for and captures the code phase and carrier frequency of the satellite signal assigned to it. After successful capture, it enters steady-state tracking of the carrier loop and code loop, and demodulates the navigation message in real time, outputting pseudorange observations, carrier phase observations, carrier-to-noise ratio, and demodulated navigation message data frames.

[0071] The timing calculation module is used to calculate satellite timing data based on observations and navigation messages output by the multi-constellation baseband processor. In one specific implementation, the timing calculation module performs the following processing flow: First, the timing calculation module obtains pseudorange observations and carrier phase observations from each tracking channel, performs frame synchronization and parity checking on the demodulated navigation message bitstream, and extracts satellite ephemeris parameters, satellite clock correction parameters, and ionospheric delay correction parameters from complete subframes or pages. When the timing terminal's own position is known and fixed (such as in static timing scenarios for base stations or substations), the timing calculation module can directly use pseudorange observations and satellite positions to calculate the clock deviation between the local clock and the satellite system time; when the timing terminal's position is unknown or movable, the timing calculation module uses a least squares iterative algorithm or extended Kalman filter for joint position-time estimation, and simultaneously solves for the receiver's three-dimensional coordinates and local clock error to obtain the local time deviation under each satellite system time.

[0072] In a preferred embodiment, the timing calculation module further reads the Coordinated Universal Time (UTC) conversion parameters from the navigation message, and also reads the GGTO parameters when the message contains Global Time Difference (GGTO) information. The timing calculation module uses these parameters to normalize the local time deviations of each satellite system time calculated above to a unified UTC time base, thereby generating corresponding satellite timing data. For example, this satellite timing data is based on UTC and includes week-based second counts and nanosecond-level fine time.

[0073] In terms of output interfaces, the satellite time synchronization data generated by the time synchronization calculation module is output to subsequent units in the form of Time Digital (TOD) signals and Pulse Per Second (1PPS) signals. The TOD signal contains UTC absolute time information, and the 1PPS signal marks the precise edge of the whole second. The rising or falling edge of the 1PPS signal is aligned with the UTC whole second, providing an accurate time comparison reference for the deviation calculation unit.

[0074] Furthermore, in multi-constellation receiving scenarios, the satellite timing data generated by the timing solution module includes at least first satellite timing data and second satellite timing data. For example, the first satellite timing data is a UTC timing solution generated based on GPS system signals, and the second satellite timing data is a UTC timing solution generated based on BDS system signals. Each timing data is tagged with its source constellation identifier and accompanied by a corresponding system time tag, for subsequent deviation calculation units and progressive deception identification units to perform inter-satellite consistency verification and time difference calculation, thereby providing a multi-source redundant time reference for high-reliability positioning.

[0075] It should be noted that, through the combination of the above hardware architecture and signal processing flow, this satellite timing receiver unit can stably receive and resolve timing signals from various satellite navigation systems in complex electromagnetic environments, providing a high-quality initial time reference source for the entire anti-spoofing trusted clock module.

[0076] The implementation details of the local trusted clock unit are as follows:

[0077] The local trusted clock unit is used to generate local trusted clock data. This local trusted clock unit is the core of the local time base of the entire anti-spoofing trusted clock module. It is responsible for receiving discipline calibration when the satellite time signal is available, and maintaining high-precision time output based on its own stability when the satellite time signal is abnormal.

[0078] In one specific implementation, the local trusted clock unit includes a cryogenic crystal oscillator (OCXO). The OCXO integrates a cryogenic bath, and a precision temperature control circuit stabilizes the operating temperature of the crystal resonator near its zero temperature coefficient point, thereby achieving high isolation from ambient temperature variations. Its frequency stability typically reaches [a certain level]. to With sampling times on the order of kiloseconds, it can maintain high-precision timekeeping for a relatively long period after satellite time synchronization is interrupted, providing a stable and reliable local time reference for the entire anti-spoofing trusted clock module. For example, a temperature-controlled crystal oscillator generates a reference oscillation signal with a nominal frequency of 10MHz. This reference oscillation signal is fed into a local clock counter, which uses this oscillation signal as its clock source to accumulate and count, generating local trusted clock data.

[0079] In a preferred embodiment, the local trusted clock unit includes a frequency control interface. This interface receives a frequency control word from the self-calibration and hold unit and fine-tunes the oscillation frequency of the oven-controlled crystal oscillator based on the control word. Specifically, the frequency control interface can be implemented using a digital-to-analog converter (DAC) to convert the digital frequency control word into an analog tuning voltage, which is applied to the voltage-controlled input of the oven-controlled crystal oscillator, thereby adjusting its oscillation frequency within a certain range. For example, the frequency control word has a bit width of 16 bits or higher, and the frequency adjustment resolution can reach sub-ppb (parts per billion) levels, meeting the requirements of satellite timing discipline for fine frequency compensation. The generation basis and algorithm of the frequency control word are handled by the self-calibration and hold unit, which will be detailed later; the local trusted clock unit only acts as a passive execution end of the control commands.

[0080] Furthermore, the local trusted clock unit outputs the generated local trusted clock data to the deviation calculation unit in a format corresponding to the satellite time synchronization data. Specifically, the local trusted clock data also includes nanosecond-level fine time stamps and integer second identifiers, maintaining the same time expression granularity as the 1PPS signal output by the satellite time synchronization receiving unit, so that the deviation calculation unit can perform successive time deviation calculations on a unified time base.

[0081] Through the aforementioned hardware architecture, the local trusted clock unit provides the entire module with a high-quality local time source independent of satellite signals. Its stability directly determines the upper limit of time synchronization accuracy during decoy attacks, making it an indispensable underlying support for achieving highly reliable positioning.

[0082] The implementation instructions for the deviation calculation unit are as follows:

[0083] The deviation calculation unit is used to calculate the time deviation between satellite time synchronization data and local trusted clock data. This deviation calculation unit is the core of the data preprocessing of the entire anti-spoofing trusted clock module. It is responsible for accurately comparing the two time bases from different sources and suppressing noise, providing a high-quality time deviation sequence for the subsequent progressive spoofing identification unit.

[0084] Specifically, the deviation calculation unit includes a time alignment subunit and a filtering subunit.

[0085] The time alignment subunit is used to align satellite time synchronization data and local trusted clock data to a unified time reference. Specifically, the satellite time synchronization data uses UTC as the reference, marking the integer second with the rising edge of a 1PPS second pulse signal, and the TOD signal carries the absolute time value corresponding to that integer second. The local trusted clock data also outputs local integer second markers in 1PPS format, along with a nanosecond-level fine time tag generated by the local clock counter. The time alignment subunit first identifies the correspondence between the 1PPS second pulse signal carried by the satellite time synchronization data and the integer second marker carried by the local trusted clock data, and extracts the satellite time synchronization data at the same integer second. and local trusted clock data ,in This is the whole-second sequence number. Subsequently, the time alignment subunit normalizes the two time data to a unified numerical representation benchmark, that is, it calculates the original value of the time deviation at each whole second: For example, when the satellite timing receiving unit outputs multi-constellation timing data, the time alignment subunit performs the above alignment and deviation calculation separately for the satellite timing data of each constellation, generates the original time deviation sequence corresponding to different satellite navigation systems, and marks its satellite navigation system source for subsequent inter-satellite consistency verification.

[0086] The filtering subunit is used to process the raw time deviation data output by the time alignment subunit. Adaptive median filtering and low-pass filtering are performed to obtain smoothed time deviation data, which is then used by the progressive deception identification unit for trend analysis.

[0087] In one specific implementation, the filtering process of the filtering subunit is divided into two stages.

[0088] The first stage is adaptive median filtering. The filtering subunits are... As the input sequence, it is subjected to adaptive median filtering. The basic principle of median filtering is to replace the sample value at the center of the window with the median value of the samples within the window within a sliding window. This can effectively eliminate isolated outliers caused by receiver lock-off, brief obstruction of satellite signals, multipath abrupt changes, or ionospheric scintillation.

[0089] In a preferred embodiment, the window size of the adaptive median filter is dynamically adjusted based on the local variance of the time-skewed data. Specifically, the filtering subunit operates within a preset minimum window length. and maximum window length Between, based on the local variance of time deviation data within a neighborhood centered on the current sampling point. Calculate the appropriate window length L. When the local variance is small, it indicates that the time deviation data is in a relatively stable state. The filtering subunit uses a smaller window length to maintain the ability to quickly track changes in the real clock drift. When the local variance is large, it indicates that the time deviation data is subject to strong instantaneous noise or interference. The filtering subunit automatically increases the window length to more effectively suppress outliers and noise and prevent impulse interference from being transmitted to the downstream deception identification stage.

[0090] The second stage is low-pass filtering. After adaptive median filtering removes outliers, the filtering subunit further performs low-pass filtering on the data sequence to suppress residual high-frequency random noise and improve the signal-to-noise ratio of the time skew curve. The data after low-pass filtering forms the basis for smoothing the time skew data.

[0091] In one implementation, the low-pass filter is implemented using an infinite impulse response (IIR) digital filter, whose cutoff frequency is selected as a trade-off between the noise characteristics of the local trusted clock and the response time requirements of the decoy detection, so that high-frequency noise can be filtered out without compromising the slowly varying drift characteristics.

[0092] The filter subunit outputs smoothed time deviation data after two-stage filtering. The data, sampled at whole-second intervals, forms a continuous time series, which serves as the input for the progressive deception identification unit. The smoothed time deviation data retains the low-frequency, gradually varying information and long-term trend information of the clock difference between the satellite timing signal and the local clock, while suppressing high-frequency noise and isolated outliers. This provides a high-quality data foundation for the accurate calculation of subsequent rate-of-change parameters, acceleration parameters, and goodness-of-fit parameters.

[0093] Furthermore, in addition to performing the basic function of time deviation calculation, the deviation calculation unit also has the function of inter-satellite time difference calculation.

[0094] In one specific implementation, when the satellite timing receiving unit simultaneously receives timing signals from at least two satellite navigation systems and generates corresponding satellite timing data, the deviation calculation unit further calculates the inter-satellite time difference sequence between the different satellite navigation systems. Specifically, the aforementioned time alignment subunit has already generated the original time deviation sequences corresponding to the first satellite navigation system and the second satellite navigation system, respectively. and The deviation calculation unit at the same whole second The two sets of time deviation sequences are then subjected to a difference operation to obtain the inter-satellite time difference sequence: This inter-satellite time difference sequence characterizes the time difference between two different satellite navigation systems at the same moment, and its trend reflects the relative time stability between the two systems.

[0095] In a preferred embodiment, the inter-satellite time difference sequence is also processed by an adaptive median filter and a low-pass filter in a filtering subunit to suppress the interference of observation noise on the inter-satellite alignment results and output a smooth inter-satellite time difference sequence. This smooth sequence can more clearly reflect the changing trend of the clock difference relationship between the two satellite navigation systems.

[0096] The deviation calculation unit outputs the inter-satellite time difference sequence and its smoothed version, along with the smoothed time deviation sequence corresponding to each satellite navigation system, to the progressive spoofing identification unit. The specific implementation details of how the progressive spoofing identification unit determines anomalies in a single satellite navigation system based on the inter-satellite time difference sequence and performs confidence weight reduction processing, as well as how the timing output control unit prioritizes maintaining the timing data output and triggers system self-checks when the spoofing identification results of the two satellite navigation systems are inconsistent, will be described in detail in the implementation descriptions of the corresponding units later.

[0097] In summary, through the three-layer functional architecture of time alignment, filtering, and inter-satellite time difference calculation, the deviation calculation unit provides multi-dimensional data support for subsequent deception detection. On the one hand, the independent time deviation sequences of each constellation provide direct evidence for detecting abnormal trends in a single constellation; on the other hand, the inter-satellite time difference sequences provide cross-validation information for comparing the consistency of behavior across different constellations. Based on this data, the progressive deception detection unit can not only detect anomalies from the time deviation trends of a single constellation, but also distinguish whether a single constellation is being deceived or whether there is a local clock failure by assessing the stability of the inter-satellite time difference. This provides a more comprehensive data foundation for the high-reliability positioning security protection of the entire anti-deception trusted clock module.

[0098] The implementation details of the progressive deception identification unit are as follows:

[0099] The progressive spoofing identification unit is used to identify whether there is progressive spoofing behavior in the satellite timing signal based on the rate of change parameter, acceleration parameter, and goodness-of-fit parameter of the time deviation data within a continuous time window, and outputs the spoofing identification result and spoofing confidence parameter. In one specific embodiment, the time deviation data is smoothed time deviation data from the deviation calculation unit.

[0100] The progressive decoy detection unit is the core of the entire anti-spoofing trusted clock module's security detection. Its design is based on the premise that traditional decoy detection methods typically rely on absolute time deviation amplitude thresholds or signal power anomalies, only capable of identifying jump-type spoofing. Progressive decoy attacks, however, apply a slow, unidirectional time drift far below the receiver's discipline loop time constant, ensuring the instantaneous amplitude of the time deviation remains within the normal range, thus bypassing traditional detection mechanisms. To counter such attacks, the progressive decoy detection unit analyzes the statistical and kinematic characteristics of the time deviation data within a continuous time window. Its identification principle lies in capturing the abnormally smooth and unidirectionally slowly changing time deviation curve caused by progressive decoy attacks, thus eliminating attack paths for slow time hijacking and ensuring high-reliability positioning.

[0101] Specifically, the progressive deception detection unit includes a sliding window construction subunit, a trend fitting subunit, a residual analysis subunit, and an anomaly detection subunit. The specific implementation of each subunit is described below.

[0102] The sliding window construction subunit continuously acquires time deviation data from multiple moments according to a preset sampling period and constructs a continuous time window. Specifically, the sliding window construction subunit receives a smoothed time deviation data sequence with sampling intervals of whole seconds from the deviation calculation unit, and constructs a continuous time window with a preset window length N and sliding step size M. For example, if the window length N is 60 sampling points (corresponding to a 60-second duration) and the sliding step size M is 10 sampling points (corresponding to 10 seconds), a new time window is generated every 10 seconds, with 50 overlapping sampling points between adjacent windows. This ensures the continuity of detection while avoiding recognition interruptions caused by window boundary effects. The data within each time window is denoted as... ,in This refers to the window sequence number. When the deviation calculation unit outputs multi-constellation smoothed time deviation data, the sliding window construction sub-unit independently constructs a time window for each constellation's time deviation sequence, generating time window sequences corresponding to different satellite navigation systems.

[0103] The trend fitting subunit is used to perform primary and secondary fitting on the time deviation data within each continuous time window generated by the sliding window construction subunit, in order to extract the trend characteristics of the time deviation within the window. In one specific implementation, the trend fitting subunit performs primary and secondary fitting on the time deviation data within each time window. The time deviation data sequence within the sampling time Independent variable, time deviation value Using as the dependent variable, perform first-order and second-order fitting respectively. Here, ΔT represents the window size. Smoothing time deviation data within .

[0104] In one specific implementation, the first-order fitting uses a first-order polynomial model: The coefficients of the first term are obtained by solving using the least squares method. and intercept term Among them, the coefficient of the linear term This is the rate of change parameter within the current time window, representing the average drift rate of the time deviation within that window. Intercept term. This represents the fitting time deviation value at the start of the fitting window. In a gradual decoy attack, the attacker slowly increases or decreases the time stamp of the satellite signal, causing the rate of change parameter to exhibit a continuous non-zero value in the same direction.

[0105] In one specific implementation, the quadratic fitting employs a quadratic polynomial model: The coefficients of the quadratic term are obtained by solving using the least squares method. Linear term coefficients and constant term Among them, the coefficient of the quadratic term twice as much ( This refers to the acceleration parameter within the current time window, which characterizes the rate of change of the time deviation drift rate itself; the linear term coefficient... Represents the linear drift velocity component in the quadratic fitting model; constant term This represents the fitting time deviation value of the quadratic fitted curve at the beginning of the window.

[0106] It should be noted that in both the first and second fitting, the intercept term... and constant term And the coefficients of the linear term in quadratic fitting. It mainly serves as a component of the fitted curve, and subsequent anomaly detection is primarily based on the rate of change parameter. , changing acceleration parameters and goodness-of-fit parameters, therefore , , The value of is not directly used as a decision parameter, but the calculation , , This is an intermediate process necessary to obtain a complete fitting curve. In a progressive decoy attack, the attacker usually wants to gradually drag the local clock without triggering an amplitude alarm. Therefore, the acceleration of the time offset they apply is usually very small, close to a constant drift or an extremely slow acceleration drift.

[0107] The residual analysis subunit is used to calculate the residual sequence of time deviation data relative to the first and second fitted curves, and to calculate the root mean square error of the residual sequence as a goodness-of-fit parameter.

[0108] In one specific implementation, for a single fit, the residual sequence is: For quadratic fitting, the residual sequence is .in, Sampling time within the current time window The corresponding smoothed time deviation data.

[0109] In one specific implementation, the formula for calculating the root mean square error is:

[0110]

[0111] in, Indicates the first time within the time window The sampling time corresponding to each sampling point; This represents the fitting residual at that sampling point, i.e., the original value of the smoothed time bias at that point. Fitted values ​​of corresponding points on the fitted curve The difference between them; This represents the total number of sampling points within the current time window. Specifically, it refers to the number of goodness-of-fit parameters calculated for each fit. When, in the above formula Pick , Take the first fitted curve in value of time When calculating the goodness-of-fit parameter corresponding to a quadratic fit. hour, Pick , Take the quadratic fitted curve at value of time Therefore, the residual analysis subunit outputs the goodness-of-fit parameters corresponding to the first fit. Goodness-of-fit parameters corresponding to quadratic fitting This provides a comprehensive evaluation for the abnormal judgment subunit.

[0112] It should be noted that under normal, deception-free operating conditions, the time deviation data is affected by a combination of random factors such as receiver thermal noise, multipath effects, and ionospheric scintillation, resulting in significant random jitter and irregular fluctuations in its curve. This inherent uncertainty of the noise leads to poor fitting of the deviation curve to both primary and secondary fits, resulting in larger residuals, i.e., a higher goodness-of-fit (RMSE) parameter.

[0113] However, under a gradual decoy attack, the situation is fundamentally reversed. To manipulate the local clock without triggering abrupt change alarms, the attacker must inject a highly regular, slowly changing deterministic time offset signal. This deterministic offset signal, superimposed on the original random noise, makes the entire deviation curve appear smoother than in a pure noise state. The fit to the first and second iterations is abnormally improved, and the residual is abnormally reduced—that is, the goodness-of-fit parameter (RMSE) becomes abnormally small. This counterintuitive characteristic of "excessive smoothness being abnormal" is precisely what distinguishes this gradual decoy detection unit from traditional detection methods. It can detect attack signs simply by observing changes in the statistical characteristics of the curve shape, even before the absolute amplitude of the time offset exceeds the normal threshold.

[0114] In a preferred embodiment, the residual analysis subunit simultaneously retains two goodness-of-fit parameters corresponding to the first and second fits (i.e., respectively ) and This is used for comprehensive evaluation by the anomaly detection subunit. For example, if the first-order fitting residual... and quadratic fitting residuals If both are abnormally low and the difference between them is very small, then the pattern of the time deviation curve is closer to uniform drift; if the quadratic fitting residuals Significantly smaller than the first-order fitting residual This indicates that the time deviation curve has an accelerating or decelerating trend.

[0115] The anomaly judgment subunit is used to integrate the multi-dimensional parameters (i.e., rate of change parameter, acceleration of change parameter and goodness of fit parameter) output by the trend fitting subunit and the residual analysis subunit, identify whether there is a gradual deception behavior according to the preset judgment criteria, and generate deception identification results and deception confidence parameters.

[0116] In one specific implementation, the anomaly detection subunit will use the rate of change parameter of the current time window. The absolute value of the changing acceleration parameter and goodness-of-fit parameters Each threshold is compared with its corresponding preset threshold range. The method for setting each threshold is as follows:

[0117] In a deception-free secure environment during the initial equipment manufacturing or deployment phase, time deviation data are continuously collected over a long period (e.g., more than 24 hours), and the probability distribution of the above parameters under normal operating conditions is statistically analyzed. A preset residual threshold is established. It can be set to normal operating conditions. A certain percentage of the mean (e.g., 50% or 30%), the specific percentage is determined according to the required detection sensitivity; preset acceleration threshold. It can be estimated based on the aging rate and frequency temperature stability of the local trusted clock OCXO itself, and multiplied by an appropriate safety factor; the same direction of the rate of change is determined by the positive or negative sign of the rate of change parameter.

[0118] The decision logic of the anomaly judgment subunit is based on a comprehensive judgment using multi-dimensional parameters of the current time window and historical continuous windows, specifically including the following three conditions:

[0119] Condition 1 (Goodness-of-fit threshold): The goodness-of-fit parameter for the current window. Less than the preset residual threshold This indicates that the time deviation curve is abnormally smooth, and there is an overlay of deterministic smoothing signals;

[0120] Condition 2 (Continuous Same-Direction Drift): Rate of Change Parameter In continuous The time deviation remains in the same direction within a given time window, meaning the sign remains unchanged (either always positive or always negative), indicating a continuous drift direction rather than random fluctuations caused by noise. For example, Take 3 to 5 consecutive windows;

[0121] Condition 3 (Low Acceleration): The absolute value of the changing acceleration parameter In continuous Within each time window, the acceleration is less than the preset acceleration threshold. This indicates that the rate of change in the drift is extremely small, consistent with the typical characteristics of a gradual deception attack's "slow drag"; for example, Select 1 to 3 consecutive windows.

[0122] When all three conditions above are met, the anomaly detection subunit outputs the progressive deception identification result. (This indicates that a progressive decoy attack has been detected), and the decoy confidence parameter is calculated based on the degree to which each parameter deviates from the normal threshold. .

[0123] In one implementation, the deception confidence parameter Conf ranges from 0% to 100%, and is calculated as a weighted sum of the confidence components of individual parameters. For example, the goodness-of-fit confidence component... ,when much smaller hour Approaching 100%; Confidence component of rate of change persistence Based on the number of consecutive same-direction drift windows Perform table lookup or linear incremental assignment; acceleration confidence components Deception confidence parameters Take the minimum or weighted average of the above components.

[0124] Furthermore, in a preferred embodiment, when multi-constellation time deviation data is available, the progressive deception identification unit also determines whether a single-constellation anomaly exists based on the inter-satellite time difference data output by the deviation calculation unit. Specifically, the anomaly judgment subunit synchronously receives independent smoothed time deviation sequences and smoothed inter-satellite time difference sequences for each constellation. If the time deviation data of a certain constellation triggers the above-mentioned deception judgment condition alone, while the time deviation data of another constellation remains normal, and the inter-satellite time difference data also shows a drift trend consistent with the abnormal constellation after analysis of rate of change, acceleration of change, and goodness of fit, that is, the goodness of fit of the inter-satellite time difference is abnormally reduced and shows a continuous unidirectional drift, then it is determined that a single-constellation progressive deception attack exists. Only the abnormal satellite timing signal is processed by reducing its credibility weight, while the timing data of the normal constellation is retained for subsequent fusion. When the deception identification results of the two satellite navigation systems are inconsistent, the inconsistency information will be transmitted to the timing output control unit, triggering the priority selection to maintain the timing data output, and notifying the system to perform self-tests on each constellation receiving link and timing calculation path, such as checking whether the receiver's RF front-end gain and baseband correlator are abnormal. The specific self-test and output switching logic will be explained in the implementation instructions of the timing output control unit.

[0125] Through the four-stage pipelined processing of sliding window construction, trend fitting, residual analysis, and anomaly detection, the progressive deception identification unit can comprehensively characterize the behavioral features of time deviation from both statistical kinematics and curve morphology dimensions. It can accurately distinguish between the normal fluctuations of natural noise and the smooth pseudo-states of progressive deception attacks, providing the core security perception capability for the entire anti-deception trusted clock module, thereby supporting the continuous operation of high-reliability positioning in complex deception environments.

[0126] The implementation details of the self-calibration holding unit are as follows:

[0127] The self-calibration hold unit is used to call a pre-established local trusted clock drift model to compensate for the drift of the output of the local trusted clock unit when the deception identification result indicates an anomaly in the satellite timing signal, so as to generate time data to hold the timing data. The self-calibration hold unit also controls the update rate of the local trusted clock drift model according to the deception confidence parameter, and freezes the model update when the deception confidence exceeds a preset threshold.

[0128] This self-calibration and holding unit is the core of the entire anti-spoofing trusted clock module. When the satellite timing signal becomes unreliable due to spoofing attacks or other anomalies, it undertakes the key task of autonomously maintaining high-precision time output, which is the fundamental guarantee for achieving high-reliability positioning without interruption during attacks.

[0129] In one specific implementation, the working mechanism of the self-calibration holding unit is divided into three progressive stages: model learning and establishment stage, compensation and holding stage during anomalies, and correction stage after anomaly recovery. These are described below.

[0130] Model learning and building phase:

[0131] The local reliable clock drift model is established through learning under normal satellite timing signal conditions. Specifically, under normal satellite timing signal conditions and deception detection results... During this period, the self-calibration holding unit continuously collects multi-dimensional operating parameters of the local trusted clock unit, including at least: oscillation frequency parameters (obtained from the current control word of the frequency control interface or an external frequency counter), operating temperature parameters (obtained from the temperature sensor inside the cryogenic crystal oscillator or an external temperature sensor), power supply voltage parameters (obtained from the power management module), and historical time deviation data output by the deviation calculation unit.

[0132] Based on the aforementioned multi-dimensional parameters, the self-calibration holding unit establishes a multivariate drift mapping model, which describes the frequency drift behavior of the local reliable clock under different operating environmental conditions. In one implementation, the multivariate drift mapping model adopts a multiple linear regression model, which has the following form:

[0133] in, For the predicted frequency drift rate, Operating temperature The power supply voltage, The current oscillation frequency parameter, to The coefficients are denoted as . This multivariate drift mapping model learns and updates the coefficients online and periodically using the least squares method or recursive least squares method. The training objective of the model is to minimize the mean square error between the model's predicted drift rate and the true drift rate extrapolated from historical time bias data.

[0134] Compensation and maintenance phase during abnormal periods:

[0135] When the deception identification result output by the progressive deception identification unit indicates an anomaly in the satellite timing signal ( When the self-calibration holding unit switches to the compensation holding mode, the self-calibration holding unit switches to the compensation holding mode.

[0136] First, the self-calibration-preserving unit freezes the parameter updates of the drift mapping model. Specifically, the freeze operation refers to stopping the online learning algorithm of the model; that is, for recursive least squares, iterative updates of the covariance matrix and parameter vectors are stopped. The trigger condition for the freeze operation is the decoy confidence parameter. If the threshold is exceeded (e.g., 85%), this threshold can be configured according to the system's requirement to protect model parameters from being contaminated by deceptive data. The higher the threshold is set, the more strictly the model will freeze and update when the deceptive confidence is extremely high, the more stringent the protection against deceptive signals, and the lower the risk of model parameters being contaminated by abnormal data, but the corresponding trigger delay may be slightly longer.

[0137] While the drift mapping model parameters are being updated, the self-calibration hold unit begins recording the multivariate parameter sequence during the anomaly. Specifically, at preset recording intervals (e.g., once per second or once per minute), the self-calibration hold unit stores information such as the current oscillation frequency parameter, operating temperature parameter, supply voltage parameter, and the model's predicted drift rate at the time of freezing, in chronological order into non-volatile memory, forming a multivariate parameter sequence log for the anomaly period. This log will be used for weighted incremental correction of the drift mapping model after the anomaly is resolved.

[0138] During the compensation hold period, the self-calibration hold unit invokes the frozen local trusted clock drift model, reads the current operating temperature parameters, supply voltage parameters, and oscillation frequency parameters in real time, and inputs them into the model to calculate the current predicted frequency drift rate. Based on this predicted drift rate, the self-calibration hold unit generates the corresponding frequency control word and outputs it to the local trusted clock unit through the frequency control interface to adjust the oscillation frequency of the oven-controlled crystal oscillator and compensate for its frequency drift in real time. Specifically:

[0139] The frequency control word is generated by converting the predicted drift rate into a frequency adjustment value. Then, based on the bit width and tuning voltage range of the digital-to-analog converter, This is mapped to the corresponding digital control word. For example, if the DAC bit width is 16 bits, the tuning voltage range is 0 to 5V, and the corresponding frequency pull range is ±0.5ppm, then the frequency adjustment step size for each LSB is approximately... This is sufficient to meet the fine compensation requirements of OCXO.

[0140] After drift compensation, the local reliable clock data output by the local reliable clock unit is the timekeeping data. This data is continuously supplied to the timekeeping output control unit during the entire abnormal period when the satellite timekeeping signal is unreliable, ensuring the continuity and accuracy of the timekeeping output.

[0141] Furthermore, the self-calibration hold unit also monitors the discipline hold duration of the local trusted clock unit, which is the cumulative time elapsed since the most recent normal satellite timing signal. As the hold time increases, the prediction accuracy of the frequency drift model of the oven-controlled crystal oscillator will gradually decrease due to factors such as its own aging and temperature compensation residuals.

[0142] In one specific implementation, the self-calibration holding unit compares the discipline holding time with a preset lifetime threshold. The preset lifetime threshold can be determined based on the OCXO's aging rate index and timing accuracy requirements, for example, for an aging rate of... For an OCXO held per day, if the required timekeeping accuracy during the holding period is ±1 microsecond, the corresponding lifetime threshold is approximately on the order of several hours. When the discipline holding time exceeds the preset lifetime threshold, the self-calibration holding unit generates a lifetime alarm flag and transmits it to the timekeeping output control unit. The timekeeping output control unit incorporates this lifetime alarm flag into the status flag data and outputs it synchronously with the target timekeeping data to the external timekeeping device, indicating that the accuracy of the current timekeeping data held by the external timekeeping device may have decreased to exceed the threshold, and that the satellite timekeeping signal needs to be restored as soon as possible or a higher-precision backup clock source needs to be activated.

[0143] Correction phase after anomaly recovery:

[0144] When the satellite timing signal returns to normal, the progressive deception identification unit outputs for multiple consecutive time windows. And the deceptive confidence parameter When the temperature falls below the safe range, the self-calibration holding unit enters the post-abnormal recovery correction phase.

[0145] Specifically, the self-calibration holding unit reads the multivariate parameter sequence log recorded during the anomaly and combines it with the reliable satellite timing data obtained after recovery to perform a weighted incremental correction on the drift mapping model. The basic principle of the correction is as follows:

[0146] For each sampling moment recorded during the anomaly period, the actual clock deviation at that moment is calculated using the recovered satellite time synchronization data. This deviation is then compared with the clock deviation predicted by the drift mapping model at that moment to obtain the prediction error of the drift mapping model. This prediction error is then used as the target to incrementally correct the parameters of the drift mapping model. During the correction process, data from different sampling moments are assigned different weights. The weight values ​​are negatively correlated with the time distance between the sampling moment and the current recovered moment; that is, older data with greater distance has lower weights, and newer data with greater distance has higher weights. This reflects the asymptotic characteristics of the drift mapping model parameters drifting over time. For example, the weights can use an exponential decay function. ,in This is the attenuation coefficient.

[0147] In one specific implementation, the aforementioned weighted incremental correction is achieved using a recursive least squares method with a forgetting factor. The value of the forgetting factor corresponds to the weighting function, allowing the drift mapping model to retain a stable memory of historical normal operating conditions while absorbing error information during anomalies, thus avoiding overfitting-induced drastic adjustments to the drift mapping model parameters. After the correction is completed, the parameter updates of the drift mapping model return to normal, and the self-calibration holding unit re-enters the online learning mode under normal conditions.

[0148] Through the aforementioned three-stage closed-loop mechanism of "learning establishment - compensation maintenance - recovery correction", the self-calibration maintenance unit ensures that the local trusted clock drift model can provide high-precision timekeeping support during the attack and can quickly self-heal and improve its adaptability to future environmental changes after the attack ends, providing continuous and stable time assurance for the high-reliability positioning of the entire anti-spoofing trusted clock module.

[0149] The implementation details of the time synchronization output control unit are as follows:

[0150] The timing output control unit is used to select the corresponding timing output mode between satellite timing data and time-keeping data based on the deception identification result and the credibility score result, and output the target timing data.

[0151] The timing output control unit is the final decision-making and output hub of the entire anti-spoofing trusted clock module. It is responsible for integrating the front-end spoofing detection results and multi-dimensional signal quality evaluation, and smoothly transitioning between normal tracking and autonomous holding in a flexible and adaptive manner. It ensures that it can provide a time reference with traceable reliability level for external timing devices under any operating conditions, and is the last guarantee for achieving high-reliability positioning to operate continuously in complex electromagnetic environments.

[0152] In one specific implementation, the workflow of the time synchronization output control unit is divided into four stages: reliability score calculation, time synchronization output mode selection, target time synchronization data generation, and status identifier data generation and output. These are described below.

[0153] Credible scoring calculation process:

[0154] In one specific implementation, the reliability score is calculated by the timing output control unit based on multi-dimensional evaluation parameters. This reliability score is a comprehensive quantitative assessment of the overall reliability of the current satellite timing signal, used to assist in the selection decision of the timing output mode.

[0155] Specifically, the multidimensional evaluation parameters include at least the following seven categories:

[0156] Time deviation amplitude parameter: The absolute value of the current time deviation data, representing the magnitude of the instantaneous clock difference between satellite time synchronization and the local clock;

[0157] rate of change parameter : Trend fitting sub-unit from the progressive deception recognition unit, characterizing the drift rate of time deviation;

[0158] Changes in acceleration parameters: i.e. The trend fitting subunit from the progressive deception recognition unit characterizes the rate of change of the drift rate;

[0159] Goodness-of-fit parameters The residual analysis sub-unit from the progressive deception identification unit characterizes the smoothness of the time deviation curve;

[0160] Carrier-to-noise ratio parameter: from the multi-constellation baseband processor of the satellite timing receiver unit, characterizing the received signal quality of each tracking channel;

[0161] Visible satellite quantity parameter: from the timing calculation module of the satellite timing receiver unit, characterizing the spatial geometric distribution abundance of currently available satellites;

[0162] The stability parameters are calculated from the timing calculation module of the satellite timing receiver unit, such as the PDOP value of the positioning calculation or the variance of the timing calculation residual, which characterize the convergence stability of the current timing calculation.

[0163] In one specific implementation, the timing output control unit normalizes each evaluation parameter, mapping the original parameters with different dimensions and value ranges to a unified standard. Interval. For example, for positive indicators (higher values ​​indicate higher confidence, such as carrier-to-noise ratio and number of visible satellites), the normalization formula is: For negative indicators (the smaller the value, the higher the confidence level, such as time deviation amplitude and goodness-of-fit parameters), the normalization formula is: .

[0164] After normalization, the time synchronization output control unit uses the entropy weight method to adaptively allocate weights and calculate the reliability score. The entropy weight method is an objective weighting method based on data information entropy. Its basic principle is: for an evaluation parameter, the greater the difference in its normalized values ​​at different sampling times, the smaller its information entropy, indicating a stronger ability to distinguish reliability in the evaluation, and thus a greater weight should be assigned in the comprehensive score; conversely, the smaller the difference in its normalized values, the greater its information entropy, the weaker its distinguishing ability, and the smaller its weight. That is, weight and information entropy have an inverse relationship.

[0165] In one specific implementation, the calculation steps of the entropy weight method are as follows: For each evaluation parameter, first calculate the proportion of each value in its normalized value sequence, and then calculate the information entropy of that parameter. ,in , The length of the sampling sequence. For the first The parameter in the first... The proportion of each sampling time; then the difference coefficient of this parameter is calculated based on the information entropy. Finally, the difference coefficients are normalized to obtain the entropy weights of each parameter. The timing output control unit uses the weighted sum of the normalized parameter values ​​as the confidence score, with the value range mapped to 0 to 100%.

[0166] Timing output mode selection process:

[0167] The timing output control unit divides the timing output mode into four types based on preset thresholds, corresponding to different reliability score ranges and deception identification states from high to low. Each preset threshold can be determined by continuously collecting reliability score data under normal operating conditions in a deception-free security environment during the initial deployment of the device, statistically analyzing its cumulative probability distribution, and selecting the corresponding quantile. For example, the mode switching thresholds can be set as follows:

[0168] Normal tracking mode: When the credibility score is high (e.g., Score ≥ 80%) and the deception detection result is... When the time is reached, this mode is entered. In this mode, the time synchronization output control unit directly outputs satellite time synchronization data. This serves as the target timing data. This normal tracking mode corresponds to the ideal operating condition where the satellite timing signal is completely normal.

[0169] Limiting Tracking Mode: This mode is activated when the confidence score is in the middle range (e.g., 50% ≤ Score < 80%), or when the decoy confidence parameter begins to rise but has not yet reached the threshold for confirming a decoy. This limiting tracking mode is the core output mode of this invention, which uses satellite timing data... With maintaining time synchronization data Flexible integration enables a seamless transition from normal tracking to autonomous maintenance.

[0170] Maintain output mode: When the credibility score is low (e.g., 20% ≤ Score < 50%) and the deceptive identification result is... When this happens, the system enters the hold output mode. In this hold output mode, the timing output control unit fully trusts and holds the timing time data. Direct output As target time synchronization data.

[0171] Freeze Alarm Mode: This freeze alarm mode is activated when the confidence score is extremely low (e.g., Score < 20%), or when the decoy confidence parameter remains persistently high for a duration close to the lifetime threshold. In this freeze alarm mode, the timing output control unit stops using satellite timing data. Continue output However, a freeze alarm is issued at the same time, notifying external timekeeping devices that the current time accuracy can no longer be guaranteed.

[0172] In one specific implementation, a hysteresis interval is set between the switching between modes to avoid frequent mode switching caused by the score fluctuating around the threshold.

[0173] Target time synchronization data generation stage:

[0174] In limited tracking mode, the time synchronization output control unit generates the target time synchronization data according to the following formula. :

[0175] in For satellite time synchronization data, To maintain the time synchronization data, The mixing coefficient is dynamically adjusted based on the deception confidence parameter.

[0176] Specifically, the mixing coefficient The range of values ​​is Furthermore, it is positively correlated with the deception confidence parameter Conf.

[0177] In one implementation method and The mapping relationship is That is, when the confidence level of deception is 0%. (Complete trust) When the deception confidence level is 100%, (Complete trust) The intermediate values ​​achieve a linear and smooth transition.

[0178] In normal tracking mode, it is equivalent to , In maintain output mode, this is equivalent to , Therefore, the above fusion formula can establish a unified mathematical expression among the four output modes, using only the mixing coefficients. The value change can realize a continuous and seamless transition between modes, avoid phase discontinuity of target time data caused by hard mode switching, ensure that external time-using devices obtain a continuous and stable time reference, and meet the stringent requirements of high-reliability positioning for time continuity.

[0179] Status identifier data generation and output process:

[0180] To further enhance system transparency and enable external time-using devices to know the reliability level of the current time synchronization data and make corresponding decisions, the time synchronization output control unit also generates status identification data and synchronously outputs the target time synchronization data and status identification data to the external time-using devices.

[0181] In one specific implementation, the status identification data includes at least:

[0182] Timing output mode identifier: Indicates the current output mode (normal tracking / limited tracking / hold output / freeze alarm);

[0183] Trustworthy score interval identifier: Indicates the preset interval level of the current trustworthy score;

[0184] Deception confidence level indicator: Indicates the level of the current deception confidence parameter;

[0185] Hold output duration flag: Indicates that the system enters hold state (depending on...) The cumulative duration of ).

[0186] In one specific implementation, the status identifier data is output after forward error correction coding. Forward error correction coding (FEC) can automatically correct a certain number of bit errors during transmission, ensuring that critical status identifier information can still be correctly decoded even when there is slight interference in the communication link between the external timing device and the timing terminal. This avoids downstream devices misjudging the reliability of time data due to misreading of status identifiers, thereby further enhancing the end-to-end reliability of high-reliability positioning. For example, forward error correction coding can use BCH codes, convolutional codes, or low-density parity-check codes, and the coding redundancy can be configured according to the bit error rate level of the communication link.

[0187] Through the collaborative process of the four stages of reliable score calculation, mode selection, time data generation, and status identifier output, the time output control unit integrates the front-end deception detection results and signal quality evaluation into a reliable time reference and reliability metadata for external output. This enables the entire anti-deception reliable clock module to have a complete closed-loop capability from signal perception and security identification to flexible output and status notification in high-reliability positioning application scenarios.

[0188] In summary, this invention constructs a progressive deception recognition unit jointly determined by the rate of change parameter, the acceleration parameter, and the goodness-of-fit parameter, and dynamically adjusts the mixing coefficient based on the deception confidence parameter. The limited tracking mode forms a closed loop, achieving accurate identification and flexible isolation of slow time-drag decoy attacks. It can still output continuous and smooth target timing data during the attack, solving the dual technical problems of traditional mutation detection methods being unable to identify progressive decoys and hard switching causing timing phase jumps. This invention uses a trend fitting subunit to perform primary and secondary fitting on time deviation data within a continuous time window. A residual analysis subunit uses root mean square error as the goodness-of-fit parameter, and an anomaly detection subunit outputs decoy identification results when the goodness-of-fit parameter is less than a preset residual threshold, the rate of change parameter continuously shifts in the same direction, and the absolute value of the acceleration parameter is less than a preset acceleration threshold for multiple time windows. It utilizes the counterintuitive characteristic that the deterministic smoothing offset signal introduced by progressive decoy attacks abnormally reduces the residual of the time deviation curve to low-order fitting. This allows for the detection of attack signs solely through changes in the statistical characteristics of the curve shape before the absolute amplitude of the time deviation exceeds the normal threshold, significantly improving the sensitivity and anticipation of progressive decoy detection. This invention employs a three-stage mechanism: a self-calibration holding unit freezes parameter updates of the local trusted clock drift model when the deception confidence exceeds a threshold, records the multivariate parameter sequence during anomalies, and performs weighted incremental correction after satellite timing signal recovery. This ensures the drift mapping model is protected from deception signal contamination during attacks and rapidly self-heals based on the recorded compensation parameter sequence after the attack ends, thus guaranteeing that both timekeeping accuracy under abnormal conditions and long-term discipline accuracy under normal conditions do not degrade. Furthermore, this invention integrates seven-dimensional evaluation parameters through a timing output control unit and uses entropy weighting to adaptively assign weights to generate trusted scoring results. Combined with a progressive deception identification unit for single-constellation anomaly detection and trusted weight reduction processing of inter-constellation time difference data, this invention achieves a three-dimensional timing reliability assessment from the signal layer to the solution layer and from single-constellation to multi-constellation levels. Multi-dimensional cross-validation significantly reduces false alarm and missed alarm rates.

[0189] Example 2 is the second embodiment of the present invention. This embodiment provides a method for enhancing the security of satellite timing terminals by preventing spoofing and using a trusted clock module for enhancing the security of satellite timing terminals in Example 1. The method includes the following steps:

[0190] S1: Receives satellite timing signals and parses them to obtain satellite timing data, while simultaneously generating local reliable clock data.

[0191] S2: The satellite time synchronization data obtained in S1 is time-aligned with the local trusted clock data to a unified UTC integer second time reference. The raw time deviation for each integer second is calculated, and fixed delays such as antenna cable delay, RF front-end processing delay, and baseband correlator delay are compensated for. Subsequently, adaptive median filtering is applied to the raw time deviation data. After adaptive median filtering, low-pass filtering is also applied to the data sequence to suppress residual high-frequency random noise and obtain smooth time deviation data.

[0192] S3: Calculate the rate of change parameter, acceleration parameter, and goodness-of-fit parameter within a continuous time window. When the goodness-of-fit parameter is less than the residual threshold and the rate of change and acceleration satisfy the persistence constraint, it is identified as a gradual deception behavior, and a deception confidence parameter is generated.

[0193] S4: Generate a reliable score result based on the deception identification results and deception confidence parameters, combined with multi-dimensional evaluation parameters.

[0194] S5: Update the local trusted clock drift model when the satellite timing signal is normal, and freeze the model update when the decoy confidence parameter exceeds the threshold.

[0195] S6: When the satellite timing signal is abnormal, perform drift compensation to generate time-keeping data and record the compensation parameter sequence during the abnormal period for use after the model recovers.

[0196] S7: Switch the time synchronization output mode based on the reliability score result. In the amplitude limiting tracking mode, the target time synchronization data... satisfy: ;in, For target time synchronization data, For satellite time synchronization data, To maintain the time synchronization data, The mixing coefficient is dynamically adjusted based on the deception confidence parameter; and the target time synchronization data and status identification data are output.

[0197] Example 3 is the third embodiment of the present invention. This embodiment provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of Example 2.

[0198] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A reliable clock module for enhancing the security of satellite timing terminals by preventing spoofing, characterized in that: include: The satellite timing receiving unit is used to receive satellite timing signals and parse them to obtain the corresponding satellite timing data. Local trusted clock unit, used to generate local trusted clock data; The deviation calculation unit is used to calculate the time deviation data between the satellite time synchronization data and the local reliable clock data. The progressive deception identification unit is used to identify whether there is progressive deception behavior in the satellite timing signal based on the rate of change parameter, acceleration parameter and goodness of fit parameter of the time deviation data within a continuous time window, and output the deception identification result and deception confidence parameter. The self-calibration and hold unit is used to call a pre-established local trusted clock drift model to compensate for the drift of the output of the local trusted clock unit when the deception identification result indicates that the satellite timing signal is abnormal, so as to generate and hold the timing data; the self-calibration and hold unit also controls the update rate of the local trusted clock drift model according to the deception confidence parameter, and freezes the model update when the deception confidence exceeds a preset threshold. The timing output control unit is used to select a corresponding timing output mode between satellite timing data and the hold-time timing data based on the deception identification result and the credibility score result, and output the target timing data; the timing output mode includes a limiting tracking mode, in which the target timing data... ,in For the satellite timing data, To maintain the timing data, The mixing coefficient is dynamically adjusted based on the deception confidence parameter.

2. The anti-spoofing trusted clock module for enhancing the security of satellite timing terminals as described in claim 1, characterized in that: The progressive deception identification unit includes a sliding window construction subunit, a trend fitting subunit, a residual analysis subunit, and an anomaly judgment subunit. The sliding window construction subunit continuously acquires time deviation data at multiple moments according to a preset sampling period and constructs a continuous time window; The trend fitting subunit performs a first-time and a second-time fitting on the time deviation data within the continuous time window to obtain the rate of change parameter and the acceleration parameter, respectively. The residual analysis subunit calculates the residual sequence of the time deviation data relative to the first and second fitted curves, and calculates the root mean square error of the residual sequence as a goodness-of-fit parameter. The anomaly judgment subunit compares the rate of change parameter, acceleration parameter, and goodness-of-fit parameter with their respective threshold intervals. When the goodness-of-fit parameter is less than the preset residual threshold, and the rate of change parameter continues to shift in the same direction, and the absolute value of the acceleration parameter is less than the preset acceleration threshold for multiple time windows, the subunit outputs the progressive deception identification result and the deception confidence parameter.

3. The anti-spoofing trusted clock module for enhancing the security of satellite timing terminals as described in claim 1, characterized in that: The local trusted clock drift model is established through a learning method under normal satellite timing signal conditions. The self-calibration holding unit collects the oscillation frequency parameters, operating temperature parameters, power supply voltage parameters, and historical time deviation data of the local trusted clock unit, and establishes a multivariate drift mapping model. When the deception identification result indicates an anomaly in the satellite timing signal, the self-calibration holding unit freezes the parameter updates of the drift mapping model and records the multivariate parameter sequence during the anomaly period; Once the satellite timing signal returns to normal, the drift mapping model is corrected by weighted incremental adjustment based on the multivariate parameter sequence recorded during the abnormal period and the satellite timing data.

4. The anti-spoofing trusted clock module for enhancing the security of satellite timing terminals as described in claim 1, characterized in that: The reliability score is calculated by the timing output control unit based on multi-dimensional evaluation parameters, which include at least the time deviation amplitude parameter, the rate of change parameter, the change acceleration parameter, the goodness of fit parameter, the carrier-to-noise ratio parameter, the number of visible satellites parameter, and the solution stability parameter. The timing output control unit normalizes each evaluation parameter and uses the entropy weight method to adaptively allocate weights to calculate the reliable score result. The timing output control unit divides the timing output mode into normal tracking mode, amplitude limiting tracking mode, hold output mode and freeze alarm mode according to a preset threshold. Among them, the mixing coefficient of the limiting tracking mode It is positively correlated with the deception confidence parameter.

5. The anti-spoofing trusted clock module for enhancing the security of satellite timing terminals as described in claim 1, characterized in that: The satellite timing receiving unit simultaneously receives timing signals from at least two satellite navigation systems and generates first satellite timing data and second satellite timing data respectively; the first satellite timing data and the second satellite timing data correspond to different satellite navigation systems; The deviation calculation unit further calculates the inter-satellite time difference data between different satellite navigation systems; the progressive deception identification unit determines whether there is a single constellation anomaly based on the inter-satellite time difference data, and performs credibility weight reduction processing on the abnormal satellite timing signals; When the deception identification results of the two satellite navigation systems are inconsistent, the timing output control unit prioritizes the output of the time synchronization data and triggers a system self-test.

6. The anti-spoofing trusted clock module for enhancing the security of satellite timing terminals as described in claim 1, characterized in that: The deviation calculation unit includes a time alignment subunit and a filtering subunit; The time alignment subunit is used to align the satellite time synchronization data with the local trusted clock data to a unified time reference. The filtering subunit performs adaptive median filtering and low-pass filtering on the time deviation data to obtain smoothed time deviation data. The window size of the adaptive median filter is dynamically adjusted based on the local variance of the time deviation data.

7. The anti-spoofing trusted clock module for enhancing the security of satellite timing terminals as described in claim 1, characterized in that: The local trusted clock unit includes a temperature-controlled crystal oscillator; The self-calibration and hold unit inputs a control word to the local trusted clock unit through a frequency control interface to adjust the oscillation frequency; The control word is generated in real time based on the local trusted clock drift model; The self-calibration holding unit also monitors the discipline holding duration of the local trusted clock unit. When the discipline holding duration exceeds a preset lifetime threshold, a lifetime alarm flag is issued through the time synchronization output control unit.

8. The anti-spoofing trusted clock module for enhancing the security of satellite timing terminals as described in claim 1, characterized in that: The timing output control unit generates status identification data, which includes at least a timing output mode identifier, a confidence score interval identifier, a deception confidence level identifier, and a hold output duration identifier. The target time synchronization data and the status identifier data are synchronously output to an external time-using device; The status identification data is output after forward error correction coding.

9. A method for enhancing the security of satellite timing terminals by preventing spoofing using a trusted clock, applied to the spoofing-resistant clock module for enhancing the security of satellite timing terminals as described in any one of claims 1-8, characterized in that, Includes the following steps: S1: Receive satellite timing signals and parse them to obtain satellite timing data, while generating local reliable clock data; S2: Calculate time deviation data and perform time alignment and adaptive median filtering; S3: Calculate the rate of change parameter, acceleration parameter, and goodness-of-fit parameter within a continuous time window. When the goodness-of-fit parameter is less than the residual threshold and the rate of change and acceleration satisfy the persistence constraint, it is identified as a gradual deception behavior, and a deception confidence parameter is generated. S4: Generate a reliable score result based on the deception identification result and the deception confidence parameter, combined with the multi-dimensional evaluation parameters; S5: Update the local reliable clock drift model when the satellite timing signal is normal, and freeze the model update when the deception confidence parameter exceeds the threshold; S6: When the satellite timing signal is abnormal, perform drift compensation to generate time-keeping data and record the compensation parameter sequence during the abnormal period for use after model recovery; S7: Switch the time synchronization output mode according to the reliability score result. In the amplitude limiting tracking mode, the target time synchronization data... satisfy: ;in, For target time synchronization data, For satellite time synchronization data, To maintain the time synchronization data, The mixing coefficient is dynamically adjusted based on the deception confidence parameter; and the target time synchronization data and status identification data are output.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the method as described in claim 9.

Images