Abstract
To increase resilience against increasingly sophisticated attacks on the ubiquitous Global Navigation Satellite Systems used for Positioning, Navigation and Timing, there has been increased interest for alternative PNT in the last years. One area of particular interest due to its diversity in space, frequency, and technology, are the 4th Generation LTE and 5th Generation New Radio (5G) networks. Previous research into their transmitter oscillator behavior has shown that some transmitters show meter-level range stability over periods of hours, while other towers drift substantially in apparent range but at a nearly constant drift rate. This work expands on previous investigations by exploring the impacts of exploiting cellular signals as range sensors or as range-rate sensors, and combinations thereof. The results show that most of the advantages of having range sensors are already achieved when as few as two transmitters are used as range constraint with the rest being a range-rate constraint, significantly relaxing the requirements on transmitter classification, a task that is challenging in practice.