GNSS-Denied Operations With Cross-Medium Sensing

Regulatory Framework

The regulatory regime governing assured PNT is layered across defense, civil, and international authorities. The Department of Defense Joint Program Office for PNT (DoD JPO PNT), established under the Office of the Under Secretary of Defense for Research and Engineering, coordinates United States military PNT requirements across the Services and into coalition contexts. The Air Force Research Laboratory Munitions Directorate (AFRL/RW) and its companion Sensors Directorate (AFRL/RY) drive resilient-PNT science-and-technology investment, including the Navigation Technology Satellite-3 demonstrator, the Modernized GPS User Equipment program (MGUE Increment 1 and Increment 2), and the Resilient Embedded GPS/INS family of receivers. MIL-STD-461G, applied to PNT receivers, fixes the electromagnetic-interference envelope that platform integration must satisfy; this matters because jamming and spoofing manifest as in-band and adjacent-band emissions that the integrated receiver must distinguish from the platform's own emission environment.

Internationally, the Galileo Open Service Navigation Message Authentication (OS-NMA), declared operational by the European Union Agency for the Space Programme in 2025, provides cryptographic authentication of the Galileo navigation message at the open-service level — a civil signal that is structurally resistant to the canonical spoofing attack of broadcasting a forged navigation message. The Indian Regional Navigation Satellite System (IRNSS), operating under the brand NavIC, provides a regional alternative GNSS constellation that, in combination with GPS, Galileo, GLONASS, and BeiDou, supports multi-constellation receivers whose denial threshold is structurally higher than any single-constellation receiver. Terrestrial PNT alternatives — NextNav L-band terrestrial PNT (operating on the Lower 900 MHz band reallocated by the Federal Communications Commission for terrestrial PNT and broadband), enhanced LORAN (eLoran) under successive National Defense Authorization Act provisions, Locata's terrestrial pseudolite network, and Trimble RTX-FAST satellite-augmentation correction services — supply complementary positioning sources whose denial profiles differ from GNSS.

Sensor-side technologies complete the picture. Bartington fluxgate magnetometers and similar ruggedized magnetic-compass instruments provide heading reference independent of the radio-frequency spectrum entirely. Vision-aided inertial-navigation systems, ranging from open research (DARPA's All Source Positioning and Navigation, ASPN) to fielded military and commercial products, supply terrain-relative positioning during GNSS outages. Tactical-grade and navigation-grade inertial measurement units provide bounded-drift dead reckoning. Each of these is regulated by its own combination of standards — MIL-STD-810H environmental, MIL-STD-461G electromagnetic, and Service-specific airworthiness or seaworthiness requirements — and each contributes a distinct medium of evidence about the platform's true state.

Architectural Requirement

A GNSS-denied-capable navigation architecture that satisfies the regulatory envelope must additionally satisfy four properties that the regulatory documents specify in objective terms but do not prescribe a primitive for. First, denial detection: the architecture must recognize a GNSS anomaly before the anomalous fix has propagated into the planning horizon, not after the platform has already acted on a spoofed position. Second, denial attribution: the architecture must distinguish the cause of the anomaly — multipath in an urban canyon, ionospheric scintillation at high latitudes, broadband jamming, narrowband jamming, repeater spoofing, meaconing, asynchronous-time spoofing — because the appropriate response differs by cause. Third, fallback selection: the architecture must select an alternative positioning source whose own denial profile is uncorrelated with the cause attributed to the GNSS anomaly. Fourth, state-rollback: when attribution shifts from blockage to spoofing after a delay, the architecture must roll back the recent state that was admitted under the anomalous fix and re-derive position from the uncontaminated history.

These properties cannot be implemented at the GNSS receiver alone, because the receiver has limited cross-medium evidence; nor at the inertial-navigation-system alone, because the INS has no view of the radio-frequency environment. They require a primitive that consumes contributions from the GNSS receiver, the inertial measurement unit, the magnetic compass, the vision-aided component, the radio-frequency spectrum monitor, and the time source, and that produces an attributed cause for any anomaly across these mediums. The Modernized GPS User Equipment Increment 2 specification approaches this requirement; the Resilient Embedded GPS/INS family of receivers approaches it from the receiver side; neither is a full architectural primitive that the autonomy stack consumes uniformly.

Why Procedural Compliance Fails

Procedural compliance with the surrounding regulations — MIL-STD-461G electromagnetic envelope, MIL-STD-810H environmental qualification, MGUE Increment 2 receiver-level requirements, OS-NMA authentication of Galileo signals — is necessary but architecturally insufficient. A receiver that passes every applicable test plan can still produce a confidently-wrong fix when a meaconing attack delays and rebroadcasts an authentic signal: the cryptographic authentication passes because the rebroadcast bits are authentic, while the position is wrong because the timing is delayed. A receiver that detects a jamming event by carrier-to-noise ratio collapse can still propagate the last good fix into the inertial fallback, where the planning horizon admits it as ground truth long enough for a spoofed ten-second window to displace the platform from its actual location.

Operational evidence accumulates. The Eastern Mediterranean and Black Sea regions experience persistent regional GPS denial and spoofing events, documented by the Maritime Administration's MSCI advisories and by aviation-industry incident-reporting channels. The 2024 Russian electronic-warfare deployments along NATO's eastern flank produced sustained civil-aviation GPS interference. The autonomous-delivery and autonomous-trucking commercial sector reports increasing rates of urban-canyon multipath and intermittent denial in dense-urban operating areas. Agricultural autonomy in subarctic latitudes encounters ionospheric scintillation that mimics jamming. Each of these scenarios shows the same architectural gap: the receivers are individually compliant, the fallback strategies are individually reasonable, and the integrated behavior under attribution-uncertain anomaly is fragile.

The DARPA Spatial, Temporal, and Orientation Information in Contested Environments (STOIC) program, the Office of the Under Secretary of Defense for Research and Engineering's Assured PNT initiative, and the DoD JPO PNT Resilient PNT program collectively recognize the gap; their performer ecosystems are filling individual receiver-level and sensor-level slots without a unifying architectural primitive that the autonomy stack above the PNT layer consumes. Procedural compliance produces qualified components; architectural compliance is the missing layer above.

What the AQ Primitive Provides

The Adaptive Query disruption-modeling primitive supplies the architectural layer directly. Each contributing source — GNSS receiver, inertial measurement unit, Bartington-class fluxgate magnetometer, vision-aided INS, RF spectrum monitor, time source attested by a chip-scale atomic clock or by Network Time Security where available — admits its observations as credentialed events into a unified disruption model. The model maintains credentialed signatures for canonical disruption modes: the broadband jamming signature (carrier-to-noise collapse across the GNSS band, typically with adjacent-band leakage), the narrowband jamming signature, the repeater-spoofing signature (authentic-bit content with anomalous time-of-arrival), the meaconing signature (delayed-rebroadcast geometry), the urban-canyon multipath signature (correlated multipath across satellites with consistent geometric structure), the ionospheric-scintillation signature (correlated amplitude and phase scintillation across constellation), and natural-anomaly signatures that the architecture must not over-attribute as adversarial.

When a GNSS anomaly registers, the disruption-modeling primitive cross-correlates the anomaly against the credentialed signatures using contributions from the other mediums. RF spectrum-monitor evidence distinguishes broadband jamming from urban-canyon blockage. Time-source attestation against a chip-scale atomic clock distinguishes meaconing from natural propagation delay. Magnetic-heading consistency distinguishes spoofing-induced platform-state inconsistencies from genuine maneuver. Vision-aided position consistency distinguishes spoofing from blockage in environments where vision is available. The attributed cause feeds the autonomy stack's fallback logic with the operational nuance that monolithic fallback patterns lack: spoofing attribution triggers state-rollback plus inertial fallback plus alert plus selection of a fallback source whose profile is uncorrelated with the attributed cause; blockage attribution triggers inertial fallback without rollback; ionospheric attribution triggers continued GNSS use with elevated uncertainty bounds; jamming attribution triggers selection of an alternative-band or alternative-medium source.

Integration with the existing receiver and sensor ecosystem is additive. The Modernized GPS User Equipment Increment 2 receiver continues to operate as it does today; its outputs are admitted to the primitive as credentialed events. The Resilient Embedded GPS/INS receiver provides tightly-coupled GNSS-INS as it does today; its tightly-coupled outputs are admitted as a higher-credential composite event. Galileo OS-NMA authenticated signals carry their authentication evidence into the primitive's credential layer. NextNav L-band terrestrial PNT, eLoran, Locata, IRNSS NavIC, and Trimble RTX-FAST corrections each contribute observations whose denial profiles the primitive treats as distinct mediums for attribution purposes. The integration effort the system integrator performs is to admit each source under its appropriate credential and signature, not to rebuild the attribution and fallback logic for each platform.

Compliance Mapping

The primitive maps onto each layer of the regulatory regime additively. MIL-STD-461G electromagnetic-interference compliance is preserved because the primitive consumes receiver and sensor outputs at the application layer and does not alter the radio-frequency behavior of the integrated platform. MIL-STD-810H environmental compliance is preserved for the same reason. MGUE Increment 2 receiver-level compliance is preserved because the receiver's outputs are admitted to the primitive without modification of the receiver. Galileo OS-NMA authentication evidence is consumed as a credential property of the admitted observation rather than re-implemented at the primitive layer. Resilient PNT program objectives are met through the architectural attribution and fallback-selection capability that the primitive provides, with receiver-level and sensor-level performers continuing to compete on their respective layers.

Service-specific airworthiness, seaworthiness, and ground-vehicle qualification regimes treat the primitive as application-layer software whose qualification is part of the platform's overall software qualification. NATO STANAG interoperability for coalition PNT operates through credentialed cross-recognition of allied PNT sources. The DoD JPO PNT all-source-PNT direction is satisfied structurally: the primitive is the all-source consumer that the JPO direction calls for. Civil aviation Required Navigation Performance regimes, maritime e-Navigation expectations, and the Federal Aviation Administration's Performance-Based Navigation framework are supported through the primitive's uncertainty-bound output, which is the property the civil regimes require for integrity assurance. The compliance evidence the platform produces remains the platform's own; the architectural compliance evidence is supplied by the primitive's lineage of attributed disruptions, fallback selections, and uncertainty bounds.

Adoption Pathway

Adoption proceeds along three concurrent tracks. The first is platform-integrator adoption: defense and commercial platform integrators adopt the primitive as the all-source PNT consumer above the receiver and sensor layer, on each new platform integration. Each integration retires the per-platform reconstruction of attribution and fallback logic and accumulates deployment experience that compounds across the integrator's product line. The second is program-of-record specification: the DoD JPO PNT writes the primitive into the next-generation Resilient PNT specification as the architectural layer above the qualified receiver and sensor floor, on the same regulatory basis that MGUE Increment 2 specifies the receiver layer. AFRL/RW and AFRL/RY S&T programs use the primitive as the architectural reference for assured-PNT experimentation, with performer receivers and sensors integrated against it.

The third track is commercial deployment. Autonomous-vehicle, autonomous-delivery, autonomous-trucking, autonomous-aviation, autonomous-maritime, and autonomous-agricultural operators integrate the primitive into their PNT stacks as the operating environments where they deploy become structurally less benign. Urban-canyon dense-multipath environments, regional-denial geographies (the Eastern Mediterranean, the Black Sea, the Korean Peninsula, the Persian Gulf), and high-latitude scintillation regions each provide concrete deployment cases where attribution-aware fallback outperforms monolithic fallback. The cumulative effect is to retire the per-platform reconstruction of attribution and fallback logic in favor of a unified primitive that all platforms consume, leaving the receiver vendors free to compete on the receiver layer where their RF and signal-processing investment compounds, the sensor vendors free to compete on their sensor layer, and the platform integrators free to compete on the autonomy and mission layer where the operational value compounds.