Asynchronous Lift-Off Spoofing on Satellite Navigation Receivers in the Signal Tracking Stage

Abstract

As Global Navigation Satellite System (GNSS) spoofing techniques are highly stealthy and pose a tremendous risk to targets using GNSS technology, studies on GNSS spoofing techniques have been in the spotlight. If the accurate position and velocity of the target receiver can be obtained, the target receiver can be covertly spoofed during the signal tracking stage using synchronous lift-off spoofing. However, it is often difficult to accurately obtain the position and velocity of a target in real GNSS spoofing scenarios. To address this problem, To study the effects of spoofing signals' power (relative to the real signal), code pulling rate, carrier Doppler shift, initial code phase difference, and carrier phase difference on the efficacy of spoofing, the intrusion of receiver's signal tracking loop by spoofing signals is mathematically modeled. Based on the model, an asynchronous lift-off spoofing for GNSS receivers in the signal tracking stage is proposed. Theoretical analysis and experimental results show that the new method resulted in stable Doppler frequency variations, short fluctuations in carrier-to-noise ratio (C/N) and signal lock time, and gentle changes to the receiver's 3D Earth-Centered Earth Fixed (ECEF) coordinates, when the target's position and velocity were approximately known during the intrusion period. The proposed spoofing method is highly feasible and could expand the scope of applicability of lift-off spoofing.

GNSS induced spoofing simulation based on path planning

“…The induction process of induced spoofing can be demonstrated by the auto-correlation function (ACF) model of the authentic and spoofing signals [3,20]. Depending on the methods of code phase alignment, induced spoofings can be classified as synchronous and asynchronous [3,8,16,[21][22][23][24]. Figure 1 shows the induction processes of the two methods.…”

“…According to the technical complexity and the difficulty of detection, generative spoofing can be classified as simplistic spoofing, intermediate spoofing, and sophisticated spoofing [7][8][9]. In simplistic spoofing, the spoofing and authentic signals received by victims have asynchronous parameters including code phase, carrier phase and other parameters.…”

“…In simplistic spoofing, the spoofing and authentic signals received by victims have asynchronous parameters including code phase, carrier phase and other parameters. Simplistic spoofing usually adopts the 'jamming-spoofing' mode, which first unlocks the target receiver by high power jamming and then enables the victim recapture and lock on spoofing signals [6,8]. Intermediate spoofing is also called induced spoofing or lift-off spoofing [8].…”

“…Simplistic spoofing usually adopts the 'jamming-spoofing' mode, which first unlocks the target receiver by high power jamming and then enables the victim recapture and lock on spoofing signals [6,8]. Intermediate spoofing is also called induced spoofing or lift-off spoofing [8]. The spoofer first controls the spoofing to synchronise with the authentic signals in the code phase and Doppler frequency so as to disguise as the authentic signals and then gradually controls the tracking loop of the target receiver [7].…”

A Slowly Varying Spoofing Algorithm on Loosely Coupled GNSS/IMU Avoiding Multiple Anti-Spoofing Techniques

“…In GNSS and the inertial measurement unit (IMU) system, IMU constantly uses measurement information of GNSS to correct its own error. Slow spoofing can also spoof the GNSS/IMU system, for example, traction spoofing can take over the loop without destroying the tracking loop [12]. When the difference between the position velocity and time (PVT) and real PVT is large, the user can detect spoofing by comparing with the measurement results of other sensors.…”