IEEE - Aerospace and Electronic Systems - March 2021 - 39

Feng et al.

Figure 2.
Top: 1-PPS output from a spoofed u-blox GPS receiver. Bottom:
Relative position output of the spoofed receiver. Despite the 1-PPS
shifting by 25 ms or the time needed for an electromagnetic signal
to travel 7.5 km, the actual receiver position hardly varies in a sub50 m range since the same time offset is introduced in the AF0
parameter of the spoofing message of all satellites. The spoofed
location is in south of France, whereas the actual experiment location is in the north-eastern location of France in Besanc¸on.

shown in Figure 2. In all cases, the commercial receivers
were running and had acquired the authentic constellation
before being spoofed to the new location or time.
Therefore, it is demonstrated that, by using a single
antenna, a properly clocked spoofing emitter will generate
the 2-MHz-wide GPS signal, which cannot be distinguished from the authentic signal: As opposed to jamming
in which the user immediately detects a loss of service,
the spoofing signal will introduce erroneous position or
timing signal, a dramatic impact if this GPS signal, for
example, feeds a network time protocol or precision time
protocol server for time dissemination in a network
assumed to be synchronized with the GPS time.

GPS SPOOFING DETECTION
In this section, we propose a computationally efficient
spoofing detection method by using a codeless decoding
approach to measure the phase difference of different satellites and different antennas. First, assuming there are M
authentic satellites and N spoofing satellites, the complex
baseband representation (I & Q) of the time-varying signal
received by the kth antennas (k ¼ 1; 2, i.e., two antennas
are used in our analysis) can be expressed as [18]
sðk; tÞ ¼

M
X

A

A
j'm ðk;tÞ A
aA
sm ðk; tÞ
m ðk; tÞbm ðk; tÞe

m¼1

þ

N
X

S

aSn ðk; tÞbSn ðk; tÞej'n ðk;tÞ sSn ðk; tÞ þ " ðk; tÞ

n¼1

(1)
with
(

A

A
A
A
A
j2pfm ðk;tÞt
sA
m ðk; tÞ ¼ dm ½t À t m ðk; tÞcm ½t À t m ðk; tÞe
S

sSn ðk; tÞ ¼ dSn ½t À t Sn ðk; tÞcSn ½t À t Sn ðk; tÞej2pfn ðk;tÞt
(2)
MARCH 2021

where the superscripts " A " and " S " denote " authentic " and
" spoofing " , t denotes time, aðk; tÞ denotes the complex
gain of the kth antenna, which is dependent on the antenna
radiation pattern and the satellite signal direction, bðk; tÞ
denotes the real-value amplitude (i.e., the square root of the
power) of the satellite signal, 'ðk; tÞ denotes the phase of
the satellite signal, " ðk; tÞ denotes the thermal noise, dðtÞ
and cðtÞ denote the navigation message and the PRN code
with BPSK modulations, tðk; tÞ denotes the time delay of
the satellite signal, and fðk; tÞ denotes the Doppler shift as
well as the frequency offset between the local oscillator
and the received satellite signal, which is identical for all
antennas in the context of a coherent receiver.
Given a short integration time T , during which the
amplitude, phase, and Doppler shift of the satellite signals
as well as the antenna gains are assumed to be constant
(i.e., unchanged with time), and a limited antenna extent,
for which the time delay, amplitude, and Doppler frequency of the satellite signal with respect to different
antennas are assumed to be equivalent, the received signal
can be approximated by
sðk; tÞ '

M
X

G

A

A j'm ðkÞ j'm A
aA
e sm ðtÞ
m ðkÞbm e

m¼1

þ

G
aS0 ðkÞej'0 ðkÞ

N
X

(3)
S
bSn ej'n sSn ðtÞ

þ " ðk; tÞ

n¼1

with
(

A

A
A A
A j2pfm t
sA
m ðtÞ ' dm ½t À t m cm ½t À t m e
S
S
S S
S j2pfnS t
sn ðtÞ ' dn ½t À t n cn ½t À t n e

(4)

G
where 'G
m ðkÞ and '0 ðkÞ denote the geometrical phase
terms of the mth authentic satellite signal and spoofing
satellite signals from a single emitter with respect to the
kth antenna. We note that, since the complex gain of the
kth antenna with respect to the nth spoofing satellite,
aSn ðkÞ is only dependent on the antenna radiation pattern
and the signal direction, we set aS1 ðkÞ ¼ aS2 ðkÞ ¼
D
Á Á Á aSN ðkÞ ¼ aS0 ðkÞ in (3) under the assumption of a single
spoofing source.
By using the first antenna as reference, the geometrical
phase terms in (3) can be expressed as

8 G
'm ðkÞ ¼ 'G
>
m ð1Þþ2pðk À 1Þd cos cm =
>
>
<
¼ 'G
m ð1Þþ2pðk À 1Þd cos um cos fm =
G
>
'0 ðkÞ ¼ 'G
>
0 ð1Þþ2pðk À 1Þd cos c0 =
>
:
¼ 'G
0 ð1Þþ2pðk À 1Þd cos u0 cos f0 =

(5)

whose value depends on the angle of the satellite to the
antenna array baseline, where d denotes the spacing between
two antennas,  denotes the GPS L1 carrier wavelength of
19 cm in this investigation, c, u, and f denote cone angle,
azimuth angle, and elevation angle, respectively.
Then, assuming the phases of different satellites corresponding to different antennas can be obtained from the

IEEE A&E SYSTEMS MAGAZINE

39
IEEE - Aerospace and Electronic Systems - March 2021

Table of Contents for the Digital Edition of IEEE - Aerospace and Electronic Systems - March 2021
