Asynchronous Lift-Off Spoofing on Satellite Navigation Receivers in the Signal Tracking Stage

As Global Navigation Satellite System (GNSS) spoofing techniques are highly stealthy and pose a tremendous risk to targets using GNSS technology, studies on GNSS spoofing techniques have been in the spotlight. If the accurate position and velocity of the target receiver can be obtained, the target receiver can be covertly spoofed during the signal tracking stage using synchronous lift-off spoofing. However, it is often difficult to accurately obtain the position and velocity of a target in real GNSS spoofing scenarios. To address this problem, To study the effects of spoofing signals' power (relative to the real signal), code pulling rate, carrier Doppler shift, initial code phase difference, and carrier phase difference on the efficacy of spoofing, the intrusion of receiver's signal tracking loop by spoofing signals is mathematically modeled. Based on the model, an asynchronous lift-off spoofing for GNSS receivers in the signal tracking stage is proposed. Theoretical analysis and experimental results show that the new method resulted in stable Doppler frequency variations, short fluctuations in carrier-to-noise ratio (C/N) and signal lock time, and gentle changes to the receiver's 3D Earth-Centered Earth Fixed (ECEF) coordinates, when the target's position and velocity were approximately known during the intrusion period. The proposed spoofing method is highly feasible and could expand the scope of applicability of lift-off spoofing.