Geolocation of Terrestrial GNSS Spoofing Signals from Low Earth Orbit

Abstract

This paper explores single-satellite single-pass geolocation of terrestrial Global Navigation Satellite System (GNSS) spoofing signals from Low Earth Orbit (LEO). GNSS spoofers transmit an ensemble of false GNSS signals intending that the victim(s) receiver will accept them as authentic signals and infer a false position fix and/or a clock offset. Receivers in LEO provide a unique opportunity to detect, classify, and geolocate terrestrial GNSS interference. Single-satellite-based transmitter geolocation is possible from Doppler measurements alone, assuming a carrier can be extracted from an interference signal. There are proven single-satellite Doppler-based geolocation algorithms, but they only apply to emitters transmitting at a constant frequency. By contrast, GNSS spoofers transmit signals whose carrier frequency contains an unknown time-varying frequency component that imitates the Doppler corresponding to each individual spoofed navigation satellite. This paper develops a single-pass single-satellite technique that removes the unknown time-varying frequency component added by GNSS spoofers so that a Doppler (range-rate) time history can be extracted for geolocation. It is shown that the true range rate between the terrestrial spoofer and LEO-based receiver manifests in the spoofed receiver clock offset rate estimate. Monte Carlo simulations are developed that investigate how transmitter motion, transmitter clock offset rate, and spoofed clock offset rate affect geolocation accuracy. The proposed method is validated by simulating the reception of terrestrial GNSS spoofing signals on a LEO-based receiver and achieving under 10 km accuracy. Additionally, recent real-world GPS spoofing signals captured by a LEO-based receiver are analyzed.