A GNSS Spoofing Detection and Direction-Finding Method Based on Low-Cost Commercial Board Components

Abstract

The Global Navigation Satellite System (GNSS) is vulnerable to deliberate spoofing signal attacks. Once the user wrongly locks on the spoofing signal, the wrong position, velocity, and time (PVT) information will be calculated, which will harm the user. GNSS spoofing signals are difficult to carry out spoofing attacks in the direction of arrival (DOA) of the real signal, so the spoofing detection method based on DOA is very effective. On the basis of identifying spoofing signals, accurate DOA information of the signal can be further used to locate the spoofer. At present, the existing DOA monitoring methods for spoofing signals are mainly based on dedicated antenna arrays and receivers, which are costly and difficult to upgrade and are not conducive to large-scale deployment, upgrade, and maintenance. This paper proposes a spoofing detection and direction-finding method based on a low-cost commercial GNSS board component (including an antenna). Based on the traditional principle of using a multi-antenna carrier phase to solve DOA, this paper innovatively solves the following problems: the poor direction-finding accuracy caused by the unstable phase center of low-cost commercial antennas, the low success rate of spoofing detection in a multipath environment, and the inconsistent sampling time among multiple low-cost commercial GNSS boards. Moreover, the corresponding prototype equipment for spoofing detection and direction-finding is developed. The measured results show that it can effectively detect spoofing signals in open environments. Under a certain false alarm rate, the detection success rate can reach 100%, and the typical direction-finding accuracy can reach $5°$.

1. Introduction

The Global Navigation Satellite System (GNSS) has been widely used in many fields, such as positioning, transportation, and meteorological application. In these fields, many modern GNSS technologies have been developed, such as PPP (precise point positioning) [1], integrated navigation technology [2], GNSS Reflectometry [3,4], and so on. These technologies have played an important role in modern society. However, the security of GNSS has attracted more and more attention in recent years. Due to the weak power of GNSS signals when they reach the ground and the public structure of civilian signals, GNSS is vulnerable to the threat of jamming and spoofing, so there are potential risks. Different from jamming, spoofer secretly broadcasts the wrong navigation information to users, making users calculate the wrong time, position, and speed information, which will cause more serious consequences. The team of Professor Humphreys of the University of Texas at Austin successfully implemented the spoofing of drones and yachts, making them deviate from the route [5,6]. In 2017, multiple ships in the Black Sea were affected by GNSS spoofing technology [7]. In 2020, Mit conducted a spoofing attack experiment on the Tesla Model 3 self-driving car. The experimental results show that the existing spoofing attack methods are enough to make the self-driving car deviate from the route and affect its decision-making ability [8]. Facing increasingly serious spoofing attacks, it is imperative to develop anti-spoofing technology. Anti-spoofing technology can be divided into four categories, which are spoofing detection, spoofing identification, spoofing suppression, and spoofer location [9]. The purpose of spoofing detection and identification is to detect whether there are spoofing signals in the current electromagnetic environment and to identify real signals from all signals. Spoofing suppression works to eliminate spoofing signals from received signals and restore the usability of navigation signals. The spoofer location method eliminates the threat of spoofing from the source by estimating the direction or position of the spoofer. For the spoofing detection module, there are mainly methods such as satellite navigation signal authentication technology [10], external equipment assistance [11,12,13,14], and signal processing of the receiver terminal. Among them, the receiver terminal signal processing method has become the easiest method to promote because of its low cost and wide application range. Specifically, receiver terminal signal processing methods can be classified into single-antenna and multi-antenna spoofing detection methods. For the single-antenna methods, most methods use the observations received by the GNSS receiver to design algorithms for spoofing detection. For example, the carrier-to-noise ratio variation of navigation signals [15], the proportional relationship between pseudo-range Doppler and carrier Doppler [16], and receiver autonomous integrity monitoring (RAIM) technology [17] is used. However, such techniques may be difficult to defend against some advanced spoofing attacks, such as traction spoofing [18]. The multi-antenna spoofing detection method utilizes the geometric space difference between real GNSS signals and spoofing signals and is a kind of spoofing detection method based on airspace features. Because the geometric space information of GNSS real signals is almost inimitable, such methods are currently one of the most effective spoofing detection methods. The spoofing detection methods based on multi-antenna have been studied to some extent. Huang proposed a method of spoofing detection using the carrier phase difference of dual antennas, and verified the feasibility of the method from simulation experiments [19]. Swaszek uses multiple commercial receivers to detect spoofing by comparing the positions of different receivers. The false alarm rate depends on the spatial distribution of receivers and the positioning accuracy [20]. A spoofing detection method using the intersection angle between two directions of arrival (IA-DOA) is proposed. The IA-DOA method is proved to be insensitive to the platform attitude, which reduces the cost and complexity of the experiment, but this method cannot obtain the direction information about the spoofer in the airspace [21]. The multi-antenna DOA spoofing detection method is mainly based on the difference between the real signal and the spoofing signal and performs spoofing detection according to the different information of DOAs. In the case of spoofing, the direction-finding of the spoofer can be realized, and the method can eliminate the threat of spoofing from the source. Reference [22] pointed out that for the double-antenna DOA spoofing detection method, the DOAs corresponding to the same carrier phase difference are ambiguous and cannot be eliminated. Additionally, it proved that the triple-antenna in a non-linear arrangement is the minimum requirement to solve DOAs ambiguity. Most of the multi-antenna spoofing detection methods developed later follow this principle in terms of antenna configuration. There have been some studies on solving the DOA of traditional antenna array [23,24]. Michael used a rectangular antenna array to estimate DOA using the ESPRIT algorithm, and realized the joint estimation of DOAs and the attitude of the antenna array. However, it requires a professional antenna array and calculates at the signal level [25]. Professional antenna array equipment and processing algorithms have a high threshold for ordinary users.

At this stage, with the continuous improvement of electronic equipment manufacturing technology, GNSS equipment is developing towards miniaturization and low cost. Many low-cost commercial boards and antennas have appeared. Low-cost commercial board components, including receiver boards and antennas, have been tested in various scenarios [26,27]. However, due to the price and manufacturing process limitations of low-cost commercial board components, there are the following three main error sources that will affect the solution of spoofing detection and direction-finding. First, low-cost commercial boards have clock bias in the sampling of signals, and time synchronization cannot be achieved when multiple receivers work at the same time. There is a power-on clock error; that is, multiple receivers cannot sample observation data at the same time. Moreover, this error is related to the starting up of the receivers. The power-on clock error will be absorbed by the receiver clock offset and cannot be eliminated in the different processes, which will introduce an error to the carrier phase observation value. Second, the antenna phase center is the benchmark of the observation data of the high-precision GNSS receiver, and the stability of the antenna phase center is an important index to measure the performance of the antenna. However, the stability of the phase center of the low-cost antenna is poor, and the antenna phase center fluctuates greatly with factors such as pitch angle and azimuth angle. At this time, when the low-cost antenna receives satellite signals in different directions, it will introduce additional phase differences and increase the measurement error [28]. Third, low-cost antennas are more sensitive to multipath effects. The multipath effect is closely related to the user’s environment, and traditional differential technology is difficult to eliminate its influence. The superimposition of multipath signals and normal signals will not only affect positioning [29] but also lead to deviations in the DOAs of signals. Multipath effects may cause spoofing signals and multipath signals to be indistinguishable [30].

Aiming at the high hardware requirements of traditional array antennas, this paper uses low-cost commercial boards and antennas to build an anti-spoofing platform. In this paper, the effects of various errors of low-cost commercial board components on the carrier phase observations are deduced and considered in detail. For the problem of power-on clock error, a compensation method using pseudo-range and instantaneous Doppler value is proposed in this paper, and the time synchronization of multiple receivers is realized at the algorithm level. In order to solve the instability of the low-cost antenna phase center and the multipath effect, this paper proposes a method to describe the sky map of the time-series average error correction value. Aiming at the problem of carrier single difference ambiguity, the carrier single difference is modeled as the addition of integers and decimals. The fractional part is obtained by calculating the decimals of the two parts of the carrier phase observation value and each error correction value. The integer part is determined by the baseline length. Additionally, the combination of the two parts obtains a complete carrier single difference value. This method simplifies the ambiguity fixation algorithm and makes full use of the length and geometric constraint information of the baseline. The expected value of the DOA can be obtained from the ephemeris information and the prior information on the station position. The calculated value is obtained in real-time by the DOA calculation method. The residual between the calculated value and the expected value fits to the Gaussian distribution with a zero mean value when there is no spoofing signal. And the residual fits a Gaussian distribution with a non-zero mean in the presence of spoofing signals. Based on this, a binary hypothesis testing model was constructed using the sum of squared errors (SSE), and the theoretical threshold was calculated. The experiment proves the effectiveness of the proposed method, and the detection rate reaches 100%. In addition, the spoofing signal is identified. The direction-finding of the spoofer is solved, and the DOA accuracy can reach within 5 degrees.

The subsequent chapters of this paper are arranged as follows: Section 2 introduces the system structure of the method and derives the necessary principles. Section 3 introduces the experimental scenario and displays the experimental results obtained from each experiment. Section 4 analyzes and discusses the experimental results. Section 5 is the conclusion part, which summarizes the research results of this paper and discusses future work.

2. Materials and Methods

2.1. System Structure

2.1.1. Hardware Structure

Compared with professional surveying and mapping grade boards and antennas, the price of commercial boards and antennas is lower. Figure 1 shows the hardware structure built in this paper. The difficulty of multi-antenna DOA calculation lies in the precise synchronization and data sharing among receivers. Frequency synchronization can be achieved between multiple receivers by locking the external clock, but time synchronization cannot be achieved, which requires compensation at the algorithm level. The data of the four receivers are shared with the processing unit for real-time calculation, and the calculation result are displayed on the computer through the upper computer. Each antenna is connected to the receiver through a long cable, and the delay of the signal in the cable needs to be considered. Low-cost antennas introduce additional measurement errors due to antenna phase center instability and susceptibility to multipath effects, which need to be corrected. Considering the DOA ambiguity of the dual antennas and introducing more geometric constraints, a special configuration of four antennas is designed, as shown in Figure 2. The multi-antenna configuration is closely related to the solution of carrier single difference and the performance of spoofing detection. More calculation details are described in detail in subsequent chapters.

2.1.2. Algorithm Process

In Figure 3, an anti-spoofing system consisting of four low-cost commercial board components is shown. On the one hand, the broadcast ephemeris information is basically impossible to be forged, and the expected DOAs can be obtained from the prior position of the antenna and the broadcast ephemeris information. On the other hand, using the geometric constraint information of the four antennas and the space information formed between the antennas and the satellite, the method of calculating the integer and fractional parts of the carrier single difference is adopted separately. The phase error caused by power-on clock error, antenna phase center error, and multipath effect is compensated. Then, the calculated DOAs can be quickly calculated. According to the data distribution characteristics of the residual error between the calculated DOAs and the expected DOAs, SSE can be used to construct a binary hypothesis testing model to achieve spoofing detection. It can output the spoofing state of the receiver in real-time, identify the spoofing signal, and find the direction information of the spoofer.

2.2. DOA Calculation

The schematic diagram of the elevation angle $\alpha$ and azimuth angle $\beta$ of the satellite $S$ in the $ENU$ coordinate system is shown in Figure 4.

The following will take the $A$ and $B$ antennas as an example to illustrate the process of solving $\alpha$ and $\beta$. In the $ENU$ coordinate system, the unit vector of the satellite signal direction can be expressed as:

$${\widehat{d}}_{enu}={\left[\cos \alpha \sin \beta ,\cos \alpha \cos \beta ,\sin \alpha \right]}^T$$

(1)

The precise relative coordinates of the four antennas in $ENU$ can be calculated by RTK (Real Time Kinematic). Take antenna $A$ as a reference and set it as the origin of $ENU$. Then we can solve the relative coordinates between the remaining three antennas and antenna $A$. The coordinates of $A$ and $B$ antennas in $ENU$ are prior values, set as:

$$\Delta X_{AB}=[\Delta x_{AB},\Delta y_{AB},\Delta z_{AB}]$$

(2)

The geometric diagram of carrier single difference between antennas $A$ and $B$ is shown in Figure 5.

The carrier difference of the two real signals is expressed as $\Delta {\phi }_{AB}$. The $\Delta {\phi }_{AB}$ is the projection of $\stackrel{\rightharpoonup }{AB}$ on the direction vector of the signal between the $A$ antenna and the satellite, which can be expressed as:

$$\begin{array}{cc}\Delta {\phi }_{AB}\lambda & =\Delta X_{AB}\cdot {\widehat{d}}_{enu}\hfill \\ & =\cos \alpha \sin \beta \Delta x_{AB}+\cos \alpha \cos \beta \Delta y_{AB}+\sin \alpha \Delta z_{AB}\hfill \end{array}$$

(3)

where $\alpha \in [0,\pi /2]$, $\beta \in [0,2\pi ]$, $\lambda$ is the carrier wavelength. When the coordinates of the baseline are known, the carrier single difference is completely determined by the elevation and azimuth angles. If the antenna $C$ is considered, the relationship can be obtained as follows:

$$\left\{\begin{array}{l}\Delta {\phi }_{AB}\lambda =cos\alpha \sin \beta \Delta x_{AB}+cos\alpha \cos \beta \Delta y_{AB}+sin\alpha \Delta z_{AB}\\ \Delta {\phi }_{AC}\lambda =cos\alpha \sin \beta \Delta x_{AC}+cos\alpha \cos \beta \Delta y_{AC}+sin\alpha \Delta z_{AC}\end{array}\right.$$

(4)

It can be seen from Equation (4) that if $\Delta {\phi }_{AB}$, $\Delta {\phi }_{AC}$, $\Delta X_{AB}$ and $\Delta X_{AC}$ can be obtained, $\alpha$ and $\beta$ can be solved. The relative coordinates between the antennas can be accurately calculated by RTK, and the solution of the carrier single difference will be deduced in detail in the next section. However, the equation similar to Equation (4) is difficult to be solved. Focusing on this problem, this paper proposes a double rotation method to solve it by eliminating some items containing unknowns through graphic rotation. The process of solving the equation is simplified. The schematic diagram before and after rotation in $ENU$ coordinate system is shown in Figure 6.

In Figure 6, _△$A{B}_1{C}_1$ can be obtained through the rotation matrix $R_1(r,p,y)$. Since the coordinates of $A$, $B$, and $C$ are known, $R_1(r,p,y)$ can be solved easily. The coordinate relationship before and after rotation is as follows:

$$\left\{\begin{array}{l}\Delta X_{A{B}_1}=R_1(\mathrm{r},p,y)({X_{AB}}^T)\\ \Delta X_{A{C}_1}=R_1(\mathrm{r},p,y){(X_{AC})}^T\end{array}\right.$$

(5)

The purpose of the rotation is to make $\stackrel{\rightharpoonup }{AB}$ coincide with the $E$ axis and _△$A{B}_1{C}_1$ to be in the same plane as the plane _▱$EAN$. Then $\Delta X_{A{B}_1}$ and $\Delta X_{A{C}_1}$ can be expressed as:

$$\left\{\begin{array}{l}\Delta X_{A{B}_1}={[\Delta x_{A{B}_1},0,0]}^T\\ \Delta X_{A{C}_1}={[\Delta x_{A{C}_1},\Delta y_{A{C}_1},0]}^T\end{array}\right.$$

(6)

Considering Equation (6), and rewriting Equation (4), we can get the following relationship:

$$\left\{\begin{array}{l}\Delta {\phi }_{AB}\lambda =cos{\alpha }_1\sin {\beta }_1\Delta x_{A{B}_1}\\ \Delta {\phi }_{AC}\lambda =cos{\alpha }_1\sin {\beta }_1\Delta x_{A{C}_1}+cos{\alpha }_1\cos {\beta }_1\Delta y_{A{C}_1}\end{array}\right.$$

(7)

where ${\alpha }_1$ and ${\beta }_1$ is the elevation and azimuth angles of the satellite $S_1$. Then ${\alpha }_1$ and ${\beta }_1$ can be easily solved by Equation (7):

$$\begin{array}{l}{\alpha }_1=\arccos \left(\frac{\Delta {\phi }_{AB}\lambda }{\Delta x_{A{B}_1}\sin {\beta }_1}\right)\\ {\beta }_1=\arctan \left(\frac{\Delta {\phi }_{AB}\Delta y_{A{C}_1}}{\Delta {\phi }_{AC}\Delta x_{A{B}_1}-\Delta {\phi }_{AB}\Delta x_{A{C}_1}}\right)\end{array}$$

(8)

$$\Delta X_{A{S}_1}={\left[\cos {\alpha }_1\sin {\beta }_1,\cos {\alpha }_1\cos {\beta }_1,\sin {\alpha }_1\right]}^T$$

(9)

By rotating $\stackrel{\rightharpoonup }{A{S}_1}$ in reverse, $\stackrel{\rightharpoonup }{AS}$ can be obtained. Then further solve $\alpha$ and $\beta$. The equation for rotation is as follows:

$$\Delta X_{AS}=R_1{}^{-1}(r,p,y)\Delta X_{A{S}_1}$$

(10)

2.3. Carrier Single Difference Solution

As can be seen from the previous section, the carrier single difference value is the premise of solving the DOAs. This section describes the solution method of the carrier single difference. The carrier phase observation equation obtained by low-cost commercial receiver measurement is as follows [31]:

$${\tilde{\phi }}_i^s\lambda ={\rho }_i^s+c\left(d{t}_i-d{t}^s\right)+d_{trop,i}^s-d_{ion,i}^s+\lambda N_i^s+\lambda b^s+\lambda b_i+d_{mul,i}+d_{apc,i}$$

(11)

where $i$ and $s$ denote the index of the station and satellite, respectively. ${\tilde{\phi }}_i^s$ is the actual observed value of the carrier phase measurement of the receiver in cycles. ${\rho }_i^s$ is the distance between the satellite $s$ and the station $i$, c is the speed of light, $d{t}_i$ is the receiver clock offset, $d{t}^s$ is the satellite clock offset, $d_{trop,i}^s$ is the troposphere delay error and $d_{ion,i}^s$ is the ionosphere delay error. $N_i^s$ is the integer ambiguity, $b^s$ is the instrumental biases of the satellite, $b_i$ is the cable delay between the receiver and the antenna, $d_{mul,i}$ is the equivalent distance error caused by the multipath effect, and $d_{apc,i}$ is the equivalent distance error caused by the antenna phase center error. When two stations $i$ and $j$ observe a satellite $s$ at the same time, the inter-station carrier single difference model can be established:

$$\begin{array}{cc}\Delta {\tilde{\phi }}_{ij}^s& ={\tilde{\phi }}_i^s-{\tilde{\phi }}_j^s\hfill \\ & =\Delta {\rho }_{ij}^s+c\Delta d{t}_{ij}+\lambda \Delta N_{ij}^s+\lambda \Delta b_{ij}+\Delta d_{mul,ij}+\Delta d_{apc,ij}\hfill \end{array}$$

(12)

where $d_{ion,i}^s$ and $d_{trop,i}^s$ are eliminated due to the shorter baseline distance. The inter-station carrier single difference eliminates the error terms $d{t}^s$ and $\lambda b^s$. The following equation can be further obtained:

$$\Delta {\tilde{\phi }}_{ij}^s-\lambda \Delta N_{ij}^s-c\Delta d{t}_{ij}-\lambda \Delta b_{ij}-\Delta d_{mul,ij}-\Delta d_{apc,ij}=\Delta {\rho }_{ij}^s$$

(13)

$\Delta {\rho }_{ij}^s$ is consistent with the meaning of $\Delta {\phi }_{AB}\lambda$ in Equation (3), which is the real distance difference between the satellite $s$ and the station $i$,$j$. After solving $\Delta {\rho }_{ij}^s$, the signal DOAs can be solved. $\Delta {\tilde{\phi }}_{ij}^s$ is given by the receiver and is a known value. In order to facilitate the subsequent solution, the three errors in Equation (13) are combined and expressed as follows:

$$\eta =\lambda \Delta b_{ij}+\Delta d_{mul,ij}+\Delta d_{apc,ij}$$

(14)

$\Delta N_{ij}^s$, $\Delta d{t}_{ij}$ and $\eta$ are three unknowns. First, consider the solution of $\Delta N_{ij}^s$. At present, the integer ambiguity resolution method is mainly based on the search algorithm of the search domain. The LAMBDA algorithm is a widely used method at present, but its solution requires multiple epochs to converge. There are also methods that use baseline information to solve ambiguities, such as the long-short baseline method. This method requires that the distance between two antennas is less than half a wavelength. The half wavelength of GPS L1 is 0.0952m. Because of the manufacturing process of the receiving antenna, it is difficult for the distance to be less than half the signal wavelength. Even if the carrier single difference ambiguity problem is solved successfully, low-priced receiver boards may still face the problem of frequent cycle slips, making data processing more difficult. Based on the consideration of the above problems, this paper innovatively proposes a method of calculating the integer and decimals of the carrier single difference value separately. The carrier single difference is modeled as the addition of the integer part and the fractional part. If $\Delta {\phi }_{ij}^s$ represents the complete carrier single difference, the following relationship can be obtained:

$$\Delta {\phi }_{ij}^s=int(\Delta {\phi }_{ij}^s)+Fr(\Delta {\phi }_{ij}^s)$$

(15)

where $int$ means to take an integer operation, $Fr$ means to take a decimal operation. In theory, $int(\Delta {\phi }_{ij}^s)$ consists of several parts, as follows:

$$int\left(\Delta {\phi }_{ij}^s\right)=\Delta N_{ij}^s+int\left({\phi }_{ij}\right)+int\left(d{t}_{ij}\right)+int\left(\eta \right)$$

(16)

where $int\left({\phi }_{ij}\right)$ represents the difference in the change in the number of carrier cycles between stations $i$ and $j$, which is recorded by the wave counter. $int\left(d{t}_{ij}\right)$ represents the integer part of the difference between the receiver clocks and $int\left(\eta \right)$ represents the integer part of the sum of the three errors in Equation (14). Considering the baseline constraint information, the length of $AB$ is 0.4m, and the GPS L1 wavelength is $\lambda$. It can be concluded $\lambda |\Delta {\phi }_{ij}^s|<0.4$. So, the value range of $int\left(\Delta {\phi }_{ij}^s\right)$ is $[-2,2]$, a total of seven integer values. In this paper, we choose to make $int\left(\Delta {\phi }_{ij}^s\right)$ completely determined by the baseline length, and its value is fixed as enumerable integers.

Consider the solution of $Fr(\Delta {\phi }_{ij}^s)$ below, $Fr(\Delta {\phi }_{ij}^s)$ consists of the following parts:

$$Fr(\Delta {\phi }_{ij}^s)=Fr\left(\Delta {\tilde{\phi }}_{ij}^s+c\Delta d{t}_{ij}+\eta \right)$$

(17)

where $\Delta {\tilde{\phi }}_{ij}^s$ represents the difference between the fractional values of the carrier less than one cycle, which is a known value. Then consider making corrections to $c\Delta d{t}_{ij}$ and $\eta$.

Consider correcting $c\Delta d{t}_{ij}$ first. There is a clock bias in signal sampling by the receiver board, which can be expressed by the following equation [32]:

$$d{t}_i^{\prime }=t_{0,i}+\Delta f_i{T}_{s}N$$

(18)

where $t_{0,i}$ is the power-on clock error of the receiver, which is related to each power-on of the receiver. $\Delta f_i$ is clock frequency, $T_s$ denotes the sampling interval and $N$ is the number of samples. Considering the equation for the second receiver $j$ and taking the difference from (18), the following relationship can be obtained:

$$\Delta d{t}_{ij}^{\prime }=t_{0,i}-t_{0,j}+(\Delta f_i-\Delta f_j)T_{s}N$$

(19)

where if two receivers work with a common frequency source, we can get $\Delta f_i-\Delta f_j=0$. At this time, if $t_{0,i}$ and $t_{0,j}$ are equal, the influence of the clock offsets $\Delta d{t}_{ij}^{\prime }$ can be eliminated when making a difference between receivers. Supposing $\Delta t_{0,ij}=t_{0,i}-t_{0,j}$, at the hardware level, the elimination of $\Delta t_{0,ij}$ requires the two receivers to be fully synchronized in time, which is difficult to achieve. $\Delta t_{0,ij}$ can be compensated at the algorithm level. Use the same antenna to sample one signal and distribute it to two receivers. Simulate a zero-baseline environment to eliminate the influence of other errors as much as possible. $\Delta t_{0,ij}$ can be compensated with pseudo-range and Doppler frequency from both receivers under zero-baseline conditions. The error compensation value of $\Delta t_{0,ij}$ at time $\tau$ can be expressed as [33]:

$$c\Delta t_{0,ij}(\tau )=\lambda f_{d,i}(\tau )\left(C_i^s(\tau )-C_j^s(\tau )\right)/c$$

(20)

where $f_{d,i}(\tau )$ is the instantaneous Doppler value of the receiver $i$, and the unit is the cycle. Going a step further, consider compensating for the difference in carrier transmission delay on different receiver boards, which will be absorbed by the clock offset. Under the condition of zero-baseline, it can be obtained by carrier difference, and the complete $c\Delta d{t}_{ij}$ can be expressed as:

$$\begin{array}{cc}c\Delta d{t}_{ij}& =c\Delta d{t}_{ij}^{\prime }+{\tilde{\phi }}_i^s-{\tilde{\phi }}_j^s\hfill \\ & =\lambda f_{d,i}(\tau )\left(C_i^s(\tau )-C_j^s(\tau )\right)/c+{\tilde{\phi }}_i^s-{\tilde{\phi }}_j^s\hfill \end{array}$$

(21)

It must be noted that $c\Delta d{t}_{ij}$ is only concerned with its fractional part. In the experiment part, the compensation result of the power-on clock error is given.

Finally, consider the solution of $\eta$. It can be seen from Formula (14) that $\eta$ includes cable delay error, multipath error, and antenna phase center error. So $\eta$ can be collectively referred to as a hardware delay error. At the hardware level, using cables of the same type and length, adding absorbing materials, and using the same type of antenna can reduce the influence of the three errors. The correction method at the algorithm level is considered below. According to Formulas (13) and (14), $Fr(\eta )$ can be expressed as:

$$Fr(\eta )=Fr\left(\Delta {\phi }_{ij}^s-\Delta {\tilde{\phi }}_{ij}^s-c\Delta d{t}_{ij}\right)$$

(22)

$\Delta {\phi }_{ij}^s$ is the complete carrier single difference, which can be obtained according to Equation (3) by using the true value information of the satellite elevation angle and azimuth angle. According to Formula (22), the single epoch solution of $Fr(\eta )$ can be obtained. Due to the complexity of the observation environment, the multipath error is difficult to quantify, but the multipath effect can be weakened by long-term observation. In addition, the phase center of the low-cost antenna will fluctuate due to the change in the incident direction of the signal, which has poor stability and introduces additional measurement errors.

According to the law of the above errors, we consider using the sky grid map to describe the hardware delay error. Fill the single epoch $Fr(\eta )$ of different directions into the grid of the sky map. Moreover, through a long period of observation, the average value in each grid can be obtained. The corrections in the sky grid map will be stored as priors. $Fr(c\Delta d{t}_{ij})$ and $Fr(\eta )$ can be used as prior values in Formula (17) to correct $Fr(\Delta {\phi }_{ij}^s)$ in real time. So far, $Fr(\Delta {\phi }_{ij}^s)$ can be solved. In Formula (15), $Fr(\Delta {\phi }_{ij}^s)$ is the only value, and by combining it with the seven values of $int\left(\Delta {\phi }_{ij}^s\right)$, a complete carrier single-difference data set can be obtained. In the same way, the data sets solved by using other baselines can be obtained, and the corresponding elevation angle and azimuth angle information can be solved according to Formulas (5)–(10). It can be seen from Figure 2 that the four antennas form a total of four triangles, namely _△$ABC$, _△$ACD$, _△$ABD$ and _△$BDC$. In each triangle, an equation similar to Equation (4) can be constructed, and a set of corresponding $\alpha$ and $\beta$ can be solved through steps (5)–(10). If the integer part of the carrier single difference is reasonable, the solutions for the real numbers of $\alpha$ and $\beta$ can be found in the four triangles. Decompose all real numbers into a data set ${\mathsf{\Theta }}_s$, and $s$ is the satellite number. The elevation angle and azimuth angle of the satellite can be calculated by using the observation value and the ephemeris file received from reference $A$, denoted as ${\tilde{\alpha }}_s$ and ${\tilde{\beta }}_s$, which are regarded as the expected value of the elevation angle and azimuth angle of the $s$. We can find the angle values with the smallest difference from ${\tilde{\alpha }}_s$ and ${\tilde{\beta }}_s$ in ${\mathsf{\Theta }}_s$, which are recorded as ${\widehat{\alpha }}_s$ and ${\widehat{\beta }}_s$. They are the final calculated values of the elevation and azimuth angles. However, if in a spoofing scenario $\alpha$ and $\beta$ are already close to the angles of the transmitting antenna of the spoofer. The above method will fail. Let the complete set of real solutions of all satellites be $U=\{{\mathsf{\Theta }}_1,{\mathsf{\Theta }}_2,{\mathsf{\Theta }}_3,\cdot \cdot \cdot \cdot \cdot \cdot ,{\mathsf{\Theta }}_s\}$. In the spoofing scenario, all satellite signals have the same direction, and the mode of $\alpha$ and $\beta$ can be found in $U$ as the elevation angle and azimuth angle of the spoofer at this time.

2.4. Anti-Spoofing Method

Figure 7 shows a general spoofing scenario. The spoofer simulates the observation information of the satellite and broadcasts it from an antenna to the user receiver. In this case, the direction information calculated based on the airspace information is related to the spoofer, not the satellite. In general, the broadcast ephemeris is almost impossible to be deceived, and the real direction information of the satellite can be calculated by using the broadcast ephemeris. The calculated value of satellite direction information can be obtained through the DOA calculation method of four antennas. In the case of not being spoofed, the residual between the expected value and the calculated value of DOA conforms to a Gaussian distribution with zero mean, and the sum of squared residuals conforms to a chi-square distribution. When there are one or more spoofing signals in the receiving signal channel of the receiver, the residual sum of squares conforms to the non-central chi-square distribution. Therefore, SSE can be used to assess whether the receiver is spoofed [34]. The SSE test metric is defined as follows:

$$SSE=trace\left\{\left[D_{pcf}-R{D}_{enu}\right]Q_N^{-1}{\left[D_{pcf}-R{D}_{enu}\right]}^T\right\}$$

(23)

where $D_{pcf}$ is a $[3\times N]$ matrix in the local coordinate frame of the antenna array and $N$ means the number of satellites. Each column in $D_{pcf}$ is a unit vector between the satellite and the receiver, denoted as ${\widehat{d}}_{pcf}^i$, and $i$ represents the number of columns. $D_{enu}$ is a $[3\times N]$ matrix in the user $ENU$ coordinate frame. Each column in $D_{enu}$ is a unit vector between the satellite and the receiver, denoted as ${\widehat{d}}_{enu}^i$. The relationship between $D_{pcf}$ and $D_{enu}$ is $D_{pcf}=R{D}_{enu}+E$. And $E$ is a $[3\times N]$ measurement noise matrix. $R$ is a $[3\times 3]$ unitary rotation matrix. $Q_N$ is a diagonal matrix consisting of the variance of the observation errors, and its diagonal elements are ${\sigma }_1^2,{\sigma }_2^2,{\sigma }_3^2,\cdots \hspace{0.17em},{\sigma }_n^2$.

From the definition of the SSE test metric, it can be seen that when the signal direction of the satellite is normal, the SSE test metric obeys the chi-square distribution with a degree of freedom $k=2N-3$. If there is a spoofing signal in the incoming signals, the SSE test metric obeys the non-central chi-square distribution with the degree of freedom as $k$ and the non-central parameter as ${\lambda }_1$. The ${\lambda }_1$ shows the degree of deviation between the non-central chi-square distribution and the standard chi-square distribution under the same degree of freedom. The binary hypothesis for spoofing detection can be obtained as:

$$\begin{array}{l}{H}_0(Real) : SSE\sim {\chi }^2(k)\\ H_1(Spoofing) : SSE\sim {\chi }^2(k,\lambda )\\ k=(2N-3)\\ {\lambda }_1={\displaystyle \sum _{n=1}^N{\left(\frac{\Delta g_n}{{\sigma }_n}\right)}^2}\end{array}$$

(24)

where $\Delta g_n$ is the angle difference between the expected value and the calculated value of the $n_{th}$ signal DOA, which can be expressed as follows:

$$\Delta g_n=\arccos \left({\widehat{d}}_{pcf}^n\cdot \left[R{\widehat{d}}_{enu}^n\right]\right)$$

(25)

${\sigma }_n$ is the standard deviation of the measurement error, which is related to the elevation angle of the satellite. In [35], the fitting function of the distribution curve between ${\sigma }_n$ and $\alpha$ is given as ${\sigma }_n=2.9e^{-0.0086\alpha }$. According to the Neyman–Pearson criterion, each epoch can set the SSE test metric related to the false alarm rate as the DOA threshold. In this paper, the false alarm rate $P_{FAR}$ is set to ${10}^{-3}$. In the case of 6 satellites, the threshold $SS{E}_{th}$ of the SSE test matric is 27.88. If the calculated value is greater than $SS{E}_{th}$, it is considered that the receiver is spoofed. The relationship between $P_{FAR}$ and $SS{E}_{th}$ is as follows:

$$P_{FAR}=P\{SSE>SS{E}_{th}|H_0\}=1-{{\displaystyle \int }}_0^{SS{E}_{th}}{p}_{{\chi }^2(k)}(x)dx$$

(26)

Comparing the DOA calculated value with the expected value, if the difference between the two is large, it can be judged that the signal is a spoofing signal so as to realize spoofing identification. Furthermore, when the receiver is locked onto the same spoofer, the DOAs of all spoofing signals should be the same. The elevation angle and azimuth angle contained in DOAs are the direction information of the deception source. It is also possible to identify the spoofing signals based on the fact that the DOAs of the spoofing signals are the same.

3. Experiments and Results

3.1. Experimental Scenario

In order to verify the effectiveness of the method proposed in this paper, spoofing detection and direction-finding experiments were carried out on the roof of the aerospace information research institute in Beijing. The experimental scenario is shown in Figure 8. The experimental equipment mainly includes a data processing unit, an external clock, a spoofer device, four antennas, and an omnidirectional transmitting antenna. Among them, the data processing unit is composed of four GNSS boards and a computing core. The GNSS board receives observation data and ephemeris data, DOAs are calculated in the computing core, and the real-time calculation results are output by the upper computer. The GNSS receiver board model is Unicorecomm UB480 (UB480 is a GNSS receiver board produced by Unicorecomm company. And the Unicorecom is a company from Beijing, China), and the price is about USD 360. The antenna model is HIGH GAIN HG-ZMYH3181 (HIGH GAIN is a company from Shanghai, China), and the price of a single antenna is about USD 290. The computing core baseboard is XC7Z035 from Xilinx Company (San Jose, CA, USA). The spoofer is a generative spoofer device. In order to improve the electromagnetic environment and weaken the influence of multipath, some absorbing materials are added around the four antennas.

3.2. Experimental Results

3.2.1. Error Calibration Results

This section focuses on the correction results of the power-on clock error $Fr(c\Delta d{t}_{ij})$ and hardware delay error $Fr(\eta )$ in Section 2.3. Experimental data were collected on 7 November 2022. Figure 9 shows the calculation results of $Fr(c\Delta d{t}_{ij})$ for multiple satellites at the three frequency points of GL1, B1I, and B1C.

Table 1. Calculated values of GL1 Power-on clock corrections between AB, AC, and AD.

GL1	AB		AC		AD
	Ave	Std	Ave	Std	Ave	Std
G01	0.0123	0.0078	0.0891	0.0132	0.2016	0.0178
G10	0.0093	0.0056	0.0898	0.0086	0.1987	0.0173
G12	0.0119	0.0055	0.0893	0.0087	0.2012	0.0175
G21	0.0144	0.0078	0.0928	0.0103	0.2024	0.0181
G22	0.0090	0.0055	0.0853	0.0120	0.1982	0.0172
G23	0.0121	0.0064	0.0891	0.0128	0.2021	0.0177
G25	0.0130	0.0054	0.0909	0.0088	0.2016	0.0174
G31	0.0114	0.0055	0.0874	0.0122	0.1985	0.0264
G32	0.0114	0.0053	0.0914	0.0088	0.2011	0.0173

shows the calculated values of GL1 Power-on clock corrections between AB, AC, and AD. Figure 10 shows the average value of $Fr(c\Delta d{t}_{ij})$ over a period of time calculated using data from three frequency points of three baselines.

The following experiment is carried out by taking the GPS L1 frequency point as an example. Experimental data were collected on 24 September 2022. The experiment lasted five days, and the sampling frequency was 1 Hz. Figure 11 is the true value of the carrier difference between $A$ and $B$ calculated according to Formula (3), corresponding to $\Delta {\phi }_{ij}^s$ in Formula (22). Figure 12 is the carrier difference in Formula (22), which is corrected by using the power-on clock correction, corresponding to $Fr\left(\Delta {\tilde{\phi }}_{ij}^s+c\Delta d{t}_{ij}\right)$. Figure 13 is the calculation result of $Fr(\eta )$, which is the difference between the data in Figure 11 and Figure 12.

3.2.2. False Alarm Experimental Results

In this section, two experiments were performed under the non-spoofing condition. The first experiment was conducted on 20 October 2022. Additionally, the second experiment was conducted on 25 October 2022. The calculated value of DOA is obtained according to the airspace information, and the expected value of DOA is obtained according to the ephemeris information. In the experiments, the difference between the two groups of values was compared, and the SSE test metric and the false alarm rate were calculated. Figure 14 and Figure 15 show the comparison information of the expected and calculated values of the elevation angle and azimuth angle of G04 and G09 in the first experiment.

Table 2. Elevation angle error statistics.

	$\mathbf{Maximum} (°)$	$\mathbf{Average} (°)$	$\mathbf{Std} (°)$
G04	1.98	0.3838	0.3191
G09	3.57	0.8474	0.5805
G16	4.11	0.3901	0.4806
G26	2.88	0.8492	0.5970
G27	3.19	0.9448	0.5836
G31	4.32	0.9099	0.6795

and

Table 3. Azimuth angle error statistics.

	$\mathbf{Maximum} (°)$	$\mathbf{Average} (°)$	$\mathbf{Std} (°)$
G04	2.48	0.6740	0.4353
G09	2.12	0.6646	0.4202
G16	6.7	1.2903	0.9061
G26	3.26	1.0334	0.6467
G27	3.04	1.1555	0.6879
G31	2.67	1.0958	0.6073

show more satellite elevation and azimuth error statistics for the first experiment.

Figure 16a and Figure 16b, respectively, show the SSE test metric and the judgment information of the receiver state in two different experiments.

3.2.3. Spoofing Experiments Results

The following shows the experimental results under the spoofing condition. The scene of the spoofing experiment is shown in Figure 8. Two spoofing experiments were conducted on 27 December 2022, and the experimental results are shown in Figure 17a and Figure 17b, respectively.

Figure 18 shows the details of G14 and G21 in the first spoofing experiment, and the part between the two red dotted lines indicates the time period when the spoofer device is turned on. Figure 19 shows the changes in the orientation of all satellites in the airspace for normal and spoofing situations.

4. Discussion

4.1. Discussion on Error Calibration Results

This section discusses the results obtained in Section 3.2.1.

It can be seen from Figure 9 that the correction values are the same among different satellites of the same frequency because the receiver’s power-on clock error is related to the receiver but has nothing to do with the satellite. The test results are consistent with reality. The data in Table 1 provide clearer evidence of this conclusion. The frequency of both GL1 and B1C is the same, while their frequency does not coincide with that of B1I. Therefore, the power-on clock error of GL1 and B1C are the same but different from that of B1C. This is consistent with the derivation of Formula (21), and the power-on clock error is related to the signal frequency. Figure 10 shows the statistical results of the mean value of $Fr(c\Delta d{t}_{ij})$ of all satellites among multiple receivers over a period of time.

The fractional part $Fr(\eta )$ of the hardware delay error includes cable delay error, multipath error, and antenna phase center error. In this paper, the correction of this error is carried out by using the method of long-term calculation and drawing the error sky map. In Figure 11, Figure 12 and Figure 13, the antenna $A$ is selected as the reference antenna, which is located at the origin of the ENU coordinate system. Ignoring the elevation angle and considering the influence of the azimuth angle, the relative positions of the four antennas in the sky map can be obtained. It can be seen that the sky diagrams of the true and calculated values of carrier difference are approximately symmetrical along the baseline $AB$. Additionally, the values in the diagram along the baseline $AB$ vary across integers as the elevation angle changes. This feature is more prominent in Figure 12. When the satellite flies above the $AB$ baseline, as the ambiguity difference between stations changes, the corresponding calculated value also changes across integers. This is the reason for the change of crossing integers. The number of times of crossing integers is related to the length of the baseline, and in Figure 11 and Figure 12, it is consistent with the length of the $AB$ baseline. The blank part within the azimuth angle of 330° to 30° in Figure 12 is caused by the fact that there is no sub-satellite point in the north of the test area. The results of $AC$ and $AD$ are similar to those of baseline $AB$ and will not be repeated here.

4.2. Discussion on False Alarm Experimental Results

This section discusses the results obtained in Section 3.2.2.

It can be seen from Figure 14 and Figure 15 that the calculated values are very concentrated around the expected value, and the error between the two fluctuates within a small range. The calculation error of G09 is slightly larger than that of the G04 satellite, which is caused by the lower elevation angle of G09. The observation error accuracy is related to the elevation angle, and a lower elevation angle may lead to an increase in the observation error. In extreme cases, wrong calculations may even occur, and a reasonable elevation angle threshold can be set when the number of satellites is sufficient. There are two possible reasons for the larger observation errors at lower elevation angles. One is that the lower elevation angles lead to lower arrival power and poorer signal quality of satellite signals. The second is that the antenna layout of the planar array limits the accuracy of DOA estimation. From Table 2 and Table 3, it can be seen that the average error and standard deviation of the elevation and azimuth angles are small, the data results are stable and reliable, and the maximum error is within an acceptable range. It shows that the DOA calculation method proposed in this paper is effective and reliable.

In Figure 16a,b, we define two status tags. We mark it as “Real” when the SSE test metric is smaller than $SS{E}_{th}$. Otherwise, we mark it as “Spoof” when the SSE test metric is larger than $SS{E}_{th}$, indicating that at least one spoofing signal exists. The detection threshold $SS{E}_{th}$ for spoofing is related to the number of satellites and the chosen false alarm rate $P_{FAR}$. In this paper, $P_{FAR}$ is $1\times {10}^{-3}$. It can be seen from Figure 16a,b that the SSE test metric in each epoch is smaller than the threshold. The state tag of all epochs is judged to be “Real”, which is consistent with the actual situation. This shows that the calculation method and the selection of $SS{E}_{th}$ in this paper are reliable.

4.3. Discussion on Spoofing Experiments Results

This section discusses the results obtained in Section 3.2.3.

The spoofing experiments were conducted according to the following description. First, the GPS L1 data of the satellite is normally received through the four antennas. After a period of time, turn on the spoofer device and broadcast spoofing signals to the four antennas. In the spoofing state, all the receiver receives are spoofing signals. After some time, turn off the spoofer device, and the four antennas will receive normal satellite signals again. The experiments mainly focus on the change of the SSE test metric under the spoofing state. The results of two spoofing experiments are shown in Figure 17a,b, respectively. During the time period without spoofing, the SSE test metric is smaller than the threshold. At the moment when the spoofer device is turned on or off, the SSE test metric has a large jump, and its value has a sudden change of about ${10}^2$ magnitude. The SSE test metric is much larger than the threshold during the time period when the receiver is spoofed (the time period between the red dotted lines in Figure 17a,b). Each epoch can accurately determine whether the receiver has received spoofing signals, and the detection rate reaches 100%.

In the case of spoofing, the elevation angle and azimuth angle of each spoofing signal is the direction information of the spoofer. It can be seen from Figure 18 that before the receiver is spoofed, the elevation and azimuth angles of G07 and G14 are different, and the satellite signal is related to the real position of the satellite in the airspace. After the receiver is spoofed, the elevation and azimuth angles of the two satellites suddenly change to near the true value of the direction of the spoofer. This is consistent with reality because, at this time, the signals received by the receiver are all sent by the transmitting antenna of the spoofer. After the spoofer device is turned off, the receiver receives satellite signals normally. The elevation angle and azimuth angle of the two satellites are no longer close to the direction of the transmitting antenna and return to normal. In this experiment, under spoofing conditions, since all satellite signals have the same DOA, and the calculated value of DOA is far from the expected value, it can be identified that the received signals are all spoofing signals.

Figure 19 shows the changes in the orientation of all satellites in the airspace for normal and spoofing situations. Before the spoofer device is turned on, the satellites are at various locations in the airspace. After turning on the spoofer device, the number of satellites simulated by the spoofer is reduced compared with the normal situation, and the elevation and azimuth angles of the satellites are suddenly changed to the direction of the transmitting antenna of the spoofer, which is consistent with the reality.

Table 4. Statistical value of the difference between spoofing signal DOA and true DOA.

	$\Delta {\mathit{g}}_{\mathit{n}}$ Mean (°)	$\Delta {\mathit{g}}_{\mathit{n}}$ Std (°)
G01	4.61	1.22
G14	4.65	1.17
G21	4.60	1.25
G17	4.67	1.23

shows the different information $\Delta g_n$ on the DOAs of each signal broadcast by the spoofer. It can be seen from Table 4 that because the spoofing signals broadcast by the same spoofer reach the receiver through the same propagation path, the differences in DOAs between different signals are very small. This is consistent with reality. The direction of the transmitting antenna of the spoofer is $Ele=41°, Azi=33°$, and the error between the calculated values and the real value is within $5°$.

4.4. Advantages and Disadvantages

This section discusses the advantages and disadvantages of the proposed methods.

The advantages of the proposed method in the article are summarized as follows: Firstly, it achieves spoofing detection and direction-finding using low-cost commercial board components. The implementation of spoofer direction finding is no longer limited to expensive array antennas. Secondly, it solves the question of power-on clock error in low-cost receiver boards. Moreover, the issue of low-cost antennas being susceptible to unstable antenna phase centers and multipath effects. Thirdly, the method proposed in the article simplifies the algorithm for solving carrier phase ambiguity.

The shortcomings of the proposed method in the article are summarized as follows: firstly, in low-elevation situations, the calculation accuracy of DOA is relatively poor, which may be limited by the planar geometric configuration of the antennas in this article. Secondly, due to the simplification of the calculation method for carrier phase ambiguity in the article, both the power-on clock error and the hardware delay error are relative values. If we want to obtain an absolute value, we need to fix the carrier phase ambiguity. The unique determination of ambiguity can also provide assistance in determining the final DOA.

5. Conclusions

This paper proposes a method for spoofing detection and direction-finding based on low-cost commercial board components. By using low-cost commercial board components, approximate DOA calculation accuracy can be obtained. The main conclusions are as follows:

(1)

Low-cost commercial board components can be used for large-scale deployment and implementation due to their low-cost and low-complexity algorithms, with high feasibility and potential application value;

(2)

Compared with professional equipment, low-cost commercial board components must solve two problems in anti-spoofing applications, namely, power-on clock error and hardware delay. The hardware delay includes cable delay error, multipath error, and antenna phase center error. In this paper, the influence of the two problems on the carrier difference is theoretically deduced, and the corresponding error correction method is proposed. Aiming at the power-on clock error, it is proposed to use pseudo-range and instantaneous Doppler values to correct it. For the hardware delay error, this paper uses the method of depicting the time-series average sky map to compensate for it. Finally, an experiment is carried out on the error term, and the experimental results are consistent with the theoretical derivation and the actual situation;

(3)

In the anti-spoofing method, a binary hypothesis testing model is constructed. With a certain false alarm rate, a 100% spoofing detection rate is achieved. Additionally, all spoofing signals are identified. Furthermore, the direction information of the spoofer is obtained under the spoofing condition. The direction error is within 5° range, achieving high accuracy.

In future work, we will pay more attention to the following research. One is to explore the relationship between the configuration of the antenna array and the accuracy of DOA at low elevation angles. The second is to apply low-cost commercial board components to more anti-spoofing scenarios. The third is to conduct test experiments in combination with more common low-cost components.