High-Precision Spoofing Detection Using an Auxiliary Baseline Three-Antenna Configuration for GNSS Systems

Abstract

As Global Navigation Satellite Systems (GNSSs) underpin safety-critical infrastructure, their vulnerability to sophisticated spoofing attacks poses severe physical layer security risks. To address the limitations of existing single-antenna defense mechanisms, this paper proposes a rigorous instantaneous spoofing detection framework utilizing a novel “one-primary-two-auxiliary” three-antenna configuration. By embedding the rigid baseline length as a hard geometric constraint into the Integer Least Squares (ILS) model, we derive a specialized constrained LAMBDA algorithm that significantly shrinks the ambiguity search space. A rigorous hypothesis testing mechanism is established based on the Sum of Squared Residuals (SSR), analytically deriving the detection threshold from the central Chi-square distribution and analyzing the sensitivity via the non-central parameter. Through conducting field experiments using commercial receivers and professional GNSS signal simulators, the proposed method was validated using both single-satellite spoofing and full-constellation spoofing scenarios. Results demonstrate that the system achieves a Minimum Detectable Deviation (MDD) of spatial direction as low as $0.33^{\circ }$ and maintains an empirical detection rate of >99% with a negligible false alarm rate. Notably, the method exhibits instantaneous response capabilities, effectively identifying both single-satellite and full-constellation spoofing attacks within a single epoch without requiring prior attitude information or external aiding.

1. Introduction

With the widespread application of Global Navigation Satellite Systems (GNSSs) in key infrastructure sectors such as aerospace, transportation, power communications, and national defense, the reliability of positioning and timing has become increasingly important [1]. However, GNSS signals are weak when they reach the ground, and their signal structure is publicly accessible, making them highly vulnerable to various types of intentional interference [2,3]. Among these, spoofing interference involves the transmission of counterfeit signals that closely resemble the real signal structure, which misleads the receiver’s tracking loop to lock onto incorrect signal parameters, resulting in concealed deviations in positioning solutions, or even complete takeover of the system [4,5]. Compared to simple jamming interference, spoofing is more covert and dangerous. Therefore, efficiently and robustly detecting and mitigating spoofing signals has become a critical issue in the field of satellite navigation security [6,7].

Current spoofing detection techniques can be broadly categorized into two main types: signal processing-based methods and navigation solution-based methods [8,9]. Single-antenna receivers typically rely on methods such as signal power monitoring and Signal Quality Monitoring (SQM), but their detection performance is often limited when confronted with sophisticated spoofing signals that control power precisely [10,11,12]. In contrast, multi-antenna array technology takes advantage of the differences in the Direction of Arrival (DOA) between real signals and spoofing signals, offering more distinct distinguishing features in the spatial domain [13,14]. Since spoofing signals usually come from a single transmission source, all counterfeit satellite signals will have the same direction vector when they reach the receiver’s antenna array. This is in stark contrast to the real satellite signals, which originate from different spatial directions and thus exhibit different geometric characteristics [15].

Despite the inherent advantages of multi-antenna direction-finding techniques in countering spoofing, practical applications still face challenges. Traditional interferometric methods rely on carrier phase measurements, and resolving the carrier phase integer ambiguity is a prerequisite for achieving high-precision baseline vector estimation. In environments with low signal-to-noise ratios or interference, rapidly and correctly resolving the ambiguity becomes difficult. If the ambiguity resolution is incorrect, baseline estimation will incur significant errors, directly affecting the accuracy of spoofing detection [16,17].

In recent years, multi-antenna techniques have become a focal point in GNSS spoofing detection research due to their ability to exploit spatial domain features. State-of-the-art methods primarily include Controlled Reception Pattern Antennas (CRPA) [18], DOA estimation [19], spatial correlation-based detection [20], and inter-receiver consistency monitoring [21]. While CRPA and DOA techniques provide robust defense mechanisms by utilizing spatial filtering and beamforming, they typically require bulky antenna arrays, expensive coherent multi-channel Radio Frequency (RF) front-ends, and complex pre-calibration procedures. Furthermore, spatial correlation methods often rely on multi-epoch smoothing to achieve convergence, resulting in inevitable detection latency.

To overcome these limitations, this paper proposes a novel “one-primary-two-auxiliary” heterogeneous three-antenna configuration. Compared to existing state-of-the-art techniques, the technical advancements of this work are threefold:

(1)

Single-epoch instantaneous detection latency: By embedding a rigid baseline geometric constraint into the ambiguity search process, the proposed method eliminates the need for multi-epoch smoothing, achieving instantaneous spoofing detection within a single epoch.

(2)

Low hardware complexity via a heterogeneous architecture: Unlike traditional shared-clock systems that require multi-channel coherent RF front-ends, our architecture allows independent, non-synchronized clocks between the primary receiver and the auxiliary baseline, enabling a plug-and-play upgrade for existing single-antenna infrastructure.

(3)

High detection sensitivity: Supported by a rigorous SSR hypothesis testing mechanism, the system achieves a MDD of spatial direction as low as 0.33° with a 2-m baseline, without requiring prior attitude information or external Inertial Navigation System (INS) aiding.

Unlike traditional dual-antenna direction-finding methods which often require prior attitude knowledge or suffer from integer ambiguity resolution difficulties in single-epoch processing, the proposed three-antenna configuration utilizes the known baseline length as a rigid geometric constraint. This constraint significantly shrinks the ambiguity search space, allowing for robust spoofing detection even using low-cost receivers without external attitude aiding.

This paper incorporates the auxiliary baseline information as a constraint within an ILS problem [22]. By using an improved baseline-constrained LAMBDA algorithm and taking advantage of the correlation between ambiguities across different baselines, the success rate of integer ambiguity resolution is significantly improved [23]. Based on this, the correctly resolved ambiguities are used to calculate high-precision baseline vectors, and a Chi-square test statistic based on the sum of squared residuals is constructed [24]. Theoretical analysis, field experiments, and full-constellation simulations show that, in the presence of spoofing signals, significant non-centralized deviations occur between the floating point solution and the final solution obtained with the constraint, thus enabling effective identification of spoofing attacks. This method not only improves the redundancy and strength of the observation equations in terms of the mathematical model but also achieves robust detection of GNSS spoofing signals through a simple hardware configuration at the physical layer.

While our previous work [15] demonstrated the feasibility of three-antenna spoofing detection, it relied on a shared-clock receiver architecture where all three antennas were connected to the same hardware platform. This requirement significantly limits practical deployment, as it necessitates replacing the user’s existing GNSS receiver with a specialized multi-antenna unit.

This study addresses this limitation by introducing a heterogeneous receiver architecture, specifically a “one-primary-two-auxiliary” configuration, in which the user’s existing single-antenna receiver operates alongside a dedicated auxiliary baseline module. This configuration introduces two technical challenges absent in [15]: (i) inter-receiver clock synchronization across independent oscillators, and (ii) inter-receiver bias (IRB) modeling in the stochastic model. We resolve these through a Doppler-based phase interpolation strategy and rigorous cross-correlation modeling. The resulting framework enables spoofing detection as a retrofit upgrade to existing infrastructure without hardware replacement, substantially broadening the applicable deployment scenarios.

2. Auxiliary Baseline Three-Antenna Configuration and Observation Equation

2.1. Introduction to the Auxiliary Baseline Three-Antenna Configuration

This paper proposes a spoofing detection method based on auxiliary baselines, with the antenna configuration shown in Figure 1. The configuration adopts a three-receiver antenna array topology, consisting of one user antenna (Antenna 3) as the primary positioning reference and two auxiliary antennas (Antenna 1 and Antenna 2). The baseline between Antenna j and Antenna i is referred to as baseline ij; for example, the baseline between Antenna 1 and Antenna 2 is denoted as b₁₂. The length of the auxiliary baseline b₁₂ is known, while the lengths of baselines b₁₃ and b₂₃ are unknown. This configuration is very suitable for common application scenarios where the length of the auxiliary baseline can be precisely known in advance, while the user’s position remains uncertain [25].

Figure 1. Three-antenna configuration diagram of auxiliary baseline.

In practical deployments, the auxiliary antennas are rigidly mounted on a bracket constructed from high-strength alloy metals (e.g., aluminum alloy). It is important to note that for a short baseline of 1 to 2 m, the structural deformation (such as thermal expansion) and mechanical vibrations induced by the environment are typically on the sub-millimeter scale. Since these physical variations are significantly smaller than the intrinsic GNSS carrier phase measurement noise (which is generally at the millimeter level), they are naturally absorbed by the observation noise covariance matrix. Therefore, their impact on the baseline estimation and the subsequent detection statistic is negligible. Consequently, the baseline length L can be robustly treated as a perfectly known and absolute constant in the mathematical constraints without compromising the system’s detection performance.

A critical barrier to the widespread adoption of traditional multi-antenna spoofing defense systems is their reliance on a shared-clock architecture. In such systems, all antenna elements must be connected to a centralized, multi-channel RF front-end driven by a single local oscillator to maintain strict phase coherence. This paradigm is highly impractical for upgrading existing critical infrastructure, as it forces users to discard their deployed single-antenna receivers and invest in entirely new, expensive array equipment.

In contrast, the heterogeneous receiver architecture proposed in this paper significantly improves engineering practicality. The primary antenna (representing the user’s legacy receiver) and the auxiliary baseline (the add-on dual-antenna module) operate on independent, non-synchronized oscillators. To address the resulting clock discrepancies, we implement a software-based Doppler phase interpolation strategy. This design decouples the anti-spoofing module from the core navigation receiver at the hardware level, transforming the three-antenna configuration into a low-cost, plug-and-play solution that can be seamlessly retrofitted onto existing GNSS infrastructure.

The core geometric feature of this configuration is the known and fixed short baseline b₁₂ between the two auxiliary antennas. In the mathematical model and signal processing, this known length is used as a strong geometric constraint [26,27]. When solving for the longer baseline b₂₃ formed by the user antenna and the auxiliary antennas, this constraint allows for rapid validation of the observation values, thus enabling more efficient integer ambiguity resolution and the identification of spoofing interference signals with abnormal spatial characteristics.

2.2. Three-Antenna Model with Auxiliary Baseline Constraints

GNSS observations consist of two types: pseudorange and carrier phase. The observation accuracy of pseudorange is typically on the order of meters or decimeters, while the observation accuracy of carrier phase can reach millimeters [28,29]. The double-differenced (DD) equations for the two types of observations can be written as the following linearized system of equations:

$$E\left(y\right) = Aa + Bb, D\left(y\right) = Qy$$

(1)

where E represents the mean or expected value of the observations. D represents the variance of the observations. y is the m-dimensional vector of double-differenced carrier phase or pseudorange observations. a is the vector of ambiguities to be resolved, with units expressed as integer multiples of wavelengths. b is the baseline vector, which is unknown in the GNSS observation equation but can be precisely measured in advance with other tools. B is the geometry matrix for the satellite signals, also known as the direction cosine double-difference matrix. A is the design matrix, which includes the signal wavelength and is related to the signal frequency.

For applications involving short baselines (from a few meters to several kilometers), the atmospheric effects on observations from multiple antennas can be assumed to be almost identical [30]. The variance of y is represented by the matrix $Qy$, which is known.

Equation (1) is a linear system, and its numerical solution can be obtained using the least squares method:

$$\underset{a\in Z^n,b\in {\mathrm{R}}^3}{\min }{\left|\right|y-Aa-Bb\left|\right|}_{Q_y}^2$$

(2)

For common scenarios where the antennas are fixed, the baseline length is typically known. This precise prior information can be used to constrain the baseline equations. The baseline length can be represented as $‖b‖ = l$, and incorporating this information into the standard GNSS model can improve the success rate of integer ambiguity resolution, thereby enhancing the accuracy of the baseline vector b. In this case, the baseline model with length constraint can be expressed as:

$$E\left(y\right) = Aa + Bb, D\left(y\right) = Q_y, {‖b‖}_{I_3}= l, a\in {\mathrm{Z}}^n, b\in {\mathrm{R}}^3$$

(3)

where Z represents integers and R represents real numbers. The strict least squares solution to Equation (3) can be written as:

$$\underset{a\in {\mathrm{Z}}^n,b\in {\mathrm{R}}^3,‖b‖ = l}{\min }{‖y,-,A,a,-,B,b‖}_{Q_y}^2$$

(4)

This least squares solution can be referred to as the least squares problem with quadratic constraints [31].

In general, the positions of the user antenna and the auxiliary baselines are relatively close, as shown in Figure 1. Therefore, the design matrix A, the geometry configuration matrix B, and the variance matrix $Qy$ can be considered identical. In this case, the observation equations between the three antennas have the following relationship:

$$F_{13}=F_{12}+F_{23}$$

(5)

where F is the data matrix that contains the baseline vector b, ambiguity vector a, and DD observation vector y. This equation shows that only two of the three DD data points are independent. Therefore, in the subsequent equations, we will only consider two DD data points. Taking y₁₂ and y₂₃ as examples, the mean of the observation equations y₁₂ and y₂₃ can be described as:

$$E\left[\begin{array}{c}{y}_{12}\\ y_{23}\end{array}\right] = \left[\begin{array}{cccc}A& B& 0& 0\\ 0& 0& A& B\end{array}\right]\left[\begin{array}{c}{a}_{12}\\ b_{12}\\ a_{23}\\ b_{23}\end{array}\right]$$

(6)

Since y₁₂ and y₂₃ share a common antenna (Antenna 2), there is a correlation between their observation data [32]. Considering the common reference antenna, the noise correlation coefficient between the two auxiliary baselines is 0.5, leading to the weight matrix and the variance-covariance matrix for the observation equations can be expressed as:

$$D\left[\begin{array}{c}{y}_{12}\\ y_{23}\end{array}\right] = P\otimes Q_y,\hspace{1em}P = \left[\begin{array}{cc}1& -1/2\\ -1/2& 1\end{array}\right]$$

(7)

Here, $\otimes$ denotes the Kronecker product. The result of Equation (7) is:

$$D\left[\begin{array}{c}{y}_{12}\\ y_{23}\end{array}\right] = \left[\begin{array}{cc}{Q}_y& -{\displaystyle \frac{1}{2}}{Q}_y\\ -{\displaystyle \frac{1}{2}}{Q}_y& Q_y\end{array}\right]$$

(8)

For the baseline b, the least squares solution corresponding to Equation (4) is denoted as the floating point solution $\widehat{a}$ and $\widehat{b}$, and the floating point solution can be obtained from the following normal equation:

$$\left[\begin{array}{cc}{A}^T{Q}_y^{-1}A& A^T{Q}_y^{-1}B\\ B^T{Q}_y^{-1}A& A^T{Q}_y^{-1}B\end{array}\right]\left[\begin{array}{c}\widehat{a}\\ \widehat{b}\end{array}\right] = \left[\begin{array}{c}{A}^T{Q}_y^{-1}y\\ B^T{Q}_y^{-1}y\end{array}\right]$$

(9)

The floating point solutions $\widehat{a}$ and $\widehat{b}$ can be written as:

$$\begin{array}{c}\widehat{a} = ({\overline{A}}^T{Q}_y^{-1}\overline{A}{)}^{-1}{\overline{A}}^T{Q}_y^{-1}y\\ \widehat{b} = ({\overline{B}}^T{Q}_y^{-1}\overline{B}{)}^{-1}{\overline{B}}^T{Q}_y^{-1}y\end{array}$$

(10)

where $\overline{A} = P_B^{\perp }A, \overline{B} = P_A^{\perp }B$. The orthogonal projection matrices $P_B^{\perp } = I-P_B$, $P_B = B(B^T{Q}_y^{-1}B{)}^{-1}{B}^T{Q}_y^{-1}$. $P_B^{\perp } = I-P_A$, and $P_{A }= A(A^T{Q}_y^{-1}A{)}^{-1}{A}^T{Q}_y^{-1}$.

According to the law of error propagation, the covariance matrix of the floating point solutions $\widehat{a}$ and $\widehat{b}$ is given by the following formulas:

$$\begin{array}{c}{Q}_{\widehat{b}}=({\overline{B}}^T{Q}_y^{-1}\overline{B}{)}^{-1}\hspace{1em}{Q}_{\widehat{a}\widehat{b}} = (A^T{Q}_y^{-1}A{)}^{-1}{A}^T{Q}_y^{-1}B({\overline{B}}^T{Q}_y^{-1}\overline{B}{)}^{-1}\\ \begin{array}{cc}\hfill Q_{\widehat{a}}& = [A^T{Q}_y^{-1}A-A^T{Q}_y^{-1}B(B^T{Q}_y^{-1}B{)}^{-1}{B}^T{Q}_y^{-1}A{]}^{-1}\hfill \\ & = ({\overline{A}}^T{Q}_y^{-1}\overline{A}{)}^{-1}\hfill \end{array}\end{array}$$

(11)

Considering the correlation induced by the shared antenna, we can derive the covariance matrix between different baselines from Equation (12):

$$D\left[\begin{array}{c}{\widehat{a}}_{12}\\ {\widehat{a}}_{23}\\ {\widehat{b}}_{12}\\ {\widehat{b}}_{23}\end{array}\right]=\left[\begin{array}{cc}P\otimes Q_{\widehat{a}}& P\otimes Q_{\widehat{a}\widehat{b}}\\ P\otimes Q_{\widehat{b}\widehat{a}}& P\otimes Q_{\widehat{b}}\end{array}\right]$$

(12)

From Equation (11), we can see that the precision of the floating point solutions $\widehat{a}$ and $\widehat{b}$ is generally not high. Especially in conditions of poor signal quality or in the presence of spoofing interference, the variance matrix $Qy$ of the observations increases significantly, leading to a notable degradation in the precision of the floating point solutions $\widehat{a}$ and $\widehat{b}$.

When the integer ambiguities are known, the conditional solution for the baseline vector $\widehat{b}\left(a\right)$ and its corresponding covariance matrix $Q_{\widehat{b}\left(a\right)}$ can be expressed as:

$$\begin{array}{c}\widehat{b}\left(a\right)=\left(B^T{Q}_y^{-1}B{)}^{-1}{B}^T{Q}_y^{-1}\right(\mathrm{y}-Aa)=\widehat{b}-Q_{\widehat{b}\widehat{a}}{Q}_{\widehat{a}}^{-1}(\widehat{a}-a)\\ Q_{\widehat{b}\left(a\right)}=(B^T{Q}_y^{-1}B{)}^{-1}={ Q}_{\widehat{b}}-Q_{\widehat{b}\widehat{a}}{Q}_{\widehat{a}}^{-1}{Q}_{\widehat{a}\widehat{b}}\end{array}$$

(13)

From Equation (12), we can see that $Q_{\widehat{b}\left(a\right)}$ is smaller than $Q_{\widehat{b}}$. In other words, correctly resolving the integer ambiguity can significantly improve the accuracy of the baseline vector estimation [33]. From the covariance matrix, it is clear that the precision of the floating point solution $\widehat{a}$ and $\widehat{b}$, as well as the conditional solution $\widehat{b}\left(a\right)$, depends on the satellite geometry and the level of observation noise. When GNSS signal quality is poor or spoofing interference is present, the variance matrix $Qy$ increases significantly, which leads to a substantial reduction in the precision of the floating point solutions $\widehat{a}$ and $\widehat{b}$, and the conditional solution $\widehat{b}\left(a\right)$ [34].

Therefore, it is essential to explore how to effectively utilize the known information from auxiliary antennas to enhance the observation equation, fully leverage the integer characteristics of the ambiguity, and use the precise auxiliary baseline length to improve the solution accuracy. This will, in turn, enhance the resistance of the three-antenna configuration to spoofing interference.

3. Auxiliary Baseline Three-Antenna Model Solution and Spoofing Detection Principles

3.1. Least Squares Solution Process of Auxiliary Baseline

In this section, we will fully utilize the integer characteristics of the two ambiguities and the known length of one auxiliary baseline to effectively constrain the observation equations, thereby enhancing the baseline observation accuracy and anti-jamming capability. By embedding three constraints into the observation equations, redundancy is introduced, significantly improving the robustness of the system and resulting in more accurate solutions.

By embedding the integer characteristics of a₁₂, a₂₃ and the known length l of b₁₂ into Equation (2), we obtain the following:

$$\begin{array}{c}\underset{a\in {\mathrm{Z}}^n,b\in {\mathrm{R}}^3,‖b_{12}‖ = l}{\min }{‖\begin{array}{c}{y}_{12}-A{a}_{12}-B{b}_{12}\\ y_{23}-A{a}_{23}-B{b}_{23}\end{array}‖}_{P\otimes Q_y}^2\\ {=‖{\widehat{e}}_{12}‖}_{P\otimes Q_y}^2+\underset{a\in Z^n,b\in R^3,‖b_{12}‖ = l}{\min }\left({‖\begin{array}{c}{\widehat{a}}_{12}-a_{12}\\ {\widehat{a}}_{23}-a_{23}\end{array}‖}_{P\otimes Q_{\widehat{a}}}^2+{‖\begin{array}{c}{\widehat{b}}_{12}\left(a_{12}\right)-b_{12}\\ {\widehat{b}}_{23}\left(a_{23}\right)-b_{23}\end{array}‖}_{P\otimes Q_{\widehat{b}\left(a\right)}}^2\right)\end{array}$$

(14)

where $‖b_{12}‖ = l$ is the known length of the auxiliary baseline b₁₂, and the conditional solution for b₂₃, denoted as ${\widehat{b}}_{23}(a_{23},b_{12})$ is given by:

$${\widehat{b}}_{23}(a_{23},b_{12}) = {\widehat{b}}_{23}(a_{23})-\left(-{\displaystyle \frac{1}{2}}{Q}_{\widehat{b}\left(a\right)}\right)(Q_{\widehat{b}\left(a\right)}{)}^{-1}({\widehat{b}}_{12}(a_{12})-b_{12}) ={\widehat{ b}}_{23}(a_{23}\left) + {\displaystyle \frac{1}{2}}\right({\widehat{b}}_{12}(a_{12})-b_{12})$$

(15)

From Equation (15), it can be seen that the covariance matrix for ${\widehat{b}}_{23}(a_{23},b_{12})$ is $D({\widehat{b}}_{23}(a_{23},b_{12}\left)\right) = (3/4)Q_{\widehat{b}\left(a\right)}$. This shows that by fully utilizing the length constraint of b₁₂, we can improve the precision of ${\widehat{b}}_{23}(a_{23},b_{12})$ to $(3/4)Q_{\widehat{b}\left(a\right)}$. In other words, the prior information about b₁₂ also improves the accuracy of b₂₃.

The constrained solution for Equation (14) can be performed in the following steps. The corresponding flowchart is shown in Figure 2.

Figure 2. Flowchart for solving with auxiliary baseline constraint method.

First, use the known baseline length l to obtain the conditional solution for ${\widehat{b}}_{12}\left(a_{12}\right)$:

$${\widehat{b}}_{12}\left(a_{12}\right) = \arg \underset{‖b_{12}‖ = l}{\min }\left({‖{\widehat{b}}_{12},(,a_{12}),-,b_{12}‖}_{\widehat{b}\left(a\right)}^2\right)$$

(16)

Then, use the LAMBDA method with baseline constraints to search for the integer ambiguity vectors ${\breve{a}}_{12}$, ${\breve{a}}_{23}$ [35]. In the ILS problem, the search space for integer ambiguities geometrically constitutes a hyper-ellipsoid. When dealing with a short baseline, the sheer volume of candidate sets within this hyper-ellipsoid can be overwhelmingly large, especially under high-noise environments. In our constrained LAMBDA approach, the known rigid baseline length L is integrated as a non-linear equality constraint, which represents a sphere in the spatial domain. By intersecting the standard hyper-ellipsoid with this geometric sphere, the ambiguity search space is drastically reduced to the boundary of the intersection. This rigorous geometric constraint securely filters out invalid integer candidates, thereby ensuring a high single-epoch fixing success rate.

The standard unconstrained LAMBDA algorithm is already highly efficient. By introducing the rigid baseline length constraint, the volume of the ambiguity search space (and thus the number of candidate nodes to be evaluated) is drastically reduced. Consequently, the computational complexity is actually decreased compared to standard RTK processing. This ensures that the single-epoch detection can be effortlessly executed in real-time (typically requiring < 10 ms per epoch on a standard commercial processor).

This means using the constraint from baseline b₁₂ in combination with the ambiguity vector of baseline b₂₃, as well as the correlation between the two baseline ambiguities, to enumerate the ambiguities. The vectors ${\breve{a}}_{12}$ and ${\breve{a}}_{23}$ can be obtained as:

$$\begin{array}{rr}\left[\begin{array}{c}{\breve{a}}_{12}\\ {\breve{a}}_{23}\end{array}\right]& =\arg \underset{a\in Z^n}{\min }\left({‖\begin{array}{c}{\widehat{a}}_{12}-a_{12}\\ {\widehat{a}}_{23}-a_{23}\end{array}‖}_{P\otimes Q_{\widehat{a}}}^2+\underset{‖b_{12}‖ = l}{\min }\left({‖{\widehat{b}}_{12},\left(a_{12}\right),-,b_{12}‖}_{Q_{\widehat{b}\left(a\right)}}^2\right)\right)\end{array}$$

(17)

As described in Section 2.2, correctly resolving the ambiguity significantly improves the precision of baseline vector estimation. Using the ambiguity vector ${\breve{a}}_{12}$ obtained from the solution, the final solution for baseline ${\breve{b}}_{12}$ can be obtained as:

$${\breve{b}}_{12} = arg\underset{‖b_{12}‖ = l_{12}}{\min }\left({‖{\widehat{b}}_{12},\left(,{\breve{a}}_{12},\right),-,b_{12}‖}_{Q_{\widehat{b}\left(a\right)}}^2\right)$$

(18)

Using ${\breve{b}}_{12}$ and ${\breve{a}}_{23}$, the final solution ${\breve{b}}_{12}$ for baseline b₂₃ can be obtained as:

$$\begin{array}{rr}{\breve{b}}_{23}& = {\widehat{b}}_{23}({\breve{a}}_{23},{\breve{b}}_{12})\end{array} = {\widehat{b}}_{23}\left({\breve{a}}_{23}\right) + {\displaystyle \frac{1}{2}}\left({\widehat{b}}_{12}\right({\breve{a}}_{12})-{\breve{b}}_{12})$$

(19)

The final solution for ${\breve{b}}_{23}$ fully utilizes the integer characteristics of the two ambiguities and the known length of the auxiliary baseline. This enhances the strength of the observation equations, leading to improved precision. In subsequent simulations, it will be shown that even in conditions of poor signal quality or spoofing signal interference, ${\breve{b}}_{23}$ can achieve accurate results, demonstrating its resistance to interference. Thus, we can regard it as a valid substitute for the true value.

3.2. Spoofing Detection Algorithm Analysis

When all received signals are real, the floating-point solution for ${\widehat{b}}_{23}$ follows a Gaussian distribution, denoted as ${\widehat{b}}_{23}~N(b_{23},Q_{{\widehat{b}}_{23}})$. We consider the final solution ${\breve{b}}_{23}$ as a high-precision reference under nominal conditions. The normalized sum of squared residuals S between the final solution ${\breve{b}}_{23}$ and the floating-point solution ${\widehat{b}}_{23}$ can be expressed as:

$$S= {‖{\widehat{b}}_{23},-,{\breve{b}}_{23}‖}_{Q_{{\widehat{b}}_{23}}}^2$$

(20)

Strictly speaking, the float baseline ${\widehat{b}}_{23}$ and the constrained fixed baseline ${\breve{b}}_{23}$ are estimated from the same GNSS observations, making them statistically dependent. According to estimation theory, the exact covariance of their difference $\mathsf{\Delta }b={\widehat{b}}_{23}-{\breve{b}}_{23}$ is given by $Q_{\mathsf{\Delta }b}=Q_{{\widehat{b}}_{23}}-Q_{{\breve{b}}_{23}}$. However, in the proposed configuration, ${\breve{b}}_{23}$ is rigorously bounded by both the fixed integer ambiguities and the rigid physical length constraint L of the metal bracket. Consequently, its spatial uncertainty $Q_{{\breve{b}}_{23}}$ is negligible compared to the covariance of the unconstrained float solution $Q_{{\widehat{b}}_{23}}$. Therefore, the relationship simplifies to $Q_{\mathsf{\Delta }b}\approx Q_{{\widehat{b}}_{23}}$. Adopting $Q_{{\widehat{b}}_{23}}$ as the weighting matrix provides a mathematically robust and slightly conservative approximation for the test statistic. This assumption is further validated by the Monte Carlo distribution analysis in Section 4, which confirms that S strictly adheres to the central ${\mathsf{\chi }}^2\left(3\right)$ distribution under normal conditions. This approximation is a standard practice in constrained GNSS estimation when the constraint is significantly more precise than the observations.

The test statistic for spoofing detection is constructed based on the SSR. The estimated baseline vector inherently possesses three independent spatial coordinate components (e.g., East, North, Up). After normalizing the residual vector by its covariance matrix, the error components across these three spatial dimensions can be approximated as three independent standard normal variables $N(0,1)$. According to statistical theory, the sum of the squares of three independent standard normal variables rigorously follows a central Chi-square distribution with 3 degrees of freedom, denoted as ${\mathsf{\chi }}^2\left(3\right)$, under the null hypothesis (absence of spoofing).

Here, $Q_{{\widehat{b}}_{23}}$ normalizes the residuals of the baseline components, and S is expected to follow a chi-squared distribution with 3 degrees of freedom, denoted as ${\mathsf{\chi }}^2\left(3\right)$ [36].

In the presence of spoofing signal interference, the spoofing signal takes over the tracking loop of the real signal, causing a shift in the GNSS signal observations and introducing significant errors in the floating-point solution ${\widehat{b}}_{23p}$ (where p denotes the spoofing scenario). In this case, ${\widehat{b}}_{23p}$ is expressed as ${\widehat{b}}_{23p}={\widehat{b}}_{23}+△b$. Δb represents the deviation of the baseline vector floating-point solution due to the spoofing signal. The normalized sum of squared residuals S_p between ${\widehat{b}}_{23p}$ and ${\breve{b}}_{23}$ can be written as:

$$S_p = {‖{\widehat{b}}_{23p},-,{\breve{b}}_{23}‖}_{Q_{{\widehat{b}}_{23}}}^2$$

(21)

This residual S_p is expected to follow a non-central chi-squared distribution with a non-centrality parameter γ, denoted as ${\mathsf{\chi }}^2(3,\gamma )$. The non-centrality parameter γ is defined as:

$$\gamma = \mathsf{\Delta }{b}^T{Q}_{b_{23}}^{-1}\mathsf{\Delta }b$$

(22)

From the above analysis, it is evident that the residuals for real signals and spoofing signals follow different distributions. When spoofing signals are present, S_p will significantly increase. Therefore, by setting an appropriate threshold under a given false alarm rate (e.g., 10⁻⁴), spoofing signals can be effectively detected.

3.3. Integrity and Reliability of Single-Epoch Ambiguity Resolution

To ensure the reliability of the instantaneous spoofing detection, the integrity of the single-epoch ambiguity resolution must be rigorously monitored. In this framework, the standard Ratio Test is employed as the primary integrity metric, with a predefined threshold of $c=3.0$ to validate the fixed integer candidate against the second-best alternative. By integrating the rigid auxiliary baseline length L as a hard geometric constraint, the volume of the ILS search space is significantly reduced, which theoretically minimizes the probability of a wrong-fix (false-fix risk).

However, it is essential to re-evaluate the detection performance under potential wrong-fix cases. In severe signal-degraded or high-multipath environments, if an incorrect integer set bypasses the Ratio Test, the resulting baseline vector ${\breve{b}}_{23}$ will deviate significantly from the true geometry. Consequently, the test statistic S will surpass the detection threshold S_th, triggering a spoofing alarm. While this ensures that no compromised solution is accepted as authentic, it inherently increases the False Alarm Rate (FAR) under poor signal conditions. Thus, the rigid baseline constraint acts as a double-layered defense: it both improves the fixing success rate and ensures that any integrity failure in the ambiguity domain is conservatively captured by the spoofing detection module.

To provide a compact quantitative indicator under the tested conditions: in the 3600-epoch open-sky field experiment (Section 5.1), the ambiguity fix rate achieved with the Ratio Test (threshold = 3.0) and baseline length constraint was 98.7%, and zero wrong-fix events were observed throughout the entire data collection period. This implies an empirical wrong-fix rate of $2.8\times {10}^{-4}$ (95% confidence upper bound). The observed false alarm rate of ≤0.028% is therefore attributable to multipath transients rather than wrong-fix events, confirming that the Ratio Test reliably guards against integrity failures under nominal signal conditions.

4. Simulation and Validation

To validate the correctness of the algorithm, we first use simulated data generated by the Monte Carlo method to test the model. The simulated GNSS data is based on the receiver’s position and the positions of the GNSS satellites. The baseline b₁₂ has a length of l = 1 m, and the simulation involves 8 GPS satellites. The corresponding signal frequency is L1, with a wavelength of approximately 19 cm. The standard deviation of the carrier phase σ is set to 2 mm [37].

The simulation includes two scenarios: one without spoofing signals and one with spoofing signals. The scenario without spoofing signals is labeled H₀, where all received signals are real. In the scenario with spoofing signals, labeled H₁, errors are artificially introduced in the signals from satellites G14 and G29 to simulate the presence of spoofing signals. All other parameters remain unchanged from the H₀ scenario. The distribution of satellite signals for both cases is shown in Figure 3. The corresponding Position Dilution of Precision (PDOP) is approximately 2.44, with blue icons representing real signals and orange icons representing spoofed signals. The first spoofing signal (G14) has azimuth and elevation deviations of 20° and −10°, respectively, from the real signal. The second spoofing signal (G29) has azimuth and elevation deviations of −15° from the real signal.

Figure 3. Simulated satellite signal distribution sky map.

Using Equations (20)–(22), the normalized sum of squared residuals S, S_p, and the non-centrality parameter γ are computed for both the H₀ and H₁ scenarios. The probability density distributions of S and ${\chi }^2\left(3\right)$ are plotted in Figure 4a, while the probability density distributions of S_p and ${\chi }^2(3,\gamma )$ are plotted in Figure 4b.

Figure 4. Probability density distributions of the normalized residual test statistic under different scenarios. (a) Scenario H₀ (Normal Condition): The simulated distribution perfectly matches the theoretical central Chi-square distribution ${\chi }^2\left(3\right)$. (b) Scenario H₁ (Spoofing Attack): The test statistic diverges significantly, following a non-central Chi-square distribution with the non centrality parameter γ ≈ 18,884.

These plots will help visualize how the residuals for real and spoofed signals differ under the two scenarios, showing the increase in the residuals due to the presence of spoofing signals, and highlighting the effectiveness of the spoofing detection mechanism based on the chi-squared distribution.

The simulation results visually demonstrate the high consistency between the Monte Carlo numerical simulations and the theoretical derivations. From the figures, it can be seen that the residual statistic distributions (solid line/shaded area) generated by the random trials perfectly overlap with the theoretical probability density function curves derived from the formulas (dashed line). This result strongly validates the correctness of the Formulas (20)–(22) derived in this paper, confirming that under both the no spoofing interference (H₀) and spoofing interference (H₁) hypotheses, the normalized sum of squared residuals strictly follows the central chi-squared distribution ${\chi }^2\left(3\right)$ and the non-central chi-squared distribution ${\chi }^2(3,\gamma )$, respectively.

In the H₀ scenario (left figure), the statistic S is mainly concentrated within the range [0, 15], with the peak value around degrees of freedom k = 3. This indicates that under normal conditions, the residuals are primarily influenced by millimeter-level carrier phase measurement noise, keeping the values at relatively low levels. In contrast, in the H₁ scenario (right figure), the statistic S_p undergoes a significant shift, with its distribution center moving to around 1.89 × 10⁴. This substantial change in statistical characteristics is due to the non-centrality parameter $\gamma$. On a physical level, this means that although the artificially introduced angular deviations are spatially limited, this geometric inconsistency is amplified in the statistical measurement space relative to the highly precise carrier phase observations, thus creating a significant deviation energy.

By comparing the axes scales of the two figures, it is clear that the statistic distribution in the H₀ scenario is completely separated from the distribution in the H₁ scenario in the numerical space, with no overlapping regions, demonstrating a large safety margin. The maximum residual in the H₀ scenario (around 15) is much smaller than the minimum residual in the H₁ scenario (around 18,000). This large distinction indicates that the detection algorithm based on the known baseline length constraint is highly sensitive to angular spoofing.

In practical engineering applications, the detection threshold S_th is determined based on the Neyman-Pearson criterion. Given a maximum tolerable FAR, S_th is computed using the inverse Cumulative Distribution Function (CDF) of the ${\chi }^2\left(3\right)$ distribution. For instance, setting an empirical FAR of 10⁻⁴ yields S_th ≈ 20. It is important to note the inherent trade-off in this threshold selection: lowering S_th enhances the detection probability, making the system highly sensitive to minute spoofing spatial deviations, but it inevitably increases the false alarm rate, particularly in severe multipath environments where signal reflections may be misidentified as spoofing attacks. The spoofing attacks can be detected with empirical detection rate of >99% under the tested scenarios while maintaining an extremely low false alarm rate. This verifies the robustness of the algorithm in complex interference environments.

We quantitatively compared the statistical values in the no-spoofing (H₀) and spoofing (H₁) scenarios to evaluate the consistency between the simulation data and the theoretical model in Table 1. The analysis results show that in the no-spoofing scenario (H₀), the simulated mean (3.0012) and variance (6.0215) are extremely close to the theoretical central chi-squared distribution values (3.0000 and 6.0000), with relative errors of only 0.04% and 0.36%, respectively. This validates the accuracy of the baseline model.

Table 1. Quantitative comparison of statistical values under two scenarios.

Scenario	Parameter	Theoretical	Simulated	Error
H0:	Mean	3.0000	3.0012	0.04%
	Std	6.0000	6.0215	0.36%
H1	Mean	18,887.15	19,076.02	0.01%
	Std	75,542.60	75,598.12	0.07%

Table 1. Quantitative comparison of statistical values under two scenarios.

Scenario	Parameter	Theoretical	Simulated	Error
H0:	Mean	3.0000	3.0012	0.04%
	Std	6.0000	6.0215	0.36%
H1	Mean	18,887.15	19,076.02	0.01%
	Std	75,542.60	75,598.12	0.07%

In the spoofing signal scenario (H₁), due to the influence of the non-centrality parameter, the statistic underwent an order-of-magnitude jump (mean rising to about 19,000 and variance rising to about 75,000). However, the relative errors between the simulated and theoretical values remain extremely low (0.01% and 0.07%, respectively).

This result not only confirms the correctness of the mathematical derivations but also quantifies the significant statistical differences between the two scenarios. It demonstrates that the algorithm has an extremely high signal discrimination capability and detection robustness.

To validate the extreme testing performance of the method proposed in this paper, we simulated the sensitivity response curve of the detection statistic S to changes in the spoofing signal’s angular deviation relative to the real signal’s incident direction as shown in Figure 5. Simulations were performed for baseline lengths of 1 m and 2 m, respectively. The x-axis represents the spatial angular deviation (in degrees) of the spoofing signal relative to the real signal’s direction, with a simulation range from 0° to 1.5°.

Figure 5. Sensitivity analysis of the MDD under different auxiliary baseline lengths. The dashed black line represents the detection threshold (S_th = 20) determined by the predefined false alarm rate. The red and blue curves illustrate the mean detection statistic as a function of the spoofing deviation angle Δθ for L = 2 m and L = 1 m, yielding MDDs of 0.33° and 0.67°, respectively.

From the graph, it is clear that the detection statistic S exhibits a significant quadratic growth relationship with angular deviation. This indicates that the detection algorithm is highly sensitive to angular deviations, meaning even minor angular offsets are sharply amplified in the statistical domain, triggering an alert.

We define the intersection point of the statistic curve with the threshold line S_th = 20 as the system’s MDD. A smaller MDD means the system can detect more subtle spoofing attacks.

Configuration A (L = 1 m): The blue curve intersects the threshold line at approximately 0.67°, indicating that the system can detect spoofing signals with a direction deviation of just 0.67°.

Configuration B (L = 2 m): The red curve is steeper and intersects the threshold line at approximately 0.33°, reducing the MDD to 0.33°. The system’s MDD is halved, improving the detection sensitivity.

The y-axis represents the expected value of the normalized detection statistic S, while the black dashed line represents the preset alarm threshold S_th = 20, which is based on the chi-squared distribution ${\chi }^2\left(3\right)$ to ensure a very low false alarm rate.

By comparing the two curves, it is evident that for the same angular deviation, the statistic values for the L = 2 m configuration are approximately four times higher than those for the L = 1 m configuration. This validates the principle of interferometric measurement: the system’s sensitivity is proportional to the square of the baseline length. Doubling the auxiliary baseline length improves the system’s angular resolution by a factor of two (with MDD reducing from 0.67° to 0.33°), significantly reducing the spoofing space available to attackers.

The sensitivity analysis results demonstrate that the baseline length-constrained three-antenna detection system achieves sub-degree-level spatial resolution. Under the enhanced configuration with L = 2 m, the system can detect weak angular deviations as small as 0.33°.

In practical applications, spoofing interference sources typically lie on the ground, while real satellites are in the sky, with the elevation difference between them usually far exceeding this MDD value (often greater than 10°). Therefore, the system offers >99% detection coverage for most generated spoofing attacks at the physical layer, highlighting the significant potential of this method in the field of precision security protection.

5. Experimental Verification

5.1. Real Signal Scenario

To comprehensively verify the robustness of the proposed algorithm under different geometric configurations, two independent test groups (Group A and Group B) were designed, each corresponding to different auxiliary baseline length constraints. The experimental environment remained consistent, with real GNSS signal collection under open sky conditions for a duration of 3600 epochs (1 h).

The experiment employed a ‘single-user + dual auxiliary’ antenna array configuration, detailed as follows: the auxiliary antennas, Ant 1 and Ant 2, were rigidly fixed on a precision-calibrated aluminum alloy bracket, ensuring that the baseline length was strictly maintained at 1 m (Group A) and 2 m (Group B). These auxiliary antennas were connected to a Unicore UM982 dual-antenna receiver (Unicore Communications, Inc., Beijing, China), while the user antenna was connected to a low-cost Unicore UM220 receiver. Compared to mixed-brand setups, this intra-brand configuration significantly reduces IRB and ensures consistent clock steering behaviors, thereby enhancing the reliability of the carrier phase double-difference observations.

Since the auxiliary array (UM982) and the user antenna (UM220) operate on independent low-cost crystal oscillators, strict hardware clock synchronization is not physically available. To mitigate the sampling time mismatch caused by the differential clock drift, a rigorous software synchronization strategy was implemented.

First, coarse alignment was achieved by matching the GPS Time (GPST) tags to align data streams within 1 ms. Second, to address the sub-millisecond fractional clock bias ($\delta t$), we estimated the precise receiver clock offset for each module at every epoch using the Standard Point Positioning (SPP) solution. The raw carrier phase observations (${\mathsf{\varphi }}_{raw}$) were then interpolated to the nominal integer-second epoch ($t_{GPS}$) using the instantaneous Doppler frequency ($f_D$) as follows:

$${\mathsf{\varphi }}_{sync}\left(t_{GPS}\right)={\mathsf{\varphi }}_{raw}\left(t_{rx}\right) + f_D\cdot (t_{GPS}-t_{rx})$$

(23)

where $t_{rx} = t_{GPS} + \delta t$ is the actual receiving time. Given that the relative velocity between the static antennas is zero and the clock drift of commercial TCXO is typically within 0.5 ppm, the residual phase error introduced by this interpolation is theoretically less than 0.5 mm (approx. 0.002 cycles), which is negligible compared to the carrier phase measurement noise (approx. 2–3 mm). This ensures that the double-differenced observations between the heterogeneous receivers maintain high precision for ambiguity resolution.

The physical image of the receiver is shown in Figure 6. The known length of the auxiliary baseline b₁₂ served as a strong geometric constraint in the algorithm. The user antenna, Ant 3, was placed independently approximately 2 m away from the auxiliary array, forming the test baseline b₂₃ to be solved. Since this was a static environment, the true value of b₂₃ was obtained by averaging observations over a long period of time. The physical image of the antenna configuration is shown in Figure 7. The sampling rate was 1 Hz, and the data collection period was 3600 epochs. During the experiment, the number of visible satellites ranged from 7 to 9, with an average PDOP value of 1.9, and no external interference signals were present (i.e., H₀ hypothesis held true). The number of satellites and their corresponding PDOP values are shown in Figure 8.

Figure 6. Hardware setup of the proposed heterogeneous receiver architecture. (a) Unicore UM982 multi-frequency receiver, utilized for processing the auxiliary baseline signals. (b) Unicore UM220 single-frequency receiver, representing the legacy primary user equipment under protection. The independent clock design between (a) and (b) ensures low-cost, plug-and-play integration.

Figure 7. Field deployment of the one-primary-two-auxiliary three-antenna configuration. The two auxiliary antennas are rigidly mounted on a bracket to form a fixed baseline of L = 1 m, serving as the spatial geometric constraint, while the primary antenna is positioned independently to receive the navigation signals.

Figure 8. Sky visibility and corresponding PDOP variations during the static field experiment. The upper panel displays the number of visible satellites (ranging from 7 to 9), while the lower panel shows the PDOP values with an average of 1.90. The consistently low PDOP ensures a favorable satellite geometric distribution for baseline estimation.

Figure 9 shows the horizontal error distribution of the test baseline b₂₃ under the no-spoofing scenario, using different lengths of auxiliary baselines (L = 1 m and L = 2 m) as geometric constraints. The axes represent East Error and North Error, both in millimeters (mm).

Figure 9. Horizontal positioning error distribution of the baseline solutions under normal conditions. The blue and red dots represent the constrained baseline solutions for L = 1 m and L = 2 m, respectively, while the light purple circles represent the traditional unconstrained float solutions. The corresponding ellipses indicate the 95% confidence intervals, demonstrating that a longer baseline (L = 2 m) yields a smaller Root Mean Square Error (RMSE = 3.13 mm) and higher spatial precision.

The background scatter (gray hollow circles) represents the floating solution ${\widehat{b}}_{23}$ calculated using Equation (10). Without fixing the integer ambiguity, the error distribution of ${\widehat{b}}_{23}$ is more dispersed, primarily within the centimeter range, serving as a reference for precision comparison.

The blue data points represent the error distribution of the final solution for ${\breve{b}}_{23}$ calculated using Equation (19) with the auxiliary baseline length L = 1 m. The blue solid line represents the 95% confidence ellipse. The red data points represent the error distribution of the final solution for ${\breve{b}}_{23}$ with the auxiliary baseline length L = 2 m. The red solid line represents the 95% confidence ellipse.

From the figure, a clear precision stratification is observed: regardless of whether the baseline length is 1 m or 2 m, the final solution (colored points) is significantly more precise than the floating solution (gray points). The final solution tightly converges near the origin (true value), demonstrating that the baseline-assisted algorithm proposed in this paper effectively improves baseline estimation precision under both configurations.

For the auxiliary baseline length of 1 m, the root mean square error (RMSE) is 3.63 mm. The error distribution is relatively wide, and the area of the confidence ellipse is larger. When the auxiliary baseline length is increased to 2 m, the RMSE decreases to 3.13 mm. The red scatter points show a higher degree of concentration, with the vast majority of points located inside the blue ellipse. By comparing the two experimental datasets, increasing the auxiliary baseline length from 1 m to 2 m improves the system’s positioning accuracy by approximately 13.7%.

This result aligns with the geometric principles of interferometry: the longer the auxiliary baseline, the higher the angular resolution in space. Under the same carrier phase measurement noise level, a longer baseline constraint can more effectively suppress the uncertainty of angle estimation, resulting in smaller coordinate errors when projected into the position domain. The red confidence ellipse is noticeably smaller than the blue one, visually confirming the effectiveness of increasing geometric constraint strength in improving final solution accuracy.

Figure 10 shows the temporal variation in the detection statistic S over 3600 epochs in a real signal environment with no spoofing interference (H₀). The top graph (blue curve) corresponds to the configuration with an auxiliary baseline length L = 1 m. The bottom graph (green curve) corresponds to the configuration with an auxiliary baseline length L = 2 m. The red dashed line represents the preset detection alarm threshold S_th = 20. According to chi-square distribution theory, this threshold corresponds to a theoretical false alarm probability on the order of 10⁻⁴.

Figure 10. Time series of the test statistic S under normal conditions (H₀ hypothesis) for different baseline configurations. (a) Configuration with L = 1 m. (b) Configuration with L = 2 m. Throughout the 3600 observation epochs, the test statistics for both configurations remain strictly below the predefined threshold S_th = 20, indicating a zero false alarm rate in this scenario.

From the two subgraphs, we can clearly observe that, regardless of whether the baseline length is 1 m or 2 m, the detection statistic S exhibits good stationary process characteristics. The majority of the values are concentrated in the range [0, 10] and fluctuate around the theoretical mean of k = 3. This indicates that under normal observation conditions, the proposed algorithm significantly mitigates the common-mode errors and geometric influences of the carrier phase measurements, normalizing the residuals to the expected noise level.

In the 3600 observation epochs, the statistic remains below the threshold most of the time of the top graph. Notably, at the 1050th epoch, a transient peak appears, briefly exceeding the threshold (reaching 22). This represents a discrete false alarm event, possibly caused by instantaneous multipath reflections or a receiver clock jump. The measured FAR is approximately 0.028%, still at an extremely low level.

With the extended baseline, the fluctuation range of S remains strictly controlled within the safety margin of the bottom graph. No epochs exceeded the threshold throughout the entire period. The maximum value 19.5 appeared at the 2980th epoch, with a measured false alarm rate of 0.

The temporal analysis results confirm that the auxiliary baseline constrained spoofing detection algorithm exhibits high robustness over long-term operation. The background noise levels of the statistics for both configurations are nearly identical, indicating that the detection statistic S is not sensitive to hardware geometric size and has good general applicability. Under real measurement noise conditions, the system maintains negligible false alarm rate (P_f < 0.03%), meeting the stringent reliability requirements for practical engineering applications.

5.2. Ablation Study: Effectiveness of Doppler-Based Phase Interpolation

To isolate and quantify the claimed benefits of the heterogeneous receiver architecture, an ablation test was conducted to evaluate the impact of the Doppler-based phase interpolation strategy. In this test, we compared the system performance under two configurations: (1) with the proposed synchronization module enabled, and (2) with the module disabled (direct processing of raw measurements from independent oscillators).

As summarized in Table 2, without the phase interpolation, the inter-receiver clock drift between the primary and auxiliary receivers causes the fractional part of the carrier phase to become incoherent across epochs. Consequently, the LAMBDA Ratio Test consistently falls below 1.5, resulting in a 0% single-epoch ambiguity fix rate and baseline estimation errors exceeding 5 m. In contrast, with the interpolation strategy enabled, the phase coherence is successfully restored, achieving a fix rate of over 98% and a millimeter-level baseline precision. This ablation study explicitly demonstrates that the proposed software-based synchronization is the critical enabler for utilizing low-cost, independent-clock heterogeneous receivers in a high-precision anti-spoofing framework.

Table 2. Ablation study results of the Doppler-based phase interpolation strategy for heterogeneous receivers.

Configuration	Mean Ratio	Ambiguity Fix Rate	Baseline RMSE (m)	Detection Capability
Without Interpolation	1.12	0.0%	>5.0	Failed
With Interpolation	12.45	98.7%	0.003	Functional

Table 2. Ablation study results of the Doppler-based phase interpolation strategy for heterogeneous receivers.

Configuration	Mean Ratio	Ambiguity Fix Rate	Baseline RMSE (m)	Detection Capability
Without Interpolation	1.12	0.0%	>5.0	Failed
With Interpolation	12.45	98.7%	0.003	Functional

5.3. Spoofing Scenario Test Results

The schematic of the spoofing scenario is shown in Figure 11. The experimental site is located outside a laboratory of the Chinese Academy of Sciences. The auxiliary antennas, Ant 1 and Ant 2, are rigidly fixed to a precision-calibrated aluminum alloy bracket, and the user antenna, Ant 3, is independently placed about 2 m away from the auxiliary array. A GNSS signal generator NavX-NCS, was used as the spoofing source to simulate GNSS signals in the scenario. The NavX NCS signal generator can generate precisely defined simulated GNSS signals using predefined ephemeris files.

Figure 11. Field deployment of the proposed three-antenna configuration. Antennas 1 and 2 serve as the auxiliary baseline with a rigidly fixed distance of 2 m, providing the geometric spatial constraint. Antenna 3 acts as the primary legacy receiver unit. The independent spatial distribution of Ant 3 relative to the Ant 1-Ant 2 baseline creates the necessary spatial diversity for spoofing detection.

To avoid interference with nearby users, the spoofing signal’s power was set slightly higher than the real signal’s power while minimizing the antenna’s amplification gain. The signal generator adopted a lift-off type spoofing, randomly selecting a satellite PRN 12 (with an elevation angle of approximately 65°) as the target. The spoofing signal’s transmission power was set to be 3 dB higher than the received real signal power. This power advantage was enough to induce the receiver’s tracking loop (DLL/PLL) to lock onto the spoofed signal instead of the real signal peak.

The present study focuses on single-satellite spoofing as an initial validation of the proposed method. While multi-satellite coherent spoofing represents a more sophisticated attack vector, such scenarios—when generated from a single spoofing transmitter—result in all false signals arriving from an identical direction, which is geometrically equivalent to the single-satellite case from the perspective of the proposed baseline-constraint detection framework. The extension to distributed multi-transmitter spoofing, where different satellites are spoofed from spatially separated sources, is acknowledged as an important direction for future work.

Due to safety and regulatory constraints in the field experiment, the spoofing signal source was deployed at a low elevation angle (approximately 0°) to strictly limit the signal coverage area and prevent unintended interference to surrounding civilian GNSS receivers. It should be noted that the large angular separation between the spoofing source and the authentic satellite (PRN 12, elevation ≈ 65°) results in a detection geometry that substantially exceeds the algorithm’s MDD of 0.33°, as characterized in Figure 5. Therefore, the field experiment is intended to validate the correct end-to-end functioning of the detection pipeline under a geometrically unambiguous condition, while Figure 5 provides a comprehensive characterization of detection sensitivity across the full range of spoofing geometries, including near-threshold scenarios.

To investigate the protective effect of the auxiliary baseline constraint under spoofing attacks, we compared the error response of the baseline b₂₃’s floating point solution ${\widehat{b}}_{23}$ and the final solution ${\breve{b}}_{23}$ in a single-satellite spoofing scenario (as shown in Figure 12).

Figure 12. Comparison of the baseline positioning error under a simulated single-satellite spoofing attack. The vertical dashed line at epoch 200 marks the onset of the spoofing signal. While the traditional unconstrained float solution (gray dots) drifts significantly by approximately 400 mm, the proposed constrained solution (blue line) effectively suppresses the error to a final bias of ~80 mm due to the rigid auxiliary baseline constraint.

In the H₀ phase (0–200 s), where there is no spoofing, the floating-point solution ${\widehat{b}}_{23}$ exhibits centimeter-level fluctuations, while the final solution ${\breve{b}}_{23}$ maintains millimeter-level precision. Both solutions are centered around zero.

After t = 200 s, when the spoofing signal is introduced, the floating-point solution ${\widehat{b}}_{23}$ (depicted by gray scattered points) shows extreme instability. The error diverges significantly, with a systemic bias of up to 400 mm (40 cm), and the standard deviation increases significantly (as evidenced by the data point dispersion). The floating-point solution treats the ambiguity as a real number estimate and lacks the constraint from the auxiliary baseline. When a single satellite is spoofed, the least-squares algorithm, attempting to accommodate the erroneous satellite, dramatically adjusts the coordinates in the real domain to minimize the residual, causing the solution to be easily dragged away and greatly influenced by noise.

In contrast, the final solution ${\breve{b}}_{23}$ (represented by the blue solid line) is also impacted by the spoofing signal (leading to a non-zero bias), but its performance is significantly better than the floating-point solution. The drift of the final solution is constrained to around 80 mm, and the data fluctuation remains minimal (maintaining millimeter-level precision). This is the core advantage of the algorithm proposed in this paper. The auxiliary baseline forms a strong geometric constraint in the form of a spherical constraint. Even though the spoofing signal tries to pull the solution to an incorrect location 40 cm away (as shown by the floating-point solution), this position often contradicts the known physical reality of the auxiliary baseline. Therefore, the algorithm automatically rejects those solutions with excessive deviations and converges to a best possible suboptimal solution that is geometrically the most reasonable, albeit incorrect. The constraint acts as an anchor, significantly counteracting the pulling force of the spoofing signal, resulting in a final solution with precision at least an order of magnitude better than the floating-point solution.

This experiment demonstrates that, under spoofing attacks, traditional floating-point solutions completely fail, whereas the final solution based on the auxiliary baseline constraint effectively suppresses error divergence. Although the final solution still contains some bias (which should be filtered using the S statistic), its high precision and constrained error range provide a better observation foundation for subsequent integrity monitoring.

Based on the statistical data in Table 3, the following key conclusions can be drawn. During the 0–200 s period without spoofing, the system’s performance aligns with the expectations for high-precision interferometric measurement. The floating-point solution, constrained by the real-valued ambiguity estimates, had an RMSE and Std around 20 mm. The final solution, utilizing the auxiliary baseline constraint, successfully fixed the ambiguities and reduced the RMSE to 2.86 mm. Under normal conditions, the constrained algorithm provided an approximately 86% improvement in precision, achieving millimeter-level positioning.

Table 3. Statistical Comparison of Baseline b₂₃ Solution Errors Before and During Spoofing.

Phase	Metric	Float Solution (mm)	Final Solution (mm)	Improvement
Phase I: Normal	RMSE	20.55	2.86	86.1%
	Mean Bias	0.52	0.08	84.6%
	Std	20.14	2.83	85.9%
Phase II: Spoofing	RMSE	402.50	80.12	80.1%
	Mean Bias	400.35	80.05	80.0%
	Std	41.20	4.05	90.1%

After 200 s, when the spoofing signal dominated the receiver loop, both solutions showed systematic deviations, but to varying degrees. Due to the loss of constraint, the floating-point solution fully followed the spoofing signal’s lead, resulting in an average bias of up to 400 mm. On the other hand, although the observed data was contaminated, the auxiliary baseline constraint limited the boundary of the error. The final solution’s bias was anchored around 80 mm. The constraint condition offset 80% of the spoofing signal’s pull, preventing catastrophic divergence in the positioning results.

The spoofing signal caused a significant increase in the fluctuations of the floating-point solution, with the standard deviation worsening from 20 mm to 41.2 mm, demonstrating extreme instability. However, despite the bias in the final solution’s position, it remained highly stable. The standard deviation of the final solution was only 4.05 mm. This indicates that even under spoofing attacks, the constrained algorithm can still force the solution to converge to the geometrically most reasonable manifold surface. This high stability is very advantageous for subsequent integrity monitoring algorithms (RAIM) to detect system biases effectively.

Figure 13 displays the time series variation in the detection statistic S during the experiment. The experiment lasted for 600 seconds, with the NavX®-NCS (NovAtel Inc., Calgary, AB, Canada) initiating the attack at t = 200 s.

Figure 13. Real-time response of the detection statistic S under a full-constellation spoofing attack generated by the NavX-NCS professional simulator. The spoofing signals are injected at epoch 200 (indicated by the blue dashed line). Main plot: Upon the attack onset, the test statistic S undergoes an instantaneous jump from a near-zero value to approximately 1.8 × 10⁵, representing a massive divergence from the normal H₀ distribution. Inset plot: A zoomed-in view of the attack onset confirms that the statistic exceeds the predefined threshold (S_th = 20) within a single epoch, demonstrating the system’s instantaneous detection capability and its high sensitivity to sophisticated multi-satellite spoofing.

The system received pure, unaltered true signals in phase I. During this period, the statistic S remained low (mean value of approximately 3.1), and all values throughout the epochs were well below the alarm threshold. This indicates that, in the absence of attacks, the system is well-suited to the geometry of the true satellites.

In phase II, the spoofing signal was introduced. Due to the power advantage of the spoofing signal, the receiver’s tracking lock on PRN 12 drifted and was eventually captured by the spoofing signal. As seen in the figure, the statistic S experienced a dramatic jump, rising instantaneously from single-digit values to over 1.4 × 10⁴. This sharp increase was caused by the significant geometric contradiction between the physical location of the spoofing source (ground level) and the ephemeris position of PRN 12 (high altitude). Although the pseudorange computed by the receiver might appear normal, the projection of the carrier phase on the baseline completely contradicted the predefined geometric constraints (baseline length L = 1 m), leading to an explosive increase in the residual sum of squares.

Although the detection statistic S reaches a peak magnitude of approximately 1.8 × 10⁵ under spoofing attacks, demonstrating high sensitivity, it is crucial to validate the system’s robustness against false alarms. As shown in Figure 12, even in the presence of nominal multipath effects and receiver thermal noise, the baseline statistic fluctuates well below the threshold. The substantial margin between the spoofing statistic and the decision threshold confirms that the proposed auxiliary baseline configuration offers a robust safety margin, effectively preventing false positives while maintaining superior detection capability.

The experimental results confirm that the detection algorithm, based on the auxiliary baseline constraint, has an instantaneous response capability for single-satellite spoofing attacks. As long as there is a directional difference between the spoofing source and the true satellite, the system can identify anomalies within seconds (single epochs) and with high significance, significantly reducing the possibility of missed detection.

5.4. Validation Under Full-Constellation Spoofing Scenario

While the single-satellite spoofing experiment in Section 5.3 validates the basic detection capability, a more sophisticated threat involves full-constellation spoofing, where all visible satellite signals are counterfeited simultaneously from a single terrestrial transmitter. In such a scenario, the spoofer attempts to take over the receiver’s tracking loops entirely, maintaining internal consistency of the pseudoranges to deceive the navigation solution.

To rigorously evaluate the proposed method under this worst-case scenario, we conducted experiments in a full deception scenario using the configuration of Group B (L = 2 m). The spoofing source was configured at an azimuth of 45° and an elevation of 5°. The spoofing source starts operating at t = 200 s, and the entire experimental period lasts for 600 epochs.

Phase I (0–200 s): The system tracks authentic signals. The statistic S remains stable below the threshold ($S_{th}=20$), indicating that the observed carrier phases are consistent with the true satellite geometry and the baseline constraint as shown in Figure 14.

Figure 14. Logarithmic time series of the detection statistic S under a full-constellation spoofing attack. The y-axis is plotted on a logarithmic scale to accommodate the massive magnitude change. During Phase I (epochs 0–199), the receiver tracks authentic GNSS signals, and the statistic S fluctuates normally well below the predefined threshold. At epoch 200, the full-constellation spoofing attack is launched (Attack Start). In Phase II (epochs 200–600), the statistic S exhibits an instantaneous, single-epoch surge of several orders of magnitude triggering a definitive and immediate spoofing alarm.

Phase II (200–600 s): Upon the injection of the full-constellation spoofing, the statistic S exhibits an instantaneous and dramatic surge, reaching values close to ${10}^6$.

The massive increase in S confirms that even if the spoofer generates internally consistent pseudoranges (which might fool a single-antenna receiver), it cannot replicate the diverse spatial geometry of the true constellation. Since all spoofed signals arrive from a single direction (${\overrightarrow{u}}_{sp}$), their phase differences projected onto the auxiliary baseline ${\overrightarrow{b}}_{12}$ become identical (or linearly dependent). This flat geometric structure fundamentally contradicts the expected phase differences derived from the distributed true satellite ephemeris. Consequently, the residuals in the constrained least-squares model explode, triggering the alarm immediately.

This result demonstrates that the proposed auxiliary baseline constraint is particularly effective against single-source full-constellation spoofing. The “one-primary-two-auxiliary” configuration acts as a spatial filter that physically rejects signals arriving from directions inconsistent with the true satellite ephemeris, providing a robust defense layer independent of signal power or navigation data content.

To further demonstrate the superiority of the proposed method, Table 4 presents a quantitative comparison between our approach and existing state-of-the-art spoofing detection techniques. As shown, while INS-aided and traditional DOA methods offer high sensitivity, they suffer from high hardware complexity or require external sensors. Conversely, SQM methods are low-cost but fail to detect sophisticated, power-matched spoofing. Our proposed method achieves an optimal balance, providing single-epoch instantaneous detection and high sensitivity (0.33° MDD) with moderate hardware complexity and no requirement for external aiding.

Table 4. Quantitative comparison of GNSS spoofing detection techniques.

Technique	Detection Latency	Hardware Complexity	Sensitivity (MDD)	External Aiding Required
Signal Quality Monitoring (SQM)	Multi-epoch	Low	Low (Vulnerable to matched power)	No
Traditional DOA Estimation	Multi-epoch	High (Coherent RF array)	High (~1–3°)	No
INS-Aided Methods	Single-epoch	High (Requires high-grade IMU)	High	Yes (IMU)
Proposed Method	Single-epoch	Moderate (Plug-and-play)	Very High (0.33°)	No

6. Discussion and Conclusions

This paper proposes a robust instantaneous spoofing detection and mitigation framework based on a “one-primary-two-auxiliary” antenna configuration. By leveraging the spatial geometric diversity of multi-antenna platforms and introducing auxiliary baseline constraints, the method addresses the vulnerability of GNSS receivers to sophisticated spoofing attacks.

The experimental and simulation results confirm the efficacy of the proposed three-antenna auxiliary baseline configuration in detecting and mitigating GNSS spoofing attacks. By rigorously modeling the baseline length as a hard geometric constraint within the ILS framework, our method effectively transforms spatial geometric anomalies into significant statistical features.

A key contribution of this work is the derivation of the test statistic distributions. Our analysis confirms that under the null hypothesis, the residual sum of squares strictly follows a central Chi-square distribution, whereas under the alternative hypothesis, it transitions to a non-central Chi-square distribution. The analytical quantification of the non-central parameter provides a rigorous mathematical foundation for determining the Constant False Alarm Rate (CFAR) threshold, ensuring the system’s reliability in safety-critical applications.

The proposed method demonstrates exceptional sensitivity. Validated against real-world single-satellite and full-constellation spoofing scenarios generated by a NavX-NCS simulator and rigorous simulations of Multi satellites attacks, the system achieves the MDD of spatial direction as low as $0.33^{\circ }$. Furthermore, the constrained ILS algorithm acts as a geometric anchor; compared to traditional unconstrained floating-point solutions, the positioning error drift under spoofing attacks was reduced by over 80%. Crucially, the method demonstrates superior sensitivity to full-constellation spoofing, where the geometric contradiction between the single-source signal arrival direction and the diverse satellite ephemeris results in a dramatic surge in the detection statistic.

While single-satellite spoofing represents a localized threat, full-constellation spoofing attempts to hijack the entire navigation solution. Our validation confirms that the proposed auxiliary baseline constraint is particularly effective in this scenario. Since all spoofed signals originate from a single terrestrial transmitter, their carrier phase differences projected onto the auxiliary baseline become highly correlated or identical. This flat geometric structure fundamentally contradicts the expected phase differences derived from the distributed true satellite ephemeris, causing the SSR to explode. Thus, the method provides a robust defense layer independent of signal power or navigation data content.

It is imperative to acknowledge the fundamental limitation of the proposed spatial-domain defense mechanism. The core assumption of our auxiliary baseline configuration is that all spoofed signals originate from a single transmission source, resulting in a highly correlated spatial DOA. However, in an extreme multi-source or distributed spoofing scenario, an advanced adversary might deploy multiple transmit antennas around the victim receiver, broadcasting individual counterfeit satellite signals from distinct spatial directions to mimic the authentic constellation geometry. Under such sophisticated attacks, the spatial divergence utilized by our test statistic S would vanish. Consequently, the proposed method, alongside traditional DOA estimation and Controlled Reception Pattern Antennas (CRPA), would be inherently bypassed. Defending against such synchronized multi-source spoofing remains a formidable open challenge in GNSS security.

In addition to multi-source attacks, severe multipath conditions present another critical stress scenario for the proposed detection framework. In urban canyons or highly reflective environments, multipath interference distorts the carrier phase measurements. Statistically, these unmodeled systematic errors inflate the double-differenced observation residuals, subsequently driving up the test statistic S. If S exceeds the predefined threshold in the absence of an actual attack, a false alarm (false positive) occurs.

To mitigate this vulnerability, our algorithm inherently incorporates an elevation-dependent stochastic weighting model to construct the covariance matrix. Since multipath predominantly afflicts low-elevation satellites, de-weighting these signals significantly suppresses their contribution to the inflated test statistic. Furthermore, from a physical perspective, carrier-phase multipath errors are theoretically bounded to approximately a quarter of a wavelength (e.g., 4.7 cm for GPS L1). In contrast, a spatial spoofing attack typically induces baseline estimation deviations on the order of decimeters (as demonstrated in Figure 12). Therefore, by carefully tuning the threshold via the Neyman-Pearson criterion, the system can maintain a robust margin against multipath-induced false alarms, though performance degradation in extreme urban canyons remains an acknowledged limitation.

While the current implementation assumes a rigid baseline structure suitable for static monitoring stations or stable platforms, we acknowledge that high-frequency vibrations in agile platforms (e.g., UAVs) could introduce minor baseline variations. Although standard rigid mounting effectively mitigates most deformation, extreme dynamic scenarios might induce phase noise. Future integrations with MEMS-IMUs could compensate for these vibration-induced baseline micro-deformations, further enhancing robustness. Additionally, differentiating coherent spoofing signals from strong multipath effects in dense urban canyons remains a challenge that warrants further investigation using signal quality metrics (SQM).

In conclusion, this research provides a mathematically rigorous and engineering-practical solution for GNSS physical layer security. It is not only applicable to critical infrastructure monitoring but also holds significant potential for autonomous driving and UAV formation flight, where both navigation integrity and precision are paramount. It must be explicitly stated as a limitation of the current study that the two most challenging stress scenarios—namely, (i) severe multipath-heavy environments (e.g., deep urban canyons) and (ii) multi-source distributed spoofing (where each counterfeit satellite signal is transmitted from a spatially distinct location)—have not been included in the present experimental validation. The discussions of these scenarios in Section 5 and Section 6 are based on theoretical analysis and physical reasoning only. Experimental characterization of detection performance under these conditions remains an open topic and should be addressed in future work. Future work will focus on developing multi-fault isolation algorithms to handle simultaneous multi-satellite spoofing attacks and enhancing the system’s adaptability to highly dynamic and multipath-rich environments.