Measurement and navigation users can not operate without the positioning, navigation and timing (PNT) service provided by the global navigation satellite system (GNSS) instrumentation, but users are also faced with unpredictable and complex interference and even spoofing. In order to effectively control and even counter the unmanned aerial vehicle (UAV) that may pose security threats, using the GNSS spoofing technology to counter UAV is an effective and important technical means. Compared with the existing spoofing algorithms, this paper fully considers the navigation system configuration and flight control principle, as well as anti-spoofing module of UAV equipped, the UAV dynamic model under GNSS spoofing environment is established, and the response law of UAV state to spoofing is analyzed. In order to realize the covert directional spoofing on UAV equipped with tightly-coupled GNSS and inertial measurement unit (IMU), a GNSS covert spoofing algorithm is proposed. The algorithm includes a fixed-point four step spoofing strategy, and pay attention to avoiding the least squares residual receiver autonomous integrity monitoring (LSR-RAIM) of UAV, so as to ensure the concealment of the deception process. Through the construction of experimental platform and experimental analysis, the effectiveness and concealment of the algorithm are verified. The experiment shows that the spoofing yaw angle error of GNSS covert directional spoofing is -0.03°. In addition, the spoofer has effectively avoided the LSR-RAIM of UAV system in the whole process, and the evasion rate has reached 100% to achieve covert spoofing. For the actual spoofing scenario application, the spoofing yaw angle error can meet the actual needs. Future work will focus on the research and design of more complex covert spoofing algorithms to meet the spoofing needs of UAV equipped with more complex navigation systems and anti-spoofing techniques.

As Global Navigation Satellite System (GNSS) spoofing techniques are highly stealthy and pose a tremendous risk to targets using GNSS technology, studies on GNSS spoofing techniques have been in the spotlight. If the accurate position and velocity of the target receiver can be obtained, the target receiver can be covertly spoofed during the signal tracking stage using synchronous lift-off spoofing. However, it is often difficult to accurately obtain the position and velocity of a target in real GNSS spoofing scenarios. To address this problem, To study the effects of spoofing signals’ power (relative to the real signal), code pulling rate, carrier Doppler shift, initial code phase difference, and carrier phase difference on the efficacy of spoofing, the intrusion of receiver’s signal tracking loop by spoofing signals is mathematically modeled. Based on the model, an asynchronous lift-off spoofing for GNSS receivers in the signal tracking stage is proposed. Theoretical analysis and experimental results show that the new method resulted in stable Doppler frequency variations, short fluctuations in carrier-to-noise ratio (C/N) and signal lock time, and gentle changes to the receiver’s 3D Earth-Centered Earth Fixed (ECEF) coordinates, when the target’s position and velocity were approximately known during the intrusion period. The proposed spoofing method is highly feasible and could expand the scope of applicability of lift-off spoofing.

Vehicle and airborne navigation users are facing more and more complex signal interference and even spoofing. If vehicles and aircraft do not strengthen their anti-spoofing ability, their navigation performance is bound to be adversely affected. global navigation satellite system (GNSS) spoofing technology has gradually become a preferred interference method for spoofer because of its high concealment and great harm. For spoofer, user terminal increasingly adopts GNSS with inertial measurement unit (IMU): tightly-coupled GNSS/IMU, on this basis, user also configures a variety of anti-spoofing techniques to effectively deal with spoofing. Even if spoofer slowly changes user's positioning, if spoofing strategy is unreasonable, it will lead to the violation of parameter rationality of coupled filter output parameters and spoofing observation, which greatly increases the difficulty of spoofing. In view of the above problems, from the perspective of spoofer, in order to effectively counter the non cooperative target of assembling tightly-coupled GNSS/IMU by using GNSS spoofing, this paper establishes GNSS spoofing mathematical model, and proposes a slowly varying spoofing algorithm to avoid tightly-coupled GNSS/IMU with multiple anti-spoofing techniques based on the analysis of the influence mechanism of spoofing on the positioning of tightly-coupled GNSS/IMU, the algorithm proposes a measurement deviation determination method to avoid a variety of anti-spoofing techniques, which can gradually pull the positioning results of coupled system, and successfully avoid anti-spoofing techniques detection of least squares residual receiver autonomous integrity monitoring (RAIM) and parameter rationality check. The experimental results show that the algorithm can gradually change positioning of tightly-coupled GNSS/IMU within 30 s, and the north, east and down displacements basically achieve the spoofing effect, the errors with the expected offset are −0.5 m, 1.9 m and 12.7 m respectively. At the same time, the detection of the above anti-spoofing techniques is avoided. The mean value of test statistics for tightly-coupled system is reduced by 75.4% and does not exceed the alarm threshold, so as to achieve the purpose of spoofing, the effectiveness and high concealment of the spoofing algorithm are proved.

Satellite navigation spoofing has become a central issue of jamming technology research because of its serious threat and ability to conceal itself. Increasingly, targets are equipped with more robust GNSS/IMU systems and normalized innovation squared (NIS) is used to detect interference. Therefore, it is harder to implement covert trajectory spoofing on a GNSS/IMU system than a GNSS-only target. In practice, spoofing is needed to control unknown targets. Therefore, covert trajectory spoofing for GNSS/IMU targets is an important issue. Hence, using the information fusion of a GNSS/IMU system, the influence of spoofing on loosely coupled GNSS/IMU positioning is derived. To avoid ill-posed equations when introducing a measurement deviation, a Kalman gain matrix local regularization method is proposed to accurately determine the measurement deviation. To avoid triggering the NIS detection alarm, the range that enables the introduced measurement deviation to remain concealed is calculated. Then, a two-step trajectory guidance algorithm is proposed to quickly guide the target onto the spoofing trajectory. The simulation results show that the proposed trajectory spoofing algorithm can guide a loosely coupled GNSS/IMU target along a spoofing trajectory without triggering the NIS detection alarm. The proposed method can remain concealed and has good theorical and practical application value.

The global navigation satellite system (GNSS) receiver instrumentation can be used for precise timing of infrastructure such as smart grid, time spoofing on smart grid is one of the important purposes for spoofers. In order to meet more diverse demands for time spoofing, provide possible time spoofing schemes for the defense of time spoofing, the qualitative influence of modifying main parameters of navigation message and the sensitivity of satellite clock correction parameters are analyzed, two GNSS time spoofing algorithms of modifying satellite clock correction parameters in navigation message are proposed: step type time spoofing algorithm and slowly varying type time spoofing algorithm. The principles of the two algorithms are deduced, the performance and effectiveness of the two algorithms are verified and evaluated through simulation experiments and practical experiments using the open source GNSS observation data provided by Curin GNSS-SPAN Group. The experimental results and insights are follows: For step type time spoofing, the average error of time spoofing is -0.53m and the distance deviation in rectangular space coordinates of the receiver instrumentation is -1.24×10 ^-3 m, which can achieve the purpose of spoofing instantaneously, it has the advantage of spoofing in a very short time, but the step type change of clock offset of receiver instrumentation is easier to be identified and detected by the victim receiver instrumentation; For slowly varying type time spoofing, the average error of time spoofing is -2.49m, and the distance deviation in rectangular space coordinates of the receiver instrumentation is 1.52m, the average error of time spoofing is slightly larger, but the way of slowly increasing clock offset of receiver instrumentation will greatly improve the concealment of spoofing and greatly increase the detection difficulty for slowly varying type spoofing, but it also takes longer to achieve the ultimate goal of spoofing. Therefore, the spoofer is very likely to implement the two different time spoofing proposed, and their performance and characteristics are different.