Necessary Condition for the Success of Synchronous GNSS Spoofing

A synchronous GNSS generator spoofer aims at directly taking over the tracking loops of the receiver with the lowest possible spoofing to signal ratio (SSR) without forcing it to lose lock. This paper investigates the factors that affect spoofing success and their relationships. The necessary conditions for successful spoofing are obtained by deriving the code tracking error in the presence of spoofing and analyzing the effects of SSR, spoofing synchronization errors, and receiver settings on the S-curve ambiguity and code tracking trajectory. The minimum SSRs for a successful spoofing calculated from the theoretical formulation agree with Monte Carlo simulations at digital intermediate frequency signal level within 1 dB when the spoofer pulls the code phase in the same direction as the code phase synchronization error, and the required SSRs can be much lower when pulling in the opposite direction. The maximum spoofing code phase error for a successful spoofing is tested by using TEXBAT datasets, which coincides with the theoretical results within 0.1 chip. This study reveals the mechanism of covert spoofing and can play a constructive role in the future development of spoofing and anti-spoofing methods.