GNSS Signal Structure Analysis and Spoofing Vulnerability Assessment

Introduction

Global Navigation Satellite Systems (GNSS) have become critical infrastructure for modern society, providing positioning, navigation, and timing (PNT) services to billions of users worldwide. However, the fundamental design of GNSS signals contains inherent vulnerabilities that make them susceptible to spoofing and jamming attacks. This article provides a comprehensive analysis of GNSS signal structure, identifies authentication weaknesses, and evaluates vulnerability characteristics across different signal types.

GNSS Signal Components

GNSS signals consist of three fundamental components that work together to deliver navigation information:

1. Carrier Signal

The carrier is a high-frequency sinusoidal wave that serves as the transmission medium. For GPS, the primary carrier frequencies are:

• L1: 1575.42 MHz (primary civilian signal)
• L2: 1227.60 MHz (primarily military, now also civilian)
• L5: 1176.45 MHz (modernized civilian safety-of-life signal)

The carrier enables precise phase measurements for high-accuracy positioning and provides the frequency reference for code modulation.

2. Spreading Code (Pseudo-Random Noise)

The spreading code modulates the carrier and provides multiple access capability through Code Division Multiple Access (CDMA). Key code types include:

• C/A Code (Coarse/Acquisition): 1.023 MHz chipping rate, publicly available, used on L1
• P(Y) Code: 10.23 MHz chipping rate, encrypted military code
• M Code: Modernized military signal with improved anti-jam characteristics
• L2C/L5 Codes: Modernized civilian codes with improved correlation properties

The spreading code enables signal acquisition, provides processing gain against interference, and allows multiple satellites to transmit on the same frequency.

3. Navigation Data

The navigation message contains critical information including:

• Satellite ephemeris (precise orbital parameters)
• Almanac data (coarse orbital information for all satellites)
• Clock correction parameters
• Ionospheric delay models
• System health and status information
• Time synchronization data

Navigation data is transmitted at low bit rates (50 bps for legacy GPS, 25 bps for modernized signals) and requires 30 seconds to several minutes for complete reception.

Signal Authentication Weaknesses

The fundamental vulnerability of GNSS stems from the lack of cryptographic authentication in legacy signal designs:

1. No Signal Authentication

Legacy GNSS signals (GPS L1 C/A, GLONASS L1OF, Galileo E1 Open) contain no cryptographic signatures. Receivers cannot distinguish between authentic satellite signals and counterfeit signals generated by adversaries. This enables:

• Spoofing: Generation of false signals that mimic legitimate transmissions
• Meaconing: Rebroadcasting of captured authentic signals with time delays
• Simulated Constellations: Complete fabrication of non-existent satellite signals

2. Predictable Code Structure

Open civilian spreading codes are publicly documented and can be generated by any adversary. The C/A code, for example, is defined by two 10-bit linear feedback shift registers with publicly known polynomials. This predictability enables sophisticated spoofing attacks that maintain code correlation properties.

3. Low Signal Power

GNSS signals arrive at Earth’s surface with extremely low power levels (approximately -130 dBm for GPS L1 C/A), making them vulnerable to:

• Overpowering attacks (jamming with signals 20-30 dB stronger)
• Subtle spoofing (spoofing signals only slightly above authentic signal levels)
• Environmental blockage (buildings, foliage, indoor environments)

4. Navigation Data Vulnerabilities

Even when signal structure is preserved, navigation data can be manipulated to introduce positioning errors. Ephemeris parameters, clock corrections, and time stamps can all be modified to produce false position solutions while maintaining signal authenticity indicators.

Vulnerability Analysis by Signal Type

L1 Signal Vulnerabilities

Characteristics: 1575.42 MHz, C/A code (1.023 MHz), BPSK modulation

Vulnerability Level: CRITICAL

• Most widely used civilian signal with largest attack surface
• Single frequency prevents ionospheric correction without external data
• Narrow bandwidth (2 MHz) limits multipath resistance
• No cryptographic authentication
• Extensively documented code structure enables easy replication
• Commercial spoofers readily available for $100-$1000

Attack Feasibility: Trivial with off-the-shelf equipment. Software-defined radio platforms (USRP, HackRF, ADALM-PLUTO) can generate convincing L1 spoofing signals.

L2 Signal Vulnerabilities

Characteristics: 1227.60 MHz, legacy P(Y) code encrypted, modern L2C civilian code

Vulnerability Level: HIGH (L2C) / MEDIUM (P(Y))

• L2C (Civilian): Similar vulnerabilities to L1 C/A but less commonly implemented in receivers
• P(Y) Code: Encrypted with W-code, requires classified AS (Anti-Spoofing) module
• Dual-frequency (L1+L2) enables ionospheric correction, improving spoofing detection
• L2C includes forward error correction and improved correlation properties
• Lower adoption rate reduces attacker incentive for L2C-specific spoofing

Attack Feasibility: L2C spoofing requires more sophisticated equipment but remains feasible. P(Y) code spoofing requires classified knowledge or sophisticated cryptanalysis.

L5 Signal Vulnerabilities

Characteristics: 1176.45 MHz, 10.23 MHz chipping rate, QPSK modulation, pilot+data channels

Vulnerability Level: MODERATE

• Higher chipping rate provides better multipath resistance
• Wider bandwidth (20 MHz) improves correlation peak sharpness
• Pilot channel enables longer coherent integration for weak signal acquisition
• Still lacks cryptographic authentication in open service
• Lower transmission power than L1
• Limited receiver adoption (primarily aviation and high-end applications)

Attack Feasibility: Requires wideband SDR capability and higher processing power. Less attractive target due to limited deployment, but fundamental authentication weaknesses remain.

Open vs Encrypted Signals Comparison

Key Differences

Encrypted Signals Advantages:

• Cryptographic authentication prevents code replication without keys
• Higher transmission power improves jamming resistance
• M-code includes additional anti-jam features (spot beams, steerable antennas)
• Restricted receiver access limits adversary capability development

Open Signals Disadvantages:

• Complete transparency enables adversary signal analysis
• No authentication mechanism beyond code correlation
• Lower power prioritizes battery life over robustness
• Mass market adoption creates large attack surface

Signal Hardening Recommendations

1. Multi-Frequency Reception

Implement receivers capable of processing multiple frequencies (L1+L2+L5) to enable:

• Ionospheric delay estimation and correction
• Cross-frequency consistency checks
• Improved multipath mitigation
• Redundancy against single-frequency jamming

2. Multi-Constellation Integration

Combine signals from multiple GNSS constellations (GPS, Galileo, GLONASS, BeiDou) to:

• Increase satellite visibility and geometric diversity
• Enable cross-constellation consistency verification
• Reduce vulnerability to constellation-specific attacks
• Improve availability in challenging environments

3. Cryptographic Authentication (When Available)

Implement emerging authentication mechanisms:

• Galileo OSNMA: Open Service Navigation Message Authentication (operational)
• GPS Chimera: Planned civilian authentication (future)
• QZSS CLAS: Centimeter-level augmentation with authentication

4. Signal Quality Monitoring

Deploy real-time signal quality metrics:

• Carrier-to-noise ratio (C/N₀) monitoring
• Signal power consistency checks
• Code-carrier divergence detection
• Correlation peak shape analysis
• Cross-correlation verification

5. Inertial Navigation Integration

Combine GNSS with inertial measurement units (IMU):

• Dead reckoning during GNSS outages
• Velocity and acceleration consistency checks
• Detection of impossible dynamics (spoofing indicator)
• Short-term navigation continuity

6. Network-Based Verification

Leverage external data sources for validation:

• Assisted-GNSS (A-GNSS) ephemeris verification
• Network time protocol (NTP) comparison
• Cell tower triangulation cross-checks
• Crowdsourced signal quality databases

7. Anti-Jam Antenna Systems

For high-value applications, implement:

• Controlled reception pattern antennas (CRPA)
• Adaptive nulling toward interference sources
• Beam steering for signal enhancement
• Multi-element arrays for spatial filtering

8. Machine Learning Detection

Deploy AI/ML-based anomaly detection:

• Pattern recognition for spoofing signatures
• Behavioral analysis of signal parameters
• Adaptive threshold adjustment
• Real-time classification of interference types

Conclusion

GNSS signal structure analysis reveals fundamental vulnerabilities inherent in legacy system designs. The combination of low signal power, predictable code structure, and lack of cryptographic authentication creates significant spoofing attack surfaces, particularly for open civilian signals. While modernized signals (L2C, L5) offer improved technical characteristics, they retain core authentication weaknesses.

Mitigation requires a defense-in-depth approach combining multi-frequency reception, multi-constellation integration, signal quality monitoring, and emerging authentication mechanisms. Critical infrastructure operators must recognize that GNSS cannot be trusted as a sole source of PNT information and should implement complementary navigation and timing sources.

As GNSS-dependent applications continue to expand—from autonomous vehicles to financial transaction timestamping—the imperative for signal hardening and spoofing detection becomes increasingly urgent. The technical solutions exist; implementation remains the challenge.