On Mixing Authenticated and Non-Authenticated Signals Against GNSS Spoofing

Anti-spoofing techniques for current global navigation satellite systems (GNSS) authenticate signals on a single band and from a single system. However, nowadays commercial GNSS receivers commonly calculate the position, velocity, and time (PVT) solution by simultaneously utilizing signals from multiple constellations and bands, with a substantial enhancement in both accuracy and availability. Therefore, anti-spoofing techniques have recently been proposed that mix authenticated and onauthenticated signals to increase performance without sacrificing security. In this paper, we formalize the models of such signal mixture-based authentication checks. We propose a spoofing attack generating a fake signal that leads the victim to a target PVT solution, undetected. We analytically relate the degrees of freedom of the attacker in manipulating the victim’s solution to both the employed security checks and the number of open nonauthenticated signals that can be tampered with by the attacker. The performance of the considered attack strategies are tested on an experimental dataset. Finally, we assess the limits of PVTbased GNSS authentication checks where both authenticated and non-authenticated signals are used.