Spoofing Control Strategy for Precise Position Offset Based on INS/GNSS Tightly Coupled Navigation

To deceive Inertial Navigation System(INS)/Global Navigation Satellite System(GNSS) integrated navigation terminals, the entry point is still to inject GNSS spoofing signals to the target system. However, the spoofing control strategy in integrated navigation mode for particular tasks such as fixed-point capture or directional drive needs further research. Whether applying GNSS spoofing attacks or not, the Kalman filter correction gain matrix element in the tightly coupled navigation system always maintains its stability, which gives us valuable clues to develop an effective spoofing attack. On this basis, this article focuses on the feasibility and operability of spoofing attacks under tightly coupled navigation conditions and innovatively proposes a spoofing control strategy that can achieve accurate position offsets: Specific spoofing signals are implanted to the target tightly coupled navigation terminal at the beginning of the spoofing attack. The amounts of pseudo-range spoofing signals corresponding to different satellites are respectively the projections of the position increments to be deceived on the sight vector of the integrated navigation terminal to each satellite. Simulation experiments and tightly coupled navigation terminal experiments verify the correctness and effectiveness of the spoofing control strategy.


I. INTRODUCTION
With the progress of science and technology and the rapid development of the economy, GNSS has been widely used in many fields of society [1], [2]. On the military field, with the advantage of durability, maneuverability, and economy, the Unmanned Aerial Vehicle (UAV) systems centered on the INS/GNSS integrated navigation system become an essential part of weapons and equipment in various countries [3]. However, due to the weak power of satellite signals, satellite navigation terminals are incredibly susceptible to interference, which seriously affects the effectiveness of UAV system operations [4]. Many countries treat satellite deceptive interference as an offensive strategy to reduce the effectiveness The associate editor coordinating the review of this manuscript and approving it for publication was Lubin Chang . of the enemy's modern weapons, including UAV. Using the electronic warfare methods of satellite deceptive interference, the Iranian military capture the top-secret ''RQ-170 Sentinel'' UAV, ''ScanEagle'' UAV, and ''MQ-9 Reaper'' UAV from the Central Intelligence Agency by the year of 2011, 2012 and 2018 [5]- [7].
The Volpe report submitted by the US Department of Transportation in 2001 focused on the analysis of civil satellite deceptive interference, which is worse than other types of intentional communication interference [8], [9]. Regarding the civilian GNSS signals as the breakthrough point, many scholars at home and abroad have carried out related research on GNSS spoofing technology. According to the type of spoofing attack target, the satellite spoofing attacks can be divided into spoofing attacks against pure satellite navigation mode, and spoofing attacks under the combined navigation mode with the GNSS navigation system as the auxiliary system terminals (including standard INS/GNSS loosely coupled integration and INS/GNSS tightly coupled integration). In 2003, Professor Warner of the University of California took the lead in completing a deceptive attack experiment against the pure satellite navigation terminal [10]. Professor Warner, using a simple satellite signal jammer (including satellite signal simulator, power amplifier, and signal transmitter) equipped on the truck to disrupt the satellite signal receiver on another target truck, changed the position output of the receiver. In 2011, researchers at Turin Polytechnic University built a simple spoofing test platform called Limpet Spoofer [11]. They confirmed that the use of the satellite spoofing attacks, causing an anomaly of the receiver carrier ring and code loop in the total spoofing process, could pull the target receiver from the tracked real satellite signal to the false satellite signal. Based on this, the Daejeon 305-700 satellite navigation research team further analyzed the effect of anomalous effects caused by false satellite signals [12]. The team found that, when spoofing signals were implanted, not only DLL and PLL tracking loops generate errors, but also pseudo moments could occur linear changes, which in turn led to the wrong navigation results and time offsets. Seong-Hun Seo et al., of Konkuk University in 2015, set up their software-based GNSS signal generator and conducted satellite navigation deceptive attack experiments against UAV [13]. The experimental results showed that despite the specific spoofing protection capabilities of the UAV, the deceptive attack method could accurately cheat the UAV to the target point when the attackers get the grasp of the movement state of the UAV.
In 2008, Professor Todd Humpherys of Texas State University in the United States designed a rough and straightforward civil GPS deception scheme for the INS/GNSS loosely integrated navigation terminal and published several reports to evaluate the threat of GPS deceptive attack [14]. In June 2012, Todd Humpherys successfully changed the flight path of a small UAV based on INS/GPS loosely coupled navigation in a college playground by using GPS civil signal deception equipment which costs less than $1000 [15]. Packing the error information into a seemingly reliable GNSS signal and sending the signal to the target receiver, this experiment made the INS/GPS loosely coupled navigation on the UAV outputs false geographic information and misguides the UAV. In 2014, researchers at Illinois Institute of Technology in Chicago proposed a UAV deceptive attack method against the INS/GPS loosely coupled navigation UAV [16]. Simulation results showed that if the attacker has an absolute understanding of the UAV track, the process would not be detected by the monitor while generating a significant position error. In 2018, Eric Horton and Prakash Ranganathan of the University of North Dakota (UND) developed a GPS spoofing device and introduced in detail the use of this device to attack Android phones and DJI Matrice 100 quadrotor UAV [17]. This experiment also simply analyzed the offset effect of navigation positioning of Android phones and quadrotor UAV under deceptive interference. In 2019, Yan Guo at the National University of Defense Technology proposed an algorithm of UAV covert deception based on GPS/INS loosely coupled navigation [18]. However, GPS deceivers need to constantly adjust the generated fake GPS signal according to the deviation between the actual state of UAV and the original reference target state.
According to the recent development of the satellite deceptive interference technology, current researches are mainly aimed at the pure satellite navigation terminal. Fewer considerations are given to the integrated navigation mode (such as INS/GNSS, DVL/GNSS, etc.) in which the satellite navigation system is used as an auxiliary system [19]. Furthermore, even though tightly integrated navigation terminals are more widely used in the military and have more complicated structures, we clearly find that the current spoofing control strategies for tightly integrated navigation terminals, have not been studied in depth. Aiming at the task of accurately achieve the position offset of tightly integrated UAV systems in military operations, the third section of this paper combines the simulation experiments to verify the stability of the Kalman filter steady-state gain matrix elements in the tightly integrated navigation system, which lays the theoretical basis for implementing pseudo-range spoofing and achieving accurate position offset in this paper. According to this characteristic of the steady-state gain matrix, the fourth section of this paper focuses on the feasibility and operability of spoofing attacks against tight coupled navigation and innovatively proposes a spoofing control strategy for a precise position offset against tight coupled unmanned systems: specific spoofing signals are implanted to the target tightly coupled navigation terminal at the beginning of the spoofing attack. The amount of Pseudo-range spoofing signal corresponding to different satellites are respectively the projections of the position increments to be deceived on the sight vector of the integrated navigation terminal to each satellite. Sections 5 and 6 of this paper verify the correctness and effectiveness of this spoofing control strategy through simulation experiments and tightly integrated navigation terminal experiments. Section 7 gives conclusions.

II. INS/GNSS TIGHTLY COUPLED NAVIGATION ARCHITECTURE
The advantages of INS are good autonomy, high dynamics, and comprehensive output of navigation information, but its errors accumulate over time which causes long-term accuracy decreases. GNSS has the advantages of high precision and no increase in error with time, but the signal is easy to interfere with. Utilizing filtering, the combination of INS/GNSS, recognized as the best-integrated navigation scheme, can improve the overall accuracy and reliability of the system, and have strong complementarity. The first and most successful filter used in the field of integrated navigation is the classical Kalman filter. In this paper, to achieve the task of precise position offset or disperse of the UAV system, we consider the specific analysis of standard tightly coupled systems that are widely used in the military background.

A. INS/GNSS TIGHTLY COUPLED NAVIGATION STATE MODEL
The definition of the state vector X of the system is combined by the error state vector X I of INS and the error state vector X G of GNSS.
The linear Kalman filter takes the navigation parameter error as the state of the filter and uses the estimated error to correct the output of INS. The error state vector of INS is defined as: where δL, δλ and δh represent the latitude, longitude and height error information of the system; δv N , δv E and δv D represent the velocity error information of the system; δϕ, δθ and δφ are the roll angle, pitch angle and heading angle error of the system. Note that the subscripts N, E, D represent the north, east and down components in the navigation frame, respectively. The expression of INS error state matrix equation is: In the formula, F I is the INS system state matrix, and its parameters can refer to [20]; G I is the INS system input matrix, whose parameters can refer to [20]; INS system noise is: w gx , w gy and w gz are the noises of the three-axis gyro of the INS, and w ax , w ay and w az are the noises of the accelerometers in the front, right and bottom directions respectively; Compared with the loosely coupled system, the tightly coupled system has not only the error state equation of INS but also the error state equation of GNSS. In error state equation of GNSS, pseudo-range and pseudo-range rate are used as observation information. Generally, two time related errors are selected: clock error δṫ u and clock frequency error δṫ ru . then the error state equation of GNSS can be expressed as: where c is the speed of light, w tu and w tru are equivalent GNSS receiver clock error and equivalent GNSS receiver clock drift error. The matrix representation of equation (4) can be defined as:Ẋ where Error state vector of GNSS X G = [cδt u cδt ru ] T , GNSS system state matrix F G = 0 1 0 0 , GNSS system input matrix Combining the INS error state equation (2) with GNSS error state equation (5), the state equation of the tightly integrated navigation system can be obtained: The pseudo-range of the ith satellite calculated directly from the inertial navigation is: where (x s ) represents the position of the ith satellite in the ECEF coordinate system, and (x I , y I , z I ) represents the position of the inertial navigation in the ECEF coordinate system.
The pseudo-range rate of the ith satellite calculated directly from the inertial navigation is: where λ L1 is the wavelength of L1 carrier, v e eb is the velocity vector of the inertial navigation system under the ECEF system, v (i) sat is the velocity vector of the ith satellite under the ECEF system, and e i is the line of sight vector from the inertial navigation system to the ith satellite: (9) r (i) is the real distance between the ith satellite and the receiver, and (x, y, z) is the real position of the receiver in the ECEF coordinate system. Pseudo-range observation equation of INS/GNSS tight combination Kalman filter Z ρ can be designed as [21]: where C e c is the transformation matrix from the ECEF coordinate system to the geodetic coordinate system, and is the pseudo-range error noise of the corresponding satellite.
Pseudo-range rate observation equation of INS/GNSS tight combination Kalman filter Z ρ can be designed as [21]: where C e g are the transformation matrix from the ECEF coordinate system to the geographical system, and are the pseudo-range rate error noise of the corresponding satellite.
The observation equation of INS/GNSS tight combination Kalman filter: where ρ G (i = 1, 2, · · · , r) are the pseudo-range rate and pseudo-range rate obtained from GNSS receiver corresponding to the ith satellite; By substituting pseudo-range observation equation (10) and pseudo-range rate observation equation (11) into equation (12), we can get: Hρ

III. STEADY-STATE GAIN MATRIX OF COMPACT INTEGRATED NAVIGATION FILTER
From equations (6) and (13), the state-space model of INS/GNSS integrated navigation system can be obtained as follows: Recursive iteration is the most significant advantage of the discrete Kalman filter. The algorithm does not need to store a large number of measurement data. Therefore, in the actual environment, the separate Kalman filter is used to combine INS and GNSS data. The integrated navigation model described in equation (14) is discretized to obtain: Among them, k,k−1 is the discrete system state matrix, k,k−1 is the discrete system input matrix, system noise V k and observation noise V k are white noise and uncorrelated, system noise variance is E WW T = Q, and observation noise variance is E VV T = R. If the observation value of time k is Z k , the estimationX k of X k can be solved according to the flow of Figure 1. From Figure 1, we can analyze that the Kalman filter gain matrix K k is the only connection between the state filter loop and the gain calculation loop [6]. And the left loop is affected by the right loop and the gain calculation loop is entirely independent of the state filter loop. The steady-state gain moment K k of the tightly integrated navigation filter has a stable state K ∞ , and the 200 filtering periods can basically converge stably. Therefore, By adding spoofing signals to Z k , we can directly inject GNSS spoofing attacks into the state filtering loop.

A. THE SOLUTION OF STEADY-STATE GAIN MATRIX AND THE MEANING OF EACH ELEMENT
The steady-state gain matrix K ∞ is determined by the system noise variance Q and the observed noise variance R, and is calculated and solved according to the steady-state value P ∞ of the state estimation variance matrix. The INS/GNSS tightly integrated navigation uses the discrete Kalman filter. We can explain the steady-state value P ∞ of the variance matrix of the state estimation through the discrete algebraic Riccati equation. Using P ∞ to solve the steady-state gain matrix K ∞ , the specific formula can be designed as follows: According to the proposed deception Figure 1, the spatial correspondence between the state vector X and the observation vector Z can be obtained.
The ground (sky) channel of the inertial navigation system is divergent when there is no external reference information (such as altimeter information) or damping. Due to accuracy limitations, the altitude information and ground speed are not used in the experiment and are not listed in Figure 2 below. To make the expression concise, we choose 4 satellites as an example to illustrate, the spatial correspondence between the state vector X and the observation vector Z . The pseudo-range and the pseudo-range observations of vector Z could change the element value of state vector X through steady-state gain matrix K ∞ .
According to the number of rows and columns of each element in steady-state gain matrix K ∞ , we define the meaning of the main elements as follows: k (1,i) (i = 1, 2, · · · , 4) is the gain of the estimated latitude error using the pseudo-range observations of ith satellite; k (2,i) (i = 1, 2, · · · , 4) is the gain of the longitude error estimation value using the pseudo-range observations of ith satellites.

B. SIMULATION EXPERIMENT OF STEADY-STATE GAIN ELEMENTS AFFECTING THE POSITION OUTPUT ESTIMATION OF TIGHTLY INTEGRATED NAVIGATION FILTER
To explore and verify the law of steady-state gain elements that affect the position output estimation under the condition of whether or not pseudo-range deception is applied, we use the simulation environment to calculate the steady-state gain matrix elements related to the position error estimation respectively for the navigation level tightly coupled navigation system.
Since the order subject to deceptive jamming is the steadystate tightly integrated navigation filter. We conduct two simulation experiments: 1) Experiment 1 obtains the changing trend of the steady-state gain without applying pseudo-range spoofing; 2) Experiment 2 obtains the changing trend of the steadystate gain, which is obtained after the pseudo-range spoofing is imposed on the tightly integrated filter after 300 seconds.
The parameters of INS and GNSS used in the simulation are shown in the table 1. The trend of state gain elements k (1,i) (i = 1, 2, · · · , 4) that can cause latitude offset are shown in Figure 3.
From Figure 3 and Figure 4, we can find the following three characteristics of steady-state gain elements: 1. All the elements affecting latitude are of the same order of magnitude, and there are no significant elements affecting latitude output; 2. All the elements that also affect longitude are of the same order of magnitude, and there are no major elements that affect longitude output; 3. After receiving pseudo-range deception, all the elements, which affect the latitude or longitude, keep the original steady-state value unchanged after experiencing slight fluctuation.
In Section 3.1 and 3.2, not only are all pseudo-ranges independent of each other verified by theoretical analysis  and simulation experiments but also it is proved that every element of the steady-state gain matrix keeps its stabil-ity no matter whether pseudo-range deception is applied or not. The above conclusions are the theoretical basis for the realization of the spoofing control strategy in the next section.

IV. FEASIBILITY ANALYSIS OF DECEPTIVE JAMMING IN TIGHTLY COUPLED NAVIGATION MODE
To achieve the goal of precise position offset of tightly integrated UAV systems in military operations, this paper needs to ensure the stability and operability of deceptive jamming. The stability of deceptive interference means that the position increment caused by adding the same pseudo-range deception amount at different times remains the same. The operability of deceptive interference implies that the position offset the effect of integrated navigation can be operated by adjusting the amount of pseudo-range deception. Combined with the experimental conclusions of the previous section, this section will verify the operability and stability of deceptive interference to the tightly coupled navigation position at sections 4.1 and 4.2 respectively, so as to verify the feasibility of deceptive interference in the tightly coupled navigation mode and propose the control strategy in section 4.3.

A. OPERATIONAL ANALYSIS OF INFLUENCE DEGREE OF DECEPTIVE INTERFERENCE ON TIGHTLY COUPLED NAVIGATION POSITION OUTPUT
Based on the conclusions drawn in Section 3.2, the following will analyze the maneuverability of the effect of deceptive interference on the estimated output position of the INS/GNSS tightly integrated navigation filter. When accessing the spoofing signal, the pseudo-range and pseudo-range rate output by the GNSS receiver is: G are the pseudo-range and pseudo-range rate directly obtained by GNSS receiver under deceptive interference; ρ G are the pseudo-range and pseudo-range rate obtained by GNSS receiver under normal conditions, δρ (i) and δρ (i) are the imposed pseudo-range and pseudo-range rate offset.
Selecting the navigation parameter error as the state of the filter, we usually use feedback correction to correct the inertial navigation system and then clear the estimated value of the navigation parameter error. Therefore, at time k, the estimated latitude error δL k of the integrated navigation output under deceptive interference is: Among them, ρ I are the pseudo-range and pseudo-range rate information calculated by the inertial navigation system, respectively. The subscript k indicates the kth time.
Substituting equation (17) into equation (18), the estimated latitude error δL k of the tightly integrated navigation output under deceptive interference at time k can be obtained (19), as shown at the bottom of this page.
δL k is the latitude filtering estimation value under deceptive interference, δL k is the correct latitude filtering estimation value without deceptive interference, L k is the latitude offset caused by deceptive interference, and: k + k (1,4) δρ (4) k + k (1,5) δρ k + k (1,8) δρ VOLUME 8, 2020 Similarly, the longitude error estimate δλ k of the tightly combined navigation output under deceptive interference can be obtained: Among them, δλ k is the estimated longitude error value of tight combination without deceptive interference, and λ k is the longitude deviation caused by deceptive interference, and: Since the inertial navigation system will not be disturbed by satellite spoofing signals, the position offset caused by the deceptive interference, as same as the constant drift of the inertial device, will be accumulated directly to the next moment.
When the latitude error and longitude error estimated by the integrated navigation filter are fed back to the calculation result of the inertial navigation, the correction of latitude result (L k ) * and the correction of longitude result (λ k ) * after time k can be obtained as follows: Among them, L k is the longitude results after correct correction, λ k is the longitude results after correct correction, and L k is the latitude drift information after the access deception interference at time k, λ k is the longitude drift information after the access deception interference at time k.
From the above formulas (20) and (22), it can be known that the deceptive interference has an impact on the position output value of the INS/GNSS integrated navigation filter, and the degree of this effect is related to the intensity of the offset generated by the interference. The elements of the steady-state gain matrix remaining stable, we can use the various elements of the steady-state gain matrix as coefficients and the interference signal strength as input to alter the position output result. We clearly find it operational to implement such GNSS deception scheme.

B. STABILITY ANALYSIS AT POSITION OUTPUT OF THE TIGHTLY COUPLED MODE UNDER DECEPTIVE INTERFERENCE
To analyze the stability of the position output of coupled integrated navigation caused by deceptive jamming is to verify that the position output offset of integrated navigation is stable under deceptive jamming. Since each pseudo-range is independent of each other which is proved in section 3 and we do not know the star selection method of the target UAV, it is proper to deceive all the acceptable satellite signals in the same form. For space limitation, we take the ith satellite as an example to illustrate the effect of pseudo-range spoofing signals on position offset.
The amount of pseudo-range deception for the ith satellite in the GNSS receiver at time k is δρ (i) k . At time k, the GNSS pseudo-range of the satellite receiver to input the Kalman filter is ρ Since INS will not be disturbed by satellite spoofing signals, the position offset caused by the deceptive interference will be accumulated directly to the next moment.
The corrected position result formula (23) (24) at time k can be derived: where L k and λ k enter filter calculation at the next time k + 1 as equivalent to the calculation of the correct latitude L I k+1 and longitude λ I k+1 information of INS; L k and λ k enter the filter calculation at the next time k + 1 as a constant deviation.
Taking the ith satellite as an example to illustrate the effect of spoofing pseudo-range signals on position offset, equation (20) and equation (22) are simplified as follows: The latitude and longitude offset L k and λ k at time k will cause a quantitative deviation to the pseudo-range positioning estimated by the INS at time k + 1. The specific definitions are as follows: is the pseudo-range calculated by the INS at the time of k + 1 when the signal of the deceptive range is accessed at the last moment; ρ (i) I k+1 is the pseudo-range calculated by the INS at the time of k + 1 when there is no spoofing at the last moment, and ρ (i) k is the pseudo-range deviation calculated by the INS at time k + 1 caused by the INS latitude and longitude offset L k and λ k ; here we will take the proportional relationship between ρ (i) k and δρ When the spoofing signal is connected, the filter does not output offset information stably in a cycle at a time. From this we can boldly derive the following formula 0 < ρ (i) k < δρ Assuming that the tightly coupled navigation is also subject to deceptive interference at time k + 1, the pseudo-range deception quantity of the ith satellite added into the GNSS receiver is recorded as δρ (i) k+1 , at this time, the GNSS observation is:ρ For the convenience of the next simplification, we take the ratio of δρ Using feedback correction, the latitude and longitude errors estimated by the filter are: Among them: Further results of feedback correction can be obtained: Substituting equations (27) (29) (33) into equations (34) and (35), we get: where (L I ) * k+1 and (λ I ) * k+1 are the position results output after spoofing attack at time k + 1; L k+1 and λ k+1 are the latitude and longitude results after correct correction at time k + 1, L k→k+1 and λ k→k+1 are the position drift after spoofing attack at time range k → k + 1.
Since INS will not be disturbed by satellite spoofing signals, the position offset caused by the deceptive interference will be accumulated directly to the next moment, that is, where L k+1 and λ k+1 enter filter calculation at the next time k + 2 as equivalent to the calculation of the correct latitude L I k+2 and longitude λ I k+2 information of INS. L k→k+1 and λ k→k+1 enter the filter calculation at the next time k + 2 as a constant deviation.
It is embodied in the pseudo-range calculated by INS at time k + 2: is the pseudo-range calculated by the INS at the time of k + 2 when the signal of the deceptive range is accessed at the last moment; ρ (i) I k+2 is the pseudo-range calculated by the INS at the time of k +1 when there is no spoofing at the last moment, and ρ (i) k→k+1 is the pseudo-range deviation calculated by the INS at time k + 2 caused by the INS latitude and longitude offset L k→k+1 and λ k→k+1 ; Supposing that the tightly coupled navigation is also subject to deceptive interference at time k + 2, the pseudo-range deception quantity of the ith satellite added into the GNSS receiver is recorded as δρ  and δρ k , then the feedback correction output at time k + 2 can be calculated as follows: where L k+2 and λ k+2 enter filter calculation at the next time k +3 as equivalent to the calculation of the correct latitude and longitude information of INS. And L k→k+2 and λ k→k+2 enter the filter calculation at the next time k + 3 as a constant deviation. Since INS will not be disturbed by satellite spoofing signals, the position offset caused by the deceptive interference will be accumulated directly to the next moment, that is: Among them, L k+2 and λ k+2 enter filter calculation at the next time k + 3 as equivalent to the calculation of the correct latitude L I k+3 and longitude λ I k+3 information of INS.
L k→k+1 and λ k→k+1 enter the filter calculation at the next time k + 2 as a constant deviation.
It is embodied in the pseudo-range calculated by INS at time k + 3: where ρ is the pseudo-range calculated by the INS at the time of k + 3 when the signal of the deceptive range is accessed at the last moment; ρ (i) I k+3 is the pseudo-range calculated by the INS at the time of k +3 when there is no spoofing VOLUME 8, 2020 at the last moment, and ρ (i) k→k+2 is the pseudo-range deviation calculated by the INS at time k + 3 caused by the INS latitude and longitude offset L k→k+2 and λ k→k+2 ; From time k, the deceptive pseudo-range is applied at each time. The ratio of deception pseudo-range at every time to time k is as follows: Among them, δρ (i) k+t (t = 1, 2, · · · , r) is the spoofing pseudo-range accessed at time k + t − 1; n r is the ratio of the amount of pseudo-range deception at time k + t − 1 to the amount of pseudo-range deception at time k.
According to the law of deducing the formula at each moment above, we can get the position output after feedback correction at k + r time is obtained: (L k+r ) * = L k+r + L k→k+r (λ k+r ) * = λ k+r + λ k→k+r where L k→k+r and λ k→k+r are the latitude and longitude offsets caused by the application of deceptive interference from time k to time k + r, and the specific expression is as follows: That is, the total position offset is a linear combination of the position offsets applied at each past time, and the pseudo-range offset calculated by INS is a linear combination of pseudo-range offsets applied to a GNSS receiver applied at each past time.
It is assumed that the deception pseudo-range generated by the spoofing GNSS signal is the same at each time during the deception attack: Substituting equations (29) and (41) into equation (40): The following will further analyze the convergence of the common coefficient (42) (43) and (44): Substituting 0 < α < 1 calculated in subsection 4 into equation (45), we can get: When spoofing signals are always applied, we further analysis the convergence of L k→∞ , λ k→∞ ρ According to the relationship between the latitude offset L k and longitude offset λ k of the tightly integrated navigation system and the pseudo-range offset ρ From equations (47) to (49), it can be seen that when the spoofing GNSS signal designed and constructed by the attacker always applies a fixed pseudo-range offset signal to the ith satellite at the beginning of the attack, INS/GNSS coupled integrated navigation filter position estimation will eventually output a stable latitude and longitude offset, where the latitude and longitude offset can cause the pseudo-range offset δρ (i) k of the ith satellite to the INS system. Due to space limitations in section 4.2, we take the ith satellite as an example to illustrate that when adding the spoofing pseudo-range signal, the position offset is stable. To achieve the precise position offset of the target tightly coupled UAV, We need to design spoofing pseudo-range signals, which adds pseudo-range spoofing to the pseudo-range between each satellite and the GNSS receiver.

C. DESIGN OF SPOOFING CONTROL STRATEGY CAPABLE OF REALIZING ACCURATE POSITION OFFSET
According to formulas (47)-(49), we can find that after accessing the spoofing GNSS signal, the tightly integrated navigation filter position estimation will eventually show a stable latitude and longitude offset, which will cause pseudo-range offset the ith satellite to the INS system. This pseudo-range offset is the same as the pseudo-range spoofing signal. We can design a spoofing control strategy based on the relationship between this position offset and the pseudo-range spoofing signal to achieve the goal of accurate position offset.
When realizing fixed-point capture and other military missions, the offset distance of the target UAV through the GNSS spoofing attack is generally less than 10km from the north or east, and the GNSS satellite is more than 20,000km from the ground. Combined with Fig. 5 and Fig. 6, we can find that after the GNSS spoofing signal is connected, the line of sight vector from the satellite to the INS system changes little under the influence of positional offset.
We can transform the position offset from the local geographical coordinate system to the ECEF coordinate system, and project the offset on the line of sight vector of each satellite and INS system. In this way, we use the projection of the position offset on the line-of-sight vector as the input pseudo-range spoofing value, thereby designing the GNSS spoofing signal to achieve accurate position offset.  . Schematic diagram of ECEF and local geographic coordinate system, where o i − x i y i z i represents the geocentric coordinate system, o e − x e y e z e represents the ECEF coordinate system, o g − x g y g z g represents the local coordinate system of the system and o g − x g y g z g represents the local coordinate system of the offset point.
This spoofing control strategy can carry out precise position offset for UAV that is already hovering or in flight, under the condition of knowing the position of a certain point in the planned path. We already know the exact coordinates of a certain point of UAV and the coordinates of the preset capture position, and we can calculate the position offset X NED = L λ 0 that the UAV needs to achieve on the local geographic coordinate system. C e g is the transformation matrix from ECEF coordinate system to local geographic system From the conversion relationship X ECEF,1×3 T = C e g X NED,1×3 T between the location offset of the local geographic system and the offset under the ECEF coordinate system, we can get: e i is the line of sight vector from the inertial navigation system to the ith satellite mentioned in Section 1.1, specific , and is the unit vector. According to the angle relationship between two vectors in three-dimensional space, the angle relationship between X ECEF and e i can be easily obtained: The projection X e i of the proposed deception X ECEF on the line of sight vector e i from the INS to the ith satellite can be calculated as: Because the line of sight vectorˆ e i to be shifted to the ith satellite is approximately parallel to the line of sight vector e i from the original position to the ith satellite, the increment of the pseudo-range of the proposed deception X ECEF can be equivalent to the projection X e i of X ECEF on the unit line of sight vector e i between the tightly combined system and the ith satellite at the moment. If the pseudo-range deception derived from the above strategy is applied to each satellite pseudo-range received by GNSS receiver, the precise offset of longitude and latitude can be completed. We will verify the accuracy of this strategy through the next two sections of simulation test and tightly coupled terminal test.

V. SIMULATION TEST AND ANALYSIS
For the following, we carry out a series of static pseudo-range deception simulation experiments based on the spoofing control strategy designed in Section 4.3. The longitude and latitude used in the simulation experiment are: Changsha north latitude 28.1 • east longitude 112.6 • . Other simulation VOLUME 8, 2020 conditions are the same as those in the section 2.3 simulation experiment, see Table 1. The simulation experiment consists of four parts (pseudo-range deception as input and position information as output): 1) Tightly combination simulation positioning experiment 1, with the pseudo-range spoofing signals added at 300s (effect: 4000m north offset and 4000m east offset). We can get the position output of the experiment in Figure 7  4) Tightly combination simulation positioning experiment 3, with the pseudo-range spoofing signals added at 300s (effect: 5000m north offset and 5000m east offset) and superimposed at 600s (effect: −1000m north offset and −1000m east offset). We can get the position output of the experiment in Figure 7 (d).
The simulation results are shown in Figure 7. From the overall simulation results, it can be seen that the precise position offset of the tightly integrated navigation system can be achieved within 100s after the pseudo-range deception is introduced into the Kalman filter of the compact integrated navigation system, and the accuracy of the east offset is higher than that of the north offset. Combined with Figure 7 (a)(b)(d), we can find that the pseudo-range deception signal designed in Section 3.3 superimposed to the tightly coupled system after the system reaches the set offset position can continue to reach the predetermined offset position. Furthermore. We found that the application of single GNSS spoofing and two GNSS spoofing signals are equivalent in position offset accuracy. This shows that the spoofing control strategy proposed in Section 3.3 can be overlapped in practice, and the position output offset of integrated navigation is stable under deceptive jamming.
Combined with Figure 7 (a)(b)(c), we can find that when the position offset does not reach a stable state, the superposition of pseudo-range deception signal can also achieve the effect that one single pseudo-range deception can achieve. This shows that we can regularly change the deceptive pseudo-range signal through this feature, which can make the UAV trajectory change more slowly, not be detected by the simple GNSS anti-spoofing module, and finally, reach the same deception position.
In order to further analyze the deception effect of the tightly integrated navigation system, this paper defines that the preset position offset r s consists of the preset north offset r sn and the preset east offset r s = r sn r se , where the subscript s represents the preset spoofing sign, n represents the north direction, and e represents the east direction. The actual location offset r a consists of the actual location offset r an in the north direction and the actual location offset r ae in the east direction. For details, r a = r an r ae , where the subscript represents the actual offset, n represents the north direction, and e represents the east direction.
The calculation formula for defining the position offset effect ∂ is as follows: The specific analysis and verification of the position offset effect are shown in the table below: It can be seen from the Table 2 that in the simulation experiment, the position offset the effect of the deception interference on the estimated offset exceeds 99.85% in the case of north or east direction less than 10km, which can achieve the precise position offset of the tightly integrated navigation system. This can fully verify that the spoofing control strategy designed in Section 4.3 can be used to achieve precise spoofing offset for the INS/GNSS tightly coupled navigation position.

VI. VERIFICATION OF DECEPTION TEST OF INTEGRATED NAVIGATION TERMINAL
In order to fully verify the correctness of the spoofing control strategy proposed in Section 4.3, this paper further conducted tightly integrated navigation terminal experiments.
Firstly, based on the GPS satellite receiver, the satellite signal simulator, the integrated box of power amplifier and the signal transmitter, this paper builds the false satellite signal generator required in Section 4.3, as shown in Figure 8. By using the spoofing satellite signal generator, the precise position deception offset test is carried out for the tightly integrated navigation terminal (computer and MTI). The specific test plan is: on the university playground, the tightly-coupled terminal follows the path indicated by the red line in Figure 10, during which it receives normal satellite signals. At the spoofing strategy starting point (marked in Figure 10), according to the spoofing strategy derived in Section 4.3, fake satellite signal generator is used to send the pseudo-range spoofing signals to the GPS receiver of MTI to cause a positioning offset of the terminal. The spoofing signals used in the experiment are divided into the following three categories: Spoofing signal 1: north offset 20m, east offset 20m; Spoofing signal 2: north offset 40m, east offset 40m; Spoofing signal 3: north offset 80m, east offset 80m. Figure 9 shows the spoofing test environment of tightly integrated navigation terminal. Figure 10 and Figure 11 show the test results of the terminal. It can be seen from Figure 10 that when the terminal receives the real satellite signal, the integrated navigation filter outputs the correct positioning result. However, when the fake GPS signal is implanted into the terminal, the positioning  result of the terminal starts to change and finally reached the preset position offset set by the attacker.
From Figure 11, we can find that when accessing the spoofing signal, the effect of the tightly integrated navigation terminal on the east offset is better than that of the north offset, which is the same as the conclusion of the simulation experiment in Section 5. After the spoofing signal is connected to the terminal, the positioning offset of the tight combination navigation has been achieved. But the error from the predetermined offset distance has fluctuated in the north and east directions. We found that the tightly integrated navigation terminal changed its direction of movement during this period, thereby stimulating some errors. However, if the tight combination terminal keeps its direction of motion unchanged, the error will quickly decay, which will not greatly affect the effect of position shift.
Actually, the reason affecting the accuracy is mainly composed of three parts: 1) The error caused by the fluctuation of the steady-state gain matrix after adding deception, which is very small but difficult to eliminate; 2) The calculation error of the position vector projected on the sight vector, which can be eliminated by fitting or compensation; 3) Experiment site noise and the error caused by the GPS signal generator, which is mainly related to equipment performance.
Through the above experiments, we can surely infer that the spoofing strategy can fulfill the task requirements of the precise offset of the UAV system in tightly integrated navigation.

VII. CONCLUSION AND EXPECTATION
In this paper, a spoofing control strategy for INS/GNSS tightly coupled system has been proposed. The spoofing control strategy neither needs external sensors to understand the flight status of UAV nor need to calculate and adjust the GNSS deception signal at any time. The strategy only needs to know a certain point in the trajectory of UAV(not include the trajectory before stable access to the spoofing signals) to complete the precise position offset of UAV or to know the general direction of UAV travel to complete the directional drive of UAV. To improve the effectiveness of this spoofing control strategy and the improvement of deception interference technology, the following aspects can be promoted in the work: 1) The spoofing control strategy proposed in this paper simplifies the conversion relationship between position offset and pseudo-range offset when calculating the GNSS deception signal. In the next step of work and analysis, the corresponding offset position output error model can be deduced, supplemented and added to the control strategy to compensate the error, and improve the effect of accurate position offset.
2) In this paper, when the spoofing control strategy is applied, the smoothness of the deception trajectory is not considered according to the different flight speed limits of a specific type of tightly combined UAV. However, according to the additivity of the spoofing control strategy obtained from the simulation experiment, further research can be done in this area. Also the anti-spoofing fault detection scheme is also a very meaningful work in the following research.
3) In this paper, the GNSS spoofing attack is carried out on INS/GNSS tightly coupled Kalman filter, and the position output results of the commonly used Kalman filter in response to access spoofing are derived and analyzed in detail. The simulation and tightly coupled terminal test in this paper show that it is possible to achieve the goal of precise position shift for tightly combined UAV. We can continue to conduct research and comparison on the spoofing control strategies of different combined navigation to achieve better deception control effect, which is worthy of further efforts.