Single-Satellite-Based Geolocation of Broadcast GNSS Spoofers from Low Earth Orbit

TL;DR

This work tackles the threat of broadcast GNSS spoofers by presenting a single-satellite, single-pass geolocation method from a LEO platform. The key idea is to extract a range-rate history embedded in the receiver clock drift measurement via a common Doppler term $\gamma(t)$, enabling nonlinear range-rate localization with an altitude constraint. An analytic model quantifies how transmitter clock instability degrades geolocation accuracy, and experimental validation with a Spire-grounded setup demonstrates 68 m horizontal error with a 95% containment ellipse. The paper further analyzes how spoofers can trade off detection risk against geolocation accuracy under clock-drift monitoring, outlining practical implications for spectrum monitoring and defense in LEO-enabled sensing ecosystems.

Abstract

This paper presents an analysis and experimental demonstration of single-satellite single-pass geolocation of a terrestrial broadcast Global Navigation Satellite System (GNSS) spoofer from Low Earth Orbit (LEO). The proliferation of LEO-based GNSS receivers offers the prospect of unprecedented spectrum awareness, enabling persistent GNSS interference detection and geolocation. Accurate LEO-based single-receiver emitter geolocation is possible when a range-rate time history can be extracted for the emitter. This paper presents a technique crafted specifically for indiscriminate broadcast-type GNSS spoofing signals. Furthermore, it explores how unmodeled oscillator instability and worst-case spoofer-introduced signal variations degrade the geolocation estimate. The proposed geolocation technique is validated by a controlled experiment, in partnership with Spire Global, in which a LEO-based receiver captures broadcast GNSS spoofing signals transmitted from a known ground station on a non-GNSS frequency band.

Figures (12)

• Figure 1: Shown here are the Doppler components in single-satellite spoofer geolocation. The Doppler components corresponding to (\ref{['eq:fD']}) are shown on the left. The Doppler components for each spoofing signal corresponding to (\ref{['eq:spooferDopplerTX']}) are shown in red to the right.
• Figure 2: The Pearson correlation coefficient between sequential estimation errors $w_\text{a}[i]$ as a function of time between estimation epochs for various values of $h_{-2}$. As the receiver's modeled process noise intensity increases, the time correlation between between estimation errors decreases.
• Figure 3: Left: The spoofed location atop the former Aerospace Engineering building in Austin, Texas. Center: The actual spoofer location, a Spire Global ground station located in Perth, Australia. Right: The ground track of the Spire Global LEO satellite during the 20-second signal capture.
• Figure 4: Left: UT RNL's GRID receiver display when processing the spoofing signals. Right: A scatter of GRID-derived position solutions. The red dot is the spoofed position. The 3D bias is 45.9 m, mostly concentrated in the vertical direction. This error is attributed to the S-band carrier.
• Figure 5: Measured Doppler time history of each received spoofing signal. Also shown is the Doppler-equivalent time history $\hat{\gamma}(t)$ (black trace), which is used for geolocation.