Demonstration of Single-Satellite GNSS Spoofer Geolocation

This paper offers an experimental demonstration of single-satellite single-pass geolocation of a terrestrial Global Navigation Satellite System (GNSS) spoofer from Low Earth Orbit (LEO). The proliferation of LEO-based receivers can provide unprecedented spectrum awareness, enabling persistent GNSS interference detection and geolocation. Accurate LEO-based single-receiver emitter geolocation is possible when a range-rate time history can be extracted, traditionally accomplished through Doppler measurements. However, Doppler-based measurement techniques assume the emitter transmits at a quasi-constant center frequency. This assumption is not true for GNSS spoofers, as they transmit an ensemble of spoofing signals wherein each spoofed signal's carrier frequency contains an unique unknown time-varying frequency component that imitates the Doppler corresponding to the spoofed navigation satellite and spoofed location. This paper presents a technique that removes the unknown time-varying frequency component across each signal so that the range-rate time history between receiver and transmitter can be extracted and exploited for geolocation. If a GNSS receiver allows itself to be spoofed, the range-rate between the receiver and the spoofer will manifest in the GNSS receiver's clock drift estimate. This technique is verified by a controlled experiment in partnership with Spire Global, in which a LEO-based receiver captures GNSS spoofing signals transmitted from a known ground station on a non-GNSS frequency band.