# Characterization of the multipath situation under meaconing interference

Mathieu Hussong, Emile Ghizzo, Carl Milner, Axel Javier Garcia Peña, Julien Lesouple

► To cite this version:

Mathieu Hussong, Emile Ghizzo, Carl Milner, Axel Javier Garcia Peña, Julien Lesouple. Characterization of the multipath situation under meaconing interference. ION GNSS+ 2024, Sep 2024, Baltimore, United States. 2024. [hal-04744012](https://hal HAL Id: [hal-04744012](https://enac.hal.science/hal-04744012v1) Submitted on 18 Oct 2024)

**HAL** is a multi-disciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire **HAL**, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Public Domain
# Characterization of the multipath situation under meaconing interference

Mathieu Hussong, Emile Ghizzo, Carl Milner, Axel Garcia-Pena, Julien Lesouple

Fédération ENAC ISAE-SUPAERO ONERA, Université de Toulouse, France.

## BIOGRAPHIES

**Mathieu HUSSONG** is a third-year PhD student at ENAC, the French Civil Aviation University. He holds a master's degree in aeronautics from ENAC and a master's degree in aerospace systems specializing in navigation and telecommunications from ISAE SUPAERO in Toulouse. His PhD research focuses on aircraft GNSS spoofing characterization and impact.

**Emile GHIZZO** is a third-year PhD student at ENAC. He received a master's degree in aeronautics from ENAC in 2021 and a master's degree in aerospace systems specializing in navigation and telecommunications from ISAE SUPAERO in Toulouse. His PhD research focuses on GNSS signal processing and jamming and spoofing detection.

**Carl MILNER** is an associate professor at the ENAC. He currently lectures on navigation science and technology including radio navigation aids, signal processing, positioning algorithms and GNSS for aviation. His research work addresses the design of integrity monitoring algorithms for civil aviation applications including the use of GNSS augmentation systems both for current and future multi-constellation multi-frequency GNSS.

**Axel GARCIA-PENA** is a researcher/lecturer with the SIGNAV research axis of the TELECOM team of ENAC, Toulouse, France. He received his double engineer degree in 2006 in digital communications from SUPAERO and UPC, and his PhD in 2010 from the Department of Mathematics, Computer Science and Telecommunications of the INPT (Polytechnic National Institute of Toulouse), France.

**Julien LESOUPLE** received the Eng. degree in Aeronautics Engineering from ISAE Ensica, Toulouse, France in 2014 and defended in March 2019 his Ph.D degree in Signal Processing applied to GNSS at the cooperative laboratory TéSA. Since October 2021, he has been a lecturer researcher at ENAC within SIGNAV team. His research interests include statistical signal processing with applications to position, navigation and timing.

## ABSTRACT

With the escalating prevalence of in-band interference, the vulnerability of Global Navigation Satellite System (GNSS) receivers to potential jamming or spoofing threats has become a critical concern. The proliferation of GNSS repeaters, commonly known as meaconers (electronic devices that intercept GNSS signals, amplify them, and subsequently rebroadcast them) contributes to this threat landscape, by compromising GNSS accuracy, availability, continuity, and integrity of the nearby receivers. This paper investigates the impact of a meaconer on a GNSS receiver, when the received satellite signals are in the multipath situation (from the classification of Hussong et al. (2023)). The multipath situation is the situation when the meaconing useful GNSS signal affects the tracking of the authentic GNSS signal, as if it were exposed to a classical multipath. This paper characterizes and bounds the estimated carrier-to-noise ratio ($C/N_0$) and tracking loop outputs in the multipath situation. Then, this paper identifies the geometrical conditions under which a satellite is affected by meaconing multipath. Finally, extensive simulations validate the mathematical models by comparing the expected $C/N_0$ and tracking loop outputs to highly realistic simulation results. The findings reveal significant distortions in the $C/N_0$ for satellites in the multipath situation. In rapid-dynamic scenarios, the $C/N_0$ can decrease up to 20 dB.Hz, and $C/N_0$ distortions may have more complex yet predictable patterns in slow-dynamic scenarios. The delay lock loop (DLL) outputs are shown to be corrupted by deterministic offsets up to ±15 meters, accompanied by increased standard deviations due to the degraded tracking performance caused by the meaconer interference.

# I. INTRODUCTION

## 1. Context

As noted by Union (2001) and Garcia-Pena et al. (2020), the increasing occurrence of in-band interference may render GNSS receivers susceptible to jamming or spoofing threats, potentially compromising their performance. The proliferation of GNSS repeaters, commonly referred to as meaconers, contribute to this threat landscape. Coulon et al. (2020) demonstrated that meaconers can significantly degrade the accuracy and availability of GNSS receivers in their vicinity.
Multiple studies focused on the general impact of meaconer interfering with GNSS signals. Dovis (2015) discussed the various types of GNSS interference, including meaconing, jamming, and spoofing, highlighting their potential to disrupt GNSS-dependent systems. Their study revealed that meaconing could cause significant deviations in positional accuracy, leading to substantial errors in navigation and timing information. Dobryakova and Ochin (2014) explored the impact of meaconing on the integrity monitoring of GNSS receivers, emphasizing that the meaconer signals can lead to hazardous yet detectable misleading information. Both papers relate that meaconing interference are ubiquitous yet concerning, as they could easily deteriorate the operations of the systems relying on GNSS.

Hussong et al. (2023) has proposed a classification of the meaconer impacts at the correlator output level, building from mathematical models of meaconing interference and from the results of Bamberg et al. (2018) and Peng et al. (2019). The effects of the meaconer can be categorized as nominal (where the meaconer impact on the tracking loops is negligible), spoofing (where tracking loops are locked on meaconer signals), jamming (where the meaconer rebroadcast noise degrades tracking performance, and potentially cause loss of lock), or multipath-like errors (where meaconer signals distort the nominal behavior of the GNSS receiver as if it were exposed to multipath). These papers also reveal that the presence of meaconers can adversely affect tracking loop performance, pseudorange estimation, and position determination under specific geometrical and power conditions.

## 2. Meaconer description and impacts

A meaconer, also known as a GNSS repeater, is an electronic device designed to capture electromagnetic signals, to amplify them, and to rebroadcast them around a specific GNSS central frequency, as illustrated on Fig 1. The meaconer is characterized by its gain $G_m$, intrinsic delay $\tau_m$, frequency offset $f_m$ and phase offset $\theta_m$. In this paper, the meaconer gain $G_m$ is defined as the ratio between the signal power at the meaconer's receiving antenna input and the signal power at its emitting antenna output. The intrinsic delay $\tau_m$ represents the signal group delay between the meaconer receiving antenna input and its emitting antenna output. The frequency offset $f_m$ and phase offset $\theta_m$ respectively denote the difference between the carrier frequency (resp. instantaneous phase) of the signal at the emitting antenna output, compared to its carrier frequency (resp. instantaneous phase) at the receiving antenna output.

<figure><img src="image_1.png" /><figcaption>**Figure 1:** Sketch of the meaconer repercussion on nearby GNSS receivers.</figcaption></figure>

The satellite signal is captured by the meaconer and the nearby GNSS receivers. The signal directly coming from the satellite to the user GNSS receiver is called the authentic signal (in green in the figure), and $d_{SU}$ represents the authentic signal propagation distance (the Euclidian distance between the satellite and the user GNSS antenna phase centers). The satellite signal that detours through the meaconer is called the meaconer signal, and is depicted in red in the figure. $d_{SM}$ represents the distance between the satellite and the meaconer antenna phase centers, and $d_{MU}$ between the meaconer and the user antenna phase centers. $d_{SM} + d_{MU}$ constitutes the propagated distance of the meaconer signal.

### a) Mathematical model of a meaconer

The GNSS signals observed and rebroadcast by the meaconer have the same structure as the authentic signals received at the user's GNSS receiver antenna, but differ in power (due to the meaconer gain $G_m$, the different space and atmospheric losses, the antenna gains and the environments around the antennas), time delay (due to the meaconer intrinsic delay $\tau_m$, the different signal propagation times and the antenna hardware biases), carrier frequency and carrier phase offset (due to the relative motions between the satellite, the meaconer and the user, and other propagation effects), as evidenced by Hussong et al. (2023) and Steindl et al. (2013). Moreover, the meaconer signal contains additional noise, generated by the meaconer active components. In this paper, the relative parameters of interest between the nominal signal and the repeated ones are expressed as follows:

* The relative power denoted as $\Delta g$ represents the ratio between the meaconer signal useful power and the authentic signal useful power at the user's antenna output.

* The relative noise power spectrum density denoted as $\Delta N$ represents the ratio between the thermal noise power spectrum density (PSD) at the correlator input that would have been observed without meaconer interference, and the thermal noise PSD that would have been observed if only receiving the meaconer signal.
* The relative delay $\Delta\tau$ represents the difference between the propagation time of the meaconer signal and the propagation time of the authentic signal at the user's antenna output.

* The relative frequency $\Delta f$ represents the difference between the received carrier frequency of the meaconer signal and the received carrier frequency of the authentic signal at the user's antenna output.

* The relative phase $\Delta\theta$ represents the difference between the received instantaneous phase of the meaconer signal and the received instantaneous phase of the authentic signal at the user's antenna output.

b) Classification of the meaconer impacts at the correlator output

For each GNSS signal reaching the user's GNSS antenna, the impact of the meaconer at the correlator output can be cataloged in one of the four situations introduced by Hussong et al. (2023). These four distinct situations are illustrated in Fig. 2 and briefly detailed below.

* In the nominal situation, the receiver is synchronized with the nominal signal parameters, without significant distortion induced by the meaconer.

* In the jamming situation, the receiver is synchronized with the nominal signal parameters, and the meaconing peak is either significantly distant (in terms of delay) or sufficiently low in amplitude to be disregarded. The impact of the meaconer on the correlator output is thus only dictated by the rebroadcast noise of the meaconer signal.

* In the spoofing situation, the receiver is synchronized with the meaconing signal parameters (meaconing peak), and the nominal peak is significantly distant (in terms of delay) or sufficiently low in amplitude to disregard the distortion induced by the nominal peak on the meaconer one.

* In the multipath situation, the nominal and meaconing peaks are sufficiently close to each other (in terms of delay) to both affect the synchronization process.

<figure><img src="image_2.png" /><figcaption>**Figure 2:** Classification of the situations at the correlator output. **E**, **P**, and **L** respectively represent the early, prompt, and late correlators.</figcaption></figure>

3. Motivations to characterize the multipath situation

The nominal, jamming, and spoofing situations, as well as their cascading impacts on the pseudoranges, $C/N_0$, and estimated positions, have been thoroughly analyzed in Hussong et al. (2024b) and Hussong et al. (2024a). However, the effect of meaconers in the multipath situation has either been left for future work or not observed due to specific scenario designs. Indeed, these articles deal with civil aviation receivers, where the aircraft and the meaconer are distant enough to consider that the meaconing signals arrive at the aircraft with a sufficient delay not to cause the multipath situation.

Nevertheless, in many other scenarios (static, pedestrian, car, ...), the multipath situation is likely to be observed and needs further investigation. The impact of the multipath situation on a GNSS receiver has been characterized in Ghizzo et al. (2024b,a) as a function of the relative parameters $\Delta\nu = [\Delta g, \Delta N, \Delta\tau, \Delta f, \Delta\theta]^T$. Both articles reveal DLL distortions and $C/N_0$ degradations, for specific values of $\Delta\nu$. However, the behavior of the models during real-life scenarios is complicated to interpret based only on the relative parameters. A clear identification of the geometrical conditions under which the multipath situation is observed could facilitate its understanding. The assessment of the multipath situation distortions on the $C/N_0$ and on the DLL outputs during realistic scenarios could also completes the characterization of meaconing multipath.
## 4. Objectives of the study

This paper targets three main objectives:

1. The first objective is to characterize and bound the precise impact of the meaconing interference on the $C/N_0$ estimations and the DLL outputs, when a satellite signal is received in the multipath situation (Section II).

2. The second objective is to compute the geometrical conditions for the multipath situation to occur (Section III), to estimate the meaconer impact on the observables only based on the geometry and the meaconer characteristics (Section IV).

3. The third objective is to validate and highlight through comprehensive simulations the impact of the meaconer in the multipath situation in various realistic scenarios (Section V).

# II. MATHEMATICAL MODELS OF THE GNSS OBSERVABLES IN THE MULTIPATH SITUATION

This section presents the theoretical model of the correlator output, tracking loops, and $C/N_0$ in the multipath situation. The models have been derived in previous works as a function of the relative parameters $\Delta\nu$

## 1. Model of the correlator outputs

GNSS implements direct-sequence spread spectrum (DS-SS). The received signal is correlated with a local replica controlled by the code and carrier Numerically Controlled Oscillators (NCOs) over the integration time $T_i$. Typically, GNSS receivers encompass at least three correlators: the early ($\Lambda_E$), prompt ($\Lambda_P$), and late ($\Lambda_L$) correlators, where the local replicas are respectively shifted in code by $-c_\tau/2$, 0, and $c_\tau/2$ ($c_\tau$ is the chip spacing). The correlator output in the presence of meaconing interference has been derived as a function of the tracking errors $\epsilon_\eta = [\epsilon_\tau, \epsilon_\theta, \epsilon_f]^T$ and relative parameters $\Delta\nu$ in Hussong et al. (2023). The correlator output at epoch $k$ is expressed as the linear combination

$$ \Lambda(\epsilon_{\eta}, \Delta\nu) = \Lambda_{a}(\epsilon_{\eta}) + \Lambda_{s}(\epsilon_{\eta}, \Delta\nu) + \Lambda_{n} \quad (1) $$

with $\Lambda_a$ and $\Lambda_s$ the nominal and spoofing contributions expressed as

$$ \Lambda_a(\epsilon_\eta) = \sqrt{C_a} d_k \zeta_\tau(\epsilon_\tau) \zeta_f(\epsilon_f) e^{j\epsilon_\theta} \quad \text{and} \quad \Lambda_s(\epsilon_\eta, \Delta\nu) = \sqrt{\Delta g C_a} d_k \zeta_\tau(\epsilon_\tau + \Delta\tau) \zeta_f(\epsilon_f + \Delta f) e^{j(\epsilon_\theta + \Delta\theta)}. \quad (2) $$

Here, $\zeta_\tau$ and $\zeta_f$ are the code and frequency synchronization mismatch functions defined in (Ghizzo et al., 2024b, Eq. (7)). $C_a$ is the received signal power, and $d_k$ is the navigation message bit (considered constant over the integration time). The noise contribution, $\Lambda_n$, can be defined as Gaussian noise with power $P_n$, expressed in Ghizzo et al. (2024b) by

$$ P_n = \frac{N_0}{T_i} (1 + \Delta N) \zeta_\tau(0). \quad (3) $$

## 2. Model of the tracking loops

The dynamic behavior of the tracking loops has been modeled in Ghizzo et al. (2024a) as a non-linear system of two difference equations. This paper focuses on the system's dynamic value at lock (i.e., where the loop has successfully established and maintains synchronization with the incoming signal dynamics). The tracking errors at lock have been shown to be equivalent to the system's stable equilibria (SE) expressed as (without stress error)

$$ D_{\phi}(\epsilon_{\eta}, \Delta\nu) = 0, \quad \frac{\partial D_{\phi}(\epsilon_{\eta}, \Delta\nu)}{\partial \epsilon_{\phi}} > 0 \quad \forall \phi \in \{\tau, \theta\} \quad ; \quad \chi_{\theta}(\epsilon_{\eta}, \Delta\nu) = 0, \frac{\partial \chi_{\theta}(\epsilon_{\eta}, \Delta\nu)}{\partial \epsilon_{f}} > 0. \quad (4) $$

$D_\phi$ is the code and phase discriminator outputs and $\chi_\theta$ the phase discriminator difference, expressed as

$$ D_{\tau}(\epsilon_{\eta}, \Delta\nu) = \frac{C_a}{2P_d} (\zeta_f(\epsilon_f)^2 Z_0(\epsilon_{\tau}) + \Delta g \zeta_f(\epsilon_f + \Delta f)^2 Z_0(\epsilon_{\tau} + \Delta\tau) + 2\sqrt{\Delta g} \cos(\Delta\theta) \zeta_f(\epsilon_f) \zeta_f(\epsilon_f + \Delta f) Z_{\Delta\tau}(\epsilon_{\tau})) \quad (5) $$

$$ D_{\theta}(\epsilon_{\eta}, \Delta\nu) = \epsilon_{\theta} + \frac{\Delta\theta}{2} - \operatorname{atan}\left(\gamma_{\Delta}(\epsilon_{\tau}, \epsilon_{f}) \tan\left(\frac{\Delta\theta}{2}\right)\right) - p\pi \quad (6) $$

$$ \chi_{\theta}(\epsilon_{\eta}, \Delta\nu) = \epsilon_{f} + \Delta f - \frac{1}{2\pi T_{i}} \left[ \operatorname{atan}\left(\gamma_{\Delta}(\epsilon_{\tau}, \epsilon_{f}) \tan\left(\frac{\Delta\theta}{2}\right)\right) - \operatorname{atan}\left(\gamma_{\Delta}(\epsilon_{\tau}, \epsilon_{f}) \tan\left(\pi\Delta f T_{i} + \frac{\Delta\theta}{2}\right)\right) \right] - \frac{p'}{2T_{i}} \quad (7) $$
The integers $p$ and $p'$ represent the phase and frequency ambiguity respectively and

$$Z_{\tau'}(\tau) \triangleq \zeta_{\tau} \left(\tau + \frac{c_{\tau}}{2}\right) \zeta_{\tau} \left(\tau + \tau' + \frac{c_{\tau}}{2}\right) - \zeta_{\tau} \left(\tau - \frac{c_{\tau}}{2}\right) \zeta_{\tau} \left(\tau + \tau' - \frac{c_{\tau}}{2}\right) \quad (8)$$

$$\gamma_{\Delta}(\varepsilon_{\tau}, \varepsilon_{f}) \triangleq \frac{\zeta_{\tau}(\varepsilon_{\tau}) \zeta_{f}(\varepsilon_{f}) - \sqrt{\Delta g} \zeta_{\tau}(\varepsilon_{\tau} + \Delta \tau) \zeta_{f}(\varepsilon_{f} + \Delta f)}{\zeta_{\tau}(\varepsilon_{\tau}) \zeta_{f}(\varepsilon_{f}) + \sqrt{\Delta g} \zeta_{\tau}(\varepsilon_{\tau} + \Delta \tau) \zeta_{f}(\varepsilon_{f} + \Delta f)} \quad (9)$$

The tracking error at lock $\varepsilon_{\eta}$ can be found solving (4) and is presented in Fig. 3 (detailed hereafter). The tracking error at lock (i.e., the SE), does not represent the actual errors, but rather the tracking error to which the system tries to converge. The full behavior of the system is further analyzed in Ghizzo et al. (2024a).

<figure><img src="image_3.png" /><figcaption>Figure 3: Maximum and mean values of the code tracking errors at lock with respect to $\Delta f$; $\Delta \tau$ and $\Delta g$, considering $\Delta \theta \sim U[0, 2\pi]$.</figcaption></figure>

Fig. 3a represents the absolute value of the tracking mean error at lock, when averaged over $\Delta \theta$ uniformly distributed between 0 and $2\pi$, and as a function of $\Delta f$ and $\Delta \tau$. This mean error is a good approximation of the DLL output error that is found in the code pseudorange estimation, in the situations when $\Delta \theta$ varies more than $2\pi$ during $T_i$ (as evidenced by Sec. V). Figure 3a highlights that the code pseudoranges can be corrupted with error of $\pm 11$ meters for many relative parameters values. Fig. 3b reports the maximum absolute value of the tracking error at lock. The DLL errors can potentially reach $\pm 15$ meters in specific conditions, especially when the relative phase $\Delta \theta$ varies slowly during $T_i$, because in that case the DLL output might not converge to the mean value of $\varepsilon_{\tau}$. Fig. 3c shows the influence of the relative power $\Delta g$ on the maximum tracking errors at lock, exhibiting that the largest errors are almost proportional to $\Delta g$ (in linear).

### 3. Impact of the tracking loops distortions on the $C/N_0$

The expected value of the $C/N_0$ estimate in the multipath situation (with moment method) has been modeled in Ghizzo et al. (2024b) as

$$C_{\Delta\nu} = \mathbb{E} \left[ \frac{\widehat{C}}{N_0} \right] = \frac{1}{T_i} \frac{\sqrt{\overline{P_d}^2 - C_a^2 \sigma_d^2}}{P_n + \overline{P_d} - \sqrt{\overline{P_d}^2 - C_a^2 \sigma_d^2}}. \quad (10)$$

with

$$\overline{P_d} = \left( \zeta(\varepsilon_{\eta})^2 + \Delta g \zeta(\varepsilon_{\eta} + \Delta \eta)^2 + 2\sqrt{\Delta g} \zeta(\varepsilon_{\eta}) \zeta(\varepsilon_{\eta} + \Delta \eta) \frac{\sin(\pi M \Delta f T_i)}{M \sin(\pi \Delta f T_i)} \cos(\Delta \theta) \right) C_a \quad (11)$$

$$\sigma_d^2 = 2\Delta g \zeta(\varepsilon_{\eta})^2 \zeta(\varepsilon_{\eta} + \Delta \eta)^2 \left[ 1 + \frac{\sin(2\pi M \Delta f T_i)}{M \sin(2\pi \Delta f T_i)} \cos(2\Delta \theta) - 2 \frac{\sin^2(\pi M \Delta f T_i)}{M^2 \sin^2(\pi \Delta f T_i)} \cos^2(\Delta \theta) \right]. \quad (12)$$

where $T_e$ is the $C/N_0$ estimation time, $\overline{\Delta \theta} = \pi M \Delta f T_i + \Delta \theta$ the mean relative phase within $T_e$ and $M = T_e/T_i$ the number of integration time within $T_e$.
Figure 4 plots the values of Eq. (10) as a function of $\Delta f$, $\Delta\tau$, and $\Delta g$, with the approximation $\varepsilon_{\eta} = 0$ and a nominal $C/N_0$ of 40 dB-Hz, $T_c = 1$ s and $T_i = 20$ ms. Figure 4a shows the mean values of the theoretical $C/N_0$, averaged over $\Delta\theta$ uniformly distributed between 0 and $2\pi$ (i.e., $\Delta\theta \sim U[0, 2\pi]$). The results are plotted for $\Delta g = \Delta N = -3$ dB, as a function of $\Delta f$ and $\Delta\tau$. It demonstrates that when $\Delta\tau < 1$ chip, the $C/N_0$ is significantly degraded, even with a low received meaconer power. The degradations are mainly observed for $|\Delta f| \in [1/(2T_c); 1/(2T_i)] = [0.5; 25]$ Hz.

Figure 4b represents the lowest theoretical $C/N_0$ values for $\Delta\theta$ varying between 0 and $2\pi$. These results are very similar to the mean values of Fig. 4a. This similarity indicates that $\Delta\theta$ does not significantly affect the $C/N_0$ estimations, except for small relative Doppler values $\Delta f$. Specifically, when $|\Delta f| < 0.1$ Hz, the mean $C/N_0$ is marginally affected by meaconing interference, whereas the lowest values show degradations around 10 dB.

Figure 4c depicts the mean $C/N_0$ values, averaged over $\Delta\theta \sim U[0, 2\pi]$, and for $\Delta\tau = 0$ chip (as this relative delay produces large $C/N_0$ degradations). The $C/N_0$ are plotted against $\Delta f$ and $\Delta g$. Even with a small relative power of $\Delta g = -30$ dB, $C/N_0$ is degraded by about 3 dB. The degradations exceed 15 dB when $\Delta g > -10$ dB and $|\Delta f| \in [0.5, 25]$ Hz. In all plots, the $C/N_0$ values are symmetrical with respect to $\Delta f$.

<figure><img src="image_4.png" /><figcaption>**Figure 4:** Maximum and mean values of the code tracking errors at lock with respect to $\Delta f$; $\Delta\tau$ and $\Delta g$, considering $\Delta\theta \sim U[0, 2\pi]$</figcaption></figure>

### III. MAPPING OF THE MULTIPATH SITUATION TO THE GEOMETRY

This section aims to determine the geometrical condition under which a satellite signal is received in the multipath situation, in order to better visualize the scenarios producing the multipath situation for a given satellite. Indeed, the relative parameters $\Delta\nu$ are useful for modeling the $C/N_0$ and the DLL outputs, but they can not provide a clear understanding of the meaconing multipath impacts during real scenarios that are defined based on their geometries. By mapping the multipath situation with respect to the geometry of the user's environment, this section identifies the geometrical configurations yielding to the multipath situation.

#### 1. Conditions to observe the multipath situation

The multipath situation is dependent on two factors: the delay condition and the Doppler criterion, defined as follows:

* **Delay condition** - To observe the multipath situation, both the authentic and meaconer peaks shall affect the correlators. For GPS L1 C/A, the signal peaks after correlation form a triangle of width 2 chips. The early and late correlators are computed at a delay difference of $c_{\tau}/2$ with respect to the prompt correlator. The meaconer peak can only be observed with a delay greater than the authentic peak because the meaconer signal detours before reaching the user GNSS antenna, resulting in a larger propagation time. Assuming the receiver tracks the authentic peak, the meaconer peak distorts the late correlator if the delay difference between the two peaks is smaller than $T_c + c_a/2$. Conversely, if the receiver tracks the meaconer peak, the authentic peak distorts the early correlator if $\Delta\tau \le T_c + c_a/2$. Fig. 5 illustrates the correlator outputs in the presence of authentic and meaconer signals. Only when $\Delta\tau < T_c + c_a/2$, the sum of the authentic and meaconer peaks modifies the correlator values, resulting in a new equilibrium different from the nominal one (as also evidenced by Fig. 3). In the illustration of Fig. 5, $c_s = T_c$ for pedagogic reasons, but the rest of this paper uses $c_s = T_c/10$.
<figure><img src="image_5.png" /><figcaption>Figure 5: Illustration of the delay condition to observe the multipath situation.</figcaption></figure>

* **Doppler criterion** - The $C/N_0$ and DLL outputs strongly depends on the relative Doppler $\Delta f$ as evidenced by Figs. 3 and 4. To observe large multipath errors and $C/N_0$ degradations, the authentic signal and the meaconer signal should have a relative Doppler shift at the user GNSS antenna between 0.25 and 25 Hz. Otherwise, the multipath situation causes smaller degradations on the GNSS observables. Whereas the delay condition is a mandatory condition for a signal to be in the multipath situation, the Doppler criterion only highlights the most affected signals among the signals inside the multipath situation, and therefore helps to identify the satellite signals bearing high degradations.

## 2. Definition of the geometry in this study

In this paper, the meaconer impact is computed according to the position of the user relative to the meaconer. This approach allows for better visualization and understanding of the meaconing effects on GNSS receivers. The meaconer impact also depends on the velocities of both the meaconer and the user, as well as the positions of the satellites and the meaconer characteristics. The term geometry refers to the relative position and velocities of the user, the meaconer, the satellites, and also the meaconer gain, intrinsic delay, frequency and phase offsets.

## 3. Mapping of the delay condition to the geometry

The delay condition $M$ is defined with respect to the relative parameters as:

$$ M \Leftrightarrow \Delta\tau < T_c \left(1 + \frac{c_s}{2}\right) = T_{\max}. \qquad (13) $$

The relative delay $\Delta\tau$ represents the difference between the meaconer signal propagation time $\tau_s$ and the authentic signal propagation time $\tau_a$. From Fig. 1, the relative delay can be expressed as:

$$ \Delta\tau = \tau_s - \tau_a = \left( \frac{d_{SM}}{c} + \tau_m + \frac{d_{MU}}{c} + \tau_{\text{ant},s} \right) - \left( \frac{d_{SU}}{c} + \tau_{\text{ant},a} \right) = \frac{d_{SM} + d_{MU} - d_{SU}}{c} + \tau_m + \Delta\tau_{\text{ant}}. \qquad (14) $$

where $c$ represents the speed of light, $\tau_m$ is the meaconer intrinsic delay, and $\Delta\tau_{\text{ant}}$ accounts for the antenna group delay difference between the authentic $\tau_{\text{ant},a}$ and meaconer $\tau_{\text{ant},s}$ signal delays at the user's receiver antenna. The expression of $\Delta\tau$ (Eq. (14)) can be rearranged using the parameters defined in Fig. 6 to obtain a geometric mapping of the delay condition.
<figure><img src="image_6.png" /><figcaption>**Figure 6:** Illustration of the satellite *S*, meaconer *M*, and user *U* positions in the (*SMU*) hyperplane, with the authentic signal in green and the meaconer signal in red.</figcaption></figure>

In Fig. 6, $M'$ is the orthogonal projection of $M$ onto the line (SU), and $O$ is the orthogonal projection of $S$ onto the line (MU). $\beta_1$ represents the non-oriented angle between the meaconer and the satellite as seen by the user, and $\beta_2$ represents the non-oriented angle between the imaginary point $O$ and the satellite as seen by the meaconer. $\gamma_1$ represents the non-oriented angle between the user and the meaconer as seen by the satellite, and $\gamma_2$ represents the non-oriented angle between the meaconer and the imaginary point $O$ as seen by the satellite.

The objective is to obtain an expression of $\Delta\tau$ that depends only on terms known in the geometry. To do so, $\Delta\tau$ is derived in terms of $d_{SU}$, $d_{MU}$, and the angle $\beta_1$. Using the parameters from Fig. 6, the relative delay (Eq. (14)) becomes:

$$ 
\begin{aligned}
\Delta\tau &= \frac{d_{SM} + d_{MU} - d_{SM'} - d_{M'U}}{c} + \tau_m + \Delta\tau_{\text{ant}} \\
&= \frac{d_{SM} - d_{SM'}}{c} + \frac{d_{MU}}{c} \left(1 - \frac{d_{M'U}}{d_{MU}}\right) + \tau_m + \Delta\tau_{\text{ant}} \\
&= \frac{d_{SM} - d_{SM'}}{c} + \frac{d_{MU}}{c} \left(1 - \cos(\beta_1)\right) + \tau_m + \Delta\tau_{\text{ant}}
\end{aligned} 
\quad (15) $$

The computation of ($d_{SM} - d_{SM'}$) is done in Appendix (VII). It is proved that an excellent approximation of the difference is $d_{SM} - d_{SM'} \approx 0$ m. It follows,

$$ \Delta\tau \approx \frac{d_{MU}}{c} (1 - \cos(\beta_1)) + \tau_m + \Delta\tau_{\text{ant}}. \quad (16) $$

By injecting Eq. (16) into (13), the delay condition can now be expressed as

$$ M \Leftrightarrow d_{MU} (1 - \cos(\beta_1)) < c (T_{\text{max}} - \tau_m - \Delta\tau_{\text{ant}}). \quad (17) $$

Particularly, if $T_{\text{max}} < \tau_m + \Delta\tau_{\text{ant}}$, this condition is never satisfied, and the multipath situation is never observed. Furthermore, if $d_{MU} < c(T_{\text{max}} - \tau_m - \Delta\tau_{\text{ant}})/2$, the condition is always satisfied, and the multipath situation is observed for all the visible satellites. Otherwise, for a given geometry, the satellites in the multipath situation $M$ are the ones seen inside a cone with summit $U$, symmetry axis (UM), and aperture angle $\beta_{\text{max}}$ given by

$$ \beta_{\text{max}} = \cos^{-1} \left( 1 - c \frac{T_{\text{max}} - \tau_m - \Delta\tau_{\text{ant}}}{d_{MU}} \right). \quad (18) $$

A representation of the multipath cone $M$ depicted by Eq. (17) is shown in Fig. 7, where the user $U$ is in the air and the meaconer $M$ is on the ground. In this configuration, only some signals are in the multipath situation. These satellite signals are received in a direction close to the direction of the meaconer from the user perspective. As the meaconer is often seen with an elevation around 0°, the signals in the multipath situation are more likely to have low elevations. Moreover, the closer the user is to the meaconer, the larger the multipath cone aperture $\beta_{\text{max}}$ is, as illustrated by the two examples on the skyplot in Fig. 7b.
<figure><img src="image_7.png" /><figcaption>Figure 7: Illustrations of the multipath cone M.</figcaption></figure>

## 4. Mapping of the Doppler criterion to the geometry

The relative Doppler $\Delta f$ can be expressed as in Petovello (2015) as

$$ \Delta f = f_s - f_a = f_m + \frac{(\mathbf{v}_S - \mathbf{v}_M)^T \cdot \mathbf{u}_{SM} + (\mathbf{v}_M - \mathbf{v}_U)^T \cdot \mathbf{u}_{MU}}{\lambda} - \frac{(\mathbf{v}_S - \mathbf{v}_U)^T \cdot \mathbf{u}_{SU}}{\lambda}. \quad (19) $$

where $f_s$ (resp. $f_a$) is the received frequency at the user's GNSS antenna of the meaconer (resp. authentic) signal. $\mathbf{v}$ represents the velocity vectors, and $\mathbf{u}$ denotes the unit direction vectors. $\lambda$ is the wavelength of the GNSS signal. Note that the receiver clock drift has no impact on the relative Doppler $\Delta f$, as it is equally present in $f_s$ and $f_a$. As a satellite is almost seen in the same direction from the user and from the meaconer points of view, $\mathbf{u}_{SM} \approx \mathbf{u}_{SU}$. This approximation leads to

$$ \Delta f \approx f_m + \frac{(\mathbf{v}_U - \mathbf{v}_M)^T \cdot (\mathbf{u}_{SU} - \mathbf{u}_{MU})}{\lambda}. \quad (20) $$

The $C/N_0$ degradation and the DLL output distortions in the multipath situation are strongly affected as a function of the absolute value of the Doppler shift $|\Delta f|$. The relative Doppler can be mapped to the geometry to identify the regions $\mathbb{F}$ of small absolute relative Doppler $|\Delta f| < f_{\max}$ where the impact of meaconing multipath is the strongest ($f_{\max}$ can be chosen depending on the tolerated degradations).

$$ \mathbb{F} \Leftrightarrow |\Delta f| < f_{\max} \Leftrightarrow \left| f_m + \frac{(\mathbf{v}_U - \mathbf{v}_M)^T \cdot (\mathbf{u}_{SU} - \mathbf{u}_{MU})}{\lambda} \right| < f_{\max} \Leftrightarrow \left| f_m - \frac{v_{MU}}{\lambda} (\cos(\alpha_U) - \cos(\alpha_M)) \right| < f_{\max} \quad (21) $$

$$ \Leftrightarrow \left| f_m + 2 \frac{v_{MU}}{\lambda} \sin \left( \frac{\alpha_U + \alpha_M}{2} \right) \sin \left( \frac{\alpha_U - \alpha_M}{2} \right) \right| < f_{\max}. \quad (22) $$

With $v_{MU} = ||\mathbf{v}_{MU}|| = ||\mathbf{v}_U - \mathbf{v}_M||$ the relative velocity between the user and the meaconer, $\alpha_U$ the non-oriented angle between $\mathbf{v}_{MU}$ and $\mathbf{u}_{SU}$, and $\alpha_M$ the non-oriented angle between $\mathbf{v}_{MU}$ and $\mathbf{u}_{MU}$, defined by:

$$ \alpha_U = \cos^{-1} \left( \frac{\mathbf{v}_{MU} \cdot \mathbf{u}_{SU}}{v_{MU}} \right) \quad \text{and} \quad \alpha_M = \cos^{-1} \left( \frac{\mathbf{v}_{MU} \cdot \mathbf{u}_{MU}}{v_{MU}} \right). \quad (23) $$
If the relative direction **u**<sub>MU</sub> and velocities **v**<sub>MU</sub> between the user and the meaconer are fixed, the relative Doppler $\Delta f$ only depends on the direction of the satellite with respect to the user **u**<sub>SU</sub>. Consequently, it is possible to represent the received relative Doppler on a skyplot as a function of the elevation and azimuth angles of **u**<sub>SU</sub>. When mapped on a skyplot, the region $\mathbb{F}$ corresponding to $|\Delta f| < f_{max}$ forms a ring perpendicular to the vector **v**<sub>MU</sub> (and containing the meaconer location if $f_m = 0$ Hz). Three examples of the regions with $f_m = 0$ Hz are shown in Fig. 8, for three different positions of the meaconer (in red on the skyplots). These plots highlight the Doppler rings $\mathbb{F}$ as a function of the elevation and azimuth angles of the received satellite signal. The relative velocity **v**<sub>MU</sub> is indicated with a black arrow, and is directed towards the East (elevation 0° and azimuth 90°) with a velocity norm of $v_{MU} = 10$ m/s. The relative Doppler does not depend on the distance between the user and the meaconer $d_{MU}$, but only on the direction vector **u**<sub>MU</sub> with respect to the velocity vector **v**<sub>MU</sub>. The absolute value of the relative Doppler $\Delta f$ can reach (in Hz) up to 10 times the value of the relative velocity (in m/s) for GPS L1.

<figure><img src="image_8.png" /><figcaption>**Figure 8:** Three examples of relative Doppler values $\Delta f$ as a function of the geometry ($v_{MU} = 10$ m/s).</figcaption></figure>

## IV. IMPACT OF THE MULTIPATH SITUATION ON THE DLL OUTPUTS AND ON THE $C/N_0$

Section II presented the DLL errors at lock and the $C/N_0$ estimations as functions of the relative parameters, and section III expressed $\Delta\tau$ and $\Delta f$ with respect to the geometry. By combining these sections, it is possible to map the DLL errors at lock and $C/N_0$ estimations to the geometry. This section provides the impact of the meaconer on the multipath error envelope (i.e., the maximum DLL error in stable equilibrium in the multipath situation) and on the estimated $C/N_0$, as functions of the satellite elevation and azimuth angles.

For better visualization of the meaconer impact on GNSS observables, the multipath error envelope and the estimated $C/N_0$ are plotted on skyplots for a specific values of $\Delta g$ (0 dB or -3 dB) and for three different values of $v_{MU}$ (0 m/s, 5 m/s, and 15 m/s). On each skyplot, the meaconer is observed at an elevation of 0° and an azimuth of 180° (South), represented by a large red dot. The user is moving at a speed $v_{MU}$ towards an elevation of 0° and an azimuth of 90° (East) relative to the meaconer. The meaconer impact on a satellite is represented by a color at the corresponding elevation and azimuth angle of the satellite, from the user's perspective.

All the skyplots have been computed with $d_{MU} = 180$ m, $\tau_m = \Delta\tau_{ant} = 0$ s, and $T_{max} = 1.05 T_c \approx 307.7$ m. Equation (18) shows that $\beta_{max} \approx 135^\circ$ in this configuration, stating that the satellites seen at an angle greater than 135° with respect to the meaconer are not in the multipath situation. The non-affected satellites lie in the northern part of the skyplot, depicted by the bold dotted line on each skyplot. The satellites not affected by multipath are either in the nominal or jamming situation, and their multipath error envelope and $C/N_0$ are computed accordingly to the formulas of Hussong et al. (2023) in these situations. Finally, the receiver noise is neglected in the skyplots, to only represent the deterministic mean behavior of the GNSS observables in the multipath situation.

### 1. Mapping of the multipath error envelope on skyplots

Figure 9 presents the Meaconer Multipath Error Envelop (MMEE), which are the maximum code tracking errors at lock, obtained by solving Eq. (4), as a function of the satellite elevation and azimuth angles. They have been computed for $\Delta g = \Delta N = 0$ dB, and for three different relative velocities $v_{MU} = [0; 5; 15]$ m/s between the meaconer and the user.

The figure highlights significant MMEE values (up to $\pm 15$ m) when the emitting satellite is observed in the multipath cone. Only the satellite that are seen extremely close to the meaconer direction do not show large DLL errors, the rest of the satellite signals are distorted by the meaconing interference depending on the relative velocity. In the static case, MMEE values are almost constant at $\pm 15$ meters all over the skyplot. When the relative velocity $v_{MU}$ increases, the large MMEE values at lock
agglomerate around a ring perpendicular to the velocity vector and containing the meaconer direction (shaping the Doppler rings $F$ evidence in section III). The errors above 10 meters are contained inside the Doppler ring corresponding to $f_{max} = 25$ Hz. The rest of the skyplot bears reduced but still significant DLL errors. In all cases, the errors outside of the multipath situation equal zero, because the receiver noise is neglected in these skyplots.

<figure><img src="image_9.png" /><figcaption>**Figure 9:** Maximum tracking error at lock $\max_{\Delta\theta \in [0, 2\pi]} |\epsilon_{\tau}|$, as a function of the geometry, with $\Delta g = \Delta N = 0$ dB.</figcaption></figure>

## 2. Mapping of $C/N_0$ degradations on skyplots

Figure 10 shows the lowest $C/N_0$ as a function of the geometry. The lowest value is computed by evaluating the $C/N_0$ for all $\Delta\theta \in [0; 2\pi]$ (knowing the satellite elevation and azimuth angles) and taking the smallest result. While $\Delta\theta$ significantly influences the $C/N_0$ estimations for small values of $v_{MU}$ (below 0.1 m/s, corresponding to $|\Delta f| < 1$ Hz), it plays a marginal role for higher values of $v_{MU}$. Therefore, the results displayed on Fig 10 provide an excellent approximation in dynamic cases of the received $C/N_0$. For the static case, the results show the largest degradation eventually observed.

The $C/N_0$ in Fig. 10 is heavily degraded by the presence of the meaconer in the multipath situation. In this figure, the nominal $C/N_0$ is set at 40 dB.Hz. Outside of the multipath cone (in the northern part of the skyplots), the nominal/jamming situation is observed, and the $C/N_0$ drops to about 37 dB.Hz when $\Delta g = \Delta N = -3$ dB. These values align with the results of Hussong et al. (2023). For the satellites in the multipath situation, the $C/N_0$ degradation exceeds 15 dB.Hz when $\Delta g = \Delta N = -3$ dB for almost all satellites in the southern hemisphere when $v_{MU} = 5$ m/s. When $v_{MU} = 15$ m/s, these degradations occur for the satellite in the Doppler ring $F$ corresponding to $f_{max} = 25$ Hz, and especially for the satellite that are seen close to the meaconer direction.

<figure><img src="image_10.png" /><figcaption>**Figure 10:** Lowest $C/N_0 = \min_{\Delta\theta \in [0, 2\pi]} |C_{\Delta\nu}|$, as a function of the geometry, with $\Delta g = \Delta N = -3$ dB.</figcaption></figure>
# V. VALIDATION OF THE MODELS AND VISUALIZATION OF THE IMPACT THROUGH SIMULATIONS

This section validates the presented models by designing three different scenarios affected by meaconing interference in the multipath situation. It compares the impact computed from the equations presented in this paper to the impact obtained by simulating the scenarios in a highly realistic GNSS generation software.

## 1. Definition of the scenarios under scrutiny

The three scenarios are designed to represent a static, a pedestrian, and a car trajectory. They pass close to a fixed meaconer on the ground. In each scenario, the same GPS satellite is under scrutiny, and its DLL outputs and estimated $C/N_0$ are monitored.

<figure><img src="image_11.png" /><figcaption>Figure 11: Illustration of the pedestrian and car trajectories.</figcaption></figure>

Figure 11 illustrates the pedestrian and car scenarios. The trajectories are each 1200 meters long, with 200 meters of nominal/jamming situation, then 800 meters where the GPS satellite under scrutiny is inside the multipath cone, and finally 200 meters back in the nominal/jamming situation. The meaconer is 100 meters away from the trajectory, with a gain of 76 dB chosen to compensate the free-space losses to have $\Delta g = \Delta N = 0$ dB when the user is closest to the meaconer. Both the user and the meaconer antennas are omnidirectional with gains of 0 dBi in all directions. The meaconer intrinsic delay is set to $\tau_m = 0$ s, its Doppler and phase offsets are set to $f_m = 0$ Hz and $\theta_m = 0$ rad. The only difference between the pedestrian and car scenarios is that the pedestrian travels the 1200 meters at 1.4 m/s (in about 857 seconds), while the car travels the same distance at 14 m/s (in about 86 seconds).

The relative parameters of both scenarios are displayed for information in Figs. 12 and 13. Outside the multipath cone, the relative power and noise PSD stay below -10 dB, and the satellite is in the nominal or jamming situation, producing negligible $C/N_0$ and DLL output distortions, as previously investigated by Hussong et al. (2023). The relative Doppler is positive in the first half of the trajectory because the user is moving towards the meaconer, perceiving the meaconer signal with a higher frequency. Conversely, the relative Doppler is negative in the second half of the trajectory, with the zero-crossing of $\Delta f$ occurring when the user is closest to the meaconer. The Doppler values are 10 times larger in the car scenario because the car is moving 10 times faster than the pedestrian. Finally, all the relative parameter curves are almost symmetrical because the user trajectory is symmetric with respect to the meaconer, and the satellite did not move significantly during the trajectory duration.

<figure><img src="image_12.png" /><figcaption>Figure 12: Relative parameters of the pedestrian scenario.</figcaption></figure>

<figure><img src="image_13.png" /><figcaption>Figure 13: Relative parameters of the car scenario.</figcaption></figure>
The static scenario represents a 120-second static user located 100 meters from the meaconer (at the “closest point to the meaconer” in Fig. 11). The meaconer is activated after 20 seconds, so the first 20 seconds of the static scenario are in the nominal situation. Similarly, the meaconer is shut down for the last 20 seconds of the scenario. In between, the meaconer gain is set to 76 dB to have $\Delta g = \Delta N = 0$ dB, and the satellite under scrutiny is in the multipath situation during 80 seconds.

The relative parameters of the static scenario are displayed in Fig. 14. The relative distance $c\Delta\tau$ is almost constant but increases slowly (by about 1 meter, or 5 GPS L1 wavelengths, during the meaconer activation) due to the satellite's motion. As $v_{MU} = 0$ m/s in this scenario, Eq. (20) states that $\Delta f \approx 0$ Hz. The exact relative Doppler is indeed extremely close to zero but varies slightly due to the satellite's different observation angles with respect to the user and the meaconer ($u_{SM} \approx u_{SU}$).

<figure><img src="image_14.png" /><figcaption>Figure 14: Relative parameters of the static scenario.</figcaption></figure>

## 2. Degradation of the DLL outputs and $C/N_0$ in the scenarios under scrutiny

The three scenarios have been run $N$ times ($N = 8000$ for the static and car scenarios, $N = 800$ for the pedestrian scenario) with a Monte-Carlo method. Only the random receiver-generated noise changes between the different runs. At each second of the scenarios, the mean value of $C/N_0$, and the mean value and standard deviation of the DLL outputs are computed with the $N$ values available. The results are shown in Figs. 15 to 17. Note that in the third subplots of the figures, the DLL outputs (in red on the figures) are the actual DLL errors comprised in the code pseudorange estimations, and not the DLL errors at lock as in the previous sections (also plotted in the figures, but in black). Indeed, the DLL errors at lock assume that the loop manages to converge towards its SE, whereas the actual DLL error considers the transient response and the smoothing effect of the loop.

### a) Impact of the multipath situation in the static scenario

In the static scenario (Fig. 15), the relative Doppler $\Delta f$ is close to zero, so the relative phase $\Delta\theta = 2\pi c\Delta\tau/\lambda + \theta_m$ plays a prominent role in the $C/N_0$ and DLL output computation. When $\Delta\theta = 0[2\pi]$, the authentic and the meaconer signals add up constructively, resulting in a higher $C/N_0$ than in the nominal situation. The DLL tracking loops are attracted towards the meaconing signal due to its similarity to the authentic signal, producing a large DLL output mean error. When $\Delta\theta = \pi[2\pi]$, the meaconer signal causes destructive interference with the authentic signal, significantly reducing $C/N_0$ (up to 18 dB.Hz). The DLL tracking loops are also repelled from the meaconer signal, producing large DLL mean errors in the opposite direction. Additionally, the DLL standard deviations increase when $C/N_0$ is low because poor signal quality degrades tracking performance.

The presented models of the theoretical $C/N_0$ and DLL SE are also plotted in black, showing an excellent match to the observed values, validating the models in static situations. Indeed, in static cases, the tracking loops have the time to converge to the SE, because the dynamic is low. Therefore, the theoretical values at the SE are extremely close to the actual values produced by the GNSS receiver software.
<figure><img src="image_15.png" /><figcaption>Figure 15: C/N₀, DLL standard deviation, and DLL mean values in the static scenario.</figcaption></figure>

b) Impact of the multipath situation in the pedestrian scenario

In the pedestrian scenario, the relative Doppler $\Delta f$ is large enough ($|\Delta f| > 1$ Hz) so that the $C/N_0$ estimation is mainly driven by the variations of $\Delta\theta$ ($\sigma_d \neq 0$ in Eq. (10)). The $C/N_0$ suffers steady but significant degradations (down to 18 dB.Hz when $\Delta g = 0$ dB), starting as soon as the user enters the multipath cone. These degradations deteriorate tracking performance and increase DLL standard deviations up to 10 times its nominal value. A rapid increase in $C/N_0$ is observed when the user is closest to the meaconer, as $|\Delta f| \approx 0$ Hz (and thus $\sigma_d \approx 0$). This rapid increase is well reflected by the theoretical model, validating the $C/N_0$ model in pedestrian or slow-motion scenarios.

The DLL stable equilibrium oscillates due to rapid variations of $\Delta\theta$, but the DLL low-pass filter limits rapid variations in DLL output and smooths the DLL stable equilibrium around its mean value, explaining the mismatch between the stable equilibrium and simulation results. Still, the stable equilibrium values shape the observed values of DLL mean outputs that reach up to 15 meters of error when the user is closest to the meaconer. Filtering the stable equilibrium values through the DLL filter produces the observed simulation results. This filtering process is not shown, but is demonstrated in Ghizzo et al. (2024a).

<figure><img src="image_16.png" /><figcaption>Figure 16: C/N₀, DLL standard deviation, and DLL mean values in the pedestrian scenario.</figcaption></figure>

c) Impact of the multipath situation in the car scenario

In the car scenario, the high velocity between the user and receiver reduces the time spent in the multipath cone. The $C/N_0$ is still degraded (up to 18 dB.Hz when the car is closest to the meaconer), leading to higher DLL standard deviations at that moment. However, the $C/N_0$ drop and the DLL distortions are not immediately visible when the car enters the multipath situation. Indeed, the large relative Doppler values $|\Delta f| \approx 65$ Hz at the beginning of the multipath situation mitigate the degradations induced by the meaconing interference. The degradations are eventually observed when $|\Delta f| < 25$ Hz as the car approaches the meaconer. The multipath situation also induces DLL mean errors up to 10 meters.

The models of $C/N_0$ and DLL mean output values show good conformity to the simulated data. The validation of the developed models exposes the meaconer threat and underscores the degradation of the GNSS accuracy (and potentially availability if the receiver loses the lock of the signal) when the meaconer is close to the user and when the multipath situation is observed.
<figure><img src="image_17.png" /><figcaption>Figure 17: C/N₀, DLL standard deviation, and DLL mean values in the car scenario.</figcaption></figure>

## VI. CONCLUSION

This study has comprehensively investigated the impact of meaconing interference on GNSS receivers in the multipath situation. The multipath situation under meaconing arises when both the authentic and the meaconer signals influence the correlator outputs of the GNSS receiver, leading to C/N₀ degradations and DLL output distortions. This paper demonstrates that the multipath situation affects all satellites observed within a cone centered around the meaconer, with the cone's width dependent on the meaconer's distance and intrinsic delay. The satellites inside this cone are not equally impaired by the multipath interference. The impact is primarily driven by the power and Doppler shift differences between the received authentic and meaconer signals. The most severe C/N₀ degradations and DLL output distortions occur when the authentic and meaconer signal powers are similar, and when the relative Doppler shift is small. This paper also shows that the relative Doppler is minimal when the satellite is observed near the ring perpendicular to the user's relative motion and containing the meaconer location. The magnitude of C/N₀ and DLL output degradations deterministically depends on the geometry between the user, the meaconer, and the satellite. C/N₀ estimations in the multipath situation can easily drop to 20 dB.Hz, and DLL outputs can exhibit mean errors of ±15 meters. Simulations confirm that satellites in the multipath situation are affected by these degradations, consistent with the models. Such signal distortions could potentially lead to signal lock losses or hazardous position estimations, compromising GNSS accuracy, availability, and integrity. Particularly, this paper speculates that meaconers used for indoor GNSS coverage in environments like metro systems or hangars might unintentionally degrade GNSS performance of nearby receivers if the multipath situation occurs. To mitigate these risks, the authors propose increasing the intrinsic delay τm of these meaconers beyond Tmax to prevent the multipath situation and preserve GNSS receiver performance. Finally, future research will explore the impact of meaconers onboard aircrafts, as this could severely impair aircraft receiver performance beyond aviation requirements.

## VII. APPENDIX : DERIVATION OF ($d_{SM} - d_{SM'}$)

The value of $d_{SM} - d_{SM'}$ can be rearranged with the notations of Fig. 6:

$$d_{SM} - d_{SM'} = d_{SM} (1 - \cos(\gamma_1)) = d_{SM} \left(1 - \cos\left(\frac{\pi}{2} - \beta_1 - \gamma_2\right)\right) \quad (24)$$

$$= d_{SM} \left(1 - \cos\left(\frac{\pi}{2} - \beta_1 - \left(\frac{\pi}{2} - \beta_2\right)\right)\right) \quad (25)$$

$$= d_{SM} (1 - \cos(\beta_2 - \beta_1)) = d_{SM} (1 - \cos(\beta_1) \cos(\beta_2) - \sin(\beta_1) \sin(\beta_2)) \quad (26)$$

$$= d_{SM} \left(1 - \frac{d_{M'U} d_{OM}}{d_{MU} d_{SM}} - \frac{d_{MM'} d_{OS}}{d_{MU} d_{SM}}\right) \quad (27)$$

$$= d_{SM} - \frac{d_{M'U} d_{OM}}{d_{MU}} - \frac{d_{MM'} d_{OS}}{d_{MU}}. \quad (28)$$

Trigonometric formulas directly give the expressions of $d_{M'U}$, $d_{OS}$, and $d_{MM'}$:

$$d_{M'U} = d_{MU} \cos(\beta_1) \qquad d_{OS} = d_{SU} \sin(\beta_1) \qquad d_{MM'} = d_{MU} \sin(\beta_1). \quad (29)$$
The Al-Kashi theorem gives the expression of $d_{SM}$:

$$d_{SM} = \sqrt{d_{MU}^2 + d_{SU}^2 - 2d_{MU}d_{SU} \cos(\beta_1)}. \quad (30)$$

Finally, the Pythagorean theorem provides an expression of $d_{OM}$, that can be arranged using (29) and (30) as

$$d_{OM} = \sqrt{d_{SM}^2 - d_{OS}^2} = \sqrt{d_{MU}^2 + d_{SU}^2 \cos^2(\beta_1) - 2d_{MU}d_{SU} \cos(\beta_1)}. \quad (31)$$

Inserting Eqs. (29) to (31) into (28) gives

$$d_{SM} - d_{SM'} = d_{SU} \left( \sqrt{1 - 2 \frac{d_{MU}}{d_{SU}} \cos(\beta_1) + \left( \frac{d_{MU}}{d_{SU}} \right)^2} - \cos^2(\beta_1) \sqrt{1 - \frac{2}{\cos(\beta_1)} \frac{d_{MU}}{d_{SU}} + \left( \frac{d_{MU}}{d_{SU} \cos(\beta_1)} \right)^2} - \sin^2(\beta_1) \right) \quad (32)$$

The distance $d_{SU}$ can be computed as a function of the satellite elevation angle (assimilated to $\beta_1$ in the case where the user is at the same altitude as the meaconer) with the formula of Hofmann-Wellenhof et al. (1997):

$$d_{SU} = \sqrt{R_S^2 - R_E^2 \cos^2(\beta_1) - R_E \sin(\beta_1)} \quad (33)$$

Where $R_E$ is the Earth radius and $R_S$ is the satellite orbit semi-major axis. The numerical values of the difference ($d_{SM} - d_{SM'}$) can then be plotted for different values of $d_{MU}$ as a function of $\beta_1$. The results are shown in Fig. 18 and clearly state that the distance can be approximated to zero meter (in comparison to the maximum multipath effect distance $cT_{max} \approx 308$ m).

<figure><img src="image_18.png" /><figcaption>Figure 18: Numerical values of Eq. (32) for three different values of $d_{MU}$ and as a function of the elevation angle (assimilated to $\beta_1$).</figcaption></figure>

## ACKNOWLEDGMENTS

The authors did not receive support from any organization for the submitted work, and have no interests to disclose.

## REFERENCES

* Bamberg, T., Appel, M. M., and Meurer, M. (2018). Which GNSS Tracking Loop Configuration is Most Robust Against Spoofing? In Proc. ION 31st Int. Tech. Meet. Satellite Division (ION GNSS+ 2018), pages 3587–3595, Miami, FL, USA.

* Coulon, M., Chabory, A., Garcia-Pena, A., Vezinet, J., Macabiau, C., Estival, P., Ladoux, P., and Roturier, B. (2020). Characterization of Meaconing and its Impact on GNSS Receivers. In Proc. ION 33rd Int. Tech. Meet. Satellite Division (ION GNSS+ 2020), pages 3713–3737.

* Dobryakova, L. and Ochin, E. (2014). On the application of gnss signal repeater as a spoofer. *Zeszyty Naukowe/Akademia Morska w Szczecinie*.

* Dovis, F. (2015). GNSS interference threats and countermeasures. Artech House.
Garcia-Pena, A., Macabiau, C., Novella, G., Julien, O., Mabilleau, M., and Durel, P. (2020). RFI GNSS L5/E5a Mask Derivation. In *Proc. ION 33rd Int. Tech. Meet. Satellite Division (ION GNSS+ 2020)*, pages 188–205.

Ghizzo, E., Hussong, M., Garcia-Pena, A., Lesouple, J., Milner, C., and Macabiau, C. (2024a). Assessing Spoofer Impact on GNSS Receivers: Tracking Loops. *Signal Processing*.

Ghizzo, E., Pena, A. G., Lesouple, J., Milner, C., and Macabiau, C. (2024b). Assessing GNSS Carrier-to-Noise-Density Ratio Estimation in The Presence of Meaconer Interference. In *Proc. Int. Conf. Acoust., Speech, Signal Process. (ICASSP)*, pages 8971–8975, Seoul, Republic of Korea. IEEE.

Hofmann-Wellenhof, B., Lichtenegger, H., and Collins, J. (1997). Gps theory and practice.

Hussong, M., Ghizzo, E., Milner, C., and Garcia-Pena, A. (2024a). GNSS Performance under Meaconing in Civil Aviation: Ground Zones of Impact. *GPS Solutions - pending*.

Hussong, M., Ghizzo, E., Milner, C., and Garcia-Pena, A. (2024b). GNSS Performance under Meaconing in Civil Aviation: Methodology, Pseudorange and Position Models. *GPS Solutions - pending*.

Hussong, M., Ghizzo, E., Milner, C., Garcia-Pena, A., Lesouple, J., and Macabiau, C. (2023). Impact of Meaconers on Aircraft GNSS Receivers During Approaches. In *Proc. ION 36th Int. Tech. Meet. Satellite Division (ION GNSS+ 2023)*, pages 856–880, Denver, CO, USA.

Peng, C., Li, H., and Lu, M. (2019). Research on the Responses of GNSS Tracking Loop to Intermediate Spoofing. In *Proc. ION 32nd Int. Tech. Meet. Satellite Division (ION GNSS+ 2019)*, pages 943–952, Miami, FL, USA.

Petovello, M. (2015). How Does a GNSS Receiver Estimate Velocity? *Inside GNSS*, 14.

Steindl, E., Dunkel, W., Hornbostel, A., Hättich, C., and Remi, P. (2013). The Impact of Interference Caused by GPS Repeaters on GNSS Receivers and Services. In *Proc. Eur. Navigat. Conf. (ENC 2013)*, Wien, Österreich.

Union, T. (2001). International telecommunication union. *Yearbook of Statistics 1991–2000*.