# Spoofing Traction Strategy Based on the Generation of Traction Code
## 2 Materials and Methods  
### Conventional GNSS Traction Spoofing  
The conventional traction process of spoofing can be divided into three steps:  
Step 1: Signal reception. The receiving module of the spoofer receives a genuine signal, detects the location and speed of the target, and estimates the genuine signal's key parameters. Step 2: Determine the traction scheme. The parameters of the spoofing signal are set such that the correlation peak of the spoofing signal arriving at the target receiver aligns gradually with the actual peak. In a conventional traction strategy, the correlation peak envelope of the composite signal is distorted, as shown in Figure 2.  
Step 3: Traction spoofing. The spoofing signal is generated to dominate the tracking loop and gradually enlarge the code phase difference to generate a pseudo-distance error, which eventually controls the target. The correlation result between the local and authentication signals is defined as \(\mathrm{R_{al}}(\tau)\), and thatbetween the local and superimposed signals is defined as \(\mathrm{R_{all}}(\tau)\). If the correla  
Figure 1: Classification of TOA detection of satellite signals. Figure 2: Demonstration of correlation peak distortion of conventional traction strategy. tion function between the spoofing signal and local replica is \(\mathrm{R_{sl}(\tau)}\), then the distortion correlation peak envelope of the composite signal is as illustrated in Figure 2.  
In the first step, the detection of the antenna position and speed of the spoofing target, power level, channel conditions, and other information is not within the scope of this study, assuming that the spoofer has obtained specific information. The content discussed in this study is the setting and generation module of the spoofing signal. The discussion in this paper is based on a Binary Phase Shift Keying (BPSK) signal system. First, we can model the genuine signal as:  
\[\mathrm{s_{a}(t)}=\sqrt{\mathrm{P_{a}(t)}}\cdot\mathrm{D_{a}(t)}\cdot\mathrm{C _{a}(t)}\cdot\cos(2\pi(f_{0}+f_{d,a})t+\theta_{a}), \tag{1}\]  
Similarly, the spoofing signal can be expressed as  
\[\mathrm{s_{s}(t)}=\sqrt{\mathrm{P_{s}(t)}}\cdot\mathrm{D_{s}(t)}\cdot\mathrm{C _{s}(t)}\cdot\cos(2\pi(f_{0}+f_{d,a}+f_{as})t+\theta_{a}+\theta_{as}), \tag{2}\]  
where the subscripts a and s represent the genuine and spoofing signals, respectively. In addition, P, D, C, fd and \(\theta\) denote the satellite signal power, navigation message, pseudo code, Doppler shift, and initial carrier phase, respectively. The traction modes in the latter two steps can be divided into synchronous and asynchronous traction according to the accuracy of the parameter estimation [10]. 1. Synchronous traction The diagram of synchronous traction is shown in Figure 3.  
T1: At the beginning of traction, the spoofing code phase (Doppler) is aligned with the genuine code phase (Doppler). T2: Increase the power of spoofing signals. T3: Drag the correlation peak away from the original tracking point. T4: Keep the power consistent with the genuine signal. This method requires high measurement accuracy in the first step and is difficult to achieve in an actual scenario. 2. Asynchronous traction A diagram of asynchronous traction is shown in Figure 4. Unlike synchronous traction, asynchronous traction does not require a spoofer to determine the exact parameters of an authentication signal. This traction mode directly generates a higher power correlation peak to control the loop, which is more suitable for application in actual scenarios. Figure 4: Diagram of asynchronous traction. Figure 3: Diagram of synchronous traction. Control of the distance velocity of the correlated peaks is defined as the traction code rate \(\rm v_{\rm drag}\).