# A Survey on Satellite Communication System Security
## 4 Attacks in Satellite Communication Systems
### Integrity Threats  
Spoofing  
Satellite, due to their significant distance from the ground and reliance on wireless signals, often transmit weak signals that are susceptible to interference. This vulnerability allows for various forms of attacks, among which spoofing can compromise the integrity of the signal. Spoofing involves deceiving a target or multiple target receivers by delaying, forging, or sending incorrect signals [52]. Conceptually, while spoofing and jamming may seem similar, spoofing is a more sophisticated and technical attack. Both attacks target the availability of satellites, but spoofing requires intricate signal processing, making it a more complex attack to execute. Spoofing fundamentally requires replicating the RF carrier signal transmitting the pseudo-random noise and spreading code, and the data from GNSS. Generally, the signals transmitted from a GNSS are of the form:  
\[y(t)=Re\Bigg{\{}\sum_{i=1}^{N}A_{i}D_{i}[t-\tau_{i}(t)]C_{i}[t-\tau_{i}(t)]e^{[ \omega_{c}t-\phi_{i}(t)]}\Bigg{\}} \tag{1}\]  
where \(A_{i}\) is the carrier amplitude of signal, \(D_{i}(t)\) is the signal's data bit stream, \(C_{i}(t)\) is the spreading code, \(\tau_{i}(t)\) is the signal's code phase, \(\omega_{c}\) is the nominal carrier frequency, and \(\phi_{i}(t)\) is the beat carrier. At this time, the spoofing signal is in a form similar to the original signal:  
\[y_{s}(t)=Re\Bigg{\{}\sum_{i=1}^{N_{s}}A_{si}\hat{D}_{i}[t-\tau_{si}(t)]C_{i}[t -\tau_{si}(t)]e^{[\omega_{c}t-\phi_{si}(t)]}\Bigg{\}} \tag{2}\]  
and each spoofed signal has the same N and \(C_{i}(t)\) and usually sends estimated data of the \(\hat{D}_{i}(t)\)[53]. To understand the typical process of a spoofing attack, we can refer to [PERSON]'s paper [53]. In Figure 9, five stages of the interaction between the spoofed signal and the true pseudorandom number code autocorrelation function are shown. Initially, in the first stage, the spoofing signal is searching for the true signal's tracking loop. In the second stage, the real and spoofed signals merge. The third stage shows the spoofed signal being modulated by the code autocorrelation function, and in the fourth stage, the tracking point shifts from the real to the spoofed signal. Finally, in the last stage, the spoofed signal  
Figure 8: Illustration of ASAT technology. becomes stronger than the real signal and undergoes phase modulation. At this point, the spoofed signal, carrying false positional signals or timing information, is transmitted to the receiver. Such methods of spoofing attacks are conventional. So, to achieve a higher success rate, appropriate techniques, equipment, and new technologies are required. Using the aforementioned principle, SCSs can be spoofed, enabling the execution of various attacks, as illustrated in Figure 10. Therefore, in this section, we will categorize the existing spoofing strategies into three types: signal meaconing spoofing attacks, signal estimation and replay spoofing attacks, and advanced signal modification spoofing attacks. **Signal Meaconing and Replay Spoofing Attacks:** These attacks are essentially no different from a signal repeater and typically rely on known signal structures [53]. It is a basic form of attack where the incoming signal is delayed and then retransmitted. The primary target of this attack is the code phase time history. For instance, if the manipulated time is 1:59:59.99, the actual time would be 2:00:00.00. In [PERSON]'s paper [54], an attack method is presented where an entire block of GNSS RF signals is recorded and played back without needing to separate each signal. This approach does not alter the actual satellite signals' position, velocity, and time values but introduces the spoofer's location and velocity to the receiver with an added time delay. In this attack, the spoofer is ideally positioned near the receiver to prevent delays in signal processing, enabling a zero-delay meaconing attack. This allows the spoofer to circumvent the receiver's defenses against clock drift.