# Spoofing Traction Strategy Based on the Generation of Traction Code
## 2 Materials and Methods
### Methods of Simulation and Experiment  
#### 2.3.1 Theoretical Model of Received Signal  
According to the signal model in Section 2.1, the composite signal r(t) is demodulated by the local receiver as follows:  
\[\mathrm{i}_{\mathrm{P}}(\mathrm{t})=\mathrm{r}(\mathrm{t})\mathrm{C}_{\mathrm{a }}(\mathrm{t}+\tau_{\mathrm{al}})\cdot\cos(2\pi(\mathrm{f}_{0}+\mathrm{f}_{ \mathrm{d}\_a}+\mathrm{f}_{\mathrm{al}})\mathrm{t}+\theta_{\mathrm{a}}+\theta_ {\mathrm{al}})=\mathrm{i}_{\mathrm{P}_{\mathrm{a}}}(\mathrm{t})+\mathrm{i}_{ \mathrm{P}_{\mathrm{s}}}(\mathrm{t}), \tag{12}\]  
where \(\tau_{\mathrm{al}}\) is the code phase difference between the genuine and local signals, and the same is true for parameters \(\mathrm{f}_{\mathrm{al}}\), \(\theta_{\mathrm{al}}\), \(\tau_{\mathrm{sl}}\), \(\mathrm{f}_{\mathrm{sl}}\), \(\theta_{\mathrm{sl}}\) and other parameters.  
Coherent integration of \(\mathrm{i}_{\mathrm{P}_{\mathrm{a}}}(\mathrm{t})\) is performed to obtain the prompt correlation values:  
\[\mathrm{I}_{\mathrm{P}_{\mathrm{a}}}=\frac{\sqrt{\mathrm{P}_{\mathrm{a}}}}{2 }\mathrm{R}(\tau_{\mathrm{al}})\mathrm{T}_{\mathrm{coh}}\mathrm{sin}\, \mathrm{c}(\mathrm{f}_{\mathrm{al}}\mathrm{T}_{\mathrm{coh}})\cos\left(2\pi \mathrm{f}_{\mathrm{al}}\left(\mathrm{t}_{1}+\frac{\mathrm{T}_{\mathrm{coh}} }{2}\right)+\theta_{\mathrm{al}}\right) \tag{13}\]  
\(\mathrm{i}_{\mathrm{P}_{\mathrm{s}}}(\mathrm{t})\) are integrated and dumped to produce the prompt correlation results of spoofing signals:  
\[\mathrm{I}_{\mathrm{P}_{\mathrm{s}}}=\frac{\sqrt{\mathrm{P}_{\mathrm{sp}}}}{2 }\mathrm{R}(\tau_{\mathrm{sl}})\mathrm{T}_{\mathrm{coh}}\mathrm{sin}\,\mathrm{ c}(\mathrm{f}_{\mathrm{sl}}\mathrm{T}_{\mathrm{coh}})\cos\left(2\pi \mathrm{f}_{\mathrm{sl}}\left(\mathrm{t}_{1}+\frac{\mathrm{T}_{\mathrm{coh}} }{2}\right)+\theta_{\mathrm{sl}}\right) \tag{14}\]  
Given \(\tau_{\mathrm{al}}\) and \(\tau_{\mathrm{sl}}\), we can obtain \(\mathrm{R}(\tau_{\mathrm{al}})\) and \(\mathrm{R}(\tau_{\mathrm{sl}})\) according to Equation (8).  
Figure 9: Transition process of the received PRN code. (**a**) Initial form of received PRN code; (**b**) Intermediate form of the received PRN code; (**c**) Final form of the received PRN code.  
**Strategy 1**: Assuming that the amplitude ratio between the spoofing and genuine signals is \(\mathrm{h}=\sqrt{\frac{P_{a}}{P_{a}}}\), the correlation results can be simplified as  
\[\mathrm{I_{P}(t)}=\frac{\sqrt{P_{a}}}{2}\mathrm{T_{coh}(R(\tau_{al})+hR(\tau_{ sl}))} \tag{15}\]  
The same is true for \(\mathrm{I_{E}}\) and \(\mathrm{I_{L}}\).  
Define \(\mathrm{v_{drag}}\) as the traction speed, then  
\[\tau_{\mathrm{as}}(t)=\tau_{\mathrm{s}}(t)-\tau_{a}(t)=\mathrm{v_{drag}}\cdott \tag{16}\]  
Then \(R(\tau_{al})\), \(R(\tau_{sl})\), the early and late correlation results can be derived.  
When the carrier loop is in a steady state, the received signal power is not transferred from the in-phase components to quadrature components. The phase discriminator of the code tracking loop processes the early and late correlation results, and the output is  
\[\delta_{cp}=\frac{I_{E}-I_{L}}{I_{E}+I_{L}}=\frac{R^{+}(\tau_{al})-R^{-}(\tau_ {al})+hR^{+}(\tau_{sl})-hR^{-}(\tau_{sl})}{R^{+}(\tau_{al})+R^{-}(\tau_{al})+ hR^{+}(\tau_{sl})+hR^{-}(\tau_{sl})} \tag{17}\]  
where \(R^{+}(\tau)=\ R(\tau+d)\), \(R^{-}(\tau)=\ R(\tau-d)\).  
Local code Doppler \(\mathrm{cd}_{l}\) is obtained after the filter of the code loop processing \(\delta_{cp}\):  
\[\mathrm{cd}_{l}(n)=\mathrm{k_{c2}}\delta_{cp}(n)+\sum_{i=1}^{n}\mathrm{k_{c1}} \delta_{cp}(i) \tag{18}\]  
Figure 10: Schematic diagram of the spoofer applying the proposed traction strategy.