# A Survey on Satellite Communication System Security
## 4 Attacks in Satellite Communication Systems
### Integrity Threats
Also, the study in [55] demonstrated that the  
Figure 10: The process of spoofing attacks. Figure 9: Spoofing attack scheme viewed from the victim receiver. Spoofer: blue dotted lines; sum of spoofer and truth: red solid lines; receiver tracking points: blue dots [53]. position, velocity, and time values of a receiver can be affected by a spoofing attack through simulations using a station repeater spoofing model. **Signal Estimation and Replay Spoofing Attacks:** Unlike the previously mentioned attack, in this approach, the spoofer does not have all the information when receiving the signal, but only a part of it [56]. For instance, in the case of military satellites or some civilian satellites with undisclosed security codes, not all information is available to the spoofer, unlike public civilian GNSSs [53]. Therefore, the spoofer needs to estimate the missing information and then introduce a delay to execute the spoofing attack. Typically, estimation and replay attacks are divided into two categories: security code estimation and replay (SCER), and forward estimation attacks (FEAs). [PERSON] [57] was the first to propose the SCER method, suggesting a technique to deceive receivers through accurate estimation of security codes and deliberate delays. This approach is suitable for various cryptographic techniques, ranging from low-rate methods like navigation message authentication (NMA) to high-rate strategies, including the legacy military GPS Y-code encryption. An FEA is a methodology employed by adversaries to generate counterfeit GNSS signals that are perceived as authentic by the target receiver [58]. Unlike the SCER attack, FEAs are not limited by the immediate estimation of each symbol as it is broadcast. Instead, this approach allows an attacker to produce counterfeit signals that can either delay or precede the genuine signal. This flexibility makes FEAs particularly potent, as it enables the synthesis of signals that closely mimic the authentic ones, thus making the deception more convincing and harder to detect. **Signal Modification Spoofing Attacks:** Recently, a different form of attack has been introduced, known as the nulling attack. A nulling attack is a specific type of spoofing strategy used against GNSS receivers. In this attack, the spoofer employs nulling signals with amplitudes that are twice those of the corresponding authentic signals. These enhanced nulling signals are activated only during specific data bits, \(D_{i}(t)\), whose polarity the spoofer aims to invert. By doing so, the spoofer manages to induce a false position or timing fix in the target receiver [54]. The detailed process is as follows. In Equation (2), the first is the counterfeit signal, which works together with the other spoofed signals to create a false location or time reading. The second signal is the inverse of the authentic signal. Therefore, the total number of signals \(N_{s}\) is twice the number of authentic signals \(N\), denoted as \(N_{s}=2N\). It is assumed that the initial \(N\) signals are the spoofed versions, while the subsequent \(N\) signals are the nulling versions. The nulling signals are designed to negate the true signals at the receiver, which means for \(i=1\) to \(N\), the following conditions are met: \(C_{i+N}(t)=C_{i}(t)\) and \(\hat{D}_{i+N}(t)=D_{i}(t)\). Moreover, the nulling signals must adhere to \(A_{s[i+N]}=A_{i}\), \(\tau_{s[i+N]}(t)=\tau_{i}(t)\), and \(\phi_{s[i+N]}(t)=\phi_{i}(t)+\pi\). Signal elimination occurs due to a 180-degree (or \(\pi\) radians) carrier phase shift [56]. The nulling process effectively eliminates any evidence of the genuine signal in the aggregate received signal. Therefore, any anti-spoofing strategies that rely on detecting such duplications are bound to fail. An interesting aspect of the nulling attack is its efficiency in terms of resource utilization. It requires only half as many spoofing channels compared to a general nulling attack, making it a more resource-effective method of spoofing.