# Impacts of GPS Spoofing on Path Planning of Unmanned Surface Ships
## 3 GPS Attack Designs and Spoofing Analysis
### GPS Introduction  
Global Positioning System (GPS) is a satellite navigation system, which provides position, navigation, and timing for land, sea, and air in the world [30]. Furthermore, a GPS is an important navigation device for an unmanned ship [31]. A GPS consists of three parts, including space, control, and a user device. The space part of aGPS consists of 27 GPS satellites (24 active and three standby). The GPS control part consists of one main control station, five detection stations, and three injection stations. The GPS user device part includes a GPS receiver and other devices. The basic principle of a GPS navigation system is to measure the distance between the satellite and the user's receiver and calculate the receiver's position by integrating the data of multiple satellites. The GPS signals include a carrier at L1 and L2, Pseudo Random Number (PRN) code at civil code (C/A) and military code (P-code), and navigation data. The GPS signals include raning codes and the navigation message, shown in Figure 4. The GPS system must modulate the ranging code and navigation information onto a carrier frequency before it can be transmitted to the receiver. The frequencies are utilized, including the L1 frequency at 1575.42 MHz and  
Figure 3: Modified APF for a dynamic TS [12].  
the L2 frequency at 1227.60 MHz. Coarse/Acquisition code (C/A code) is transmitted on the L1 frequency as 1.23 MHz signal. Precision code (P-code) is transmitted on both L1 and L2 frequencies as 10.23 MHz signal.  
First of all, before we introduce a GPS attack, we need to understand the GPS working principle. Figure 5 shows how a GPS works. Based on [24], let \(D_{i}\), \(L\), and \(L_{i}\) denote the distance between the \(i\)-th satellite and the receiver, the location of the receiver, and the location of the \(i\)-th satellite, respectively. \(D_{i}\) is expressed by Euclidean distance as follows:  
\[D_{i}=|L_{i}-L|, \tag{20}\]  
where \(L_{i}=(x_{i},y_{i},z_{i})\) is the coordinate of satellite in Cartesian three-dimensional coordinate system. Similarly, \(L=(x,y,z)\) is the coordinate of the receiver. Equation (20) can be transformed into the following Equation (21):  
\[D_{i}=\sqrt{(x-x_{i})^{2}+(y-y_{i})^{2}+(z-z_{i})^{2}}. \tag{21}\]  
The receiver can separate transmission time (\(T_{i}^{s}\)) and location of the i-th satellite (\(L_{i}\)) from the received GPS signals. Meanwhile, the receiver can acquire arrival time (\(T_{r}\)) when receiving the GPS signal. GPS signal transmission speed (\(V\)) is close to the speed of light. \(D_{i}\) can be expressed by \(T_{i}^{s}\), \(T_{r}\) and \(V\) as follows:  
\[D_{i}=(T_{r}-T_{i}^{s})V, \tag{22}\]  
Figure 4: GPS signal structure.  
Figure 5: GPS working principle [32].  
where \(T_{i}^{s}\), \(T_{r}\), and \(V\) are known scalars. Combining Equations (21) and (22), we can know that the receiver location (L) can be calculated when at least three satellite signals are received. In geometric space, a satellite defines a transmission circle with radius \(D_{i}\). At least three of these circles intersect with the earth's surface, where the receiver is located  
In practice, the time between different satellites is synchronous, but the time of different types of receivers is not exact. We assume that \(\delta\) is a clock offset between the receiver and exact GPS time system and \(T_{u}\) is the arrival time of GPS signal measured under a common standard. We can get the following equation:  
\[T_{u}=T_{r}+\delta, \tag{23}\]  
\[D_{i}=(T_{r}-T_{i}^{s})V+\delta V. \tag{24}\]  
Based on the above, there are four unknown scalars, including \(\delta\), \(x\), \(y\), and \(z\). Therefore, the receiver must receive more than four satellites' signals to calculate the receiver's exact location.