## 4 Equivalent Block Diagrams for GNSS and Spoofing Signals
### Equivalent Block Diagram of the Full Transmitter-Channel-Receiver Chain  
Figure 8 shows the equivalent full transmission chain of a generic system with \(N\) genuine GNSS transmitters and \(M\) spoofers, \(N\geq 1,M\geq 1\). Assuming that spoofers (if more than one) are placed at different locations, the wireless channel experimented by each of the genuine and non-genuine transmitters will exhibit different multipath and fading profiles, as well as different noise levels. In this generic example, there will be \(N+M\) different wireless channels, which can typically be assumed to be non-correlated. A typical channel impulse response \(h_{i}(t),i=1,\ldots N+M\) can be modelled via a tapped-delay line with \(L_{i}\) multipaths via  
\[h_{i}(t)=\sum_{l=1}^{L_{i}}\alpha_{i,l}\delta(t-l\tau_{i,l}) \tag{15}\]  
where \(\alpha_{i,l}\) are the complex channel coefficients of the \(l\)-th path of the \(i\)-th channel, and \(\tau_{i,l}\) are the multipath delays of the \(l\)-th path of the \(i\)-th channel. Above, \(\delta(t)\) is the Dirac pulse. Clearly, such a channel acts as a finite impulse response (FIR) filter which is likely to smooth out some of the transmitter HW features. A signal \(s_{i}(t),i=1,\ldots N+M\) originated from a genuine GNSS transmitter (\(i=1,\ldots N\)) or from a spoofer (\(i=N+1,\ldots N+M\)) will reach the receiver antenna in the combined form \(r(t)\):  
\[r(t)=\sum_{i=1}^{N+M}\sum_{l=1}^{L_{i}}\alpha_{i,l}s_{i}(t-l\tau_{i,l})+\eta_{ i}(t) \tag{16}\]  
where \(\eta_{i}(t)\) is the additive noise corresponding to the \(i\)-th channel. Typically, \(\eta_{i}(t)\) is modelled as the Gaussian noise of a zero mean and \(\sigma_{i}^{2}\) variance, and the overall channel  
Figure 7: The diagrams of an equivalent model for GNSS and spoofer transmitter. In GNSS transmitters, all distortions are indexed with s*; in a spoofer transmitter, all distortions are indexed with i*. variance \(\sum_{i=1}^{N+M}\sigma_{i}^{2}\), as well as the transmitted signal power, which will determine the carrier-to-noise ratio (CNR) at the receiver. The impact of the channel effects on the RFF have been reported as either insignificant or as negative in the literature so far, meaning that the transmitter features were either found to be invariant to the type of channel (static versus fading, multipath versus single path, etc.) [54; 53] or to adversely affect the transmitter features, by smoothing them out [55]. However, very few studies, to the best of our knowledge, addressed the impact of channel impairments on the RFF, and to date, all have been performed in a non-GNSS context. For example, the studies on [53] were done for WiFi signals, the studies in [54] were for Zigbee signals, and the studies in [55] were for 3G cellular signals. Therefore, more simulation-based and measurement-based experiments are needed in order to fully understand the channel effects on RFF in GNSS and this remains one interesting research challenge. Furthermore, the receiver from Figure 8 also has its own HW elements such as front-end filtering, analog-to-digital (ADC) conversion, local oscillators, and power amplification, and each of these elements will act as additional distortions to the individual transmitter features, as they will be common to all signals \(s_{i}(t)\) found in the received signal \(r(t)\) (see Equation (16)). As shown in [3], the same GNSS data from GNSS satellites collected with two different antennas give different fingerprints. This means that, in order to be able to fully identify a GNSS transmitter, one should be able to remove the receiver front-end features from the analysis. For example, one could try to model the behaviour of a certain type of receiver (e.g., USRP, commercial GNSS receiver) and a certain antenna type (e.g., Talysman, Zenith, etc.) and try to compensate the fingerprint it produces via some equalization-like functions. No such models exist in the current literature, according to the best of our searches, and this also remains a topic of open investigation.