## 5 Experimental Results and Analysis  
### Spoofing  
Since it is prohibited to broadcast spoofing signals in real world, the following method is devised to simulate an intentional attack, as shown in Figure 5. Firstly, a previously stored interval of authentic  
Figure 4: Flow chart for detecting and removing the counterfeit signal. IF GPS signals with a sampling rate of 38.192 MHz is read. Secondly, these loaded signals are acquired and tracked by a software receiver, and the authentic signal from each satellite is amplified by 1.2 times such that the output is denoted as the counterfeit signal. Thirdly, time delay is applied to the counterfeit signal from each satellite. Lastly, we simulate the composite signals received by the target receiver by adding all original authentic signals and certain time-delayed counterfeit signals. The visible satellites corresponding to the used IF signals are shown in Figure 6. Fixed delay spoofing and variable delay spoofing are applied to PRN22 and PRN21, respectively. The fixed delay spoofing is executed at 300 ms and the delay is 0.6 chips. The variable delay spoofing is also executed at 300 ms and the delay changes gradually from 0 chips to 2 chips. It should be noted that all time domains where there are spoofing signals are highlighted in the following figures. Figure 7 shows the outputs of the prompt correlators of PRN22 I and Q branches within 1000 ms. The receiver starts tracking at 0 ms. Since the initial tracking value obtained by the conventional acquisition method is not accurate enough, the carrier phase of the local signal gradually aligns with that of the authentic signal until about 180 ms. The output of the I prompt correlator is stabilized at around 1. After the spoofing is executed, the output of the quadrature prompt correlator suddenly changes, which indicates that the carrier phases of the counterfeit signal and the authentic signal are not the same. However, the counterfeit signal lags behind the authentic signal by only 0.6 chips. Their carrier frequencies are close, and the carrier phase difference between them is almost fixed. Therefore, the carrier phases of the local signal and the composite signal align rapidly, and the output of the quadrature prompt correlator is restored to near zero. At the same time, due to the large amplitude of the composite signal, the output of the I prompt correlator becomes larger. In addition, the noises of the prompt correlators of I and Q branches also become larger after the spoofing is executed, which indicates that spoofing signals might increase the noise level and deteriorate the precision of the estimated coordinates (similar to solar radio emission) [23]. As shown in Figure 8, at the beginning of spoofing, there is a significant jump in the output of the code phase discriminator of PRN22, which is confirmed by the results in Figure 7 and vice versa. The effective overlapping of the counterfeit signal  
Figure 5: Simulation of spoofing. Figure 6: Satellites sky plot. and the authentic signal is equivalent to indirectly magnifying \(C/N_{0}\). Consequently, after the receiver locks the composite signal, the accuracy of the code phase discriminator is slightly improved. Figure 9 shows the outputs of the prompt correlators of PRN21 I and Q branches within 1000 ms. On one hand, since the counterfeit signal corresponding to the PRN 21 has the same carrier phase as the authentic signal, the output of the quadrature prompt correlator remains near 0 throughout spoofing. On the other hand, at the beginning of spoofing, the output of the I prompt correlator has jumped to about 2.2, which is the sum of the amplitudes of the counterfeit signal and the authentic signal. It decreases and finally arrives at the steady state of around 1.2 as the counterfeit signal correlation peak gradually moves away from the authentic signal correlation peak. This indicates that the receiver has turned to lock the counterfeit signal.