# A NavCom Signal Authentication Scheme Based on Twice Two-Way Satellite Time Transfer
## 2 A Twice TWSTT NavCom Signal Authentication Scheme
### Fundamental Theory
Hence, the twice clock difference measurements obtained should be identical without considering any errors according to Equation (4), i.e., \(\Delta T_{1}=\Delta T_{2}\). Figure 2: Schematic of repeater spoofing interference. Generally, there is a risk of being spoofed due to the satellite downlink signal being broadcast signals to the ground terminal, mainly including generated spoofing and repeater spoofing interference. For generated spoofing interference signals, information authentication or digital signature can be added to the message of navigation signals, so that the receivers in the satellite or earth can effectively block the unauthenticated signals and prevent the generated spoofing interference. However, it is impossible to block repeater spoofing interference signals in such a way, which is the main problem that the proposed authentication scheme focuses on solving. Figure 3 illustrates the scenario with repeater spoofing interference, where \(d_{B}\) denotes the delay of the spoofing interference signal, \(d_{SB}\) represents the delay from satellite S to the repeater spoofing terminal B, and \(d_{BA}\) denotes the delay from spoofing terminal B to ground terminal A. As the signal transmitted by ground terminal A to satellite S is pulsed, it is challenging to record and forward it. Therefore, it is the most common form of repeater spoofing interference as depicted in Figure 3.  
As a result, the clock difference can be determined by  
\[\text{A}-\text{S}=\frac{\text{TIC(A)}-\text{TIC(S)}}{2}+\frac{d_{TA}-d_{RA}}{2} -\frac{d_{TS}-d_{RS}}{2}+\frac{S_{A}-S_{S}}{2}+\frac{d_{AS}-(d_{SB}+d_{B}+d_{ BA})}{2} \tag{5}\]  
It is obvious that the clock difference measurements are pulled out of alignment because of the last term in Equation (5). Therefore, ensuring that the clock difference measurements obtained from twice TWSTT are constant is crucial for them to be equal. However, satisfying this condition can be challenging in practice, and the reasons will be discussed below in two different scenarios. Scenario 1: Ground terminal remains stationary. Figure 4 depicts the schematic diagram of twice TWSTT in the repeater spoofing interference scenario, where the satellite downlink signals are recorded and forwarded by the spoofing terminal. As shown in Figure 4, the satellite's position changes during the twice TWSTT processes. When the ground terminal remains motionless, the spoofing terminal can theoretically calculate the trajectory in advance based on the position of the ground terminal and the satellite ephemeris and follow the satellite movement to realize the same value of \(d_{\text{AS}}-(d_{\text{SB}}+d_{\text{B}}+d_{\text{BA}})\) in twice measurements. Fortunately, it is challenging  
Figure 3: Schematic of twice TWSTT. to achieve such consistency in practice. Firstly, it is challenging for the spoofing terminal to accurately determine the precise geographic coordinates of the ground terminal. Secondly, there are numerous LEO satellites, and the ground terminal can simultaneously observe multiple satellites. As a result, the spoofing terminal cannot predict the specific moment when the ground terminal will initiate the authentication or the ID of the LEO satellites involved. Thirdly, it requires a high level of control accuracy for the flight platform carrying the spoofing terminal, even if the operation trajectory is calculated in advance. Any slight deviation can disrupt the spoofing scheme, making it infeasible to achieve the desired consistency in the measurements. Scenario 2: Ground terminal is in motion. It becomes even more difficult to achieve consistency in twice measurements if the ground terminal is also in motion. This is because the trajectory of the ground terminal cannot be precisely predicted in advance, which makes it impossible for the spoofing terminal to calculate the running trajectory ahead of time. In summary, it is difficult to keep the two clock difference measurements consistent according to the analysis of scenario 1 and scenario 2.