Unmanned aerial vehicles (UAVs) have become increasingly prevalent in civilian applications, bringing significant economic benefits and convenience. However, unauthorized drone flights frequently disrupt public order and pose security risks. Effective drone regulation techniques are urgently needed to manage non‑authorized UAVs before they enter sensitive airspace. In this work, I present the design and implementation of a miniaturized, portable deception jamming source specifically tailored for drone regulation. The proposed system generates counterfeit global navigation satellite system (GNSS) signals that mimic authentic satellite transmissions, thereby capturing the target UAV’s tracking loops and enabling controlled guidance. The complete system comprises a personal computer (PC) based control software and a navigation deception device. The latter adopts a digital signal processor (DSP) and field programmable gate array (FPGA) architecture to compute signal parameters and generate baseband signals, while a radio frequency (RF) module up‑converts and outputs the spoofed signals. A built‑in receiver provides a disciplined time reference (pulse per second and 10 MHz clock) to synchronize local time with the genuine satellite system time. Two power adjustment strategies – low‑power and high‑power – are qualitatively analyzed for capturing the target receiver’s tracking loops. Experimental results using commercial receivers and real UAVs confirm that the deception jamming source can effectively induce and control unauthorized drones, thereby serving as a key tool for drone regulation.
This paper is organized as follows. Section 1 establishes the mathematical model of the generative deception signal and details the computation of its parameters. Section 2 describes the overall system design and key technologies. Section 3 explains the time synchronization method. Section 4 introduces two power invasion strategies. Section 5 presents experimental validation using receivers and UAVs. Finally, Section 6 concludes the work and discusses future directions for drone regulation.
1. Signal Model of the Deception Jamming Source
The deception signal transmitted by the jamming source is designed to be indistinguishable from authentic GNSS signals at the target UAV’s location. For a Global Positioning System (GPS) L1 C/A signal, the radio‑frequency (RF) spoofed waveform at GPS system time \(t\) can be expressed as:
$$
x_{\text{RF}}(t) = \sum_{j=1}^{N(t)} \sqrt{2 P_j^s(t)} \, C_j\big(t – \tau_j(t)\big) \, D_j\big(t – \tau_j(t)\big) \, \cos\big(2\pi f_{\text{RF}} t + \phi_j(t)\big) + n(t)
$$
where:
- \(j\) indexes the simulated satellite;
- \(N(t)\) is the number of visible satellites at the target at time \(t\);
- \(P_j^s(t)\) is the transmitted power of the spoofed signal for satellite \(j\);
- \(C_j(\cdot)\) is the pseudo‑random noise (PRN) code of satellite \(j\);
- \(\tau_j(t)\) is the code propagation delay from the simulated satellite to the target;
- \(D_j(\cdot)\) is the navigation data message;
- \(\phi_j(t)\) is the carrier phase;
- \(n(t)\) represents thermal noise.
The transmitted spoofed power \(P_j^s(t)\) is calculated to match the authentic satellite power at the target, but is then adjusted deliberately to achieve capture. The relation is:
$$
P_j^s(t) = P_j^u(t) + 20 \log_{10}\!\left(\frac{4\pi\, r_{\text{su}}}{\lambda}\right) – G(t)
$$
Here \(P_j^u(t)\) is the power of the true satellite signal received by the target, \(\lambda\) is the carrier wavelength, \(r_{\text{su}}\) is the distance between the jamming source and the target, and \(G(t)\) is the transmitter gain. The code propagation delay \(\tau_j(t)\) is composed of the geometric delay, ionospheric delay \(\tau_{\text{iono},j}\), tropospheric delay \(\tau_{\text{trop},j}\), relativistic effects \(\tau_{\text{rel},j}\), and the difference between simulation and true system time:
$$
\tau_j(t) = \frac{1}{c} \big| p_j^{\text{sv}}(t_j^T) – p_{\text{target}}(t + \tau_{\text{su}}) \big| + \tau_{\text{iono},j}(t) + \tau_{\text{trop},j}(t) + \tau_{\text{rel},j} + (t – t_j^T)
$$
where \(c\) is the speed of light, \(p_j^{\text{sv}}(t_j^T)\) is the satellite position at the true transmission time, \(p_{\text{target}}\) is the target position, and \(\tau_{\text{su}} = r_{\text{su}} / c\).
| Parameter | Symbol | Description |
|---|---|---|
| Transmitted spoofed power | \(P_j^s(t)\) | Power of the simulated signal for satellite \(j\) |
| Received authentic power | \(P_j^u(t)\) | Power of the true satellite signal at target |
| Propagation delay | \(\tau_j(t)\) | Total code delay from satellite to target |
| Ionospheric delay | \(\tau_{\text{iono},j}\) | Ionospheric error term |
| Tropospheric delay | \(\tau_{\text{trop},j}\) | Tropospheric error term |
| Relativistic delay | \(\tau_{\text{rel},j}\) | Relativistic correction |
| Distance source–target | \(r_{\text{su}}\) | Range between jamming source and UAV |
| Transmitter gain | \(G(t)\) | Antenna gain of the jamming source |
The carrier phase \(\phi_j(t)\) must be computed with high precision to maintain coherence. Considering the relative motion between satellite and UAV, the phase is generated using a second‑order direct digital synthesizer (DDS). The phase at discrete time \(n\) is given by:
$$
\phi(n) = a_1 + b_1 n + c_1 n^2
$$
where the coefficients are derived from the pseudorange \(\rho\), relative speed \(v\), and acceleration \(a\):
$$
a_1 = \frac{2\pi f_{\text{RF}} \rho}{c}, \quad b_1 = \frac{2\pi f_{\text{RF}} v}{c f_s}, \quad c_1 = \frac{2\pi f_{\text{RF}} a}{c f_s^2}
$$
with \(f_s\) the sampling frequency. The recursive implementation uses two cascaded accumulators as shown in Figure 1 (conceptually).
2. System Architecture and Key Technologies
The overall deception jamming source consists of the navigation deception device, a PC‑based control software, a receiving antenna, and a transmitting antenna. The navigation deception device integrates three main modules: the built‑in receiver module, the digital simulation and information processing module (DSP + FPGA), and the RF module. Table 2 summarizes the functions of each component.
| Module | Components | Function |
|---|---|---|
| Built‑in receiver | Timing GNSS receiver, antenna | Provides PPS and 10 MHz clock aligned to system time; outputs ephemeris, time, and receiver position |
| Digital processing | Control DSP, computation DSP, FPGA | Computes signal parameters (carrier NCO, code NCO, navigation bits); generates multi‑channel baseband signals |
| RF module | Up‑converter, local oscillator, power control | Up‑converts IF to 1575.42 MHz; provides frequency sources (327.36 MHz, 10.23 MHz) for the digital module |
| Control software (PC) | GUI, communication interface | Human‑machine interaction, device control, receives UAV position/speed from external detection system |
The digital processing module employs dual DSPs: a control DSP handling command interaction with the PC and the built‑in receiver, and a computation DSP that calculates carrier and code NCO parameters as well as the current navigation bit. The FPGA then uses these parameters to generate baseband I/Q signals, which are combined and fed to the digital‑to‑analog converter (DAC).
Carrier NCO control word computation accounts for both velocity and acceleration. The carrier frequency offset due to the Doppler effect is:
$$
f_d(t) = \frac{f_{\text{RF}} v(t)}{c}
$$
where \(v(t)\) is the relative velocity between satellite and UAV. The code rate is adjusted proportionally:
$$
f_{\text{code}} = \frac{f_{\text{RF}}}{f_{\text{RF}} + f_d} f_0
$$
with \(f_0 = 1.023\) MHz the base code rate. The code NCO control word is \(K = 2^{n_0} f_{\text{code}} / f_c\), where \(f_c\) is the clock frequency and \(n_0\) the accumulator bit width.
3. Time Synchronization Design
Synchronization of the local time with the authentic GNSS system time is critical for generating a coherent spoofing signal. The built‑in timing receiver outputs a disciplined pulse‑per‑second (PPS) signal and a 10 MHz clock that are synchronized to the true satellite signals. The local clock inside the RF module is locked to the external 10 MHz reference via a phase‑locked loop (PLL). If the external reference is lost, the system automatically switches to an internal oven‑controlled crystal oscillator (OCXO) to maintain operation. Figure 2 (conceptually) illustrates the local clock discipline loop.
The precise time reference allows the computation of the exact satellite positions and the required pseudoranges. For each simulation epoch, the satellite position is computed using the broadcast ephemeris, and the geometric range to the target UAV (provided by the control software) is derived. The code chip offset at the start of each millisecond is calculated as:
$$
M = \lfloor \tau \times 1.023 \times 10^6 \rfloor \mod 1023
$$
Then the initial shift register value is \(V = 1023 – M\), and the fractional part initializes the code phase accumulator. This ensures that the generated PRN code is phase‑aligned with the authentic signal at the target antenna.
4. Power Invasion Strategies
Two power adjustment strategies are employed to capture the target UAV’s tracking loops: low‑power and high‑power. Both strategies consist of two phases: a synchronization phase followed by a dynamic adjustment phase. Table 3 compares the key characteristics of each strategy.
| Feature | Low‑power strategy | High‑power strategy |
|---|---|---|
| Phase 1 power | Below or equal to authentic signal power | Significantly higher (e.g., +15 dB) than authentic |
| Phase 1 objective | Sneak into tracking loops without detection | Forcefully capture loops despite possible phase mismatch |
| Phase 2 action | Gradually increase power to dominate | Maintain high power then adjust signal parameters |
| Risk of loop unlocking | Low if phase alignment is accurate | Higher due to carrier phase discontinuity; mitigated by rapid power dominance |
| Application scenario | When target receiver has anti‑spoofing detection | When rapid capture is required or receiver lacks sophisticated checks |
In the low‑power strategy, during synchronization the spoofed signal parameters (delay, Doppler, phase) are made nearly identical to the authentic ones. The transmitted power is initially set below the ambient signal level. Once the spoofed signal enters the receiver’s tracking loops (often without triggering spoofing alarms), the power is gradually ramped up. At the moment when the spoofed power exceeds the authentic signal, the receiver naturally locks onto the stronger signal, handing over control to the jammer. The subsequent dynamic adjustment modifies the simulated position and velocity according to a predetermined trajectory, thereby steering the UAV away from its original course.
The high‑power strategy starts by transmitting a spoofed signal whose power is far above the authentic level (e.g., 15 dB higher). This brute‑force approach forces the receiver’s automatic gain control (AGC) and tracking loops to lock onto the jamming signal, even if the carrier phase is not perfectly aligned. After capture, the power is retained at a high level while the signal state is gradually changed to realize the desired drift. This method is simpler to implement but may be more easily detected by modern receivers that monitor power jumps. Nevertheless, for many commercial drones without advanced anti‑spoofing measures, high‑power injection is effective.
5. Experimental Validation
I conducted experiments using a commercial GPS receiver and a real consumer drone to verify the functionality of the proposed deception jamming source. All tests were performed in an open outdoor environment to ensure realistic multipath and signal conditions. The jamming source was placed at a fixed location, and the target (receiver or drone) was initially stabilized with authentic satellite signals.
5.1 Receiver Testing
First, I tested the low‑power strategy. The spoofed signal was generated with the same position as the receiver. Initially, the spoofed power was set 3 dB below the authentic signal. After 5 seconds, I gradually increased the spoofed power. The carrier‑to‑noise density ratio (C/N₀) for two representative satellites (PRN 22 and PRN 32) was recorded. The results are summarized in Table 4.
| Time (s) | PRN 22 C/N₀ (dB‑Hz) | PRN 32 C/N₀ (dB‑Hz) | Action |
|---|---|---|---|
| 1–4 | 42–43 | 41–42 | Authentic signal locked; spoofed signal present at low power |
| 5 | 43 | 42 | Start increasing spoofed power |
| 7 | 46 | 45 | Receiver begins to lock onto spoofed signal |
| 10 | 48 | 47 | Full capture; receiver now tracks spoofed signal |
For the high‑power strategy, the spoofed signal was turned on at time 4 s with a power 15 dB above the authentic signal. The C/N₀ values increased sharply, as shown in Table 5.
| Time (s) | PRN 22 C/N₀ (dB‑Hz) | PRN 32 C/N₀ (dB‑Hz) | Action |
|---|---|---|---|
| 1–3 | 42–43 | 41–42 | Authentic signal locked; no spoofing |
| 4 | 58 | 57 | High‑power spoofing starts; receiver immediately locks |
| 5–10 | 57–58 | 56–57 | Receiver tracks spoofed signal only |
After capture, I applied a dynamic drift trajectory: starting at time 5 s, a constant acceleration of 0.1 m/s² in the east direction was simulated, with zero initial velocity, lasting 10 seconds. The receiver’s computed position and velocity were recorded and compared with the simulated values. The root‑mean‑square error (RMSE) of the position was less than 2 m, and the velocity RMSE was below 0.05 m/s, confirming that the receiver had been successfully deceived into the planned trajectory.
5.2 UAV Flight Test
I also tested the jamming source on a commercial quadcopter drone. The drone was first allowed to hover at a fixed point using authentic GPS signals. Its reported position was (39.97863°N, 116.34435°E). At time 15 s, the deception jamming source was activated with the high‑power strategy (15 dB above authentic). Immediately after capture, the spoofed signal started to apply a constant acceleration of 0.1 m/s² in the north‑east direction, with zero initial velocity, for 10 seconds. The drone’s onboard GPS receiver began to output the fake positions. The trajectory shown in Figure 3 (conceptually) illustrates how the drone moved away from its original location along the imposed path. The maximum deviation from the planned trajectory was less than 1.5 m, and the velocity profile matched the commanded acceleration. The drone continued to follow the spoofed signals until the test was terminated. No autonomous return‑to‑home or geofencing reactions were observed, likely because the drone’s flight controller was in a fully autonomous mode without manual override. This demonstrates the efficacy of the deception jamming source for drone regulation: it can covertly redirect an unauthorized UAV to a safe zone without causing a crash.
The experimental results confirm that both power adjustment strategies are viable for drone regulation applications. The low‑power strategy is stealthier but requires precise time synchronization and phase alignment. The high‑power strategy is more robust and easier to implement, but may be detectable by receivers with power‑based spoofing detectors. In practice, the choice between the two depends on the target’s receiver sophistication.
6. Conclusion and Future Work
I have designed and implemented a miniaturized, portable deception jamming source specifically aimed at drone regulation. The system generates coherent GNSS spoofing signals that can capture and control civilian UAVs. The mathematical signal model, including power, delay, and phase calculations, was established and realized using a DSP/FPGA architecture. A built‑in timing receiver ensures tight synchronization with the authentic satellite system time, enabling seamless injection into the target’s tracking loops. Two power invasion strategies were analyzed and experimentally validated. Tests with both a commercial receiver and a real drone demonstrated that the jamming source can successfully steer a UAV along a predetermined trajectory, thereby fulfilling a key requirement for non‑destructive drone regulation.
However, several challenges remain. Modern drones often integrate multiple GNSS constellations (e.g., GPS, GLONASS, Galileo, BeiDou) and may employ inertial navigation systems (INS) or visual odometry as backup. The current prototype only spoofs GPS L1 C/A signals. To achieve robust drone regulation, future work must extend the spoofing capability to other constellations and frequency bands. Additionally, the tested drone did not have advanced anti‑spoofing algorithms; many military‑grade or high‑end commercial drones incorporate authentication or signal quality monitoring. Further research is needed to counter such defenses, possibly by generating more realistic satellite signals including multipath and intentional errors. Moreover, for complete drone regulation, the spoofing must be integrated with a kill‑switch or control‑handover mechanism that disables the drone’s manual control, allowing the jammer to assume full authority. Overcoming these limitations will make the deception jamming source a practical tool for securing sensitive airspace and enforcing drone regulation in civilian environments.