In recent years, the proliferation of low-altitude civil small unmanned aerial vehicles (UAVs) has brought unprecedented convenience to aerial photography, logistics, agriculture, and surveillance. However, the widespread misuse of drones, including unauthorized flights (commonly referred to as “black flights”) and deliberate intrusions into sensitive airspace, has raised significant security concerns. The ability to effectively counter rogue drones has become a pressing research topic. Among various countermeasure techniques, GPS spoofing has emerged as a promising method to redirect drones without physical destruction. This paper delves into the specific challenges of GPS spoofing when combined with inertial navigation systems in civilian drones, particularly focusing on the interplay between MIMU (Micro Inertial Measurement Unit) and GPS positioning.
Our work investigates the scenario where the communication link between the drone and its remote controller is first disrupted, forcing the drone into autonomous navigation mode. In this mode, the drone relies on its onboard MIMU/GPS integrated navigation system. The MIMU provides short-term high-precision positioning but drifts over time, while GPS offers absolute corrections. The idea of drone spoofing through GPS deception is to inject manipulated pseudorange measurements into the receiver, causing the drone to compute a false position. However, the presence of the MIMU imposes constraints: the induced position error must stay within the MIMU’s short-term drift error bounds; otherwise, the drone’s navigation filter will detect inconsistency and reject the GPS update. Therefore, a successful drone spoofing attack requires careful design of the induced pseudorange errors.
Traditional GPS spoofing methods include generative spoofing (creating false GPS signals) and repeater-based spoofing (delaying and retransmitting genuine signals). The former is technically challenging due to the need to decrypt military codes, while the latter is more feasible for civilian drones that use unencrypted C/A codes. In this paper, we adopt a repeater spoofing approach with controlled delays. Our key contribution is to determine the optimal number of satellite channels to manipulate and the magnitude of pseudorange errors to avoid detection by the MIMU while maximizing the positioning deviation. Through half-physical simulation experiments, we demonstrate that using two satellites with pseudorange errors of 10–20 m yields the most effective drone spoofing, achieving a positioning offset of up to 12 m while remaining within the inertial drift tolerance.
The rest of this paper is organized as follows. Section II presents the theoretical foundations of GPS positioning and repeater spoofing. Section III details the MIMU error model and the constraints for undetectable spoofing. Section IV describes the experimental setup and methodology. Section V analyzes the results with extensive tables and formulas. Section VI concludes the study.
Theoretical Foundations of GPS Spoofing
GPS Positioning Principle
A GPS receiver determines its position by measuring the time of flight of signals from at least four satellites. The pseudorange from the receiver to satellite \(i\) is given by:
$$
P_i = \sqrt{(x – x_i)^2 + (y – y_i)^2 + (z – z_i)^2} + c \cdot (t_u + t_{\text{iono}} + t_{\text{trop}})
$$
where \((x, y, z)\) is the receiver’s position, \((x_i, y_i, z_i)\) is the satellite’s position, \(c\) is the speed of light, and \(t_u\) is the receiver clock bias combined with ionospheric and tropospheric delays. To solve for the four unknowns \((x, y, z, t_u)\), at least four equations are needed. In practice, more satellites improve accuracy.
Repeater Spoofing with Delayed Signals
In a repeater spoofing attack, the adversary receives genuine GPS signals, adds controlled delays to each satellite signal, and retransmits them with higher power. The drone’s receiver locks onto the stronger spoofed signals, and the measured pseudorange becomes:
$$
\rho_i = P_i + c \cdot (t_u + \Delta\tau + \Delta\tau_i)
$$
where \(\Delta\tau\) is the natural delay introduced by the propagation path through the repeater (common to all satellites), and \(\Delta\tau_i\) is the artificial delay intentionally added to satellite \(i\). The goal is to make the receiver compute a false target position \((x_f, y_f, z_f)\). Setting \(\rho_i\) equal to the pseudorange from the target position to satellite \(i\) yields:
$$
\sqrt{(x_f – x_i)^2 + (y_f – y_i)^2 + (z_f – z_i)^2} + c \cdot t_u = \sqrt{(x – x_i)^2 + (y – y_i)^2 + (z – z_i)^2} + c \cdot (t_u + \Delta\tau + \Delta\tau_i)
$$
Solving for the artificial delay:
$$
\Delta\tau_i = \frac{\rho’_i + \rho”_i – \Delta S}{c}
$$
where \(\rho’_i\) is the pseudorange from the spoofed target to satellite \(i\), \(\rho”_i\) is the pseudorange from the repeater to satellite \(i\), and \(\Delta S\) is the distance between the receiver and the repeater. To avoid negative delays, a common delay \(T\) is added to all channels:
$$
T = \begin{cases} 0, & \text{if } \tau_{\min} \geq 0 \\ -\tau_{\min}, & \text{if } \tau_{\min} < 0 \end{cases}
$$
$$
\Delta t_i = \Delta\tau_i + T
$$
MIMU Error Constraints
The MIMU in a civilian drone typically uses MEMS gyroscopes with drift rates of 0.01–0.05 °/s and accelerometer biases of 5×10⁻⁴ g/s to 1×10⁻³ g/s. Over a 1-second GPS update interval, the MIMU alone can accumulate positioning errors of 3–15 m. Moreover, the integrated navigation filter (e.g., Kalman filter) compares GPS and MIMU estimates. If the difference exceeds the expected error bound, the GPS measurement is rejected. Therefore, any drone spoofing attack must induce a positioning error smaller than the MIMU’s short-term drift plus the GPS nominal error (about 5 m). This yields a tolerated spoofing error of approximately 8 m (minimum MIMU error + 5 m GPS error) to 20 m (maximum MIMU error + 5 m). The MIMU position error dynamics are given by:
$$
\delta\dot{L} = \frac{\delta v_N}{R_M + h} – \frac{v_N}{(R_M + h)^2}\delta h
$$
$$
\delta\dot{\lambda} = \frac{\delta v_E}{R_N + h} \sec L + \frac{v_E}{R_N + h} \tan L \sec L \delta L – \frac{v_E \sec L}{(R_N + h)^2}\delta h
$$
$$
\delta\dot{h} = \delta v_U
$$
where \(L, \lambda, h\) are latitude, longitude, altitude; \(R_M, R_N\) are the radii of curvature; and \(\delta v_E, \delta v_N, \delta v_U\) are velocity errors. For a flying drone, altitude changes are small, so \(\delta h\) and \(\delta\dot{h}\) can be neglected. The velocity errors depend on initial conditions and sensor drifts, which we assume to be within the ranges mentioned above. Table I summarizes the MIMU error budget used in our analysis.
| Sensor | Specification | Error Range (1σ) |
|---|---|---|
| Gyroscope drift | 0.01–0.05 °/s | 0.01–0.05 °/s |
| Accelerometer bias | 5×10⁻⁴ g – 1×10⁻³ g | 0.5–1.0 m/s² |
| MIMU position error (1 s) | Calculated | 3–15 m |
| GPS nominal error | Typical C/A code | ~5 m |
| Combined tolerable spoofing offset | MIMU + GPS | 8–20 m |
Experimental Methodology
To validate the theoretical analysis, we conducted half-physical simulation experiments. The core idea was to test how a COTS GPS receiver reacts to artificially injected pseudorange errors. Instead of generating actual RF signals with delays, we directly modified the pseudorange observations in the receiver’s data stream, which is equivalent to a repeater delay effect. The experimental setup included:
The equipment consisted of a SOUTH GPS receiver, an eight-frequency signal repeater, and a 1-to-4 signal splitter. The rooftop antenna captured live GPS signals, which were fed into the splitter. One output of the splitter was connected to the repeater that amplified and retransmitted the signals indoors to ensure strong reception. The other output was connected directly to the receiver. By accessing the receiver’s user interface via a fixed IP address, we could monitor satellite visibility, raw pseudoranges, and computed position in real time. The experiments were conducted under typical conditions with 6–9 visible satellites.
We designed tests to examine the effect of modifying pseudorange errors on a single satellite, two satellites, and three satellites. For each configuration, we added errors of 10 m, 20 m, and 30 m to the pseudorange of the selected satellite(s). For each error level, we recorded at least 50 consecutive position fixes. Table II lists the detailed experimental parameters.
| Parameter | Value |
|---|---|
| Number of visible satellites | 6 – 9 |
| Number of spoofed satellites | 1, 2, 3 |
| Pseudorange error injected | 10 m, 20 m, 30 m |
| Data points per test | ≥50 |
| Receiver type | SOUTH GNSS receiver (L1 C/A) |
| Environment | Indoor laboratory with roof antenna |
| Duration of each measurement | ~60 seconds |
The performance metrics included: (1) whether the receiver maintained a valid fix (i.e., using the spoofed satellite in the solution), (2) the maximum horizontal position deviation from the true position (computed from the unmodified satellite measurements), and (3) the range (maximum – minimum) of the position fixes to assess dispersion. A successful drone spoofing attack should produce a large deviation while keeping the fix consistent (low dispersion) and without being detected by the receiver’s integrity checks.
Results and Analysis
Single Satellite Spoofing
First, we modified the pseudorange of one satellite. The results are summarized in Table III.
| Pseudorange Error (m) | Valid Fix | Satellite Used? | Max Deviation (m) | Position Range (m) |
|---|---|---|---|---|
| 10 | Yes | Yes | 2 | 1 |
| 20 | Yes | Yes | 4 | 2 |
| 30 | Yes | No | 0.4 | 0.6 |
When the error was 10 m, the receiver continued to use the spoofed satellite, and the horizontal position shifted by about 2 m. At 20 m, the shift increased to 4 m. However, at 30 m error, the satellite was excluded from the solution (marked “No”), and the deviation dropped back to only 0.4 m. This indicates that the receiver’s fault detection and exclusion (FDE) algorithm rejected the satellite when the residual exceeded a threshold (likely around 20–30 m). For drone spoofing, the 20 m case provides a deviation of 4 m, which is within the 8–20 m tolerable range, but 4 m is relatively small. To achieve a larger offset, we need to spoof more satellites.
Two-Satellite Spoofing
Next, we applied the same error to two satellites simultaneously. Table IV shows the results.
| Pseudorange Error (m) | Valid Fix | Satellites Used? | Max Deviation (m) | Position Range (m) |
|---|---|---|---|---|
| 10 | Yes | Yes | 7 | 1 |
| 20 | Yes | Yes | 12 | 2.5 |
| 30 | Partial | No | — | — |
With two spoofed satellites, the deviation increased significantly: 7 m at 10 m error and 12 m at 20 m error. The 12 m deviation falls well within the 8–20 m tolerable range for effective drone spoofing. Moreover, the position dispersion remained low (2.5 m). At 30 m error, the receiver frequently lost lock or excluded the spoofed satellites, resulting in intermittent fixes. Therefore, the best performance for drone spoofing was achieved using two satellites with an error of 20 m. This configuration yields a deviation of 12 m, which is near the maximum that the MIMU could tolerate without detecting inconsistency (assuming a combined 8–20 m threshold).
Three-Satellite Spoofing
Finally, we spoofed three satellites. The results are in Table V.
| Pseudorange Error (m) | Valid Fix | Satellites Used? | Max Deviation (m) | Position Range (m) |
|---|---|---|---|---|
| 10 | Yes | Yes | 3 | 1 |
| 20 | Yes | Yes | 12 | 4 |
| 30 | Partial | No | — | — |
Surprisingly, with three satellites at 10 m error, the deviation was only 3 m (worse than two satellites). At 20 m error, the deviation reached 12 m again, but the dispersion increased to 4 m, which indicates less stability. At 30 m, the receiver often failed to maintain a stable fix. The increased dispersion and the need to control three channels make the three-satellite approach less attractive for practical drone spoofing.
Comparison and Discussion
Table VI provides a consolidated comparison of the best performing configurations.
| Number of Spoofed Satellites | Pseudorange Error (m) | Max Deviation (m) | Position Range (m) | Suitable for Drone Spoofing? |
|---|---|---|---|---|
| 1 | 20 | 4 | 2 | Marginally (insufficient deviation) |
| 2 | 20 | 12 | 2.5 | Yes (optimal) |
| 3 | 20 | 12 | 4 | Yes but less stable |
| 2 | 10 | 7 | 1 | Acceptable if smaller deviation needed |
From these experiments, we conclude that the most effective and stable drone spoofing attack for low-altitude civilian UAVs involves injecting a pseudorange error of 10–20 m on two satellite channels. The induced horizontal deviation of 7–12 m is sufficient to alter the drone’s flight path while remaining undetected by the MIMU/GPS navigation filter, provided that the total error does not exceed the MIMU drift plus GPS error (roughly 8–20 m). Using three satellites does not increase the maximum deviation but worsens the position dispersion, making the spoofing less predictable. Using one satellite alone yields too small a deviation for practical redirection.
It is also important to note that the drone’s velocity and altitude affect the MIMU error accumulation. The 1-second error bound used here is conservative; actual drones may have larger or smaller drifts depending on the quality of their MEMS sensors. However, the principle remains: the spoofing error must be carefully calibrated to fall within the expected inertial error window. Continuous injection of gradually increasing delays can then steer the drone to a desired location without abrupt jumps that would trigger the filter’s detection.
Conclusion
This paper presented a systematic study of GPS spoofing techniques for low-altitude civil drones, with a focus on the constraints imposed by the integrated MIMU/GPS navigation system. We derived the theoretical relationship between artificial pseudorange delays and receiver positioning errors, and analyzed the MIMU error dynamics to identify the tolerable spoofing window. Through half-physical simulations, we found that spoofing two satellites with pseudorange errors of 10–20 m yields a position deviation of up to 12 m while maintaining reliable fixes and low dispersion. This configuration provides an effective balance between deception strength and stealth, making it suitable for real-world drone spoofing countermeasures. The proposed approach can be combined with communication link jamming to build a low-cost and efficient anti-UAV system that forces rogue drones to land at designated areas. Future work will extend the study to dynamic spoofing trajectories and multi-drone scenarios.