Beyond Legacy L1 C/A: Characterizing Advanced Multi-Frequency Spoofing Against Multi-Frequency GPS Receivers for Autonomous Navigation

Abstract

Autonomous vehicles increasingly rely on high-end multi-frequency GNSS receivers that track modernized civil signals, such as L2C, L5, and L1C, alongside legacy GPS L1~C/A. Although multi-frequency operation improves robustness against natural error sources, its resilience against synchronous multi-band spoofing attacks remains insufficiently characterized. This paper presents a method for quantifying the inter-band alignment accuracy required for a coherent spoofer to evade cross-frequency consistency monitoring that a resilient receiver may employ. As a foundational study, the presented method is implemented and evaluated using the GPS L1 C/A and L2C signal pair within a controlled software-defined environment. This environment encompasses deterministic signal synthesis, programmable inter-band code offsets realized through fractional-delay filtering, and processing by a dual-frequency GNSS-SDR receiver. An inter-frequency pseudorange-difference consistency detector is defined and calibrated using a constant-false-alarm-rate (CFAR) approach, yielding a threshold of approximately 19 m at a false-alarm probability of $10^{-3}$. Signal fidelity and receiver capture are verified through correlation-function analysis using a multi-tap correlator bank. The inter-band code offset is then swept from one code chip to 0.005 chips to characterize detector performance. Results show that a perfectly aligned coherent attack yields a detection probability of zero, while detection probability increases rapidly with inter-band misalignment, reaching approximately 50% at 0.05 chips (about 15 m) and approaching unity for offsets of 0.2 chips or greater. These results quantify the alignment precision required for successful coherent dual-frequency spoofing and establish a practical framework for future evaluation of L5, L1C, and hardware-based multi-frequency spoofing scenarios.