Continuous GPS signal simulation system based on ZYNQ chip
By using a GPS signal simulation system based on the ZYNQ chip, a continuous GPS spoofing signal is generated and modulated, solving the problems of high cost and discontinuous signal in existing technologies, and achieving a highly efficient and low-cost GPS spoofing effect.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-11-26
- Publication Date
- 2026-03-13
AI Technical Summary
Existing GPS spoofing techniques are costly, lack controllability and continuity of signals, have a low probability of deception, and are difficult to effectively counter GPS navigation interference from drones and mobile phones.
A continuous GPS signal simulation system based on the ZYNQ chip is adopted. The ZYNQ chip generates and modulates GPS spoofing signals, and the GPS receiver obtains accurate time and location information. The satellite position is calculated by combining the orbital elements model, so as to realize continuous and real-time transmission of signals.
It achieves GPS spoofing signals with nanosecond-level time accuracy. The system has low hardware cost and extremely low power consumption, and can effectively and specifically spoof drones and mobile phones, thus improving the spoofing effect.
Smart Images
Figure CN121664352A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of wireless signal generation and deception technology, and in particular to a continuous GPS signal simulation system based on a ZYNQ chip. Background Technology
[0002] GPS is short for Global Positioning System. Currently, besides the United States, there are also global positioning systems from Russia, the European Union, and China. However, the GPS we usually refer to is the US Global Positioning System. GPS navigation uses navigation signals emitted by any four or more of the 24 satellites launched by the United States to accurately measure the instantaneous position of an object at any location and any time; more precisely, it measures the object's latitude, longitude, altitude, speed, and other positional information.
[0003] However, with the rapid development of GPS technology, on the one hand, some criminals use GPS-based detection drones to spy on private areas, infringe on personal privacy, and affect citizens' quality of life; therefore, in order to improve the quality of life and happiness index of the people, countermeasures against drones (GPS deception) urgently need to be developed.
[0004] Early GPS spoofing primarily relied on receivers that collected genuine GPS signals or generated noise signals, then amplified their strength and broadcast them to suppress the real GPS signal, thus deceiving the target. However, this method was costly, requiring large receiving equipment, and the signal lacked controllability and continuity, resulting in a low probability of deception. Therefore, with technological advancements, the generation of fake GPS signals for spoofing has become common. This method doesn't emit interference signals but mimics the characteristics of genuine signals, causing the receiver to generate incorrect position and velocity information. Specifically, spoofing can replicate the same code phase, carrier frequency, and Doppler shift as genuine navigation satellite signals, thereby interfering with the receiver. Furthermore, autonomous spoofing systems require the direct generation of fake navigation signals to further enhance their deception effect, necessitating a continuous, controllable, and low-cost generative GPS spoofing system. Summary of the Invention
[0005] In view of this, the present invention proposes a continuous GPS signal simulation system based on the ZYNQ chip. The GPS spoofing signal generated by the present invention is continuous and real-time, and its system hardware cost is low, power consumption is extremely low, and sensitivity is high, enabling efficient targeted deception of drones and mobile phones.
[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows:
[0007] A continuous GPS signal simulation system based on a ZYNQ chip includes a PC, a ZYNQ chip, a GPS receiver, and a radio frequency antenna.
[0008] The GPS receiver acquires the PPS second pulse and GPS time, and transmits them to the PC via the ZYNQ chip.
[0009] The PC is used to download the corresponding ephemeris file, combine it with GPS time to generate a GPS decoy signal and transmit it to the ZYNQ chip;
[0010] The ZYNQ chip stores the GPS spoofing signal in real time and modulates the local oscillator and gain using preset parameters before transmitting it through the radio frequency antenna. After transmitting each GPS spoofing signal, the ZYNQ chip sends a feedback signal to the PC, prompting the PC to send the next GPS spoofing signal, thus enabling continuous and real-time transmission of the GPS spoofing signal.
[0011] Furthermore, the PC client downloads the corresponding ephemeris file from the NASA website. The file is in the format "filename_.22n" and is cached according to a fixed format, specifically including:
[0012] Read ionospheric parameters from the ephemeris file: A0~A4, B0~B3; T is the reference time for UTC data; W is the UTC reference week number, which is a continuous count; jump second, the difference between GPS time and UTC time; satellite clock time, satellite clock difference, satellite clock offset, satellite clock deviation, data age, orbital radius correction, mean angular velocity correction, mean perigee angle, ascending node angular distance correction, orbital eccentricity, ascending node angular distance correction, square root of orbital semi-major axis, reference time for ephemeris, orbital inclination correction, ascending node longitude, orbital inclination correction, orbital inclination, orbital radius correction, perigee angular distance, ascending node right ascension variation, orbital inclination variability, L2 channel C / A code identifier, GPS time week, L2P code identifier, satellite accuracy, satellite health, ionospheric delay, and satellite clock data quality.
[0013] Furthermore, the desired location and time are input into the PC, the GPS time is received, and the GPS time is compensated for based on the transmission delay of the ZYNQ chip to obtain the accurate GPS time. Based on the accurate GPS time and the orbital element model, the satellite's position and velocity at this time are calculated. Then, the satellite position is converted into ECEF coordinates, clock difference and ionospheric delay by combining its spatiotemporal model, and the pseudorange at this time is calculated.
[0014] By combining the calculated pseudorange, the time it took for the satellite to arrive at the deceitful position at the previous moment is obtained by using the speed of light, and the position of the satellite at the previous moment can be calculated from this.
[0015] The radial Doppler frequency shift of the satellite to the deception position is calculated by transforming its position before and after, and the offset of its code phase is obtained by combining it with its CA code frequency.
[0016] Finally, by combining the initial time, the initial code phase and the bit delay of the navigation message are calculated and converted into a GPS decoy signal.
[0017] Furthermore, the ZYNQ chip includes a clock chip and a high-speed AD converter with two transmit and two receive signals; the RF antenna is a conventional small suction cup antenna with a gain of 15dB.
[0018] Furthermore, the ZYNQ chip includes a PS terminal and a PL terminal;
[0019] The PS end of the ZYNQ chip receives and buffers the GPS spoofing signals transmitted from the PC via a gigabit Ethernet port. During buffering, a dual buffering mode is used for timely switching.
[0020] Once a GPS spoofing signal packet is cached, the PS terminal sends it to the PL terminal. After startup, the PL terminal sends a signal flag back to the PS terminal. Upon receiving the current signal flag, the PS terminal sends a flag to the PC terminal, prompting the PC terminal to send a new GPS spoofing signal packet. The PS terminal then caches this signal in another register address.
[0021] Furthermore, after receiving the GPS spoofing signal from the PC, the PS terminal modulates the local oscillator and gain according to the preset parameters.
[0022] After the PS end completes the signal modulation, it sends the signal to the PL end's dual-port RAM via DMA. The PL end uses two dual-port RAMs and switches between them to buffer the signal sent by the PS.
[0023] After the first RAM cache is completed, the PL terminal modulates the signal sampling rate to the AD transmission frequency of 9009 through the PL terminal upsampling module and DDS module, and modulates the signal from the ZIF architecture to the intermediate frequency.
[0024] When the PL starts transmitting the GPS spoofing signal of the first RAM core, it will send a flag signal to the PS. The PS will then immediately send the second spoofing signal to the second RAM of the PL. Similarly, when the second RAM starts transmitting the GPS spoofing signal, it will immediately send the PS to send a new GPS spoofing signal to the first RAM. By repeatedly switching RAMs, the continuous and real-time transmission of GPS spoofing signals can be achieved.
[0025] Due to the adoption of the above technical solution, the beneficial effects of this invention compared with the prior art are as follows:
[0026] 1. This invention generates GPS decoy signals based on GPS time, with time errors at the nanosecond level, resulting in higher calculation accuracy.
[0027] 2. This invention is based on the ZYNQ chip, and the generated GPS decoy signal is continuous and real-time. Its system hardware cost is low, power consumption is extremely low, and sensitivity is high, which can effectively and specifically deceive drones and mobile phones. Attached Figure Description
[0028] Figure 1 This is a schematic diagram of the overall structure of a continuous GPS signal simulation system based on a ZYNQ chip according to an embodiment of the present invention. Detailed Implementation
[0029] The invention will be further described below with reference to the accompanying drawings and specific embodiments.
[0030] A continuous GPS signal simulation system based on a ZYNQ chip, such as Figure 1 As shown, an FPGA model of the 7045ZYNQ series, an RF antenna, and a gigabit network cable are selected to form a hardware system for signal generation and transmission.
[0031] In generating the GPS spoofing signal, the corresponding ephemeris file is first downloaded from the NASA website and imported into the seat software. The desired time and location for spoofing, as well as the duration of the spoofing, are selected within the software, and then "start" is clicked. The seat software reads the ephemeris file content through internal functions. After reading the parameters, the previously sent position (latitude 62.523, precision 141.13) and time (default ephemeris start time) are used. Information extracted from the broadcast ephemeris file (ephemeris reference time, orbital eccentricity, orbital inclination, etc.) is analyzed. Since the default ephemeris time differs from the current time, to achieve real-time and continuous spoofing, the ephemeris time needs to be replaced with the current time. Most models directly replace this with the PC time; however, there is a millisecond delay between the PC time and the actual time received by the target receiver. This error can cause calculation accuracy errors of hundreds of kilometers. Therefore, this invention utilizes an external GPS receiver to acquire PPS (piston-second pulse) and G... The PS time is recorded and reported to the PC via ZNYQ. After correcting for line delays on the PC, the time error is reduced to the nanosecond level, thus improving time accuracy and optimizing the model algorithm. The orbital elements model is then used to calculate the satellite's current position and velocity. Subsequently, combined with its spatiotemporal model, the satellite position is converted into ECEF coordinates, clock bias, and ionospheric delay to calculate the pseudorange. The time it took for the satellite to reach the spoofed position (receiver time) the previous moment is obtained using the speed of light, thus calculating the satellite's previous position. The radial Doppler frequency shift from the satellite to the spoofed position is calculated again through the position transformation, and the code phase offset is obtained by combining this with the CA code frequency. Finally, the initial code phase and bit delay of the navigation message are calculated at the initial moment and converted into a GPS spoofing signal.
[0032] The data is transmitted via Ethernet to the ZYNQ PS terminal for real-time storage. After the host generates continuous GPS spoofing signals in real time, the data is transmitted via gigabit Ethernet to the ZYNQ PS terminal (port number: 5001, address: 192.168.1.20) for buffering, with a size of 256KB. During buffering, a dual-buffering mode is used for timely switching. After a packet is buffered, the PS sends it to the PL. The PL, upon startup, sends back a signal flag. Upon receiving the current signal flag, the PS sends a flag to the host, instructing the host to send a new data packet. The PS buffers the data in a separate register address.
[0033] The decoy signal is transmitted. After receiving the decoy signal from the host, the PS modulates the local oscillator (1565.42MHz) and gain (control signal amplitude -20dBm to -40dBm) according to pre-set parameters to control the signal amplitude. Once the PS has prepared the signal, it sends it to the PL's dual-port RAM via DMA. The PL uses two dual-port RAMs, switching between them to buffer the signal sent by the PS. After the first RAM is buffered, the PL removes the decoy signal from the RAM and modulates the signal sampling rate to a 9009A AD transmission frequency (clock 245.76MHz) using its upsampling module and DDS module, then modulates it from the ZIF architecture to an intermediate frequency of 10MHz. When the PL starts transmitting the decoy signal from the first RAM core, it sends a flag signal to the PS, which immediately sends a second decoy signal to the PL's second RAM. Similarly, once the second RAM starts transmitting a decoy signal, the PS terminal immediately sends a new packet to the first RAM. By repeatedly switching RAMs, the GPS decoy signal is continuously and in real-time transmitted. Finally, by deceiving the mobile phone and drone and viewing their internal map positions, they were successfully lured to the set location and time.
[0034] Furthermore, the following steps are included:
[0035] S1: Select FPGA model 7045 ZYNQ series, RF antenna and GPS receiver to form a hardware system for signal generation and transmission;
[0036] S2: Extract ephemeris files using seat software to generate continuous GPS spoofing signals with controllable position and time;
[0037] S3: After generating the decoy signal, it is sent to the ZYNQ's PS terminal via the network port for real-time transfer;
[0038] S4: By setting the frequency and signal gain through PS and controlling the signal transmission logic of PL, the decoy signal is transmitted.
[0039] Furthermore, the board and radio frequency antenna in step 1 specifically include:
[0040] The ZYNQ board includes an AD9528 clock chip, a high-speed AD9009 with two transmit and two receive chips, a standard small suction cup antenna with 15dB gain, and a GPS receiver.
[0041] The ZYNQ and antenna are connected to form the hardware system of GPS software radio.
[0042] Furthermore, step 2, which involves extracting ephemeris files and generating a continuous GPS spoofing signal with controllable location and time, specifically includes:
[0043] Download the ephemeris file from the NASA website. Its format is "filename_.22n", which is a precise ephemeris file.
[0044] The designed software imports and reads files, and caches them in a fixed format.
[0045] The designed seat software sends out the desired location and time for deception. By combining the various signals read earlier with the seat software, it generates a continuous GPS deception signal with controllable location and time.
[0046] Read the ionospheric parameters from the almanac: A0~A4, B0~B3 (parameters in the fifth and sixth rows can be used for ionospheric correction); almanac parameters used to calculate UTC time; A0, A1 are polynomial coefficients; T is the reference time for UTC data; W is the UTC reference week number, which is a continuous count; jump second, the difference between GPS time and UTC time; satellite clock time (toc time, year, month, day, hour, minute, second), satellite clock error (a0, s), satellite clock offset (a1, s / s), satellite clock deviation (a2, s / s²), data age (AODE); orbital radius correction (Crs, rad), mean angular velocity correction (deltan), mean anomaly angle (M0, rad), ascending node distance correction (Cuc, rad), orbital eccentricity (e). The following parameters are included: Ascending node angular distance correction (Cus, rad), orbital semi-major axis square root (sqrtA) ephemeris reference time (TOE), orbital inclination correction (Cic, rad), ascending node longitude (OMEGA), orbital inclination correction (Cis, rad), orbital inclination (i0), orbital radius correction (Crc, m), perigee angular distance (omega, rad), ascending node right ascension variation (deltaomega, rad), orbital inclination variability (IDOT), L2 channel C / A code identifier, GPS week L2P code identifier, satellite accuracy (SVA, m), satellite health (SVH), ionospheric delay (TGD, s), and clock data quality (IODC). Input the position and time, extract information from the broadcast ephemeris file (ephemeris reference time, orbital eccentricity, orbital inclination, etc.), optimize the time on the PC by combining the PPS second pulse, calculate the satellite's position and velocity at this time using the orbital elements model, and then combine its spatiotemporal model to convert the satellite position into ECEF coordinates, clock difference and ionospheric delay, and calculate the pseudorange at this time.
[0047] Combining the pseudorange mentioned earlier, the time when the satellite arrived at the deception position (the time of the receiver) at the previous moment is obtained by using the speed of light, and the position of the satellite at the previous moment can be calculated from this.
[0048] The radial Doppler frequency shift of the satellite to the deceiving position is calculated by transforming its position before and after, and the offset of its code phase is obtained by combining it with its CA code frequency.
[0049] Finally, the initial code phase and bit delay of the navigation message are calculated at the initial moment and converted into a GPS decoy signal.
[0050] Furthermore, in step 3, the data is transmitted from the network port to the ZYNQ's PS terminal for real-time transfer, specifically including:
[0051] After the seat generates continuous GPS spoofing signals in real time, the signals are transmitted to the ZYNQ's PS terminal via a gigabit network port for caching. The size of the cache is 256KB. During caching, a dual-caching mode is used for timely switching.
[0052] Once a packet is cached, the PS will send it to the PL. After the PL starts, it will send back a signal flag. After receiving the entire signal flag, the PS will send a flag to the seat, instructing the seat to send a new packet of data. The PS caches the data in another register address.
[0053] Furthermore, the decoy signal transmission in step 4 specifically includes:
[0054] After receiving the decoy signal from the host, the PS terminal modulates the local oscillator and gain according to the preset parameters to control the signal amplitude.
[0055] After the PS side prepares the signal, it sends it to the dual-port RAM of the PL side via DMA. The PL side uses two dual-port RAMs and switches between them to buffer the signal sent by the PS.
[0056] Once the first RAM cache is complete, the PL will remove the RAM decoy signal and modulate the signal sampling rate to a 9009 AD transmit frequency through the upsampling module and DDS module at the PL end, and modulate the signal from the ZIF architecture to the intermediate frequency.
[0057] Once the PL (Plug and Switch) terminal starts transmitting the decoy signal for the first RAM core, it sends a flag signal to the PS (Power Switch) terminal. The PS terminal then immediately sends a second decoy signal to the second RAM core of the PL terminal. Similarly, once the second RAM core starts transmitting the decoy signal, it immediately instructs the PS terminal to send a new packet to the first RAM core. By repeatedly switching between RAM cores, continuous and real-time transmission of GPS decoy signals is achieved.
[0058] Finally, deception tests were conducted using mobile phones and drones with different signals. The location on the mobile phone map and the Beidou Companion APP was successfully deceived, and the map on the drone was also successfully deceived.
[0059] Those skilled in the art will recognize that the described embodiments are intended to help readers understand the principles of the invention and should be understood as not limiting the scope of protection of the invention to the described embodiments. Various modifications and variations can be made to the invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the invention should be included within the scope of the claims of the invention.
Claims
1. A continuous GPS signal simulation system based on a ZYNQ chip, characterized in that, This includes the PC component, ZYNQ chip, GPS receiver, and RF antenna; The GPS receiver acquires the PPS second pulse and GPS time, and transmits them to the PC via the ZYNQ chip. The PC is used to download the corresponding ephemeris file, combine it with GPS time to generate a GPS decoy signal and transmit it to the ZYNQ chip; The ZYNQ chip stores the GPS spoofing signal in real time and modulates the local oscillator and gain using preset parameters before transmitting it through the radio frequency antenna. After transmitting each GPS spoofing signal, the ZYNQ chip sends a feedback signal to the PC, prompting the PC to send the next GPS spoofing signal, thus enabling continuous and real-time transmission of the GPS spoofing signal.
2. The continuous GPS signal simulation system based on a ZYNQ chip according to claim 1, characterized in that, The PC client downloads the corresponding ephemeris files from the NASA website. These files are in the format "filename_.22n" and are cached according to a fixed format, specifically including: Read ionospheric parameters from the ephemeris file: A0~A4, B0~B3; T is the reference time for UTC data; W is the UTC reference week number, which is a continuous count; jump second, the difference between GPS time and UTC time; satellite clock time, satellite clock difference, satellite clock offset, satellite clock deviation, data age, orbital radius correction, mean angular velocity correction, mean perigee angle, ascending node angular distance correction, orbital eccentricity, ascending node angular distance correction, square root of orbital semi-major axis, reference time for ephemeris, orbital inclination correction, ascending node longitude, orbital inclination correction, orbital inclination, orbital radius correction, perigee angular distance, ascending node right ascension variation, orbital inclination variability, L2 channel C / A code identifier, GPS time week, L2P code identifier, satellite accuracy, satellite health, ionospheric delay, and satellite clock data quality.
3. The continuous GPS signal simulation system based on a ZYNQ chip according to claim 2, characterized in that, Input the desired location and time on the PC, receive the GPS time, and compensate for the GPS time delay based on the transmission delay of the ZYNQ chip to obtain the accurate GPS time. Based on the accurate GPS time and the orbital element model, calculate the satellite's position and velocity at this time. Then, combine its spatiotemporal model to convert the satellite position into ECEF coordinates, clock difference, and ionospheric delay, and calculate the pseudorange at this time. By combining the calculated pseudorange, the time it took for the satellite to arrive at the deceitful position at the previous moment is obtained by using the speed of light, and the position of the satellite at the previous moment can be calculated from this. The radial Doppler frequency shift of the satellite to the deception position is calculated by transforming its position before and after, and the offset of its code phase is obtained by combining it with its CA code frequency. Finally, by combining the initial time, the initial code phase and the bit delay of the navigation message are calculated and converted into a GPS decoy signal.
4. The continuous GPS signal simulation system based on a ZYNQ chip according to claim 1, characterized in that, The ZYNQ chip includes a clock chip and a high-speed AD converter with two transmit and two receive chips; the RF antenna is a conventional small suction cup antenna with a gain of 15dB.
5. A continuous GPS signal simulation system based on a ZYNQ chip according to claim 4, characterized in that, The ZYNQ chip includes a PS terminal and a PL terminal; The PS end of the ZYNQ chip receives and buffers the GPS spoofing signals transmitted from the PC via a gigabit Ethernet port. During buffering, a dual buffering mode is used for timely switching. Once a GPS spoofing signal packet is cached, the PS terminal sends it to the PL terminal. After startup, the PL terminal sends a signal flag back to the PS terminal. Upon receiving the current signal flag, the PS terminal sends a flag to the PC terminal, prompting the PC terminal to send a new GPS spoofing signal packet. The PS terminal then caches this signal in another register address.
6. A continuous GPS signal simulation system based on a ZYNQ chip according to claim 5, characterized in that, After receiving the GPS spoofing signal from the PC, the PS terminal modulates the local oscillator and gain according to the preset parameters. After the PS end completes the signal modulation, it sends the signal to the PL end's dual-port RAM via DMA. The PL end uses two dual-port RAMs and switches between them to buffer the signal sent by the PS. After the first RAM cache is completed, the PL terminal modulates the signal sampling rate to the AD transmission frequency of 9009 through the PL terminal upsampling module and DDS module, and modulates the signal from the ZIF architecture to the intermediate frequency. When the PL starts transmitting the GPS spoofing signal of the first RAM core, it will send a flag signal to the PS. The PS will then immediately send the second spoofing signal to the second RAM of the PL. Similarly, when the second RAM starts transmitting the GPS spoofing signal, it will immediately send the PS to send a new GPS spoofing signal to the first RAM. By repeatedly switching RAMs, the continuous and real-time transmission of GPS spoofing signals can be achieved.