GPS Anti-Spoofing for ArduPilot — Sensor Cross-Check Approach

[Mission-analyzer]

Given

The following independent sources of information are available for navigation integrity assessment:

• GPS — position, velocity and altitude
• IMU — accelerations and angular rates
• Barometer — independent estimation of altitude changes
• Rangefinder — additional altitude information when available
• EKF — current navigation estimate and information about the active positioning source

Concept

The basic idea is not to detect spoofing from GPS data alone, but to detect inconsistencies between GPS and independent measurements.

During normal flight, changes reported by GPS should be physically consistent with the motion observed by the IMU. Similarly, changes in GPS altitude should be consistent with independent estimates of vertical motion and barometric altitude.

A spoofing attack may provide plausible GPS coordinates and velocity, but maintaining consistency with several independent sensors is considerably more difficult.

The algorithm therefore uses a combination of inconsistency indicators rather than relying on a single criterion.

Algorithm

flowchart TD
    A[Sensor Data] --> B[GPS]
    A --> C[IMU]
    A --> D[Barometer]
    A --> E[Rangefinder]
    A --> F[EKF State]

    B --> G[GPS Displacement]
    C --> H[IMU Displacement]
    C --> I[Vertical Motion]
    D --> J[Barometric Altitude]
    E --> K[Rangefinder Altitude]
    F --> L[Navigation Source / EKF State]

    G --> M[Horizontal Consistency Check]
    H --> M

    I --> N[Vertical Consistency Check]
    J --> N
    K --> N

    M --> O[GPS Inconsistency Evidence]
    N --> O
    L --> O

    O --> P{GPS Spoofing Suspected?}

    P -->|No| Q[Continue Normal Navigation]
    P -->|Yes| R[Generate Spoofing Status]
    R --> S[Navigation Protection / EKF Source Handling]

Loading

Horizontal Consistency

GPS displacement is compared with an independent estimate of vehicle displacement derived from IMU data.

The goal is not to expect the two trajectories to match exactly. IMU integration inevitably accumulates errors, while GPS has its own measurement errors and noise.

The important factor is the character and persistence of the discrepancy.

A short-term difference caused by sensor noise, GPS error or IMU drift should not by itself be considered evidence of spoofing.

A more significant situation occurs when GPS persistently reports movement that is not supported by the inertial measurements.

Vertical Consistency

The same principle is applied to the vertical component.

GPS altitude can be compared with independent estimates of vertical motion and barometric altitude. When a rangefinder is available, it provides an additional independent source of altitude information.

Horizontal and vertical spoofing are therefore evaluated separately.

Decision Process

The algorithm should not react to a single inconsistent measurement.

Conceptually, the process is:

Sensor Measurements
        ↓
Cross-check Independent Sources
        ↓
Detect Inconsistency
        ↓
Evaluate Persistence
        ↓
Accumulate Evidence
        ↓
Assess GPS Spoofing
        ↓
Update Navigation Status
        ↓
If Required → Navigation Protection

This approach is intended to distinguish normal GPS errors or temporary sensor problems from a situation in which GPS systematically reports a trajectory that is inconsistent with the physical state of the aircraft.

Why This Approach?

GPS is an external source of navigation information. IMU, barometer and rangefinder rely on different physical measurements and can therefore provide an independent cross-check.

The fundamental principle is:

GPS should not be responsible for determining whether its own navigation solution is trustworthy. Trust should be assessed against independent measurements.

The proposed algorithm could be implemented as a Lua script for ArduPilot, using the available scripting and navigation interfaces.