Jammertest 2025 Results: How FocalPoint’s Supercorrelation® Defends Against Spoofing

Spoofing, meaconing and jamming present a growing and active threat to any industry dependent on GNSS-based positioning, navigation and timing (PNT) solutions. For safety-critical systems in defence, automotive and critical infrastructure, interference compromises the reliability and integrity of positioning. This can lead to serious operational, safety and economic consequences.

FocalPoint’s Supercorrelation® technology provides a software-based upgrade at the heart of a GNSS receiver that protects systems against these growing threats.

This article presents a first look at the performance of Supercorrelation® during the September 2025 Jammertest in Norway.

Spoofing and meaconing

Spoofing and meaconing attacks on GNSS involve a malicious third-party broadcasting inauthentic GNSS signals in an attempt to disrupt the accurate operation of a receiver, ideally forcing the receiver to output a PNT solution that is controlled by the third-party. Spoofing involves a transmitter creating counterfeit GNSS-like signals designed to mislead a receiver into producing erroneous position or time estimates. Meaconing is more straightforward, and involves the reception of the authentic live GNSS signals and rebroadcasting them at a higher power. This preserves their structure while altering their apparent origin and timing. Both techniques can induce gradual or abrupt errors that may evade simple power- or consistency-based detection methods, particularly when the inauthentic/delayed signals are stronger than or closely synchronised with the authentic ones.

Diagram illustrating a meaconing attack. Meaconing involves the reception of authentic GNSS signals (single satellite shown for simplicity) and rebroadcasting. Spoofing is equivalent, except the inauthentic/spoofed signals are fabricated.

Often, sophisticated hardware such as additional or complex antennas are used to provide extra resilience to these kinds of attacks; however, these solutions are expensive, power-hungry and cumbersome rendering their use infeasible for mass-market products such as mobile phones or personal vehicles. Supercorrelation®, FocalPoint’s patented signal processing technology, is a software based solution that enables a receiver to distinguish between authentic GNSS signals and those from inauthentic or non-line-of-sight (NLOS) origins. Central to this technology is the concept of long (≥ 1 second) coherent integration of signal power, while compensating for the receiver motion in the direction of the LOS signal. Under such conditions, the signal-to-noise ratio (SNR) of the LOS signal is boosted significantly while signals arriving from other directions are suppressed. In the case of a spoofing attack, a Supercorrelation-enabled GNSS (S-GNSS®) receiver can recover the genuine satellite signals while suppressing the stronger spoofed signals that would otherwise confuse a traditional GNSS receiver.

Jammertest 2025

In September 2025 FocalPoint travelled to Andoya, Norway to take part in Jammertest. Hosted by an array of Norwegian authorities, and attracting participants from around the world, the annual Jammertest event offers a unique opportunity to test the resilience of GNSS receivers to different spoofing and jamming scenarios under realistic open-air conditions.

Left: test vehicle with a patch antenna at the starting location. Right: recording equipment including a LabSat GNSS recorder and reference receivers for monitoring.

The trials hardware consisted of a LabSat 4 GNSS spectrum recorder connected to a standard GNSS patch antenna mounted on the roof of our test vehicle. The Labsat 4 was used to capture the GNSS radio frequency (RF) signals, enabling future repeated replay of the data into multiple different receivers in our Cambridge office, as though these receivers had been physically present at the test site. To complement the analysis, we also collected inertial sensor data using a consumer-grade inertial measurement unit (IMU) and recorded the live outputs from several off-the-shelf GNSS receivers.

The image below shows the route driven during a specific meaconing test (Jammertest scenario 3.1.3), with the location of the meaconer shown on the mountaintop.

Meaconer location and route driven during Jammertest 2025 meaconing scenario. Used for illustrative purposes only. Image credit: Google Earth, Image ©Airbus, Image IBCAO.

Findings and results

The captured RF data was replayed into FocalPoint’s S-GNSS® software-defined radio (SDR) receiver. By configuring the receiver to operate first with and then without Supercorrelation processing, we were able to analyse the anti-spoofing benefits of Supercorrelation in the measurement domain. In both cases the basic measurements consisted of 20 millisecond coherent correlations of a received GNSS signal with a local replica. Extended signal integration periods of 1 second or more were employed with the intention of increasing the received SNR. In the non-Supercorrelation case this consisted of the incoherent summation of multiple consecutive 20 ms correlation outputs up to the desired total integration time, while in the Supercorrelation case a coherent summation was performed. The figure below shows the integrated correlation outputs from a Galileo E1C signal for a wide range of correlation code delays at experiment time, t = 125 s. At this time during the experiment the meaconing has not yet begun and the authentic signal, located at zero delay, is clearly resolved. With 1 second integration, both the coherent (Supercorrelation — in blue) and incoherent (non-Supercorrelation — in red) methods clearly resolve a peak.

Correlation outputs with and without Supercorrelation processing for an authentic (LOS) GAL E1C PRN 15 signal.

The next figure shows the same comparison as above but during the meaconing attack. Without Supercorrelation (red plot), the meaconed signal is clearly visible as a large peak with a delay of approximately 14 chips (~14 microseconds). This delay compared to the authentic LOS signal is due to the additional geometric distance travelled by the signal (i.e. travelling from the satellite to the meaconer then to the receiver) and the signal processing delay introduced by the meaconer’s hardware. In this case, the authentic LOS signal (having travelled the shortest path from the satellite) is not visible above the noise floor, which now includes a significant contribution from the meaconer itself. However, by applying Supercorrelation processing (blue plot) to the same basic measurements the authentic signal is now clearly visible above the much reduced noise floor and the magnitude of the meaconed signal is greatly reduced also.

Correlation outputs with and without Supercorrelation processing for the GAL E1C PRN 15 signal during a meaconing attack. LOS signal is at zero delay while the meaconed (replayed signal) is a delay of around 14 chips (~14 microseconds).

Below we show the correlation results during the full meaconing scenario for the same Galileo E1C signal; however here we have extended the integration period from 1 second to 5 seconds to further demonstrate the benefits of Supercorrelation’s motion-compensated coherent integration. In the first plot below we show the results of incoherent integration. Light to dark colours indicate low to high correlation amplitudes respectively. Strong correlation (darkest) indicates that the GNSS signal can be resolved and its time of arrival accurately measured.

Correlation outputs without Supercorrelation processing for the GAL E1C PRN 15 signal over time. Meaconed signal is visible from around 150-650 s.

At around 150 seconds, the meaconing begins and strong correlation is observed at around a 10-15 chip (10-15 microseconds) offset from the authentic signal. During the attack (150-650 s) the meaconed signal overpowers or “outshines” the authentic signal which is located at zero signal delay and is completely lost below the elevated noise floor. Even with 5 seconds of integration time, incoherent processing cannot recover the LOS signal in this scenario. When unable to resolve the authentic signal, the receiver will track the meaconed one, significantly compromising the receiver’s ability to provide reliable position estimates.

The following figure shows the same Galileo E1C signal, this time applying Supercorrelation processing. In comparison, it shows a significant attenuation of the meaconed signal whilst boosting the authentic signal to well above the now suppressed noise floor. One notable event is at around 450 s, during which time the vehicle is stationary. For this period, Supercorrelation processing does not attenuate the meaconed signal as there is no difference between the motion of the receiver relative to the GNSS satellite and the meaconing transmitter; however Supercorrelation still increases the signal-to-noise ratio of the authentic signal through long coherent integration such that it can be tracked.

Correlation outputs with Supercorrelation processing for the GAL E1C PRN 15 signal over time.

High-rate PNT solutions can be augmented with long motion-compensated coherent correlations provided by Supercorrelation. Here we have shown correlation outputs for 1 second and 5 second integrations reported at rates of 1 Hz and 0.2 Hz respectively; however, the length of integration can be configured during runtime – for example, in response to a change in signal environment or upon the detection of a potential jamming or spoofing event – and performed over a rolling window that reports at a faster rate. Alternatively, the high-accuracy, lower rate S-GNSS measurements can be fused with higher-rate sensor data such as from inertial measurement units or vehicle odometry, enabling high-rate PNT solutions with much greater resilience to spoofing and meaconing attacks.

Supercorrelation®: Proven spoofing resilience for GNSS receivers

In safety-critical applications, positioning errors can have serious consequences. For automated vehicles, a delayed signal could compromise navigation performance, potentially leading to unsafe decisions in lane positioning, path planning or vehicle control. Across industries, the consequences of a compromised position fix are equally severe.

As demonstrated here, by reinforcing the authentic line-of-sight signal and suppressing delayed or inauthentic signals, Supercorrelation® enhances both the reliability and integrity of GNSS under hostile RF conditions. This provides an additional layer of resilience against spoofing and meaconing attacks, without the need for modifying hardware, making it suitable for deployment in mass-market platforms.

Conclusion

The Jammertest 2025 results show that even in the presence of real-world interference, Supercorrelation® enables the recovery and tracking of authentic GNSS signals. We will share deeper insights and further analysis in the coming months.

Our paper based on these results, Real-world Multipath and Spoofing Suppression Capabilities with Supercorrelation® Processing, has been submitted to EUSIPCO, and we will share it once available.

FocalPoint’s S-GNSS® Auto, powered by Supercorrelation®, is a software upgrade for automotive-grade GNSS receivers, delivering reliable positioning in challenging environments. Integration with leading chipset partners is underway. To learn more, contact us.

(Cover pic: FocalPoint engineers Laurence Bennett and J. Ross van der Merwe at Jammertest 2025.)