Rafael Terris-Gallego

The Galileo Signal Authentication Service (SAS) is the next new feature to be offered by Galileo, the European GNSS. Its signal-in-space initial capability is expected already in the next months of 2025, starting with the L3 (Launch 3) Galileo elliptical-orbit satellites. It is the first-ever navigation signal authentication feature offered globally and openly. Galileo SAS uses the existing Galileo E6-C signal to be encrypted, in combination with OSNMA (Open Service Navigation Message Authentication), through the so-called semi-assisted authentication concept. In this concept, portions of the E6-C are re-encrypted with OSNMA future keys and published in a server. The concept allows signal authentication openly and for free, and without private key management by users. In exchange, the time between authentications is 30 s, inherited from OSNMA, and it introduces a latency between the E6-C signal reception and its authentication down to a few seconds. This work presents the status of Galileo SAS. It outlines its latest technical definition, already shared in previous publications. It will also present the MMARIO (Message and Measurement Authentication Receiver for Initial Operations) project, developing the first SAS server, receiver and testing platform. The paper also outlines the Galileo SAS plans for the near future, up to the Initial Service Declaration.

Galileo Signal Authentication Service (SAS) is an assisted signal authentication capability under development by Galileo, designed to enhance the robustness of the European Global Navigation Satellite System (GNSS) against malicious attacks like spoofing. It operates by providing information about some fragments of the unknown spreading codes in the E6-C signal. Unlike other approaches, Galileo SAS uniquely employs Timed Efficient Stream Loss-tolerant Authentication (TESLA) keys provided by Open Service Navigation Message Authentication (OSNMA) in the E1-B signal for decryption, avoiding the need for key storage in potentially compromised receivers. The encrypted fragments are made available to the receivers before the broadcast of the E6-C signal, along with their broadcast time. However, if the receiver lacks an accurate time reference, searching for these fragments—which typically last for milliseconds and have periodicities extending to several seconds—can become impractical. In such cases, the probability of detection is severely diminished due to the excessively large search space that results. To mitigate this, initial estimates for the code phase delay and Doppler frequency can be obtained from the E1-B signal. Nevertheless, the alignment between E1-B and E6-C is not perfect, largely due to the intrinsic inter-frequency biases they exhibit. To mitigate this issue, we can leverage auxiliary signals like E6-B, processed by High Accuracy Service (HAS)-compatible receivers. This is a logical choice as E6-B shares the same carrier frequency as E6-C. This could help in obtaining more precise estimates of the location of the encrypted fragments and improving the probability of detection, resulting in enhanced robustness for the SAS authentication process. This paper presents a comparison of uncertainties associated with the use of the E1-B and E6-B signals, based on real data samples obtained with a custom-built Galileo SAS evaluation platform based on Software Defined Radio (SDR) boards. The results show the benefits of including E6-B in SAS processing, with minimal implementation cost.

The use of multiple frequencies in GNSS allows for greater accuracy of the navigation receiver. This not only reduces the impact of the ionosphere, but also provides additional signals to enhance robustness. In various applications, receivers require synchronous access to samples from different frequency bands. In this paper, we provide an overview of several low-cost SDR platforms that enable synchronized sample capture and describe how to configure them for this purpose. Finally, we discuss GNSS applications, such as Galileo SAS, that can take advantage of these platforms for testing and evaluation.

This paper presents for the first time the full specification of the Galileo Signal Authentication Service (SAS), formerly known as Assisted Commercial Authentication Service (ACAS). It includes a general description of the concept and a detailed description of the service, with focus on the ground interfaces and cryptographic operations, and with the aim of helping developers to test SAS receiving prototypes in view of the forthcoming SAS early testing phase. The paper also summarizes some of the field and lab testing results obtained so far and outlines some recommendations for future SAS receivers.

To enhance the robustness of the Global Navigation Satellite System (GNSS) against malicious attacks (e.g., spoofing), the European Galileo is working on new services, like Open Service Navigation Message Authentication (OSNMA), which provides authentication on the navigation bits, or Commercial Authentication Service (CAS), which aims to encrypt the spreading code chips. An assisted mode of the latter, named Assisted Commercial Authentication Service (ACAS), is currently under definition by the Galileo program. It uses the Timed Efficient Stream Loss-tolerant Authentication (TESLA) keys provided by OSNMA on the E1-B signal to re-encrypt some fragments of the encrypted E6-C signal, known as Re-Encrypted Code Sequences (RECSs), that are made available in the GNSS Service Centre (GSC). Once downloaded by a compatible receiver, they can be decrypted using the corresponding key and used to perform the correlation with the broadcasted E6-C signal. If that results in a correlation peak, the signal can be authenticated under certain circumstances. However, the probability of detecting this peak depends on the length of these fragments and their periodicity, since they are only provided for certain predefined instants. Indeed, if the receiver relies solely on E6-C signal and has no accurate time reference, this probability is severely degraded. This is why the nominal operating mode proposed for ACAS is to use the estimates provided by E1-B to reduce the uncertainty on the E6-C signal, so that the receiver can know precisely where these fragments are located. In the context of the PAULA project, we have developed a low-cost hardware platform based on bladeRF that allows acquiring both E1-B and E6-C samples synchronously. In this paper, we describe how to set up this platform and we characterise the alignment between the E1-B and E6-C estimates (code phase and Doppler frequency) using the real datasets obtained with such a platform, which is of key importance for the ACAS nominal mode. The results confirm the convenience of using the estimates from the E1-B signal for ACAS.

Malicious attacks such as spoofing are a significant concern within the Global Navigation Satellite System (GNSS) community. The European Galileo program is actively developing new services to bolster the resilience of these systems, as outlined in (Fernandez-Hernandez et al., 2018). These services include Open Service Navigation Message Authentication (OSNMA), which offers authentication for navigation bits, and Commercial Authentication Service (CAS), designed to encrypt the spreading code chips. Similar concepts are being applied in Chips-Message Robust Authentication (CHIMERA) for Global Positioning System (GPS). In this paper we focus on Assisted Commercial Authentication Service (ACAS), which is currently under definition (European Commission, 2020b). It uses the Timed Efficient Stream Loss-tolerant Authentication (TESLA) keys supplied by OSNMA via the E1-B signal to re-encrypt specific fragments of the encrypted E6-C signal, referred to as Re-Encrypted Code Sequences (RECSs). These RECSs are then made accessible in the GNSS Service Centre (GSC). Once a compatible receiver downloads them, it can decrypt these fragments using the corresponding key and then correlate them with the broadcasted E6-C signal. If this process results in a correlation peak, the signal can be authenticated under certain conditions. To enhance the probability of detecting this correlation peak, the proposed nominal operating mode for ACAS entails using the estimates provided by E1-B to reduce the uncertainty associated with the E6-C signal, given that these fragments are only accessible at specific predefined instants. This approach enables the receiver to accurately predict the locations of these fragments. The alignment between the E1-B and E6-C signals is of utmost importance for this operational mode. To assess it in a real-world context, a series of real datasets were captured using a low-cost Software Defined Radio (SDR) platform based on bladeRF. This platform enabled the synchronous acquisition of samples from both E1-B and E6-C bands. Additionally, the performance of ACAS in terms of acquisition-level probability of detection has been evaluated across various RECS lengths. This evaluation serves as a valuable tool for choosing the configuration of a receiver’s hardware and as a performance reference for practical implementations.

A semi-assisted GNSS authentication concept is proposed, with two main advantages. Firstly, it can be implemented in a GNSS without modifications to the signal plan, provided that the GNSS can transmit an encrypted signal and an open signal with unpredictable and verifiable bits regularly. Secondly, it can work in a receiver for up to several days without any assistance or the possession of a private key, at the expense of some authentication latency. In this concept, parts of the encrypted signal to be transmitted in the future are re-encrypted, published, and downloaded in the receiver. Some seconds after transmission, the satellite openly broadcasts the decryption key, and the receiver performs the a-posteriori correlation with the encrypted signal. The concept is particularized for the Galileo system as Galileo ACAS (Assisted Commercial Authentication Service), based on OSNMA in E1B for the decryption keys and E6C for the encrypted signal. An end-to-end procedure for measurement authentication is proposed and tested, showing its viability.

The European Global Navigation Satellite System (GNSS), Galileo, is currently leading the development of new services focused on the authentication of the position to mitigate the vulnerabilities of common receivers. It has recently incorporated the Open Service Navigation Message Authentication (OSNMA) in its E1-B signal, which allows to authenticate the navigation data symbols, but it is also working in the encryption of the spreading codes to provide increased security and robustness against malicious attacks like spoofing ones. This last technique will be provided in the forthcoming Commercial Authentication Service (CAS) operating in the E6-C signal. Currently, an ‘assisted’ mode is being defined, known as Assisted Commercial Authentication Service (ACAS), which aims to authenticate the ranging signal without the need of storing any secret key at the receiver. This paper reviews the key aspects of this service and its implementation issues and analyses the different operating modes that arise from this implementation, identifying the possible threats to face off.

The European Global Navigation Satellite System (GNSS), Galileo, is currently developing and implementing new added-value services aiming to provide increased security and robustness against malicious attacks (e.g. spoofing), like Open Service Navigation Message Authentication (OSNMA), to authenticate the data symbols, or Commercial Authentication Service (CAS), to authenticate the ranging signal. This paper analyses the impact, from a signal-level performance, of the different parameters involved in the service definition of the Assisted Commercial Authentication Service (ACAS) mode, and presents some guidelines for the implementation of this new service, focusing on the acquisition procedure. We also offer some simulation results showing the performance in different scenarios.

A GNSS signal authentication concept named semi-assisted authentication is proposed. It is based on the re-encryption and publication of keystream sequences of some milliseconds from an already existing encrypted signal. Some seconds after the keystreams are transmitted in the signal-in-space, the signal broadcasts the key allowing to decrypt the sequences and the a-posteriori correlation at the receiver. The concept is particularized as Galileo Assisted Commercial Authentication Service, or ACAS, for Galileo E1-B, with OSNMA used for the decryption keys, and E6C, assumed to be encrypted in the near future. This work proposes the ACAS cryptographic operations and a model for signal processing and authentication verification. Semi-assisted authentication can be provided without any modification to the signal plan of an existing GNSS, without the disclosure of signal encryption keys, and for several days of receiver autonomy, depending on its storage capabilities.