Search

The first version of the SBAS Dual Frequency Multi-Constellation (DFMC) standard has been recently finalized. It is foreseen that its extension includes message authentication, to protect avionics from SBAS data spoofing attacks. This paper focuses on the main candidate scheme at the moment, based on the TESLA protocol in the L5-I channel. This paper analyzes which data needs to be used before authentication in order to maintain time to alert. It describes two options, named Authenticate-then-Use and Use-then Authenticate, and analyzes its prospective performance for EGNOS and WAAS.

Satellite Based Augmentation Systems (SBAS) are primarily designed to provide Safety of Life (SoL) services to aviation users as defined in ICAO SARPs [4] (Standards And Recommended Practices). SBAS’ augment Global Navigation Satellite Systems (GNSS), broadcasting corrections and integrity information to aviation users via geostationary satellites. This not only improves the accuracy of the navigation solution, it also allows aeronautic receivers to compute a protection level, bounding the residual position error with the required level of confidence. The European Geostationary Navigation Overlay Service (EGNOS) provides service levels up to LPV200 (Localizer Performance with Vertical guidance), which enables aircraft approaches that are operationally equivalent to Category I (CAT-I) Instrument Landing System (ILS) using GNSS. In recent years, there have been increasing cases of radio frequency interference (RFI) and cyberattacks (spoofing) targeting navigation systems. The message stream broadcast by SBAS is currently not protected from message level cyber-attacks, providing a potentially hazardous backdoor for adversaries to affect navigation solutions. The European Commission (EC) is exploring the possibility of improving the security of SBAS, considering SBAS authentication as a possible barrier against this type of attack. The SPARC (Simulation Platform for Authentication Reliable Concept) project was financed by the EC with the objective of identifying viable solutions for SBAS authentication. This paper focuses on the investigation of various SBAS authentication paradigms from the perspective of receiver processing, providing an overview of assumptions and a discussion on design considerations that impact the definition of an SBAS authentication capability.

The Satellite Based Augmentation Systems (SBAS) are primarily designed to provide Safety of Life (SoL) services as defined in ICAO SARPs [1] (Standards And Recommended Practices). SBAS systems exploits satellite transmission from the geostationary orbit and they broadcast corrections and integrity data for GNSS constellations such as GPS. The SBAS data allows prompt reaction to GNSS malfunction and improve the overall navigation accuracy thus allowing aeronautic receivers to compute a protection level, bounding the residual position error with the required level of confidence. SBAS signals are broadcast from the GEO orbit and designed to be received on ground surface with a strength comparable to those of GNSS signals. This guarantees the compatibility at receiver level, however the very low power (e.g. around -158 dBW) makes signals weak against interference: replication, potential malicious alteration or forging can be easily achieved. In particular, the broadcast of non-authentic SBAS data messages can have a detrimental impact on receiver operations, because the navigation solution could be affected even if the received GNSS signal is not spoofed. The European Commission is exploring the possibility of improving the resilience of the SBAS service against cybersecurity threats through the authentication of SBAS messages broadcast by the GEO satellites. This would enable receivers to verify that the received SBAS messages are authentic and not altered. With this objective, the EC is financing the SPARC (Simulation Platform for Authentication Reliable Concept) project to identify viable solutions for the authentication of SBAS data. This paper presents four authentication solutions viable to protect the SBAS data service, developed in the SPARC project. The solutions consider the DFMC SBAS service still under definition, and protect the SBAS L5 data. One of them is designed to broadcast messages within the standard data stream, with a clear impact on the available bandwidth and the overall performance. The others exploit a quadrature channel, not currently available, providing higher bandwidth at a cost of a higher power to be transmitted by the SBAS payload. In this paper, the performance indicators of the solutions are presented considering the nominal AWGN conditions compared with a reference case, which is the standards service without authentication. This approach has been specifically chosen in order to measure the impact on the SBAS service itself. Additionally, a performance assessment under spoofing attack have been done and the detection and false-alarm rejection capabilities are reported.

On November 22, 2019, the UP-Aerospace Space Loft 14 (SL-14) sounding rocket was launched from Spaceport America in New Mexico, USA, on a suborbital flight with four payloads on board, including the GARHEO (GPS-GALILEO Receiver for Human Exploration & Operations) experiment to analyze GPS L1 and Galileo E1 signals under a highly dynamic environment. The mission followed a parabolic trajectory reaching 92 km altitude before returning to Earth. The experiment is a partnership agreement between ASI (Agenzia Spaziale Italiana) and the National Aeronautics and Space Administration (NASA). Qascom, a European aerospace company, contributed a space-qualified receiver capable of tracking multi- Global Navigation Satellite System (GNSS) signals. The objective is to validate the capability of GPS-Galileo signals to support launchers and space users. Being able to rely on signals from more than one GNSS constellation greatly improves signal coverage, and increases the diversity of system architecture, frequencies and geometry. SpaceLoft XL is a single-stage unguided sounding rocket. The standard configuration is 6.1 m in overall length, 26.4 cm in maximum diameter, and 354 kg maximum lift-off mass including the payloads. The nominal flight profile is a sub-orbital trajectory reaching 100 km altitude in 160 seconds, followed by four minutes under microgravity conditions. During the main flight phases (boost, re-entry, recovery, and landing), the payloads experience an axial acceleration up to 16G, and a radial acceleration up to 18.5G due to the spin of the launch vehicle. The GARHEO payload was installed in Payload Transportation System (PTS) slot number 4-1. A circular ring antenna was used for acquisition of the L-band GNSS signals. Preliminary analysis of the digitally-recorded GNSS signals indicates that the rapid acceleration was observed during lift off and booster separation. The results also demonstrate the impact to standard receivers under these dynamics and their difficulty to track signals. This paper presents how high-dynamics, including spin, impacts the signal-to-noise ratio (CN0) during acquisition and tracking, and how this affects the positioning performance. It includes the mission results and also provides recommendations for the design of future multi-GNSS receivers that are capable to track signals under high dynamics. The paper also discusses options for integrating GARHEO with the Autonomous Flight Termination Systems (AFTS). A key feature of the analysis is the ability to reproduce the recorded signals in a simulator to achieve realistic replay of mission scenarios. Validation of the capability of GPS-Galileo signals to support space users will, in turn, greatly improve the overall Positioning, Navigation, and Timing (PNT) performance. GARHEO builds on the success of another successful U.S.-Europe cooperation effort, the GARISS (GPS-Galileo Receiver for the International Space Station) project, which was completed in May 2019 and demonstrated a combined GPS/Galileo (L5/E5a) waveform on a software-defined radio on-board the space station.

ESA and NASA conducted a joint Galileo/GPS space receiver experiment on-board the International Space Station (ISS). The objectives (Enderle 2017) of the joint project were to demonstrate the robustness of a combined Galileo/GPS waveform uploaded to NASA hardware already operating in the challenging space environment - the SCaN (Space Communications and Navigation) software defined radio (SDR) testbed (FPGA) - on-board the ISS. These activities data included the analysis of the Galileo/GPS signal and on-board Position/Velocity/Time (PVT) performance, processing of the Galileo/GPS raw data (code- and carrier phase) for Precise Orbit Determination (POD), and validate the added value of a space-borne dual GNSS receiver compared to a single-system GNSS receiver operating under the same conditions. This paper will provide a general overview of the Galileo/GPS experiment – called GARISS - on-board the ISS, describe design, test and validation and also the operations of the experiment. Further, the various analysis conducted in the con is joint project and also the results obtained will be presented with a focus on the (Precise) Orbit Determination results.

This paper presents the results of a simulator study on the impact of cybersecurity threats on commercial flight crews that has been carried out following a call for tender by the European Aviation Safety Agency (EASA). In particular, spoofing attacks on a Global Navigation Satellite System (GNSS), ACARS attacks on the Flight Management System (FMS), and an attack on the FMS' navigation database were assessed. This assessment was performed in simulator trials using the AVES research simulator of the German Aerospace Center DLR. Type-rated commercial airline pilots were invited under false pretenses to take part in the experiments. Cyberattack scenario elements were developed based on their likelihood and expected safety impact. From these scenario elements operationally relevant scenarios were composed and implemented into AVES. Based on this, trials were conducted and the collected data was analyzed subsequently. This paper is going to present the setup of the study and the results obtained with focus on the flight crews' behavior. The paper concludes with recommendations for mitigating the effects of the identified cyber threats.

© 2018 Institute of Navigation The GNSS community is dedicating significant effort to protect applications from harmful interference, including spoofing. As part of this effort, Europe will authenticate the Galileo Open Service message and is currently evaluating authentication schemes for EGNOS. This article presents the main results of recent EU activities on EGNOS authentication. After presenting some examples that illustrate the importance of authenticating SBAS, this article describes the main drivers for SBAS authentication design, namely, the use of I and/or Q channels, the use of the L1 and/or L5 frequencies, the authentication latency, and the cryptographic parameters. Later, the article presents the performances of EC-Schnorr and TESLA data authentication schemes and analyzes their impact in the SBAS L1 message sequence and in the L1/L5 Dual Frequency Multi-Constellation Standard message sequence, currently under development. ispartof: NAVIGATION-JOURNAL OF THE INSTITUTE OF NAVIGATION vol:65 issue:4 pages:517-532 status: published

The Galileo program is in continuous evolution to develop and deploy all the necessary elements and functionalities for the provision of the Galileo services. In this regard, the European Commission (EC) has been working together with the European GNSS Agency (GSA) and industry for the definition, demonstration and performance assessment of the future capabilities of the Galileo Commercial Service (CS). With this purpose, the Navigation Authentication through Commercial Service-Enhanced Terminals (NACSET) project has been recently launched. The project has a twofold objective: to study and assess system evolutions for cryptographic key management, and to develop a resilient receiver combining receiver aids and sensors with the Galileo CS Authentication features to increase robustness against spoofing attacks. NACSET comprises the design, implementation and experimentation phases of two key elements: a key management simulator (KMS) that will support the cryptographic key generation, transmission, storage, renewal and destruction, including signal-in-space and ground-assisted solutions; and a Commercial Service Resilient PVT Platform (CS-RPP), a navigation platform with improved anti-attack techniques based on different elements: two antennas, atomic clocks, dedicated signal processing techniques, inertial sensors, and remote assistance for navigation authentication and time synchronization through non-GNSS channels. This paper presents the NACSET system, architecture, elements and operational modes. The assistance service and user terminal are described in detail, including the characteristics of all its elements: antennas and RF Front End (E1-E6 enabled), CSAC and TCXO clock features, signal processing techniques, IMU features, PVT algorithms (including integrity and authentication) and secured communication protocols. Special focus is put on the definition of the anti-spoofing measures to be implemented in the User Terminal, including Angle-of-arrival and Automatic Gain Control interference detection, clock drift monitoring, anti-replay signal processing techniques, etc., all integrated with the level of authentication obtained from code-encrypted Galileo CS signals.

A candidate specification of the protocol for the Galileo Open Service navigation message authentication (hereinafter referred to as OSNMA) has been implemented as part of the AALECS project (Authentic and Accurate Location Experimentation with the Commercial Service). The protocol has been integrated into an end-to-end demonstrator in order to evaluate its performance. The purpose of this paper is to present the testing framework that has been adopted in the AALECS experimentation activities and to report the first end-to-end test results. This includes worldwide service volume analyses with realistic satellite visibility and availability of satellites connected to the Galileo Uplink Stations, in order to characterize the entire system performance by simulation of the Galileo Full Operational Capability (FOC). These results allow evaluating in advance the achievable performances of a future Galileo OSNMA user considering the full system capabilities. This paper also partly addresses the fundamental requirements to implement Galileo Open Service Navigation Messages Authentication in the current and next generation of GNSS receivers, based on the lessons learned in the AALECS project.

Satellite Based Augmentation Systems enhance GNSS by increasing accuracy and providing integrity [1]. In the next future, SBAS will evolve to accommodate the new dual frequency multi constellation (DFMC) standard providing messages in two frequencies L1 and L5 [2]. The falsification of the SBAS information can be a concern for many users [3]: SBAS outages can degrade service continuity and in general, SBAS spoofing can lead the receiver to compute a coherently false position and time solution. This can create a risk for many SBAS users, including civil aviation and other safety critical applications. In spite of the amount of references already available concerning GNSS authentication (e.g.: [4], [5], [6], [7], [8] [9]), SBAS authentication is a subject not yet widely analyzed in the literature ([3], [10], [11], [12], [13], [14]). In 2015, the European Commission launched the EAST project (EGNOS Authentication System Test-bed), recently concluded, in order to study if and how authentication services can be added to EGNOS [3]. Specifically, the focus of the project is on the DFMC standard, to be implemented in EGNOS V3 to augment both GPS and Galileo. The project participants include Qascom as prime contractor, GMV and University of Padova, with the advice and support of KU Leuven. This paper summarizes the results obtained during more than one year of design, development and laboratory testing activities of SBAS authentication solutions. The paper is divided in three main sections: first, the authentication protocols are proposed and compared. Then, the SBAS authentication Test Bed used for the experimentation is presented. Finally, the paper shows the results of the experimentation conducted over the selected protocols, and the conclusions derived from the results.

The transmission of GNSS constellation-wide messages through multiple satellites can be more flexible than the transmission of clock and ephemeris by each satellite. Messages may be divided into packets and routed through different satellites to optimize reception performance. This paper proposes some basic routing strategies based on packet offsetting. It then proposes a performance analysis methodology through Monte Carlo simulations. Strategies are particularized for the Galileo OS I/NAV signal and the transmission of a digital signature used by the whole constellation, and the results are analyzed in order to determine which of the proposed transmission strategies best serve the target application.

The evolution plan of the European Railways Train Management System (ERTMS) includes the GNSS localization as one of the Game Changer technologies to improve the competitiveness of the ERTMS. GNSS will allow the implementation of cost-effective solutions to reduce the maintenance and operational cost without reducing the safety levels required by railway operations. The inherent low power of satellite navigation signals exposes GNSS-based solution to Radio Frequency threats, namely intentional or unintentional interference, that can lead to performance degradation or denial of service, and to spoofing/meaconing attacks, that can lead to receiver deception and hence to misleading PVT (Position, Velocity and Time) estimation. The aim of this paper is to present an architecture for detection and mitigation of radio-frequency hazards in a rail operational environment. The investigated solution is based on a Digital Beamforming Platform (DBP) coupled with advanced GNSS signal processing techniques for high rejection of GNSS interfering and counterfeit signals. This approach fully exploits the characteristics of the railway context, to support the evolution of the Location Determination System (LDS) based on GNSS in ERTMS Train Control System (TCS). This paper presents the DBP architectural design, focusing on the most meaningful and innovative solution foreseen for the prototype implementation. Each subsystem of the DBP is described in details, and a preliminary assessment of the performances is provided, by means of simulative and analytic tools.

This paper describes a secure framework for tracking applications that use the Galileo signal authentication services. First a number of limitations that affect the trust of critical tracking applications, even in presence of authenticated GNSS signals, are detailed. Requirements for secure tracking are then introduced; detailing how the integrity characteristics of the Galileo authentication could enhance the security of active tracking applications. This paper concludes with a discussion of our existing tracking technology using a Siemens TC45 GSM/GPRS module and future development utilizing our previously proposed trusted GNSS receiver.

Global Navigation Satellite System (GNSS) signal authentication is a requirement for a number of applications. GNSS authentication has been proposed with aiding techniques that can be applied to the existing GPS and as a new security function for future GNSS. The paper proposes a concept of a new authentication scheme based on signal authentication sequences that can be integrated in GNSS. The method works on systems that provide an open and encrypted service on the same frequency. The scheme would require minimum impact to the system. The architecture is explained in the different components of ground, space and user segment. A simulation of the architecture has been implemented in Matlab and performances and test results are shown. The paper concludes with suggestions of optimal parameters for an hypothetical implementation, explaining the future research steps.

The evolution of Global Navigation Satellite Systems (GNSS) will see the introduction of new security services both in the civil and military domain. The threat of attacks against GNSS such as spoofing has lead to the design of GNSS signals and receiver technologies that attempt to address the problem both at the signal, data and receiver level. In particular, it is expected that modern GNSS will provide both in the civil and government domain access control to the signal through spreading code encryption or access control and/or authentication at the navigation data level. This will require the support on GNSS receiver for secure cryptographic keys and the implementation of security functions. The different security functions are identified and explained. The paper reviews a number of vulnerabilities of these security functions, and provides a number of design considerations in order to mitigate these attacks.

The main focus of Satellite-Based Augmentation Systems has been the provision of integrity to the GNSS signals. However, the sensibility towards interference is growing within the GNSS community, as it becomes day by day more realistic, more feasible and cheaper. The purpose of this paper is to present a framework for designing SBAS authentication and to present innovative solutions. The paper will initially outline the threats to be mitigated, with emphasis on those specific to SBAS. The work will then focus on signals and signal components that could support authentication, its adequacy and the margin of maneuver for implementation. Subsequently, the paper will present some authentication approaches and discuss their adequacy for the SBAS service. Finally, the paper will discuss the impact of authentication for the SBAS users. Finally, some concrete implementation proposals will be presented and its bit-level implementation and their performance will be characterized, concluding with some recommendations. The paper is based on the activities of the EAST project (EGNOS Authentication Security Testbed), therefore most of the considerations are based on the European SBAS service EGNOS.