SNAP: An Authentication Concept for the Galileo Open Service
Beatrice Motella, Davide Margaria, Istituto Superiore Mario Boella (ISMB), Italy; Matteo Paonni, Joint Research Centre of the European Commission, Italy
CONTEXT AND MOTIVATION OF THE WORK
Though the vulnerability of Global Navigation Satellite Systems (GNSSs) to Radio Frequency Interference (RFI) is a reason of concern since many years , the awareness of this kind of threats has been recently further strengthen, also thanks to the increased number of reported events of intentional interference .
The large availability of personal jammer devices, that can be easily purchased over the web, and (illegally) used, makes them the primary source of intentional interference, both of malicious and uninformed nature. According to the classification given in , jamming broadcasted on or near GNSS frequencies is intended to damage GNSS users (malicious interference), but in the majority of the cases, there is no the intent to cause harm to third parties (uninformed interference) . In addition, in the last years the attention went more to structured forms of interference, known as spoofing attacks, which have the goal of producing false information within the victim receiver. Not only the feasibility of such attacks have been widely demonstrated trough experiments and trials , but also, more recently, their real implementation in the civil domain has started to be documented .
Several anti-spoofing techniques have been proposed , based on a wide variety of different approaches. A first macro classification of such methods groups those that directly apply at user side, working on specific observables available along the receiver chain (e.g., antenna-aided techniques, methods based on the signal power monitoring or consistency check with other navigation sensors). A second group consists of techniques applied at the signal level, implementing civil-signal authentication and cryptographic defence algorithms . In this sense, a proper partition between system and receiver contribution to the robustness against spoofing represents a key aspect , in order to take advantage from both cryptographically secure features in the Signal In Space (SIS), and the implementation of non-cryptographic countermeasures.
In the design of the authentication solutions for a new generation of civil GNSS signals one can act on different signal’s components. As described in , the Navigation Message Authentication (NMA) denotes the protection of the navigation message bits (i.e., the full data frame or a portion of it) and can be implemented by digitally signing the navigation data, thus keeping the navigation message unencrypted. Spreading Code Authentication (SCA) inserts unpredictable portions, which are later verified through cryptographic functions, within the nominal (unencrypted) spreading code.
SIGNIFICANCE AND OBJECTIVES OF THE WORK
Within this context, the work has been encouraged by the need of increasing the level of the SIS robustness, required in many applications. The paper proposes an authentication concept able to exploit some of the characteristics of the current Galileo Open Service (OS) signal  and those of the OS NMA , that will start to be transmitted from 2018 .
The paper makes two primary contributions. It firstly provides a detailed analysis on the open choices for the design of signal components dedicated to authentication, describing tangible benefits and considering possible limitations of each solutions. On the other hand, on the basis of the presented analysis, the paper presents the Spreading code and Navigation data based Authentication Proposal (SNAP), a solution to provide authentication both at the navigation data and spreading code levels and tailored to the evolution of the Galileo E1 OS signal. In detail, the proposed approach builds upon the structure and the characteristics of the OS NMA, thus being capable of increasing the spoofing robustness.
USED METHODOLOGY: THE DRIVING CRITERIA
As said, the implementation of an authentication concept is open to several choices and optimizations, mainly related to specific signal characteristics. The methodology used to trade-off all the available signal options takes into account both quantitative results from simulations and qualitative analyses based on the maximization and harmonization of three main criteria.
First of all the authentication performance has been taken into account, in order to assess the technique mainly in terms of two metrics, the Time Between Authentication (TBA) and the Time To Alarm (TTA). In addition, the criterion of spoofing robustness has been used to measure the level of resilience against a set of specific spoofing attacks, considered significant for applications based on the open services. The third criteria, referred to as current signal valorisation, has been adopted to assess the level of reuse and valorisation of the current Galileo OS signal and messages structures.
In the definition of the authentication method, the three criteria have not been considered separately, nor maximized independently from each other. On the contrary, the methodology we followed tried to balance all the criteria and find a single solution, suitable for the evolution of the Galileo OS signal, and able to achieve competitive performance in terms of authentication requirement and spoofing robustness.
With the aim of limiting the TBA, the design of the SNAP technique has been initially inspired from other solutions available in the state of the art, mainly focusing on the benefits of the following three approaches: the “public-SCA” concept proposed in , the “Supersonic Codes” presented in , and the “Signature-Amortization” scheme discussed in .
The SNAP concept foresees the use of two types of SCA bursts, inserted in the pseudo-random noise (PRN) sequence at different rates. Slow SCA bursts allow for a robust a-posteriori verification with moderate latency (i.e., TBA of about 10 seconds), while fast SCA bursts are able to reduce the TBA to about 2 seconds, under a wide set of spoofing attacks.
In addition, contrary to those authentication solutions in which the verification at the receiver is performed separately on each single channel, the SNAP is able to exploit the information received from all the in-view satellites, thus obtaining a solution suitable for a two-steps authentication procedure. More in detail, the fast bursts for all the satellite signals are generated from the same cryptographically-generated spreading code chips, but a unique circular shift, that depends on the satellite identifier can be applied to each of them. In this way, the bursts received from different satellites at a given time instant consist of the same code chips sequence, just shifted in a different way for every satellite. The receiver can first cross-authenticate pairs of satellite signals by applying a codeless correlation between bursts of signal samples, properly shifted and aligned (first step authentication). It can then a-posteriori verify both slow and fast bursts, as soon as the required cryptographic information are disclosed (second step authentication).
Last but not least, the paper proves that the SNAP technique is able to increase the spoofing robustness respect to the basic OS NMA verification, by making impractical or detectable several specific types of attacks. The fact that the data message and spreading code solutions work interconnected to each other, in fact, further protect the authenticated data bits, thus increasing the overall level of security (for example, as highlighted in ).
The paper describes the technique, providing details both on the achievable performance of participant users (i.e., those able to process the authenticated portion of the signal, containing the authentication symbols or chips) and on the impact of the technique on non-participant users (i.e., those limited to process the non-authenticated signal components).
CONCLUSIONS AND SIGNIFICANCE OF THE WORK
The design of a solution for the authentication of both navigation data bits and spreading code chips, referred to as SNAP and suitable for the evolution of the Galileo E1 OS signal, will be deeply described in the paper. The significance of the work mainly lies in three elements.
First, though the technique is innovative and able to achieve predefined authentication performance, it exploits the structure of the legacy Galileo signal and the characteristics of the OS NMA, thus being capable of increasing the spoofing robustness.
Second, the work will investigate the performance of the solution under different families of spoofing attacks. The advantages of the SNAP will be described against solutions entirely based on the authentication of the navigation data components only, and those techniques that implement both NMA and SCA, but leave them independent from each other.
Third, the two-steps authentication concept allows the receiver to adapt its authentication verification process, depending on specific requirements and conditions. For example, receivers used for applications with low authentication requirements might decide to only verify the first step authentication, while more demanding users might implement the full two-step process, at a cost of an increased complexity within the receiver.
This article will present some findings of a project funded by the European Commission under the Horizon 2020 Framework Program (Funding Reference No. 435/PP/GRO/RCH/15/8384).
In addition, the authors want to thank Airbus Defence and Space GmbH (project prime contractor) for their constructive comments, helpful to improve the analysis.
 Anon., “Vulnerability assessment of the transportation infrastructure relying on the global positioning system,” J.A. Volpe National Transportation Systems Center, 2001.
 M. Jones, “Spoofing in the Black Sea: What really happened?,” GPS Word website, October 2017. Available at: http://gpsworld.com/spoofing-in-the-black-sea-what-really-happened/
 S. Pullen, G.X. Gao, “GNSS Jamming in the name of Privacy,” Inside GNSS, Vol. 7, No. 2, March/April 2012.
 J. C. Grabowsky, “Personal privacy Jammers. Locating Jersey PPDs Jamming GBAS Safety-of-Life Signals,” GPS World, Vol. 23, No. 4, April 2012.
 M. L. Psiaki, T. E. Humphreys, and B. Stauffer, “Attackers can spoof navigation signals without our knowledge. Here's how to fight back GPS lies,” IEEE Spectrum, Vol. 53, Issue 8, August 2016.
 D. P. Shepard, J. A. Bhatti, and T. E. Humphreys, “Drone Hack: Spoofing Attack Demonstration on a Civilian Unmanned Aerial Vehicle,” GPS World, August 2012.
 A. Jafarnia-Jahromi, A. Broumandan, J. Nielsen, and G. Lachapelle, “GPS Vulnerability to Spoofing Threats and a Review of Antispoofing Techniques,” International Journal of Navigation and Observation, vol. 2012, Article ID 127072, 16 pages, 2012. Doi:10.1155/2012/127072.
 M. L. Psiaki and T. E. Humphreys, “GNSS Spoofing and Detection,” in Proceedings of the IEEE, Vol. 104, No. 6, pp. 1258-1270, June 2016. Doi: 10.1109/JPROC.2016.2526658.
 F. Dovis, GNSS Interference Threats and Countermeasures. Artech House, Norwood, MA, Jan. 2015, ISBN 9781608078103.
 D. Margaria, B. Motella, M. Anghileri, J. J. Floch, I. Fernandez-Hernandez, and M. Paonni, “Signal Structure-Based Authentication for Civil GNSSs: Recent Solutions and Perspectives,” in IEEE Signal Processing Magazine, Vol. 34, No. 5, pp. 27-37, Sept. 2017. Doi: 10.1109/MSP.2017.2715898.
 European GNSS (Galileo) open service. Signal-in-space interface control document. OS SIS ICD, Issue 1.3, Dec. 2016.
 I. Fernández-Hernández, V. Rijmen, G. Seco-Granados, J. Simon, I. Rodríguez, and J. David Calle, “A Navigation Message Authentication Proposal for the Galileo Open Service,” NAVIGATION, Journal of The Institute of Navigation, Vol. 63, No. 1, Spring 2016, pp. 85-102.
 GSA website, “Assuring authentication for all”, Aug. 3, 2016. Available at: https://www.gsa.europa.eu/news/assuring-authentication-all
 L. Scott, “Anti-Spoofing & Authenticated Signal Architectures for Civil Navigation Systems,” in the Proceedings of the 16th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GPS/GNSS 2003), Portland, OR, Sept. 2003, pp. 1543-1552.
 O. Pozzobon, G. Gamba, M. Canale, S. Fantinato, “From Data Schemes to Supersonic Codes – GNSS Authentication for Modernized Signals,” Inside GNSS, pp. 55-64, Jan./Feb. 2015.
 G. Caparra et al., “Design Drivers and New Trends for Navigation Message Authentication Schemes for GNSS Systems,” Inside GNSS, pp. 64-73, Sept./Oct. 2016.
 J. M. Anderson et al., “Signal-in-Space Methods for Authentication of Satellite Navigation Signals,” in the Proceedings of the 30th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS + 2017), Portland, OR, Sept. 25-29, 2017.