Tag: OSNMA

It’s Galileo time: Options for crystal oscillators in OSNMA-enabled receivers
By Francesco Ardizzon, Nicola Laurenti, Carlo Sarto and Giovanni Gamba

To ensure the authenticity of the Galileo navigation messages, the Open Service navigation message authentication (OSNMA) mechanism requires a loose synchronization between the receiver clock and the system time.

To ensure the authenticity and the integrity of the transmitted messages, the Timed Efficient Stream Loss-tolerant Authentication (TESLA) protocol for broadcast authentication requires a loose time synchronization between the transmitter and the receiver — that is, an upper bound to the time offset between their clocks. In the context of the TESLA-based Open Service navigation message authentication (OSNMA) protocol, it is customary to assume that:
- On the system side, the transmission is synchronous because the satellites are equipped with high-precision atomic clocks, the drift of which is assumed negligible with respect to those at the receiver side.
- At the receiver side, commercial clocks can be found that are less accurate and less stable, which accounts for the substantial time mismatch between the transmitter and the receiver clocks accumulating over time.
To limit the impact of such mismatch on OSNMA operation, it is envisioned that clocks for authenticated tachographs onboard vehicles, such as the ones that will be employed for the position authenticated tachograph for OSNMA launch (PATROL) project, are reset and precisely realigned to system time in periodic workshop visits. However, the clock mismatch must satisfy the OSNMA constraint at all times between successive workshop resets, in the “holdover” period, and through all possible operating conditions, to ensure constant authenticity of the navigation message.

In other contexts, this task is performed by such means as network synchronization protocols.

However, we are considering a scenario where, during holdover, we cannot rely on other sources, such as an internet connection or other devices to synchronize with the reference time to assure the authenticity of our time reference and, consequently, of the PVT solution. We also cannot trust any signal received during the holdover period, thus we should not use the PVT solution to synchronize the clock.

Here, we have two goals. First, investigate the causes of the misalignment and frequency deviation in clock generators commonly found on the market for GNSS receivers. Second, relate the clock specification parameters, taken directly from the real-time clock (RTC) device datasheets, the holdover period, and the OSNMA misalignment constraints.

Atomic clocks at ESTEC’s Navigation Laboratory in The Netherlands independently validate Galileo timing performance. (Photo: ESA)

Frequency Accuracy and Stability

Two metrics are usually employed to evaluate the performance of an oscillator.
- Clock frequency accuracy is the normalized difference between the frequency output and its nominal value, f₀.
- Clock frequency stability is the normalized instantaneous frequency deviation from its local mean.
Although devices are characterized in terms of their stability, we are interested in measuring their accuracy y(t)ΔF(t)⁄f₀, where ΔF(t) is the instantaneous frequency deviation from f₀ at time t. The calibration performed during each workshop reset brings the residual misalignment to a negligible value called phase calibration error. On the other hand, we will later discuss the residual frequency deviation, due to the frequency calibration error.

The loose time synchronization requirement T_L states that the authenticity of the navigation message received at time t is guaranteed if |ΔT(t)|≤T_L, at every t during the holdover period.

Finally, we can relate accuracy and misalignment using the bound

(1)

which allows us to upper bound the clock misalignment at any time t in terms of the frequency accuracy along the whole interval elapsed from the last calibration time t₀.

Accuracy Loss for Receiver Clocks

Thanks to their affordable price and wide temperature operating conditions, quartz crystal oscillators are used for clock generation in GNSS receivers (see TABLE 1). We distinguish among simple, temperature-controlled crystal oscillators (TCXOs) and oven-controlled crystal oscillators (OCXOs). GNSS receivers typically employ TXCOs because they offer the best trade-off in terms of power consumption, price and typical accuracy.

Table 1. Summary of the main quartz crystal oscillator characteristics.

Sources of Frequency Accuracy Loss. Quartz crystals are piezoelectric materials, therefore any additional stresses and environmental changes generate an additional voltage, decreasing the clock stability. In the automotive scenario, the main sources of accuracy loss are temperature changes, long-term aging, and the residual calibration frequency offset, while the impact of accelerations, vibrations, gravity variation and supply voltage oscillation can safely be neglected as they result in changes of a few parts per billion.

Currently, no analytic relationship is known between frequency accuracy and temperature for TCXOs (or OCXOs). Therefore, as reported in datasheets, the inaccuracy induced by the temperature changes is bounded by a constant value Y_tempacross the whole operating temperature range. This yields a bound on the clock misalignment that increases linearly with the time from the last calibration.

Long-term aging has significant impacts on the clock frequency accuracy and may affect the device even when it is not used for a long time (see Figure 1). A critical aspect of this effect is that it is time-variant, with the accuracy loss increasing over time.

Figure 1. Graphical representation of the model for aging accuracy loss: upper-bound (red) versus estimated model (blue). (Image: R. Filler and J. Vig)

However, datasheets typically report a single value, Y_age (T_data ), which bounds the accuracy at a fixed time T_data.

The effect of long-term aging for both TCXOs and OCXOs was investigated in a 1993 study by R. Filler and J. Vig measuring the accuracies of oscillator models for several years. The study concluded that a logarithmic fit is better suited for long-term measurements, while a linear fit is better suited for initial measurements (t<30 days) and is a loose upper-bound for longer times. Because we are interested in establishing a prudential upper bound rather than a precise estimate, we use the constant upper bound Y_age (T_data) for all t<T_data and a linear upper bound for t>T_data. This leads to a linearly increasing bound on the time offset before T_data, and a quadratically increasing bound after T_data.

Finally, the misalignment due to the frequency calibration error accumulates over time. An off-the-shelf oscillator has an initial accuracy that depends on the frequency tolerance f_tol. To improve this, a precise calibration is performed, trying to synchronize the RTC with the nominal frequency f₀, such as by using PTP. The contribution to the accuracy loss given by calibration can be bounded by Y_calib, a value set a priori either by system design or during the calibration process itself, yielding again a linearly increasing bound on the clock misalignment.

Bound on the Total Misalignment. In general, the cross-correlation between the uncertainties is unknown; we can only consider the worst-case scenario where the total uncertainty is bounded by the sum of the single bounds. This choice represents a prudential and conservative approach that may yield a rather loose bound with very high probability.

Thus, considering that all terms in the clock error bound increase over time, we can bound the total misalignment as

(2)

Example Values from Datasheet Specifications

Based on the above result, we can deem a commercial oscillator suitable for OSNMA operation if B(T_R )≤T_L. We can then compare the requirements for different RTCs, focusing on TCXOs designed for GNSS receivers suitable for the automotive scenario, with f₀=52 MHz and a target operating temperature range between –20° Celsius and +85° Celsius. We assume that devices are subject to a calibration process, such that Y_calibY_temp; thus we have neglected the calibration accuracy loss. We report in Table 2 the values of the misalignment bound, B(T_R ), for T_R=2 years and the maximum reset period T_R_,_max such that B(T_R_,_max)≤T_L, with a loose time synchronization requirement T_L=165s, as computed form the specs found in the datasheets.

Table 2. Bound values B(T_R) and T_R_,_max computed using several RTCs’ datasheet specs with T_L=165 s and T_R=2 years.

Conclusions

To ensure the authenticity of the GNSS navigation message, the Galileo OSNMA protocol requires a loose synchronization between the transmitter and the receiver. The misalignment between transmitter and receiver clock needs to be lower than a threshold T_L for the whole holdover period T_R. In this article, we have investigated the causes of the misalignment and frequency deviation in clock generators commonly found on the market and defined a general relationship between T_L ,T_R and the specifications commonly found in datasheets. Finally, we examined several mass-market temperature-controlled crystal oscillator datasheets, evaluating their performance in terms of worst-case offset bound B(T_R).

The bound represents a prudential conservative approach and may be rather loose. However, given the lack of a consistent statistical model, this is a reasonable solution. We conclude that most devices can satisfy the constraint B(T_R)≤T_L=165 s with a workshop reset period of T_R = 2 years.

Acknowledgements

This study was conceived within the PATROL (Position Authenticated Tachograph foR OSNMA Launch) project, funded by the EU Agency for the Space Programme through the Fundamental Elements programme, under procurement No. GSA/OP/23/16 “Development, supply and testing of a Galileo open service authentication user terminal (OSNMA) for the GSA.”

The authors acknowledge the invaluable support provided by the PATROL technical team: Davide Marcantonio (Qascom), Fabio Pisoni, Giovanni Gogliettino and Domenico di Grazia (ST Microelectronics), Alexandre Allien and Francois Riou (FDC), Jacques Kunegel (ACTIA), Simón Cancela Díaz and Belén Villanueva Coello (GMV).

PATROL success was fostered by the commitment and support of Flavio Sbardellati (EUSPA Project Officer), Gonzalo Seco Granados and Alexander Rügamer (EUSPA external reviewers), Javier Simon (EUSPA reviewer), Ignacio Fernandez-Hernandez and Giovanni Vecchione (EC reviewers). The authors thank colleagues Giada Giorgi (UNIPD) and Lorenzo Dal Corso (Qascom) for reviewing this work.

The content of this publication does not reflect the official opinion of the European Union or of the EU Agency for the Space Programme. Responsibility for the information and views expressed therein lies entirely with the authors.

Francesco Ardizzon is a Ph.D. student and Nicola Laurenti an associate professor in the Department of Information Engineering of the University of Padova, Italy. Carlo Sarto is the head of the security engineering division and Giovanni Gamba the head of the SIGINT and EW division at Qascom S.r.l., in Bassano del Grappa, Italy.

REFERENCES

A. Perrig, R. Canetti, J. Tygar, and D. Song, “The TESLA broadcast authentication protocol,” RSA CryptoBytes, vol. 5, 11 2002.

I. Fernandez-Hernandez, T. Walter, A. Neish, and C. O’Driscoll, “Independent time synchronization for resilient GNSS receivers,” in 2020 International Technical Meeting of The Institute of Navigation, 02 2020, pp. 964–978.

I. Fernandez-Hernandez, V. Rijmen, G. Seco-Granados, J. Simon, I. Rodriguez, and J. D. Calle, “A Navigation Message Authentication proposal for the Galileo Open Service,” NAVIGATION, vol. 63, no. 1, pp. 85–102, 2016. [Online]. Available: https://onlinelibrary.wiley.com/doi/abs/10.1002/navi.125

L. Cucchi, S. Damy, M. Paonni, M. Nicola, M. Troglia Gamba, B. Motella, and I. Fernandez-Hernandez, “Assessing galileo OSNMA under different user environments by means of a multi-purpose test bench, including a software-defined GNSS receiver,” in 4th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2021), 9 2021.

PATROL, https://www.patrol-osnma.eu/, last access 11 2021.

“IEEE standard definitions of physical quantities for fundamental frequency and time metrology—random instabilities,” IEEE Std 1139-2008, pp. c1–35, 2009.

J. Vig, “Quartz crystal resonators and oscillators for frequency control and timing applications – a tutorial,” in IEEE International Frequency Control Symposium Tutorials, 2016.

M. Lombardi, “Fundamentals of time and frequency,” in The Mechatronics Handbook, CRC Press, 01 2002, ch. 17.

J. Cartright, “Aging performance on crystals,” http://www.conwin.com/pdfs/aging perf crystals.pdf, 2008.

R. Filler and J. Vig, “Long-term aging of oscillators,” IEEE Transactions on Ultrasonics, Ferroelectrics, and Frequency Control, vol. 40, no. 4, pp. 387–394, 1993.

W. Riley and D. Howe, Handbook of Frequency and Stability Analysis. Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD, 2008-07-01 00:07:00 2008.

“Performance specification: oscillator, crystal controlled, general specification for,” MIL-PRF-55310F, 2018.

“Fundamentals of quartz oscillators, application note 200-2,” http://leapsecond.com/hpan/an200-2.pdf, last access November 2021.
January 13, 2022
EUSPA releases Info Note on Galileo authentication service

An Info Note has been published with analytical information on the Galileo Open Service – Navigation Message Authentication (OSNMA). The note is available on the European Union Agency for the Space Programme (EUSPA) website or through the European GNSS Service Centre. To contribute to the detection of GNSS jamming and spoofing attacks, EUSPA together with the European Commission is testing OSNMA.

This forthcoming service is an authentication mechanism that allows Open Service users to verify the authenticity of GNSS information, making sure that the data they receive is indeed from Galileo and has not been modified in any way.

OSNMA is authenticating data for geolocation information from the Open Service through the Navigation Message (I/NAV) broadcast on the E1-B signal component. This is realized by transmitting authentication-specific data in previously reserved fields of the E1 I/NAV message. By using these previously reserved fields, OSNMA does not introduce any overlay to the system, thus the OS navigation performance remains untouched.

Authentication is set to further strengthen service robustness by increasing the capability of detecting spoofing events. However, it should be kept in mind that authentication does not prevent the occurrence of such an event, and does not protect against jamming. Nonetheless, this added layer of protection proposes to be one step ahead of evolving technological trends by amplifying the service’s overall robustness and resilience.

January 3, 2022
Galileo OSNMA position opens, TeleOrbit authenticates with Goose
On Nov. 15, the European Union Agency for the Space Programme (EUSPA) opened the Galileo Open Service Navigation Message Authentication (OSNMA) Public Observation test phase for the secured signal.

The OSNMA is a freely accessible data-authentication function for the Galileo Open Service worldwide. OSNMA provides receivers a first-level of protection against spoofing the Galileo Open Service, assuming that the receiver meets requirements. This is realized by transmitting authentication-specific data in previously reserved fields of the E1 I/NAV message.

Galileo OSNMA improves confidence on the user side by enabling the user to verify the authenticity of the Galileo navigation parameters required for positioning, navigation and timing. In particular, it will allow the user to authenticate geolocation information of the Open Service:
- the ephemerides and clock corrections
- the ionospheric corrections
- the status flags
- the Broadcast Group Delay
- the GST to UTC parameters
TeleOrbit quickly authenticates with Goose

In late 2020 and the first half of 2021, TeleOrbit GmbH and Fraunhofer IIS worked on a project to implement the Galileo OSNMA capabilities onto its powerful and compact GNSS receiver lab “Goose”. This project, completed in May, successfully authenticated simulated OSNMA signals.

For the new phase, the team at Fraunhofer IIS adapted the setup to the newly published Interface Control Documents (ICDs) and receiver guidelines, and was able to authenticate the live signal on Nov. 16.

The screenshots below show snapshots of the Goose user interface with enabled OSNMA and successfully authenticated satellites, indicated by the green circle surrounding the blue Galileo satellites in the skyplot.

GPS + Galileo authenticated Galileo PVT. (Image: Fraunhofer IIS)

Galileo-only authenticated PVT. (Image: Fraunhofer IIS)

Access Now Available

Interested users can sign up for this OSNMA test phase on GSC website. The site provides access to all corresponding documents and information, including the current ICD, receiver guidelines, OSNMA public key and Merkle Tree Root — both needed for the authentication process.

To learn about using GOOSE for your own tests and projects, contact [email protected].
November 17, 2021
Research Roundup: Combatting jamming and spoofing

Image: MF3d/E+/Getty Images

Of the hundreds of papers researchers presented at 2020’s annual Institute of Navigation (ION) GNSS+ conference, which took place virtually Sept. 21–25, the following six focused on combating jamming and spoofing. The papers are available at www.ion.org/publications/browse.cfm.

Using Direction of Arrival

The author presents a scheme to combine multiple measurements for GNSS spoof detection for safety-of-life applications. The author’s algorithm combines both independent and correlated direction of arrival measurements that result in an analytic solution for the detection threshold, which can be computed online by the receiver. The scheme is validated for correlated azimuth measurements with data recorded by a dual-polarization antenna mounted on a C12 aircraft in flight, and applied to data from a live spoofing event. Results show an increase in detections of 47% using just two sequential measurements, with equal robustness for false alerts compared to snapshot-based detection. The results also show using sequential spoof detection is a powerful way to improve the detection capability of an anti-spoof defense, costing only added computational complexity while introducing a timely component to the detection.

Citation. Rothmaier, Fabian; “Optimal Sequential Spoof Detection Based on Direction of Arrival Measurements.” https://doi.org/10.33012/2020.17538

Using Neural Networks

Spoofing attacks are difficult to model and counteract. Data-driven schemes become useful if enough training data is available. This article explores such an approach using the cross-ambiguity function delay/Doppler map as input to a deep neural network for classification purposes. Several neural network models are trained, and their performance compared for detection and false-alarm probabilities. Results are promising, particularly with more complex neural networks, which are able to capture the nature of spoofing attacks. The method operates on a per-satellite basis.

Citation. Borhani-Darian, Parisa; Li, Haoqing; Wu, Peng; Closas, Pau; “Deep Neural Network Approach to Detect GNSS Spoofing Attacks.” https://doi.org/10.33012/2020.17537

Using Networks for Timing

Information cross-validation can be a powerful tool to detect manipulated, dubious GNSS timing data. Opportunistic time providers, Wi-Fi beacons and dedicated timing infrastructures provide largely available, precise sources of time information. A promising approach is to leverage time obtained over networks to which a mobile device can connect, and detect discrepancies between the GNSS-provided time and the network time. The paper investigates different options to secure augmentation time information, notably Network Time Security (NTS) and modified Wi-Fi beacons to support authentication. This scheme requires limited overhead, does not disrupt the normal operation of the Wi-Fi access points, and can be readily deployed.

Citation. Spanghero, Marco; Zhang, Kewei; Papadimitratos, Panagiotis; “Authenticated Time for Detecting GNSS Attacks.”

Using Cooperative Positioning

This paper highlights possible metrics to be checked to identify malicious attacks to the positioning and navigation systems in mass-market connected devices. The network-based exchange of GNSS data — such as GNSS raw measurements recently disclosed in Android smart devices — could offer the possibility to compare or combine such metrics to better identify spoofing and meaconing attacks.

This paper provides experimental tests and analysis toward devising an anti-spoofing strategy in connected GNSS devices. Included are a classical spoofing approach (simplistic RF attack) and its effects on the raw GNSS observables. With two synchronized devices in a cooperative framework, possible metrics are highlighted to identify a spoofing attack to one of the devices by observing anomalies.

Also included is work on simulated meaconing of an already-developed collaborative positioning framework based on the exchange of raw GNSS measurements through the network. The different approaches of an attack to the framework are laid down, and the anomalies to be considered to detect an attack in a network of cooperating devices are presented.

This paper represents a part of a larger goal to develop an anti-spoofing detection and coping mechanism in connected commercial GNSS devices.

Citation. Rustamov, Akmal; Gogoi, Neil; Minetto, Alex; Dovis, Fabio; “GNSS Anti-Spoofing Defense Based on Cooperative Positioning.”

Using OSNMA in the GIANO GNSS receiver

In recent years, the awareness about jamming and spoofing risks has been increasing, particularly in the timing community because they may cause the disruption of critical services and infrastructures in the telecommunication, energy and finance sectors, which rely on GNSS timing to operate. To overcome these hazards, the European GNSS Agency (GSA) has funded the development of timing receivers for professional applications, with the aim to address specifically the above vulnerabilities, improving the receiver’s robustness and the accuracy and reliability of time transfer.

In this context, the GIANO (Galileo-based timing receiver for critical infrastructures robustness) project consortium, coordinated by Thales Alenia Space Italy and with the support of Deimos Engenharia S.A. (Portugal), the Space Research Centre PAS in Poznan (Poland), Piktime System SP. Zoo (Poland) and Business Integration Partner S.p.A. (Italy), has been awarded a contract in the framework of the GSA’s “Fundamental Elements” program to develop a timing receiver for critical infrastructure applications. Besides the implementation of some interference and spoofing detection and mitigation techniques, the GIANO receiver makes use of Galileo’s authentication service OSNMA (Open Service Navigation Message Authentication), which can be employed as an added defense against some types of spoofing.

OSNMA exploits the TESLA (Time Efficient Stream Loss-tolerant Authentication) scheme, which is a protocol based on the transmission of message authentication codes generated with a key broadcast with some delay. The receiver authenticates the satellite messages through a digital signature algorithm and a public key known by the receivers, which also validates the root key of the TESLA chain, and through message authentication codes (MAC) used to authenticate specific fields of the navigation message. The receiver will also support public key renewals over the air.

This paper presents the OSNMA implementation within GIANO receiver, including the cryptographic operations required. The GIANO OSNMA capability will be extensively tested and validated with the support of the European Commission Joint Research Centre (Ispra, Italy).

Citation. Catalano, Valeria; Prata, Ricardo; Carvalho, Filipe; Nunes, Rui; Marradi, Livio; Franzoni, Gianluca; Puccitelli, Marco; Campana, Roberto; Gioia, Ciro; “Galileo OSNMA Preliminary Implementation in the GIANO GNSS Receiver.” https://doi.org/10.33012/2020.17714

Using Chimera Authentication

Chimera is a signal authentication enhancement suitable for protecting the L1C GPS signal. As specified by the acronym itself (chips-message robust authentication), Chimera is based on the insertion of authentication features both at the message and spreading code levels. The data are digitally signed, while the spreading code is protected by the insertion of cryptographically generated punctures.

The Chimera interface specification document was made public in 2019, while its first transmission is expected to be broadcast from the Navigation Technology Satellite 3 (NTS-3) satellite, set for launch in 2023.

This paper describes the software implementation of the functions required to enable a GNSS software receiver to elaborate the Chimera authentication service. It includes a description of the development work and a detailed software profiling analysis, allowing for evaluation of the additional computational burden required by the Chimera verification and useful for providing important guidelines for receiver implementation.

Citation. Gamba, Micaela Troglia; Nicola, Mario; Motella, Beatrice; “GPS Chimera: A Software Profiling Analysis.” https://doi.org/10.33012/2020.17717

September 23, 2021
Spirent and Qascom collaborate on OSNMA simulation tools for Galileo

SimOSNMA provides vital test tools for Galileo’s emerging end-to-end security protocol

Spirent Communications plc and Qascom have announced a simulation test solution for the Galileo Open Service Navigation Message Authentication (OSNMA) mechanism.

SimOSNMA is designed to work with Spirent’s GNSS simulation platforms to test OSNMA signal conformance, which will bring new levels of robustness for both civilian and commercial GNSS uses.

The GSS9000 test system. (Photo: Spirent)

SimOSNMA provides developers with new simulation tools to test for OSNMA, the security protocol that enables GNSS receivers to verify the authenticity of signals distributed from the Galileo satellite constellation. Designed to combat spoofing, OSNMA ensures the data received is authentic and has not been modified in any way. It is now completing the test phase before its formal launch.

SimOSNMA enables developers to simulate and test OSNMA signals and features, allowing GNSS receiver manufacturers and application developers to accelerate and assure development programs.

Qascom has been a significant contributor to the development of Galileo OSNMA. The company helped create the main test vectors for early testing and led the Position Authenticated Tachograph for OSNMA Launch (PATROL) project, which is the European Union Agency for the Space Program (EUSPA) procurement looking at the implementation of OSNMA into automotive and mass-market GNSS receivers.

“During the development of the first OSNMA receiver prototype, we needed a tool that would allow us to run tests in a controlled and repeatable environment, generate reference data, test corner cases and system events that seldomly occur in reality,” said Carlo Sarto, head of Security Engineering Domain Area. Qascom. “SimOSNMA will allow industries and agencies to speed up the development and qualification of their systems.”

Since the inception of the Galileo project, Spirent has provided crucial simulation and test capabilities to many of the key organizations and projects responsible for development of the European Space Agency (ESA) program.

SimOSNMA is available now for Spirent GSS7000 and GSS9000 platforms.

September 22, 2021
GMV awarded contract for Galileo HAS data generator

Image: EUSPA

GMV has been awarded a contract for the implementation of the Galileo High Accuracy data generator (HADG), which will be the facility in charge of generating the high-accuracy corrections data to enable the provision of the Galileo High Accuracy Service (HAS).

The contract was awarded by the European Union Agency for the Space Programme (EUSPA).

HADG will ensure the continuous provision of HAS data with a proper rate, accuracy, availability, continuity and latency. The data will encompass orbit and clock corrections, biases, quality indicators and service parameters.

The HADG contract addresses a key infrastructure development of the Galileo program. The Galileo HAS, together with the Open Service Authentication (OSNMA) and the Commercial Authentication Service (CAS), is one of Galileo’s stand-out services, setting it apart from GPS or GLONASS.

The HAS will be an open-access service based on the provision of high-accuracy corrections transmitted in the Galileo E6-B signal (E6, data component), at a rate of 448 bps per Galileo satellite connected to an uplink station. The data retrieved by the user from the different satellites offering the HAS will be reconstructed, allowing the user to achieve an improved positioning performance.

As the project’s leader, GMV will be responsible for core project activities such as the provision of the algorithms for the computation of the high-accuracy corrections, which rely on GMV’s MagicPPP software suite for precise point positioning. GMV is supported by SIDERTIA in the area of cybersecurity.

The specification , design and development phases have already been completed, and the project is progressing toward qualification of the system that will enable the execution of the necessary validation activities prior to the HAS initial service declaration, which is expected in 2022.

GMV presented the first version of MagicGNSS in 2008.

June 10, 2021
How Galileo performed its authenticated positioning fix

News from the European Space Agency (ESA)

In a first for any satellite navigation system, Galileo has achieved a positioning fix based on open-service navigation signals carrying authenticated data. Intended as a way to combat malicious spoofing of satnav signals, this authentication testing began at ESA’s Navigation Laboratory — the same site where the very first Galileo positioning fix took place back in 2013.

These historic first authenticated signal position, velocity and timing fixes were made using a total of eight Galileo satellites for around two hours on Nov. 18. The tests represent a first proof of concept for an eventual operational service offering positioning with authenticated data to users.

Spoofing has, for instance, been demonstrated as a means of forcing down drones or redirecting ships, while some high security locations — as well as disrupted international borders — have become notorious for spoofing signals that prevent the reliable use of satnav in their vicinity.

The Galileo Control Centres send the navigation signal to the GSC for the addition of the authentication code, which is then returned for uplink to the satellites.

“When a receiver picks up a navigation signal from a satellite, up until now it has no way of confirming that was indeed its source,” said navigation engineer Stefano Binda, overseeing the project for ESA. “This can result in spoofing — malicious people and organisations using false signals to mislead users about their actual position. This authentication service offers a way to prevent such deception.”

“In recent years, this problem has become sufficiently pronounced as a weak point that the European Commission, ESA and European GNSS Agency (GSA) decided to develop signal authentication as a differentiator for Galileo,” Binda said.

An ESA Navigation Directorate team at the Agency’s ESTEC technical centre in the Netherlands worked with its GSA counterparts at the twin Galileo Control Centres (GCCs) in Italy and Germany and the Galileo Service Centre (GSC) in Spain. “In everyday authentication you might send a document that has been digitally signed, where both sender and recipient use compatible cryptographic keys to validate the document’s source of origin,” Binda said.

“In this case we were working with a constrained amount of bandwidth within the navigation signal, so instead opted for a ‘delayed key’ approach. This means the initial data come along together a short tag which, within a short stretch of time usually not exceeding 30 seconds, is followed by a key, which is able to validate the tag and authenticate the data associated with it.”

During the test campaign, the Galileo Control Centres send the navigation signal to the GSC for the addition of the authentication code, which is then returned for uplink to the satellites, to be received and authenticated by the test receivers at ESTEC’s Navigation Lab and elsewhere in Europe, in participating laboratories.

To enabled the authentication test campaign, Thales Alenia Space in France served as prime contractor to upgrade of the Galileo Mission Segment — the world-spanning system that determines and create the navigation messages broadcast by Galileo satellites. Thales Alenia Space in Italy was responsible for the system level integration.

No modification of onboard satellite systems has been required to support Open Service Navigation Message Authentication (OSNMA), as spare bandwidth was made use of.

“We used our standard laboratory Septentrio test user receivers with a software add-on,” Binda said. “The beauty of this approach is that receivers will be able to make use of the future authenticated service without needing any new hardware, only software updates — apart from additional measures that might be mandated for operation in practice.”

ESA and GSA are continuing their authentication testing, with a view to introducing an operational Open Service Navigation Message Authentication service for users in the near future.

ESA’s Radio Frequency Systems, Payload and Technology Laboratories perform RF research for both the space and ground segments. (Photo: ESA)

March 15, 2021
Septentrio receiver authenticates Galileo OSNMA signals

A Septentrio receiver has successfully authenticated navigation data of the first OSNMA encrypted GNSS satellite signal.

OSNMA (Open Service Navigation Message Authentication) offers end-to-end authentication on a civilian signal, protecting receivers from spoofing attacks.

OSNMA is being pioneered by the Galileo Program, with Septentrio providing a testbed for this technology from the end-user point of view. The anti-spoofing capabilities of OSNMA will complement Septentrio’s already available anti-jamming technology, AIM+, and further strengthen the overall security of Septentrio GNSS receivers.

“The authentication of the Galileo signal using the OSNMA technology is yet another first that we are pleased to share with our close partner ESA [European Space Agency],” commented Bruno Bougard, R&D director at Septentrio. “Septentrio is proud and thankful to be able to contribute to the realization of one of Galileo’s key differentiators. “

With OSNMA, Galileo is the first satellite system to introduce an anti-spoofing service directly on a civil GNSS signal.

OSNMA is a free service on the Galileo E1 frequency. It enables authentication of the navigation data on Galileo and even GPS satellites. Such navigation data carries information about satellite location — if altered, it will result in wrong receiver positioning computation.

While currently in development, OSNMA is planned to become publicly available in the near future. GPS is experimenting with satellite-based anti-spoofing for civil users with its Chimera authentication system.

Within the scope of the FANTASTIC project led by GSA, OSNMA anti-spoofing protection was implemented on a Septentrio receiver.

“Septentrio is committed to providing highly accurate and secure positioning and timing solutions to industrial applications and critical infrastructure. This is another example where Septentrio demonstrates its leadership in end-to-end GNSS receiver security with its breakthrough anti-jamming and anti-spoofing technology,” said François Freulon, head of Product Management at Septentrio. “Thanks to our future proof products, we will be rolling out OSNMA in our portfolio as soon as it is available. This will further enhance the security of our receivers, ensuring robust, trustworthy and reliable operation even in the most challenging environments.”

European Galileo satellites provide an open authentication service on the E1 signal and a commercial authentication service on the E6 signal. (Image: European Space Agency)

ESA and GSA (European GNSS Agency) have now commenced the testing phase of the OSNMA authentication, which will continue during the coming months. To find out more about spoofing and OSNMA, see this article. For more information about GNSS signals and the value they bring, see Septentrio’s free webinar More GNSS signals: What’s in it for you?

March 10, 2021
Tests begin of Galileo’s OSNMA signal authentication service

In a first for any satellite navigation system, Galileo has achieved the first position fix based on navigation signals carrying authenticated data, according to the European Space Agency.

Galileo’s Open Service Navigation Message Authentication (OSNMA) is intended as a way to combat malicious spoofing of satnav signals.

OSNMA receivers successfully calculated an OSNMA-protected position fix after Galileo satellites started transmitting authentication data at 15:28 UTC on Nov. 18, 2020. The first tests used eight Galileo satellites for around two hours on Nov. 18. Tests have continued ever since, for intermittent periods, and will continue over the next months ahead of a public observation phase.

The first authenticated signal position, velocity and timing fixes were made using a total of eight Galileo satellites for around two hours on Nov. 18, 2020. The tests represent a first proof-of-concept for an eventual operational service offering positioning with authenticated data to users. (Image: ESA)

Pioneering a long-awaited service

The Galileo OSNMA authentication mechanism allows GNSS receivers to verify Galileo information, making sure that received data are indeed from Galileo and not modified in any way.

“Ensuring the validity of positions elaborated by GNSS is one of the main challenges before addressing an entirely new set of applications demanding dependability and resilience,” said Matthias Petschke, director of space at the European Commission, DG DEFIS. “Galileo is now set on course to deliver on this highly anticipated feature and has many more novel features in store for the coming years.”

Testing is taking place at ESA’s Navigation Laboratory at ESTEC in the Netherlands, the same site where the first Galileo positioning fix took place in 2013.(Photo: ESA)

Increased robustness

OSNMA test signals are being broadcast by the Galileo constellation using the spare bits from the current navigation message, therefore not impacting the legacy OS receivers implementing the current OS Signal-In-Space Interface Control Document (OS SIS ICD).

“Galileo’s Open Service Navigation Message Authentication is one of its key differentiators,” said Rodrigo da Costa, executive director of the European GNSS Agency. “The additional robustness that it will provide to the Galileo signal will be critical for many applications, particularly those where security and trustworthiness are a priority, making the OSNMA a key component in any resilient PNT solution.”

OSNMA works on a comparable basis to everyday encryption, where sending a digitally signed document involves both sender and recipient using compatible cryptographic keys (private and public) to validate the document’s source of origin.

“Up until now, as a navigation satellite disseminates navigation and timing data, there is no way of confirming these data are indeed coming from their apparent originator,” explained Paul Verhoef, director of navigation at the European Space Agency. “As a result, the data could be falsified, a phenomenon known as spoofing, where corrupt false signals mislead receivers about their position, misleading their users in turn, with potentially serious consequences.”

An ESA Navigation Directorate team at the ESTEC technical centre in the Netherlands worked with their European GNSS Agency (GSA) counterparts at the twin Galileo Control Centres in Italy and Germany and the Galileo Service Centre (GSC) in Spain to develop and test the OSNMA.

Next steps

Upon successful completion of the internal testing phase, a public observation phase will begin, in which the OSNMA signal will be publicly accessible. In preparation for this phase, the OSNMA user Signal-In-Space Interface Control Document (OSNMA SIS ICD), receiver implementation guidelines, and the necessary cryptographic materials will be published. This will allow receiver manufacturers and application developers to test and prepare their products.

During the public observation phase, feedback will be gathered from users, leading to the consolidation of the service.

Testbed vehicle by ESA’s Navigation Lab. (Photo: ESA)

February 11, 2021