Preliminary Evaluation of Galileo ACAS Using Existing E1-E6 Open Signals and a Low-Cost SDR Platform

Malicious attacks such as spoofing are a significant concern within the Global Navigation Satellite System (GNSS) community. The European Galileo program is actively developing new services to bolster the resilience of these systems, as outlined in (Fernandez-Hernandez et al., 2018). These services include Open Service Navigation Message Authentication (OSNMA), which offers authentication for navigation bits, and Commercial Authentication Service (CAS), designed to encrypt the spreading code chips. Similar concepts are being applied in Chips-Message Robust Authentication (CHIMERA) for Global Positioning System (GPS). In this paper we focus on Assisted Commercial Authentication Service (ACAS), which is currently under definition (European Commission, 2020b). It uses the Timed Efficient Stream Loss-tolerant Authentication (TESLA) keys supplied by OSNMA via the E1-B signal to re-encrypt specific fragments of the encrypted E6-C signal, referred to as Re-Encrypted Code Sequences (RECSs). These RECSs are then made accessible in the GNSS Service Centre (GSC). Once a compatible receiver downloads them, it can decrypt these fragments using the corresponding key and then correlate them with the broadcasted E6-C signal. If this process results in a correlation peak, the signal can be authenticated under certain conditions. To enhance the probability of detecting this correlation peak, the proposed nominal operating mode for ACAS entails using the estimates provided by E1-B to reduce the uncertainty associated with the E6-C signal, given that these fragments are only accessible at specific predefined instants. This approach enables the receiver to accurately predict the locations of these fragments. The alignment between the E1-B and E6-C signals is of utmost importance for this operational mode. To assess it in a real-world context, a series of real datasets were captured using a low-cost Software Defined Radio (SDR) platform based on bladeRF. This platform enabled the synchronous acquisition of samples from both E1-B and E6-C bands. Additionally, the performance of ACAS in terms of acquisition-level probability of detection has been evaluated across various RECS lengths. This evaluation serves as a valuable tool for choosing the configuration of a receiver’s hardware and as a performance reference for practical implementations.