Authentication Security of PRF GNSS Ranging

• URL: http://arxiv.org/abs/2510.02196v2
• Date: Thu, 09 Oct 2025 21:04:04 GMT
• Title: Authentication Security of PRF GNSS Ranging
• Abstract summary: This work derives the authentication security of pseudorandom function (PRF) ranging under multiple spoofing models.<n>I apply the methods herein to Galileo's Signal Authentication Service (SAS) utilizing the encrypted Galileo E6-C signal.
• Score: 0.4109482099507688
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: This work derives the authentication security of pseudorandom function (PRF) GNSS ranging under multiple GNSS spoofing models, including the Security Code Estimation and Replay (SCER) spoofer. When GNSS ranging codes derive from a PRF utilizing a secret known only to the broadcaster, the spoofer cannot predict the ranging code before broadcast. Therefore, PRF ranging can be used to establish trust in the GNSS pseudoranges and the resulting receiver position, navigation, and timing (PNT) solution. I apply the methods herein to Galileo's Signal Authentication Service (SAS) utilizing the encrypted Galileo E6-C signal to compute that, at most, 400 ms of Galileo E6-C data to assert 128-bit authentication security under non-SCER models. For the SCER adversary, I predict the adversary's needed receiving radio equipment to break authentication security. One can use this work to design a PRF GNSS ranging protocol to meet useful authentication security requirements by computing the probability of missed detection.

Related papers

• First Galileo SAS Authenticated Time Solution [9.327459030816309]
  Spoofing attacks against civilian receivers have grown more common.<n>Galileo is introducing a Signal Authentication Service (SAS) in the E6-C signal, which directly authenticates ranging measurements.<n>This paper presents, for the first time, a timing solution computed from an authenticated civil signal.
  arXiv  Detail & Related papers  (2026-09-14T16:26:44Z)
• AmbSentry: Mitigating Sensing Eavesdropping in ISAC Systems by Harnessing Ambient IoT Devices [60.083979780396014]
  Integrated sensing and communication (ISAC) has emerged as a pivotal paradigm for 6G networks.<n>This paper proposes AmbSentry, an ISAC system that prevents the leakage of sensing information to sensing eavesdroppers.
  arXiv  Detail & Related papers  (2026-08-12T08:42:05Z)
• AmbShield: Enhancing Physical Layer Security with Ambient Backscatter Devices against Eavesdroppers [69.56534335936534]
  AmbShield is an AmBD-assisted PLS scheme that leverages naturally distributed AmBDs to simultaneously strengthen the legitimate channel and degrade eavesdroppers'<n>In AmbShield, AmBDs are exploited as friendly jammers that randomly backscatter to create interference at eavesdroppers, and as passive relays that backscatter the desired signal to enhance the capacity of legitimate devices.
  arXiv  Detail & Related papers  (2026-01-14T20:56:50Z)
• Multi-Agent-Driven Cognitive Secure Communications in Satellite-Terrestrial Networks [58.70163955407538]
  Malicious eavesdroppers pose a serious threat to private information via satellite-terrestrial networks (STNs)<n>We propose a cognitive secure communication framework driven by multiple agents that coordinates spectrum scheduling and protection through real-time sensing.<n>We exploit generative adversarial networks to produce adversarial matrices, and employ learning-aided power control to set real and adversarial signal powers for protection layer.
  arXiv  Detail & Related papers  (2026-01-06T10:30:41Z)
• GNSS Spoofing Detection Based on Opportunistic Position Information [1.9688858888666714]
  Position-based Attack Detection Scheme (PADS) is a probabilistic framework that uses regression and uncertainty analysis for positions.<n>PADS achieves up to 3 times the true positive rate at a low false positive rate.
  arXiv  Detail & Related papers  (2025-06-14T17:27:06Z)
• Time-based GNSS attack detection [0.0]
  Cross-checking the provided time against alternative trusted time sources can lead to attack detection aiming at controlling the receiver time.<n>We implement adversaries spanning from simplistic spoofers to advanced ones synchronized with the constellation.<n>The method is largely agnostic to the satellite constellation and the attacker type, making time-based data validation of information compatible with existing receivers and readily deployable.
  arXiv  Detail & Related papers  (2025-02-06T08:28:41Z)
• Rydberg Atomic Quantum Receivers for Multi-Target DOA Estimation [77.32323151235285]
  Rydberg atomic quantum receivers (RAQRs) have emerged as a promising solution to classical wireless communication and sensing.<n>We first conceive a Rydberg atomic quantum uniform linear array (RAQ-ULA) aided wireless receiver for multi-target DOA detection and propose the corresponding signal model of this sensing system.<n>To solve this sensor gain mismatch problem, we propose the Rydberg atomic quantum ESPRIT (RAQ-ESPRIT) relying on our model.
  arXiv  Detail & Related papers  (2025-01-06T07:42:23Z)
• Physical Layer Deception with Non-Orthogonal Multiplexing [52.11755709248891]
  We propose a novel framework of physical layer deception (PLD) to actively counteract wiretapping attempts.<n>PLD combines PLS with deception technologies to actively counteract wiretapping attempts.<n>We prove the validity of the PLD framework with in-depth analyses and demonstrate its superiority over conventional PLS approaches.
  arXiv  Detail & Related papers  (2024-06-30T16:17:39Z)
• Extending RAIM with a Gaussian Mixture of Opportunistic Information [1.9688858888666714]
  Original receiver autonomous integrity monitoring (RAIM) was not designed for securing. We extend RAIM by incorporating all opportunistic information, i.e., measurements from terrestrial infrastructures and onboard sensors. The objective is to assess the likelihood of spoofing by analyzing locations derived from extended RAIM solutions.
  arXiv  Detail & Related papers  (2024-02-05T19:03:18Z)
• Secure Ranging with IEEE 802.15.4z HRP UWB [14.906397437053908]
  We will look at secure ranging in the context of ultra-wideband impulse radio (UWB-IR) as specified in IEEE5.4z (a.k.a. 4z) In particular, an encrypted waveform, i.e. the scrambled timestamp sequence (STS), is defined in the high rate pulse repetition frequency (HRP) mode of operation in 4z. This work demonstrates the security analysis of 4z HRP when implemented with an adequate receiver design and shows the STS waveform can enable secure ranging.
  arXiv  Detail & Related papers  (2023-12-07T00:44:31Z)
• Probabilistic detection of GNSS spoofing using opportunistic information [1.9688858888666714]
  Civilian signals are usually not cryptographically protected.<n>This makes attacks that forge signals relatively easy.<n>Considering modern devices often have network connections and onboard sensors, a Probabilistic Detection of Spoofing scheme is proposed.
  arXiv  Detail & Related papers  (2023-05-09T12:53:07Z)
• Task-Oriented Communications for NextG: End-to-End Deep Learning and AI Security Aspects [78.84264189471936]
  NextG communication systems are beginning to explore shifting this design paradigm to reliably executing a given task such as in task-oriented communications. Wireless signal classification is considered as the task for the NextG Radio Access Network (RAN), where edge devices collect wireless signals for spectrum awareness and communicate with the NextG base station (gNodeB) that needs to identify the signal label. Task-oriented communications is considered by jointly training the transmitter, receiver and classifier functionalities as an encoder-decoder pair for the edge device and the gNodeB.
  arXiv  Detail & Related papers  (2022-12-19T17:54:36Z)
• Safe RAN control: A Symbolic Reinforcement Learning Approach [62.997667081978825]
  We present a Symbolic Reinforcement Learning (SRL) based architecture for safety control of Radio Access Network (RAN) applications. We provide a purely automated procedure in which a user can specify high-level logical safety specifications for a given cellular network topology. We introduce a user interface (UI) developed to help a user set intent specifications to the system, and inspect the difference in agent proposed actions.
  arXiv  Detail & Related papers  (2021-06-03T16:45:40Z)
• CryptoSPN: Privacy-preserving Sum-Product Network Inference [84.88362774693914]
  We present a framework for privacy-preserving inference of sum-product networks (SPNs) CryptoSPN achieves highly efficient and accurate inference in the order of seconds for medium-sized SPNs.
  arXiv  Detail & Related papers  (2020-02-03T14:49:18Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.