First Galileo SAS Authenticated Time Solution

• URL: http://arxiv.org/abs/2609.15824v1
• Date: Mon, 14 Sep 2026 16:26:44 GMT
• Title: First Galileo SAS Authenticated Time Solution
• Abstract summary: Spoofing attacks against civilian receivers have grown more common.<n>Galileo is introducing a Signal Authentication Service (SAS) in the E6-C signal, which directly authenticates ranging measurements.<n>This paper presents, for the first time, a timing solution computed from an authenticated civil signal.
• Score: 9.327459030816309
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Spoofing attacks against civilian GNSS receivers have grown more common, especially near conflict zones where they now disrupt civil aviation, maritime operations, and critical infrastructure on a daily basis. Spoofing is possible because legacy civil GNSS signals are largely predictable in both their navigation data and ranging codes, allowing an attacker to forge a signal that imposes a false position and time on an unsuspecting receiver. Cryptographic authentication schemes such as Galileo's Open Service Navigation Message Authentication (OSNMA) mitigate this threat by verifying the authenticity of the navigation data. The ranging code itself, however, remains unprotected. To close this gap, Galileo is introducing a Signal Authentication Service (SAS) in the E6-C signal, which directly authenticates ranging measurements. SAS is currently transmitted by only two satellites in an elliptical orbital plane, of which at most one is visible at a time, meaning a full position solution is not yet possible; however, a georeferenced receiver can still obtain an authenticated time solution. This paper presents, to the authors' knowledge, for the first time, a timing solution computed from an authenticated civil GNSS signal. We develop a snapshot software receiver implementing a simplified version of the Galileo SAS protocol to compute the receiver clock bias from an authenticated pseudorange, using radio-frequency data recorded with an engineering prototype software-defined radio receiver from Septentrio. We evaluate the resulting timing solution using recordings from both SAS-capable satellites collected at different locations, demonstrating the feasibility of authenticated timing ahead of full SAS operational deployment.

Related papers

• GalSAS-SDR-SIM: An End-to-End Simulation Platform for Galileo Signal Authentication Service [14.79936512411958]
  GalSAS-SDR-SIM is an open-source software-defined radio (SDR) simulation platform.<n>It emulates the Galileo Signal Authentication Service (SAS) workflow by coupling E6 code encryption with the OSNMA key-disclosure process.<n>GalSAS-SDR-SIM provides a practical tool for accelerating SAS-capable receiver development.
  arXiv  Detail & Related papers  (2026-08-03T08:37:32Z)
• TRICK: Time and Range Integrity ChecK using Low Earth Orbiting Satellite for Securing GNSS [0.7863638253070439]
  Global Navigation Satellite Systems (GNSS) provide Positioning, Navigation, and Timing (PNT) information to over 4 billion devices worldwide.<n>Despite its pervasive use, GNSS remains vulnerable to spoofing attacks.<n>We propose TRICK, a primitive for secure positioning.
  arXiv  Detail & Related papers  (2025-11-07T09:30:18Z)
• ASTREA: Introducing Agentic Intelligence for Orbital Thermal Autonomy [51.56484100374058]
  ASTREA is the first agentic system executed on flight-heritage hardware for autonomous spacecraft operations.<n>We integrate a resource-constrained Large Language Model (LLM) agent with a reinforcement learning controller in an asynchronous architecture tailored for space-qualified platforms.
  arXiv  Detail & Related papers  (2025-09-16T08:52:13Z)
• CANTXSec: A Deterministic Intrusion Detection and Prevention System for CAN Bus Monitoring ECU Activations [53.036288487863786]
  We propose CANTXSec, the first deterministic Intrusion Detection and Prevention system based on physical ECU activations.<n>It detects and prevents classical attacks in the CAN bus, while detecting advanced attacks that have been less investigated in the literature.<n>We prove the effectiveness of our solution on a physical testbed, where we achieve 100% detection accuracy in both classes of attacks while preventing 100% of FIAs.
  arXiv  Detail & Related papers  (2025-05-14T13:37:07Z)
• Time-based GNSS attack detection [0.0]
  Cross-checking the provided time against alternative trusted time sources can lead to attack detection aiming at controlling the receiver time.<n>We implement adversaries spanning from simplistic spoofers to advanced ones synchronized with the constellation.<n>The method is largely agnostic to the satellite constellation and the attacker type, making time-based data validation of information compatible with existing receivers and readily deployable.
  arXiv  Detail & Related papers  (2025-02-06T08:28:41Z)
• Practical Spoofing Attacks on Galileo Open Service Navigation Message Authentication [22.4706805281638]
  This paper examines the Galileo Open Service Navigation Message Authentication (OSNMA)<n>It discovers two critical vulnerabilities, namely artificially-manipulated time synchronization (ATS) and interruptible message authentication (IMA)
  arXiv  Detail & Related papers  (2025-01-16T02:16:53Z)
• Task-Oriented Communications for NextG: End-to-End Deep Learning and AI Security Aspects [78.84264189471936]
  NextG communication systems are beginning to explore shifting this design paradigm to reliably executing a given task such as in task-oriented communications. Wireless signal classification is considered as the task for the NextG Radio Access Network (RAN), where edge devices collect wireless signals for spectrum awareness and communicate with the NextG base station (gNodeB) that needs to identify the signal label. Task-oriented communications is considered by jointly training the transmitter, receiver and classifier functionalities as an encoder-decoder pair for the edge device and the gNodeB.
  arXiv  Detail & Related papers  (2022-12-19T17:54:36Z)
• On the Effective Usage of Priors in RSS-based Localization [56.68864078417909]
  We propose a Received Signal Strength (RSS) fingerprint and convolutional neural network-based algorithm, LocUNet. In this paper, we study the localization problem in dense urban settings. We first recognize LocUNet's ability to learn the underlying prior distribution of the Rx position or Rx and transmitter (Tx) association preferences from the training data, and attribute its high performance to these.
  arXiv  Detail & Related papers  (2022-11-28T00:31:02Z)
• LocUNet: Fast Urban Positioning Using Radio Maps and Deep Learning [59.17191114000146]
  LocUNet: A deep learning method for localization, based merely on Received Signal Strength (RSS) from Base Stations (BSs) In the proposed method, the user to be localized reports the RSS from BSs to a Central Processing Unit ( CPU) which may be located in the cloud. Using estimated pathloss radio maps of the BSs, LocUNet can localize users with state-of-the-art accuracy and enjoys high robustness to inaccuracies in the radio maps.
  arXiv  Detail & Related papers  (2022-02-01T20:27:46Z)
• DAE : Discriminatory Auto-Encoder for multivariate time-series anomaly detection in air transportation [68.8204255655161]
  We propose a novel anomaly detection model called Discriminatory Auto-Encoder (DAE) It uses the baseline of a regular LSTM-based auto-encoder but with several decoders, each getting data of a specific flight phase. Results show that the DAE achieves better results in both accuracy and speed of detection.
  arXiv  Detail & Related papers  (2021-09-08T14:07:55Z)
• Real-time Outdoor Localization Using Radio Maps: A Deep Learning Approach [59.17191114000146]
  LocUNet: A convolutional, end-to-end trained neural network (NN) for the localization task. We show that LocUNet can localize users with state-of-the-art accuracy and enjoys high robustness to inaccuracies in the estimations of radio maps.
  arXiv  Detail & Related papers  (2021-06-23T17:27:04Z)
• Prediction-Based GNSS Spoofing Attack Detection for Autonomous Vehicles [5.579370215490055]
  We have developed a prediction-based spoofing attack detection strategy using the long short-term memory (LSTM) model. Based on the predicted distance traveled between the current location and the immediate future location, a threshold value is established. Our analysis revealed that the prediction-based spoofed attack detection strategy can successfully detect the attack in real-time.
  arXiv  Detail & Related papers  (2020-10-16T18:26:59Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.