Signal Processing - September 2017 - 33

recurring intervals or in randomized time slots). Such SCA
solutions are presented as generic concepts in an early stage of
design and appear to be less consolidated than solutions based
on NMA (e.g., see [13]).
In addition, other recent approaches do not directly fall in
one of the previous categories, but rather are the result of a combination of them. For instance, the joint use of Galileo E1 OS
and a specific encryption mechanism for E6 CS signals is proposed in [14], resulting in a combined use of NMA and SCE.
Similarly, the concept of supersonic codes has been introduced
in [32] as a combination of SCE and NME, that also exploits the
code shift keying (CSK)-modulation principle for authentication
purposes. The CSK modulation represents an interesting option
for the evolution of GNSS signals, being suitable to carry a high
data rate. Nonetheless, as highlighted in [45], CSK demodulation performance is very sensitive to the channel code design.
The basic idea is to apply circular shifts to some or all of the
spreading code periods (i.e., partial or complete CSK) to encode
specific data symbols. In principle, this concept can be applied
even without SCE and/or NME, still leading to a modified code
sequence that, to some extents, is not a priori predictable by a
spoofer. Assuming that the data symbols transmitted by the CSK
shifts are unpredictable, this approach also introduces some unpredictability at the spreading code level. In this sense, the CSK
modulation by itself can represent a simple form of signal authentication, with some similarities with the SCA concept. Going back
to the supersonic codes, the CSK modulation is combined with
the SCE and NME concepts, resulting in an authentication procedure performed in two stages: a first stage based on an encrypted
code, generated with a block cipher (i.e., SCE), and a second stage
exploiting a CSK modulation with encrypted and authenticated
data (i.e., NME). More details about these aspects can be found in
[32]. This sophisticated solution allows achieving rapid authentication performance with a good robustness against specific spoofing
attacks, at the price of a significant increase in the receiver cost and
complexity with respect to basic NMA or SCA approaches.
Given this context, it is already confirmed that at least a basic
authentication mechanism will be provided in the near future,
through Galileo OS NMA and CS SCE [46]. Additional measures such as SCA may be added to future civil signals themselves, potentially boosting even further the GNSS adoption in
specific safety-critical or liability-critical applications [2]. Future
concepts may even devote other full signals to SCE (e.g., a fully
encrypted component, as mentioned in [10]), avoiding any degradation to nonparticipating users.
To conclude this overview on cryptographic GNSS defenses,
remember the following:
■ No cryptographic approach is absolute protection against
all attacks.
■ Cryptographic design and implementation are specialized
subjects, and the navigation community must reach out to
the cryptographic community for assistance.
■ An essential part of determining the robustness of a cryptographic system is to submit it to the cryptography/security
community for attacks, as it is proven that openness is
much more effective than obfuscation.

Threat analysis: Robustness of NMA/SCA
against specific attacks
Each family of authentication approaches shows a specific level
of robustness against different GNSS threats. Relying on previous results available in the literature [3]-[9], Table 2 provides an
assessment over three qualitative levels (i.e., low, medium, and
high) of the robustness of NMA and SCA techniques against the
attacks listed in Table 1. The column related to the NMA has to
be interpreted as related to the intrinsic NMA robustness at the
receiver, without assuming any additional spoofing defense.
The analysis reported in Table 2 shows that, generally, the
SCA approach presents a higher level of robustness than NMA,
especially against SCER and FEA attacks. Nonetheless, in the
case an antireplay protection technique based on symbol unpredictability is integrated in the receiver (e.g., see [18], [22], and
[47]), the NMA robustness level would pass from the low to
medium level. Even with antireplay protection, from a spoofer
perspective, it is easier to perform a quasi-real-time estimation of
the NMA symbols, than that of the SCA chips, for which highgain antennas would be required.
Both NMA and SCA techniques are vulnerable to all types
of meaconing attacks. This vulnerability affects all cryptographic
defenses, including SCE and NME [3]. In fact, the direct protection of the time of arrival of the received signal (and the consequent
protection of the pseudorange computation) cannot be completely
ensured by using only cryptographic solutions implemented
on the SIS. The synergy of such solutions with receiver-based
Table 2. Robustness of the NMA and SCA against specific attacks.
Robustness of authentication
approaches

List of Meaconing and Spoofing
attacks

NMA

SCA

Meaconing

Meaconing with variable delay

Meaconing with modem

Simplistic spoofing-custom low
cost HW

Simplistic spoofing-commercial
HW simulator

Intermediate self-spoofing

Intermediate spoofing

Estimation and Replay

M/H

FEA

M/H

Meaconing with multiple
receiver antennas

Meaconing/spoofing with
multiple transceiver antennas

Meaconing/spoofing with
high-gain antennas

Nulling attack

Sophisticated spoofing

M/H

H: high, M: medium, L: low.

IEEE SIGNAL PROCESSING MAGAZINE

September 2017

Table of Contents for the Digital Edition of Signal Processing - September 2017