Efficient Detection of Galileo ACAS Sequences using E6-B Aiding

Galileo ACAS is an assisted mode of Commercial Authentication Service (CAS) designed to enhance robustness against malicious attacks like spoofing. It operates by providing information to about some fragments of the unknown PRN codes in the E6-C signal. Unlike other approaches, ACAS uniquely employs TESLA keys provided by OSNMA in the E1-B signal for decryption, avoiding the need for key storage in potentially compromised receivers.

The encrypted fragments are made available to the receivers before the broadcast of the E6-C signal, along with their broadcast time. However, if the receiver lacks an accurate time reference, searching for these fragments, which typically last for milliseconds with periodicity that could extend to several seconds, can become impractical. In such cases, the probability of detection would be severely diminished due to the excessively large search space that ensues.

In the nominal operating mode for ACAS, this issue is resolved by obtaining initial estimates for the code phase delay and Doppler frequency from the E1-B signal. These estimates are then used to narrow down the search space for the E6-C signal. However, the alignment between the two signals is not perfect, particularly due to the intrinsic inter-frequency biases they exhibit.

To mitigate this issue, we can leverage auxiliary signals like E6-B, processed by HAS-compatible receivers. This is a logical choice as E6-B shares the same carrier frequency as E6-C. This could help in obtaining more precise estimates of the location of the encrypted fragments and improving the probability of detection, resulting in enhanced robustness for the ACAS authentication process.

This paper presents a comparison of uncertainties associated to the use of the E1-B and E6-B signals, based on real data samples obtained with an ACAS evaluation SDR-based platform. The results show the benefits of including E6-B in ACAS processing, with minimal implementation cost.