Jonathan M Histon
email: jhiston@mit.edu

Guillaume Aigoin
email: aigoin@recherche.enac.fr

John Hansman

Stéphane Puechmorel
email: puechmor@recherche.enac.fr

Daniel Delahaye
email: delahaye@recherche.enac.fr

Introducing Structural Considerations into Complexity Metrics

Field observations and focused interviews of Air Traffic Controllers have been used to generate a list of key complexity factors in Air Traffic Control.

The underlying structure of the airspace was identified as relevant in many of the factors.

A preliminary investigation has revealed that the structure appears to form the basis for abstractions that reduce the difficulty of maintaining Situational Awareness, particularly the projection of future traffic situations.

Three examples of such abstractions were identified: standard flows, groupings, and critical points. Preliminary approaches to developing metrics including these structural considerations are discussed.

Introduction

In the face of the continued increase in demand for Air Traffic Control (ATC) services, there is a clear need for a better understanding of the capacity of airspace. At present, sector capacity is normally expressed as a maximum instantaneous number of aircraft in a sector. However, anecdotal evidence and direct observations suggest that this maximum capacity level varies between sectors and varies with different traffic situations.

In this paper it is assumed that complexity is related to the cognitive difficulty of controlling the air traffic situation, which in turn is tied to the ability of controllers to maintain safe operations under normal and abnormal conditions. The objective is to understand those factors that influence complexity, particularly those factors which relate to the underlying structural elements in ATC. Various structural elements and the mechanisms by which they reduce complexity have been identified. Including their effects in complexity metrics is an important step towards developing useful measures of complexity in ATC.

Improved measures of ATC complexity would find many applications including: airspace design, airspace slot allocation and traffic flow management. Specifically, such measures can be used to compare the effectiveness of different airspace structures, and/or to evaluate new air traffic management concepts.

Previous Work on ATC Complexity

Significant research interest in the concept of ATC complexity was generated by the "Free Flight" operational concept. Integral to Free Flight was the notion of dynamic density. Conceptually, dynamic density is a measure of ATC complexity that would be used to define situations that were so complex that centralized control was required [START_REF]Final Report of RTCA Task Force 3: Free Flight Implementation[END_REF].

Efforts to define "dynamic density" have identified the importance of a wide range of potential complexity factors, including structural considerations. However, the proposed complexity metrics have typically concentrated on only those factors that can be easily elicited from the geometry of an ATC situation [START_REF] Delahaye | Air Traffic Complexity: Towards Intrinsic Metrics, 3 rd USA/Europe[END_REF], [START_REF] Laudeman | Dynamic Density: An Air Traffic Management Metric[END_REF], [START_REF] Sridhar | Airspace Complexity and its Application in Air Traffic Management, 2 nd USA/Europe Air Traffic Management R&D Seminar[END_REF], [START_REF] Inc | An Evaluation of Air Traffic Control Complexity[END_REF]. Examples of such geometric factors include aircraft densities, the proportion of aircraft maneuvering and encounter probabilities.

A few previous studies have attempted to include structural considerations in complexity metrics, but have done so only to a restricted degree.

The Wyndemere Corporation proposed a metric that included one term that was based on the relationship between aircraft headings and a dominant geometric axis in a sector [START_REF] Inc | An Evaluation of Air Traffic Control Complexity[END_REF]. Including structural considerations has also been identified in recent work at Eurocontrol. In a study to identify complexity factors using expert judgment analysis, "Airspace Design" was identified as the second most important factor behind traffic volume [START_REF] Kirwan | Investigating Complexity Factors in U[END_REF].

Methodology

In order to investigate the relationship between structure and cognitive complexity, a series of site visits to ATC facilities in the United States, Canada and France were conducted. The site visits included both enroute and terminal area control centers.

The site visits consisted of focused interviews with current controllers and observations of live operations.

To understand how complexity is regulated through traffic management initiatives, discussions were held with members of Traffic Management Units (TMU). Training personnel were interviewed to determine the importance of structure in the job training process.

Additionally, representative traffic patterns were captured using a commercial software product that provides a real-time feed of the Enhanced Traffic Management System (ETMS) data-stream. 1 This tool allows visualization of structural elements in the current system. It has also been used to generate illustrations of the use of that structure to reduce complexity.

Key Complexity Factors

Based on the field observations, ETMS data analysis, and a review of the pertinent literature, a list of the key factors influencing cognitive complexity was developed and is presented in Table 1 One important observation from the field studies is shown in Figure 1. A distinction was identified between the physical dimensions of a sector, the "Area of Responsibility," and the "Area of Regard" over which a controller's attention was focused. Events occurring near or outside the boundaries of a controller's sector are important for decisions about aircraft within the current sector.

In the field observations, controllers often spent as much attention on incoming aircraft and their impact on the sector than on active aircraft in their sector.

Generalized Model of Complexity and Structure

Based on the field observations and analysis, structure appears to be used as the basis for abstractions that simplify the control process for controllers.

Figure 2 shows a generalized model of how structure appears to influence the control process.

The underlying structure, which influences the traffic situation can, if recognized, act as the basis for a set of abstractions internal to the controller that can simplify the task of predicting the future behavior of the traffic. The abstractions are thought to support the controller's situational awareness at each of the three levels identified by Endsley: perception, comprehension, and projection [START_REF] Endsley | Situational Awareness Requirements for En-route Air Traffic Control[END_REF]. The controller's ability to correctly project future traffic situations is essential to the decision making process. The key structure-based abstractions that have been identified each simplify the task of projecting future states of the traffic situation.

Several mechanisms have been identified. One such mechanism is the consolidation of the information required to project an aircraft's future path. Structure-based abstractions also simplify the task of identifying traffic conflicts by eliminating some potential interactions or by identifying areas of traffic focus. This limits the number of spatial locations at which interactions are likely to occur and eases the monitoring task.

It is hypothesized that controllers also use structure-based abstractions to simplify the decision process, and to reduce the complexity associated with the implementation of control actions.

However, the remainder of this paper will focus on examples of structure-based abstractions reducing the cognitive difficulty associated with projecting future traffic situations.

Examples of Structure-Based Complexity Reduction Mechanisms

This preliminary investigation has identified three key structure-based abstractions that appear to reduce cognitive complexity in ATC. The key abstractions are:

• Standard Flows • Groupings • Critical Points
Each abstraction is described briefly below.

Standard Flows

Standard flows appear to be the most important structure-based abstraction used by controllers. There appear to be two structural bases that establish standard flows:

• Explicit structural elements • Standardized operations
The first type of standard flow is based on explicit structural elements in the airspace system such as navigational aids, airways, and standardized procedures. An example of this type of flow is an arrival stream, as shown in Figure 3 for arrivals into Chicago from the East. The second type of standard flow emerges as a result of common practices, or standardized but unpublished patterns of operation. An example is the typical "trombone" vectoring sequence used to merge aircraft onto final approach.

An aircraft identified as a member of a flow carries with it an associated set of higher-level attributes such as expected future routing, ingress and egress points from the airspace, and locations of probable encounters. These attributes form a generalized expectation of an aircraft's trajectory through the airspace.

The standard flow abstraction emerges as a means of classifying aircraft into standard and non-standard classes on the basis of their membership in established flow patterns in a sector (see Figure 4). The task of projecting the future behavior of an aircraft that belongs to a standard flow is greatly simplified by the generalized expectation of its trajectory. In contrast, aircraft that are operating in ways that do not fall into the normal operating pattern, such as the "special case" aircraft in Figure 4, do not provide the same simplifications. The standard flow abstraction accounts for the contextual nature of ATC. Snapshots of the instantaneous traffic situation do not capture all of the information that is available and used by controllers to understand and project the current traffic situation. Multiple aircraft do not need to be in the airspace to constitute a flow. Even if there is only a single aircraft currently following the flow path, the standard flow abstraction is still available.

Groupings

The presence of an underlying structure in a piece of airspace provides the basis for creating groups of aircraft linked by common properties. This type of abstraction can take advantage of properties that are known to segregate a traffic situation into non-or minimallyinteracting groups. 2 Consequently, the aircraft groups can be independently projected, reducing the cognitive complexity.

One simple example of a grouping abstraction is the standard flight levels that associate directions of travel with particular flight levels.

This allows controllers to manage each flight level independently with vertically transitioning aircraft representing special cases.

As reported in Table 1, controllers have consistently reported altitude transitions as a key complexity factor [START_REF] Laudeman | Dynamic Density: An Air Traffic Management Metric[END_REF], [START_REF] Sridhar | Airspace Complexity and its Application in Air Traffic Management, 2 nd USA/Europe Air Traffic Management R&D Seminar[END_REF], [START_REF] Inc | An Evaluation of Air Traffic Control Complexity[END_REF], [START_REF] Kirwan | Investigating Complexity Factors in U[END_REF]. Aircraft that are transitioning between flight levels do not fit into the grouping abstraction, preventing a controller from projecting flight levels independently.

Grouping abstractions also explain an interesting result from the list of complexity factors in Table 1. Ranges of aircraft performance were identified as key factors influencing complexity. If aircraft performance was uniform, grouping abstractions could be used to simplify the projection task. For example, a wide distribution of aircraft speeds makes the process of projecting future positions more difficult than the case where all aircraft are flying at a uniform speed.

The grouping abstraction can also operate on the basis of the simple proximity of aircraft. Multiple examples of aircraft diverting as groups around convective weather have been observed. For example Figure 5 shows three distinct clusters of aircraft deviating as groups around convective activity.

Critical Points

Critical points are an additional example of a structure-based abstraction that simplifies the projection task.

The underlying structure, in the form of crossing and merge points of flows, will tend to concentrate the occurrences of encounters at common locations.

A "critical point" abstraction can be formed from the standard responses to such encounters at the spatial locations.

Concentrating the location of aircraft encounters at a finite set of spatially localized points simplifies the analysis of a traffic situation. The dimensions of the spatial region that must be searched are reduced to a limited set of points. In forming projections, a controller's attention can be focused on a finite number of critical locations, simplifying the task.

Additionally, the typical responses associated with each critical point reduce the amount of cognitive effort that must be expended in evaluating encounters at the point.

For example, the interaction between two aircraft approaching a merge point is reduced to a temporal or phasing problem. The same encounter geometry in the absence of a known critical point abstraction may require consideration of multiple dimensions, making the projection task more difficult. An example of a localized critical point is the merge point in an arrival stream. This can be seen in Figure 6, which shows the arrival flows into Chicago on May 3, 2001 at 9:00 p.m. The figure indicates that the merges occur at relatively well-defined spatial locations.

Robustness of Structure-Based Abstractions to Off-Nominal Conditions

Each of the structure-based abstractions identified above reduces cognitive complexity by simplifying the task of projecting future traffic situations. In general, abstractions take advantage of expectations created during operations under normal conditions.

However, controllers must be able to guarantee safe operation of the system under both normal and abnormal conditions. The robustness of an abstraction will determine how effective that abstraction can be as a traffic system deviates from nominal conditions.

Structure-based abstractions can continue to function under some degree of system perturbation. For example, a standard flow abstraction may tolerate a localized disturbance in the flow trajectory, such as a deviation around an isolated area of convective weather. However, disturbances may become so large that the underlying structure can no longer be used to support the standard flow abstraction. Under such conditions, the cognitive complexity will increase dramatically; controllers sometimes report this as a fear of losing "the picture."

Including Structure-based Abstractions in Complexity Metrics

The identified structure-based abstractions motivate a variety of mathematical representations of cognitive difficulty. Three preliminary approaches to including structural considerations have been developed.

Although none of the approaches have been fully developed, they represent examples of how structural considerations may be accounted for in metrics of cognitive complexity.

Explicit inclusion of Structural Elements

Given validated models of how structural elements influence complexity, they could be explicitly included in a metric. If, for example, critical points were identified as being a key part of a mechanism, then it would be possible to include an explicit term in a complexity metric based on the number of merge points in a sector. Such an approach is dependent on developing a prior understanding of the relative effects of the structure.

The standard flow abstraction identified above suggests that the cognitive difficulty of handling an aircraft that is on a standard flow is reduced compared with a non-standard aircraft.

Within a complexity metric, aircraft can be classified as standard or non-standard based on a comparison between their position, velocity, and destination and a known set of standard flows for the sector.

Situational Measures of Complexity: Cluster Approach

The grouping abstraction motivates a second approach to a complexity metric. Delahaye and Puechmorel introduced three geometrical metrics: proximity, convergence and insensitivity, which aim to capture respectively the level of aggregation of aircraft, the convergences in sectors and the difficulty in solving the induced conflicts [START_REF] Delahaye | Air Traffic Complexity: Towards Intrinsic Metrics, 3 rd USA/Europe[END_REF]. G. Aigoin has extended and refined these concepts using a cluster-based analysis [START_REF] Aigoin | Air Traffic Complexity Modeling[END_REF].

Two aircraft are said to be in the same cluster if the product of their relative speed and their proximity (a function of the inverse of the relative distance) is above a threshold. For each cluster, a matrix of relative dependence between aircraft is computed and the whole complexity of the cluster is then given by a weighted sum of some matrix norm. Those norms give an aggregated measure of the level of proximity of aircraft in clusters and the associated convergence with the relative speed. From the cluster matrix it is also possible to compute the difficulty of the cluster. The difficulty captures how hard it is to solve this cluster.

Multiple clusters can exist within a sector, and their interactions must also be taken into account (see Figure 7). A measure of this interaction has been proposed by G.

Aigoin [START_REF] Aigoin | Air Traffic Complexity Modeling[END_REF]. This technique allows multiple metrics of complexity to be developed such as average cluster complexity, maximum and minimum cluster complexities, and complexity speeds.

Kolmogorov Entropy Metrics: Structure Through Trajectory Disorder

Where the previous approach used clusters to parse aircraft states, an alternative mathematical representation has been developed based on measures of disorder of aircraft trajectories.

The use of standard flows points to the importance of the distribution of aircraft trajectories within a sector. Specifically, measures of the disorder of trajectories in a sector will reflect the degree to which standard flows are being used and hence provide a proxy estimate of the cognitive difficulty In generating such measures, the classical probabilistic entropy is not relevant because the number of aircraft in a sector is too small to give accurate estimates of the associated statistic.

However, topologic entropy (Kolmogorov entropy) is adapted to capture this disorder and works on the shape of trajectories.

The control sector is considered as a dynamical system for which the state space is the 3D geometrical space in which aircraft are flying. A 3D state space dynamical system cannot model the aircraft route because of ambiguity introduced by the presence of crossing aircraft trajectories. To circumvent such a limitation the state space has been extended to the fourth dimension (x,y,z,t) and locally to the fifth dimension in order to produce artificial trajectories without crossing. This local increasing of the dimension is needed only when a conflict appear and will be used to increase the associated complexity in the sector.

The results from dynamical system theory can be applied to this model. The metric works on trajectories themselves and not only on the associated speed vectors. Therefore, it uses the full evolution of aircraft in the past and can capture the intent information associated with a flight plan provided to the model. For a given time window (this window is a parameter given to the model), the Kolmogorov Entropy is computed for each time step belonging to this window.

If the necessary intent information is not available the model will do a linear extension of trajectories.

When the predictor is linear, the traffic is assumed to be routed on direct routes. From this direct routing the "natural" complexity of the demand without any action of the air traffic system can be observed. This approach can be used to estimate the impact of the geographical/temporal distribution of the demand on the complexity.

Conclusions

Understanding cognitive complexity is an important component of ensuring safe and efficient use of airspace.

Based on complexity factors reported by controllers, structure appears to form the basis for abstractions that reduce the difficulty of maintaining situational awareness.

In this preliminary study, three key abstractions have been identified:

• Standard Flows • Groupings • Critical Points
These structure-based abstractions appear to play important roles in reducing the difficulty of projecting the future behavior of traffic situations. Not including the underlying structural elements on which these abstractions are based may artificially inflate the outputs of any cognitive complexity metrics. Three preliminary approaches to including structural considerations in complexity metrics have been discussed.

Figure 1 .

 1 Figure 1. Dashed line demonstrates how the "Area of Regard" extends beyond the physical boundaries of Sector A.

Figure 2 .

 2 Figure 2. Proposed model illustrating how structure forms the basis for abstractions that influence Situational Awareness. (Adapted from [7]).

Figure 3 .

 3 Figure 3. Example of standard arrival flows into O'Hare airport in Chicago.

Figure 4 .

 4 Figure 4. Standard flows form the basis for a structure-based abstraction, which distinguishes between standard and nonstandard aircraft.

Figure 5 .

 5 Figure 5. Example of clusters of aircraft following common paths while diverting around convective weather.

Figure 6 .

 6 Figure 6. White dots are examples of critical points in the standard arrival flows into O'Hare airport in Chicago.

Figure 7 .

 7 Figure 7. A cluster based analysis considers both intra and inter cluster complexities.

Table 1 .

 1 Key factors reported by controllers as influencing cognitive complexity. Items marked with a * are related to structural elements.

	.

* Traffic management restrictions (e.g. miles-in-trail requirements) Communication limitations

It must be cautioned that the ETMS data was filtered by the provider to remove military and other potentially sensitive aircraft, and thus may under represent the real traffic situation.

"Interactions" are not limited to solely aircraft-aircraft encounters, but can also include aircraft-airspace and aircraft-weather etc.

R. John Hansman has been on the faculty of the Department of Aeronautics & Astronautics at MIT since 1982. He obtained his A.B. in Physics from Cornell University in 1976, his S.M. in Physics in 1980 and his Ph.D. in Physics, Meteorology, Aeronautics & Astronautics and Electrical Engineering from MIT in 1982. He is the Head of the Humans and Automation Division, the Director of the International Center for Air Transportation and of the Aeronautical Systems Laboratory at MIT. He conducts research in several areas related to flight vehicle operations and aviation safety. His current research activities focus on advanced cockpit information systems, including Flight Management Systems, air-ground datalink, electronic charting, advanced alerting systems, and flight crew situational awareness, cockpit human factors and information management.

Stephane Puechmorel is a research associate at the Math department of the Enac school. He graduated from the Polytechnique school and obtained his master degree in signal processing in 1990 and his Ph.D in pure math in 1992 from the national polytechnic institute of Toulouse. He conducts research on algebraic topology and infers new models for air traffic complexity.

Author Biographies


Simón Cancela
email: scancela@gmv.com

Javier Navarro

David Calle

Eckart Göhler

Andrea Dalla Chiara

Giacomo Da Broi

Ignacio Fernández-Hernández

Gonzalo Seco-Granados

Javier Simon

Gmv E Göhler

Ifen A Dalla Chiara

G Da

Broi Qascom

Simón Biographies

Cancela

Andrea Dalla Chiara

Eckart Göhler

Testing receiver resilience against signal replay attacks

la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Ignacio Fernández-Hernández is the Galileo service definition coordinator at the European Commission, DG ENTR. He is an ICAI engineer, holds an MBA by LBS and a PhD in electronic systems by Aalborg University.

Gonzalo Seco-Granados is associate professor with the Dept of Telecom. Eng. of Univ. Autónoma de Barcelona (UAB) and head of the Signal Processing for Navigation and Communications (SPCOMNAV) group. Previoulsy, he was staff member at the Radionavigation Section in ESTEC/ESA, and involved in the Galileo project and in the development of GNSS receivers and applications. Javier Simon is Service Design Engineer within the European GNSS Agency, currently contributing to the definition and design of the Galileo OSNMA and CS services. He holds a MSc. degree in Telecommunications Engineering from the Polytechnic University of Madrid, Spain. Before joining GSA he participated in several projects for the study and design of future GNSS algorithms and systems

ABSTRACT

The Galileo program is implementing enhancements with respect to standard GNSS services. Some of these enhancements relate to complementing the Galileo Open Service with Navigation Message Authentication (NMA) and providing signal authentication through the Commercial Service. These new features will improve resilience of the GNSS applications and reduce the likelihood of successful attacks to GNSS users. However, these upcoming Galileo services still require a step to be completed on the user side: the definition and implementation of algorithms to successfully exploit them. In this context, the European Commission launched the Navigation Authentication through Commercial Service-Enhanced Terminals (NACSET) project aiming at investigating and implementing techniques to detect and mitigate spoofing attacks, improving user-level resilience.

As part of the NACSET project, a resilient user terminal has been developed based on a high-end multi-GNSS receiver. This GNSS receiver is complemented with International Technical Symposium on Navigation and Timing (ITSNT) 2018 13-16 Nov 2018 ENAC, Toulouse, France a software module that implements several protection techniques that exploit Galileo authentication. This module includes standalone techniques such as direction of arrival estimation, clock monitoring, IMU hybridization, AGC-C/N0 monitoring, a navigation message authentication (NMA) module and an anti-replay technique based on the use of NMA unpredictable symbols.

This paper focuses on the proposed anti-replay technique. While plenty of literature is already available on GNSS spoofing and replay attacks [START_REF] Caparra | Improving secure code estimatereplay attacks and their detection on gnss signals[END_REF] [START_REF] Fernández-Hernández | Galileo NMA Signal Unpredictability and Anti-Replay Protection[END_REF] , most of the research available is based theoretical models and simulations. The paper details a hardware and software implementation of anti-replay capabilities in a real highend receiver in order to complement the existing work. The implementation is then tested in real time against a simulated attack implemented explicitly for the technique validation. Results and conclusions are derived and presented.

INTRODUCTION

This section introduces the NACSET project and the platform architecture [Figure 1]. The NACSET project's main objective is to develop a resilient User Terminal able to implement and combine a wide range of anti-spoofing algorithms which can benefit from Galileo authentication services, including Commercial Service authentication and Open Service NMA. These capabilities are complemented with specific equipment such as IMUs, barometers and high-performance clocks to support standalone spoofing detection techniques. In order to provide the PVT resilience thanks to assisted authentication, the project includes a Synchronization and Authentication Server (SAS). This module is the responsible for providing assisted navigation and signal authentication capabilities to the User Terminal as well as accurate time synchronization. For the distribution of the cryptographic information, such as the Commercial Service keys and OSNMA information, a dedicated Key Management Simulator is also developed to emulate all the required interfaces.

This paper is mainly focused on the anti-replay technique, implemented in the User Terminal. This technique provides protection against zero-delay SCER attacks based on the use of NMA unpredictable symbols [START_REF] Fernández-Hernández | Galileo NMA Signal Unpredictability and Anti-Replay Protection[END_REF] . Throughout the paper first, it is described the NACSET platform architecture, with special detail on the NACSET receiver (User Terminal). Then, it describes the anti-replay technique implemented in the receiver. Later, it explains how Security Code Estimate-Replay (SCER) attacks are simulated in the NACSET test environment. Finally, the results of a set of validation tests are presented exercising different configurations of the SCER attacks against the developed receiver and a COTS one in order to evaluate the effectiveness of the proposed anti-replay technique in the detection process. The base band processing supports the complete Galileo spectrum including OS E1 CBOC, E6-B/C and E5 AltBOC, GPS L1 (including TMBOC), L2 (semi-codeless P(Y), L2C) and L5, SBAS L1 and L5, BeiDou and GLONASS G1 and G2. In addition, the GNSS antenna is a two antenna array with the specifications described in Table 1. The two antenna are placed at 94 mm distance inside the radome protective case as shown in Figure 4.

Software Module

The GNSS receiver is commanded and complemented by a software module installed in a standard laptop and physically connected to the hardware receiver. The software module is in charge of implementing a portfolio of anti-spoofing measures and includes a PVT module able to compute a trustable position with the protection techniques outcomes. The receiver module processes the data from the Signal-In-Space and forwards the GNSS observations and navigation along with the E1B signal samples for the software module to process.

The anti-spoofing and authentication techniques implemented are listed below:  Anti-replay protection  Dual-antenna measures analysis  IMUs Hybridization  Clock Monitoring  AGC-C/N0 Monitoring  Galileo Open Service Navigation Message Authentication (see [START_REF] Fernández-Hernández | A navigation message authentication proposal for the galileo open service[END_REF])  Assisted signal authentication on Galileo E6

(see [START_REF] Cancela | Designing and evaluating next generation of resilience receivers[END_REF] )

Next sections provides the implementation details and early results of the anti-replay protection technique developed within the NACSET user terminal.

ANTIREPLAY PROTECTION

If a GNSS signal stream contains data that is authenticated, a spoofer can only alter the pseudorange measurements to spoof the receiver position. This attack falls under the category of signal replay attacks. In order to protect pseudoranges from replay attacks, the pseudoranges can include authentication features. Ideally, these authentication features can be implemented at spreading-code level. However, if the data modulated includes unpredictable symbols, this unpredictability can be also exploited against replay attacks. One of the novel features of the User Terminal is the inclusion of anti-replay protection measures based on the unpredictability bits of NMA data present on a GNSS signal, as introduced in [START_REF] Fernández-Hernández | Galileo NMA Signal Unpredictability and Anti-Replay Protection[END_REF] .

Anti-replay solutions can address zero-delay SCER (Security Code estimation and replay) attacks. To execute this attack an attacker estimates and rebroadcasts the original signal with a zero or almost negligible delay, taking control of the tracking loop and gradually modifying the signal. The NACSET terminal implements a method that takes advantage of the existence of unpredictable bits and symbols in the navigation thanks to NMA cryptographic information provided through the SIS. In order to conduct a zero-delay SCER attack on a signal containing NMA data, the attacker shall predict the unknown symbols with minimal or none information. The technique is based on the analysis of the signal correlation loss caused by the imperfect estimation of the signal chips corresponding to the mentioned unpredictable symbols.

The first step is to verify that the satellite data is authentic, as well as the correctness of the unpredictable symbols used for the anti-replay check, this is performed through the NMA verification. The NMA solution used for this implementation is the Galileo Open Service NMA (OSNMA) defined to be included in the I/NAV data that is transmitted through the in Galileo E1-B. The Galileo I/NAV is transmitted in the signals E1 (1575.42 MHz) and E5b (1207.14 MHz). NMA is currently designed for the E1-B (data) component. Satellites transmit a navigation frame every 750 seconds, composed by 25 subframes of 30 seconds duration each. Every subframe is divided into fifteen 2-second pages, each of which contains one word and some other fields [START_REF]The European Union, European GNSS (Galileo) Open Service Signal In Space Interface Control Document[END_REF] . The I/NAV effective bit rate is 120 bps. The I/NAV message bits are convolutionally International Technical Symposium on Navigation and Timing (ITSNT) 2018 13-16 Nov 2018 ENAC, Toulouse, France encoded and interleaved into two symbols for each bit, to which a 10-symbols pattern is added for page synchronization. This sums to a rate of 250 symbols per second. This makes 4092 signal chips per symbol as the Ranging Code Chip-Rate of the E1-B signal is 1023 MChips per second. The convolutional encoding shall be carefully considered for the definition of unpredictable symbols. Every page has a 40-bit field, which is proposed to be used for the transmission of the OSNMA data as described in [START_REF] Fernández-Hernández | A navigation message authentication proposal for the galileo open service[END_REF]. This OSNMA data includes cryptographic material, such as pseudorandom generated keys which makes part of the I/NAV data unpredictable and thus, subject to be used for the anti-replay protection.

As opposed to a standard receiver, which performs a continuous signal correlation, different subsets of chips can be selected in the NACSET receiver for the correlation process. The purpose of this feature is to perform specific correlations on, or including, parts of the signal that are considered unpredictable. These subsets may be chosen according to different criteria: fixed subsets, random subsets or based on a statistical analysis. Finally, the correlation values are analyzed to check whether the signal is authentic or not. These correlation values will depend on the number of chips stored per symbol and the power of the signal. This implementation allows performing statistical analysis to optimize the false alarms and missed detection probabilities for different applications and environments.

Figure 5 -Anti-replay processing schema

In the following sections, these three main processes implementation will be explained thoroughly.

OSNMA UNPREDICTABLE SYMBOLS

As it is mentioned before, the aim of the technique is to exploit the unpredictability of the cryptographic data included in an NMA scheme, as proposed e.g. in [START_REF] Wesson | Practical cryptographic civil GPS signal authentication[END_REF]. The Galileo OSNMA data is sent inside the I/NAV pages in batches of 40 bits. The OSNMA protocol consists of transmitting two types of data, Digital Signature Messages (DSMs) and Message Authentication Codes (MACs) with a private key (see [START_REF] Fernández-Hernández | A navigation message authentication proposal for the galileo open service[END_REF]). The DSM is repeated over time so it cannot be considered unpredictable, and it is transmitted using 8 of the previously mentioned 40 bits of the I/NAV page. Hence, at most, only the MACs and the keys can be considered fully unpredictable, i.e. 32 symbols per I/NAV page, and they may not be homogenously distributed in all the I/NAV pages. Other consideration may be taken into account to protect from brute force attack in the last bits of the MACs and keys as explained in [START_REF] Fernández-Hernández | Galileo NMA Signal Unpredictability and Anti-Replay Protection[END_REF] . The unpredictable bits available thanks to the OSNMA scheme have been analyzed in different publications (see [START_REF] Fernández-Hernández | Galileo NMA Signal Unpredictability and Anti-Replay Protection[END_REF] and [START_REF] Curran | Message Authentication, Channel Coding & Anti-Spoong[END_REF] ) with similar results than the ones obtained in the analysis herein conducted. Next figures are taken from [START_REF] Fernández-Hernández | Galileo NMA Signal Unpredictability and Anti-Replay Protection[END_REF] and depict the position of the unpredictable symbols in green, assuming 32 unpredictable bits per I/NAV page, which is the assumption taken for this work. Note also that the unpredictability in the I/NAV CRC, which is computed on the NMA bits, varies the position of the unpredictable symbols with respect to the below figures, although this does not alter the paper conclusions.

Figure 6 -I/NAV unpredictable symbols before interleaving

The position of the symbols inside the I/NAV page is also necessary to be determined in order to store the samples to be analyzed. For this, the Galileo I/NAV encoding and interleaving has to be considered. As explained before the I/NAV page is encoded in 240 symbols which then are interleaved with a block interleaver with dimensions of 30 columns x 8 rows.

Figure 7 -I/NAV unpredictable symbols after interleaving

For the UT implementation the number and position of the unpredictable bits can be configured to test different OSNMA configuration and security assumptions.

ANTI-REPLAY IMPLEMENTATION

Throughout this section the actual implementation of the theoretical technique described in section 3 will be presented. The anti-replay technique as presented earlier is a software program external to the hardware receiver that processes its data to implement the proposed protection technique.

The hardware receiver processes the GNSS signals and provides a continuous stream of E1B signal samples to the International Technical Symposium on Navigation and Timing (ITSNT) 2018 13-16 Nov 2018 ENAC, Toulouse, France receiver. The receiver also generates the Doppler values for the satellites in view for the technique.

The anti-replay module has to process the E1B signal samples in order to compute the needed correlations. The first step is to execute the acquisition process. In order to speed up the acquisition process and symbol decoding, the Doppler values from the receiver are used. The module starts processing the received samples data as soon as the PRN of the satellites in view and their respective Doppler values are provided from the receiver.

As the sample stream is not provided synchronized to the symbol, the module needs to compute the beginning of each symbol inside the stream. For this, the symbol code offset (𝑠𝑐𝑜), a number between 0 and 4092, gives us the information of when a new symbol starts in the samples stream. The computation process requires several milliseconds of data to ensure a proper processing. As Figure 8 shows, the beginning of the samples does not have to coincide with the beginning of a symbol. In most of the cases, the receiver starts to sample after the beginning of a symbol. The number of samples of the first chip (𝑛 1 ) is lower than the number of samples of the second chip (𝑛 2 ) because the second symbol is completely sampled.

Figure 8 -Signal sampled

If the sampling frequency (𝑓𝑠) is not proportional to the E1b code chip (1,023 MHz), the number of samples of some symbols will be different. If the 𝑠𝑐𝑜 is lower than half Galileo E1b code length (4092/2) the number of samples of each symbol (𝑛) is modelled as

𝑛 = ⌊𝑓𝑠 * 𝑡𝑠 𝑒1𝑏 (𝑐𝑙 𝑒1𝑏 -𝑠𝑐𝑜) 𝑐𝑙 𝑒1𝑏 ⌋
where 𝑛 is the number of samples to seek to the beginning of the symbol, 𝑓𝑠 is the sampling frequency, 𝑡𝑠 𝑒1𝑏 is the time of symbol (in Galileo E1b is 0.004 seconds), 𝑐𝑙 𝑒1𝑏 is the code length (in Galileo E1b is 4092), and 𝑠𝑐𝑜 is the symbol code offset. But if 𝑠𝑐𝑜 is equal or higher than half Galileo E1b code length, 𝑛 is modelled as

𝑛 = ⌊𝑓𝑠 * 𝑡𝑠 𝑒1𝑏 (2 * 𝑐𝑙 𝑒1𝑏 -𝑠𝑐𝑜) 𝑐𝑙 𝑒1𝑏 ⌋
As explained in the previous section, in order to detect the zero-delay SCER attacks, the antireplay method stores 𝑁 𝑐 chips (in samples) of the 𝑁 𝑈 unpredictable symbols over a given interval. To find the chips related only to the unpredictable symbols, a tracking process is carried out. The module decodes the I/NAV symbols and aligns to page level searching for the I/NAV page synchronization pattern. Then the antireplay solution, which knows the value of the unpredictable symbol, select a subset of chips from the symbol and correlates the chips with the public spreading code of each satellite. It is likely that the SCER attacker estimates wrongly the first chips of each unpredictable symbol, therefore, these are the most appropriate chips to consider against this type of attacks. In the implemented solution, two different processing modes are supported for the chip selection: fixed and random selection. The fixed selection mode extracts the chips at the beginning of each symbol, and random mode extracts it randomly through the whole unpredictable symbol. The results reported are based on the fixed selection mode. The number of chips per symbol to be used are also configurable.

The correlation values are stored for a twofold purpose: First, to check the possible loss of correlation gain produced by a spoofer and update the thresholds for the correlation values checks. Therefore, the correlations of each unpredictable symbol are accumulated and, as a result, we obtain the correlation of each independent 2second page. The other purpose of storing the correlation values is to generate statistics to detect when an unusual correlation loss has occurred. When the technique is enabled, the first 30 seconds are stored in a correlation window to calculate a mean correlation value. This mean correlation is updated with a sliding window every 2 seconds. The computed value is used to establish an expected value to be compared with the new correlation computed. A logical threshold difference between them is defined taking into account the probabilities of false alarm (𝐹𝐴) and missed detection (𝑀𝐷), with threshold configuration. This threshold and reference values are used to give a warning if the correlation gain is too low. The technique will raise a warning to the user in case the correlation checks are not met. These checks are performed when the unpredictable symbols subject to analysis are validated, i.e. the OSNMA verification result successful.

The sample processing technique is summarized as follows: after correct initialization, the module starts processing the signal samples and performing required correlations nominally. The generated correlation values are internally stored waiting for navigation authentication messages and events. Once the data is authenticated by the OSNMA protocol, the signal-level checks are executed, raising an alarm whether a correlation loss is observed in the chips analyzed.

SCER ATTACK SIMULATION

In order to demonstrate the functionality of the antireplay technique, a SCER attack simulator has been developed. Considering the current status of the Galileo Services, which do not provide the OSNMA service through the SIS yet, the signal containing the OSNMA symbols has to be simulated. For this purpose, a tool able to generate both trusted and spoofed signals to simulate the attack has been implemented. The tool consists of two elements: a software module and the HackRF softwaredefined radio (SDR) platform.

International Technical Symposium on Navigation and Timing (ITSNT) 2018 13-16 Nov 2018 ENAC, Toulouse, France

The HackRF One from Great Scott Gadgets is a Software Defined Radio peripheral capable of transmission or reception of radio signals from 1 MHz to 6 GHz. It is an open source hardware platform that can be used as a USB peripheral or programmed for stand-alone operation, and its output format is 8-bit quadrature samples (8-bit I and 8bit Q). The HackRF is needed to convert to RF the GNSS baseband signal data streams generated and replay it with the antenna. The signal generated is a simulated GNSS signal in clear open sky conditions. The software produces the signal with three specific inputs:

 Navigation RINEX for GNSS system status simulation  User position in NMEA format, either kinematic or static  OSNMA data  SCER attack configuration, mainly errors introduced in the chips and time-to-start the attack.

The OSNMA data is generated by means of the Commercial Service Demonstrator (CSDemo) platform developed in the frame of the AALECS, project managed by the European Commission (see [START_REF] Sarto | Implementation and testing of OSNMA for Galileo[END_REF])

It is important to highlight that a Zero-delay SCER attack tries to estimate and rebroadcast a GNSS signal with the intention to force the receiver to lock to it instead of the original signal. Before the attack starts, we assume that the genuine signal is being tracked by the receiver. The attacker is steadily transmitting a signal with zero-delay, or a delay that is so close to zero that it does not represent any difference in the symbol detection process. The spoofer generates the security code wk estimating each successive security chip, and immediately injecting it into a signal replica. The resulting signal is modelled as

𝑠̂𝑘 = 𝑤 ̂𝑘𝑐(𝜏̂𝑘)𝑐𝑜𝑠 (2𝜋𝑓 𝐼𝐹 𝑡 𝑘 + 𝜃 ̂𝑘)

where 𝑤 ̂𝑘 is the security code estimate, 𝑐 is the known spreding code array and 𝑐(𝜏̂𝑘) is the spreading code value at the code offset estimate 𝜏̂𝑘, 𝑓 𝐼𝐹 is the intermediate frequency after receiver front-end down-conversion, 𝜃 ̂𝑘 is the carrier phase estimate, and 𝑡 𝑘 is time, all evaluated at samples index 𝑘. Zero-delay attacks force the attacker to estimate the symbols in a short time, and the presence of unpredictable symbols makes this task more difficult and causes an imperfect estimation of the symbols. The antireplay technique looks at that imperfect estimations of unpredictable symbols demodulated by the receiver before the Viterbi decoding. Further details on security code estimation and replay attack can be found in [START_REF]The European Union, European GNSS (Galileo) Open Service Signal In Space Interface Control Document[END_REF].

In order to simulate the SCER attack the developed tool generates two signals at the same time. The first signal reproduces the real signal coming from the satellites, while the second is the spoofed signal, coming from a transmitter that tries to accomplish the attack. The real signal is similar to the spoofed signal but the security code 𝑤 𝑘 , the code offset 𝜏 𝑘 and the carrier phase 𝜃 𝑘 are not estimated.

𝑟 𝑘 = 𝑤 𝑘 𝑐(𝜏 𝑘 )𝑐𝑜𝑠 (2𝜋𝑓 𝐼𝐹 𝑡 𝑘 + 𝜃 𝑘 )

The transmitted signal is formed by the real and the spoofed signal, and is modelled as 𝑦 𝑘 = 𝑤 𝑘 𝑐(𝜏 𝑘 )𝑐𝑜𝑠 (2𝜋𝑓 𝐼𝐹 𝑡 𝑘 + 𝜃 𝑘 ) + 𝑤 ̂𝑘𝑐(𝜏̂𝑘)𝑐𝑜𝑠 (2𝜋𝑓 𝐼𝐹 𝑡 𝑘 + 𝜃 ̂𝑘)

The spoofed signal starting time is configurable. The scenario begins with only the trusted signal being tracked, and it evolves to a spoofing attack when the second signal, the spoofed one, starts.

The simulation of the attack can be divided in three phases:

 Phase 1: Only the signal without spoofing is generated. The receiver tracks only this real signal.  Phase 2: The spoofing signal perfectly aligned with the real signal, simulating a theoretical perfect zero delay.  Phase 3: After some time, when the receiver tracks the spoofing signal, the spoofing signal starts delaying the signal to spoof the receiver position

The steps are shown in the Fig. 9 The imperfect estimation of the symbols is simulated by modifying the sample chips on the spoofed signals. This imperfect estimation can be complemented with different levels of signal power in the spoofer. In some cases, the signal coming from the spoofer may have a higher power than the real signal, in order to induce the receiver to track this signal instead of the real signal. The scenarios under test, as well as the results, are described in more detail in the next section.

RESULTS

A dedicated testing campaign to validate both the SCER attack implementation and the effectiveness of the protection technique has been conducted. The first step was to identify an independent COTS receiver to compare the results with respect to the NACSET User Terminal. The selected receiver is a u-Blox M8T which supports Galileo E1 and GPS L1 amongst other constellations.

For the test set-up, the UT is used to test the performances of the implemented anti-replay technique and the COTS receiver is used to test how a mass-market receiver without any anti-replay protection behaves receiving the signals generated by the SCER simulator (see Figure 11).

Figure 11 -Test environment set-up

Throughout this section the results of the anti-replay checks will be presented as variations in the correlation mean values and the impact in the COTS receiver, showing that the SCER simulator is able to successfully spoof the receiver position without the anti-replay protection.

The initial configuration applied to the User Terminal anti-replay module is described in the Table 2.

at the beginning of the symbol

The SCER simulator is configured as defined in the following table: Apart from this configuration, three types of attacks depending on the spoofer estimation errors and transmission power have been modeled and executed. They are listed below and described in more detail in the rest of the section.

 Reference attack: Pseudorandom errors are introduced in the estimation of the unpredictable symbols (50% of chip errors at the beginning of each symbol) and no modification of the signal power is done.  Intermediate attack: low error rate in the estimation of the unpredictable symbols (30% of chip errors at the beginning of each symbol) and no modification of the signal power is done.

International Technical Symposium on Navigation and Timing (ITSNT) 2018 13-16 Nov 2018 ENAC, Toulouse, France  High-power attack: low errors rate in the estimation of the unpredictable symbols (30% of chip errors at the beginning of each symbol) and modification of the signal power per symbol to mask the errors in the estimation process.

The results of the tests executed with the U-Blox receiver show the behavior of the normal receiver against spoofing attacks. Figure 12 shows the satellite C/N0 in dB at the beginning with only genuine signals. This power profile is the nominal one in all the tests. The "reference attack" is proposed by simulating 5 erroneous chips of the first 10 chips at the beginning of each unpredictable symbol and no power supply modification. This attack is considered the worst case scenario from the spoofer perspective, hence it is used to demonstrate the detection performances of the technique and compare with the other attack cases that are presented within the paper. It is observed that this kind of spoofing attack is not detected by COTS receivers, but the antireplay technique detects drastic changes in the correlation of the spoofed signal. Even if the success rate of this attack is considered pessimistic for the spoofer (the successful symbol estimation probability cannot be lower than 0.5), it is considered useful to show the detection capabilities of the spoofing detector in a best-case scenario for the receiver and compare it with the other cases.

The beginning of the Phase 2 is shown in Figure 13. Several changes in the C/N0 are observed when new signals appear in the spectrum. In Phase 3, the position of the COTS receiver is spoofed in a linear trajectory as defined in the attack. Figure 15 shows the evolution of the COTS receiver position.

Figure 15 -Reference attack Map View

In the NACSET receiver, when the spoofed signal appears, the monitored correlation values decrease significantly per satellite as it can be seen in Figure 16. So, it is considered that the NACSET receiver is able to detect the attack and stops computing the positioning solution. Therefore, it can be concluded that the anti-replay technique works successfully against that kind of attack.

International Technical Symposium on Navigation and Timing (ITSNT) 2018 13-16 Nov 2018 ENAC, Toulouse, France 4 shows the variation of the correlation outcomes per satellite comparing to the mean of the last subframe outcomes.

-45%

-51% -42% -51%

Intermediate attack

An "intermediate" spoofing attack is proposed introducing 2 error chips at the beginning of each unpredictable symbol and no power supply modification. Even if a spoofer can guess at least half of the time the unpredictable symbols, and therefore the chips, the gain loss that it produces models is equivalent to a wrong guess of twice the error chips (4 chips in this case) half of the times. Therefore this simplification is considered as representative. In this case, the anti-replay technique detects smoother variations in the correlation of the unpredictable symbols, which confirm the need of previous fine tuning of the techniques thresholds to achieve a fine detection of the spoofed signal.

The beginning of the Phase 2 is shown in Figure 17. Table 5 shows the variation of the correlation outcomes comparing to the mean of the last subframe outcomes.

High-power attack

The "high-power" spoofing attack modeled has 2 error chips at the beginning of each symbol and a power increase of a factor two, i.e 3 dB, in the spoofed signal with respect to the genuine signal. In this case, the variation of the correlations are much more subtle due to the masking of the estimation errors by the attacker. It is difficult to detect the attack without restricting the technique thresholds. In this case, the combination of the technique with another anti-spoofing monitoring based on power monitoring such as C/N0 and AGC would be recommended.

The beginning of the spoofed signal produces as a result a tracking transition which is shown in Figure 14. The spoofed signal employs higher power, as we see in the Figure 21 recorded by a COTS receiver. When this configuration of the attack, the difference of the receiver position with respect to the genuine signals (static position) in 4 minutes of radiation is higher than 3 km in the COTS. These results show that the receiver tracks the spoofed signal alone when it starts as it can be observed in the evolution of the positions computed by the COTS receiver (linear trajectory as defined in Table 3).

Figure 23 -High Power Map view

Two different values of power increases has been tested, 3dB and 5dB. In the first case, a 3dB increase has been simulated resulting in a variation of the correlation that can be seen in Figure 24. It is observed that the correlation variation is more subtle than in the previous cases but a general correlation loss can be identified. In the second case, an increase of 5dB has been tested, in this test the NACSET receiver is unable to clearly detect the attack, as it is quite difficult to propose a firm decision based on the correlation values. Figure 25 shows that once the attack is started the correlation values computed deviate more than before but very erratically.

International Technical Symposium on Navigation and Timing (ITSNT) 2018 13-16 Nov 2018 ENAC, Toulouse, France As proposed before, in this type of attacks complementing the technique with a signal power monitoring could help the detection process since 5dB change in the signal power can be easily detected.

CONCLUSIONS

Throughout the paper, an implementation of a solution for protecting against zero delay SCER attacks has been described and tested against a simulated attack.

It has been demonstrated that the technique behaves well against standard zero-delay SCER attacks for opensky, being able to detect the spoofing signal as soon as it starts tracking it. The results for spoofers that vary the power of the signal considering the symbol estimation outcomes, show that further improvements can be made to the technique in terms of correlation analysis, selection of number of chips, as well as combination with other signal power-related indicators, such as AGC or C/N0. In summary, from the validation tests, it can be concluded that the unpredictable symbols inside a GNSS signals can be exploited to detect certain types of SCER attacks, leaving the door open for future improvements of the concept. Further work will consist on proving the technique with real SIS and in harsher environments (e.g. urban static, kinematic and tree canopies) and characterize the probability of false alarm, time to alert and refine the statistical analysis to work in those environments.

Figure 1 -

 1 Figure 1 -NACSET platform architecture

Figure 2 -

 2 Figure 2 -User Terminal Architecture

Figure 3 -

 3 Figure 3 -NavX-NTR Receiver

Figure 4 -

 4 Figure 4 -Receiver GNSS two-antenna array 2.2 Software ModuleThe GNSS receiver is commanded and complemented by a software module installed in a standard laptop and physically connected to the hardware receiver. The software module is in charge of implementing a portfolio of anti-spoofing measures and includes a PVT module able to compute a trustable position with the protection techniques outcomes. The receiver module processes the data from the Signal-In-Space and forwards the GNSS observations and navigation along with the E1B signal samples for the software module to process.

Figure 9 -

 9 Figure 9 -HackRF One The software module is in charge of simulating the zero delay SCER attack. It has two main duties, generate the "genuine" Galileo E1B signals and generate the signals needed to simulate the SCER spoofer in a realistic way. The generation of the Galileo signals is based on a GPS software simulator developed by Takuji Ebinuma ([9]) modified to generate both GPS L1 and Galileo E1 signals, including pseudoranges, navigation, signal power variations and inject Galileo OSNMA information in the navigation.

  in a timeline diagram: International Technical Symposium on Navigation and Timing (ITSNT) 2018 13-16 Nov 2018 ENAC, Toulouse, France

Figure 10 -

 10 Figure 10 -Spoofing attack steps

Figure 12 - 7 . 1

 1271 Figure 12 -C/N0 (in dB) values observed in the COTS receiver with no spoofed signal 7.1 Reference attackThe "reference attack" is proposed by simulating 5 erroneous chips of the first 10 chips at the beginning of each unpredictable symbol and no power supply modification. This attack is considered the worst case scenario from the spoofer perspective, hence it is used to demonstrate the detection performances of the technique and compare with the other attack cases that are presented within the paper. It is observed that this kind of spoofing attack is not detected by COTS receivers, but the antireplay technique detects drastic changes in the correlation of the spoofed signal. Even if the success rate of this attack is considered pessimistic for the spoofer (the successful symbol estimation probability cannot be lower than 0.5), it is considered useful to show the detection capabilities of the spoofing detector in a best-case scenario for the receiver and compare it with the other cases.

Figure 13 -

 13 Figure 13 -Reference attack -spoofed signal beginning in COTS receiver

Figure 14 -

 14 Figure 14 -C/N0 (in dB) values observed in the COTS receiver with the Reference attack

Figure 16 -

 16 Figure 16 -Reference attack -correlation variationTable4shows the variation of the correlation outcomes per satellite comparing to the mean of the last subframe outcomes.

Figure 17 -

 17 Figure 17 -Intermediate attack -spoofed signal beginning in COTS receiver In Figure 18 the C/N0 values at the moment of the beginning of the attack are shown. The C/N0 overall pattern is consistent with the nominal scenario and slightly better than in the "reference attack".

Figure 18 -

 18 Figure 18 -C/N0 (in dB) values observed in the COTS receiver with the Intermediate attackIn Phase 3, the position of the COTS receiver is spoofed in a linear trajectory. The result is equivalent to the Reference attack. Figure19shows the modification of the COTS receiver position.

Figure 19 -

 19 Figure 19 -Intermediate attack Map ViewOn the other hand, in the NACSET receiver, when the spoofed signal starts, the correlation indicator decreases less clearly than in the previous case because of the fewer estimation errors. This can be observed in Figure20, but it is still able to detect the attack and stops computing the positioning solution.

Figure 20 -

 20 Figure 20 -Intermediate spoofing correlation variation

Figure 21 -

 21 Figure 21 -High power spoofed signal beginning Figure 22 shows that the satellites' signal power has increased significantly because of the spoofed signal.

Figure 22 -

 22 Figure 22 -C/N0 (in dB) values observed in the COTS receiver with the High power attack

Figure 24 -

 24 Figure 24 -High-power attack (3dB increase) spoofing correlation variation

Figure 25 -

 25 Figure 25 -High-power attack (5dB increase) spoofing correlation variation

Table 1 -Antenna specification

 1

		Specifications
	Galileo Signals	E1, E5a, E5b, E5a+b (AltBOC),
		E6
	GPS Signals	L1, L2
	Element Distance < λ/2 at 1591 MHz (94 mm)
	Passive Gain	Elev. 90° (zenith): > 3.5 dBic
		Elev. 60°: > -3 dBic
		Elev. 15°: > -10 dBic
	LNA Power Gain	~30 dB
	LNA Noise factor	< 2 dB

Table 2 -Anti-replay technique configuration

 2

	Parameter	Value
	Sampling frequency	8192000 Hz
	Threshold	40	%	maximum
		correlation loss from the
		mean.
	Unpredictable symbols	32 per page
	Chips to be correlated per
	unpredictable symbol.

Table 3 -SCER simulator configuration

 3

	Phase	Duration Notes
			Real	signal	simulating
	Phase 1	60s	position in LLH: (40.59º, -
			3.7º), 806 m
			Both spoofing signal and real
	Phase 2	20s	simulate position (40.59º, -3.7º), 806 m with one chip
			delay
			Spoofing	signal	deviate
	Phase 3	60s	receiver position in a linear
			trajectory.

Table 4 -Reference attack -correlation results variation

 4

	E02	E08	E11	E12
	Reference
	attack

Table 5 -Intermediate attack correlation results variation

 5

		E02	E08	E11	E12
	Intermediate attack	-27%	-31%	-21%	-28%

Table 6 -High-power attack (3dB increase) correlation results variation

 6

		E02	E08	E11	E12
	High-power attack (3dB)	-19%	-29%	-21%	-25%

Table 7 -Correlation results variation

 7

		E02	E08	E11	E12
	High-power attack (5dB)	26%	6%	15%	17%