Galileo's encrypted signal holds a true position under spoofing

Five Galileo satellites encrypted part of their signal over Europe on Wednesday 16 September, and receivers on the ground worked out where they were from it: the first civil satellite-navigation position authenticated in both the data the satellites send and the measurement of how long that signal took to arrive, EUSPA said.

Between 14:00 and 16:00 UTC the satellites E06, E21, E23, E34 and E36 encrypted one of their signal components, the E6-C at 1278.75 MHz, which is normally transmitted in the clear. Receivers at Andøya in Norway and at ESA’s navigation laboratory at ESTEC, in the Netherlands, established their location from those encrypted signals — the first real-world positioning with Galileo’s coming Signal Authentication Service, or SAS.

A spoofer in the same field

A large part of the demonstration ran during Jammertest on the island of Andøya, where controlled jamming and spoofing are broadcast over the air. Each September Norwegian authorities put out a wide variety of jamming and spoofing scenarios so that receiver makers and application developers can see how their equipment behaves under pressure, ESA said.

Spoofing is the transmission of counterfeit signals designed to mislead a receiver about where or when it is, and it already reaches aviation and shipping, according to EUSPA. Jamming and spoofing are reported daily in many regions, including in Europe, and particularly in or near conflict zones, ESA says. During the tests conventional receivers were deceived and reported false positions, EUSPA said, while the Galileo SAS receiver detected the attack and held on to a true position.

“By combining signal authentication and navigation message authentication, users will know they can trust the position their device is showing,” said ESA’s Galileo Head of Engineering, Joerg Hahn.

The half of the fix that had no lock

A receiver needs two things to place itself: the navigation message the satellites send, and the ranging measurement — the time the signal took to travel down, as ESA puts it. Galileo has been authenticating the first since OSNMA was declared operational in 2025. SAS covers the second.

It does so without the stored secret keys or the permanent link to a ground station that military-grade solutions usually need, EUSPA said. For each fix a SAS receiver records digital samples of the encrypted E6-C; a few seconds later the matching OSNMA key is disclosed in the signal itself, and the receiver uses it to verify what it recorded and compute a position from ranging measurements it can vouch for, according to EUSPA. What it checks the recording against is published openly: Galileo re-encrypts portions of the E6-C with OSNMA keys and puts them on the European GNSS Service Centre’s site for receivers to download. That was the unguarded half: civil receivers have had limited means of verifying that the signals they use genuinely come from navigation satellites rather than from a counterfeit transmitter.

“This demonstration is an important milestone for trusted satellite navigation. By combining navigation message authentication with authenticated ranging measurements, Galileo is further strengthening resilience against spoofing and confidence in the positioning information provided to users,” said Guerric Pont, EUSPA’s Head of PNT.

The constellation it came from

Galileo has 27 satellites in orbit, according to Orbinauts — our list holds every Galileo satellite flying, whether or not it is in service — so about a fifth of the constellation carried the test. Neither agency says which of the 27 the five signal identifiers belong to.

Behind the test is the whole European chain, though the two agencies divide the credit differently. EUSPA makes the European Commission’s defence industry and space directorate, with the Joint Research Centre, Galileo’s programme manager and the SAS design lead; itself, as service provider, it oversaw the testing with the Galileo operator, and ESA, which develops the satellites and the ground segment, supported the tests in the field. ESA says the Commission defined the concept, and that ESA and EUSPA between them designed the architecture and updated the satellites and the ground infrastructure.

What comes next

Testing continues with the Launch 3 satellites E14 and E18 and others across the constellation, towards a SAS Initial Service declaration in 2027, EUSPA said. Next year EUSPA, with the Commission, ESA and industry, will carry out the service validation and accreditation before SAS is declared operational, according to ESA, which adds that SAS and OSNMA will both be free and available worldwide, and that users of Galileo’s High Accuracy Service will get the authentication too.

Both services are meant for ordinary users rather than governments alone: they are “advance protection features for mass market users, in addition to the already available Public Regulated Service”, said ESA’s Galileo Programme Manager, Miguel Manteiga Bautista. Every smartphone sold in the European Single Market is already guaranteed to be Galileo-enabled, ESA says. Reaching one with SAS is a further step, though: the fix needs a receiver that records samples of the E6-C and checks them against a key that arrives seconds later, and neither release says when a phone will do that.