Two Galileo-based technologies designed for robust and secure positioning and timing have been successfully showcased in the context of an extreme disaster scenario during the GEXTRECS Live Demonstration Event on 23 October 2025. Both solutions leverage GOVSATCOM to transmit position requests and deliver precise location information back to the Mission Control Centre.
Satellite navigation systems are deeply embedded in modern life. From guiding airplanes and ships to enabling financial transactions and emergency response. They have become critical in both civilian and governmental operations. Yet, as the reliance on these systems grows, so does the associated risk. Signals generated by any Global Navigation Satellite System (GNSS), including the European Galileo, are vulnerable to spoofing, jamming, and manipulation. These threats can disrupt services, mislead users, and even compromise national security.
To address these challenges, certain security features have been introduced in services offered by the Galileo system, including:
- Open Service Navigation Message Authentication (OSNMA) – a free service that helps users verify the authenticity of satellite navigation messages.
- Public Regulated Service (PRS) – a governmental service which ensures secure navigation for national security through signal encryption.
As previously mentioned, GNSS signals are weak and unencrypted, thus vulnerable to any malicious activities. OSNMA is a free authentication service that enables users to verify Galileo’s public navigation messages (including satellite almanac, ephemeris, timing, and other navigation messages) to ensure they are genuine and have not been spoofed or tampered with. OSNMA allows compatible receivers verify that the navigation data broadcast on Galileo’s public signal certainly have originated from Galileo and were not altered by any attacker.
At the core of OSNMA is a digital signature authentication. Galileo satellites transmit navigation messages that include a digital signature. This signature is generated using a private key held securely by the Galileo system. To verify the signature, users need access to the corresponding public key. Galileo distributes the public key through a trusted channel (e.g., via the internet or secure broadcast). The OSNMA receiver uses the public key to check the digital signature. If the signature matches, the message is confirmed as authentic. If there is no match, the receiver identifies the signals as spoofed or corrupted. In addition, OSNMA includes time-stamped data, which help prevent replay attacks, where old and previously valid signals are rebroadcast to mislead systems.
OSNMA is freely available to all users without any need for special authorization or licensing. In general, this Galileo service can strengthen resilience in sectors where secure timing and positioning are essential, such as energy infrastructure, telecommunications, finance, transport, and emergency services. However, OSNMA is not protected against radio-frequency (RF) jamming, which blocks signals entirely, nor does it prevent a well-equipped attacker from performing meaconing, capturing authentic signals and rebroadcasting them at a different location or time. In such cases, the receiver may still accept the relayed signals as valid.
The second Galileo service explored is PRS, which is a restricted and encrypted navigation service. Galileo satellites broadcast PRS signals using governmental-grade encryption. PRS signals are designed to be resistant to jamming and spoofing and they can operate in hostile environments, such as during natural disasters or cyberattacks.
PRS signals are not publicly accessible and cannot be decoded without proper keys. This service is dedicated to authorized users who need highly secure and resilient positioning, especially in sensitive or emergency situations. Unlike OSNMA which authenticates open signals, PRS uses fully encrypted navigation signals that are only accessible to users with special clearance. Since PRS is a governmental service, it involves classified documentation, software and hardware. In the scope of the GEXTRECS project, the so-called “Low-PRS” service has been introduced, representing an extension of the PRS concept, which adds an extra layer of security, being designed to overcome the limitations of using PRS receivers (classified devices) outside Regulated Access Zones (RAZ). Low-PRS uses a PRS recorder that captures encrypted signals and sends them to a server located in a secure RAZ. The server processes and decrypts the signal, then returns the encrypted position to the user, ensuring security without exposing the sensitive equipment.
As a result, Low-PRS ensures that only trusted users can access the service and provides stronger assurance that the signal received by an authorized user is the legitimate PRS signal and not a counterfeit. Because it is restricted and encrypted, generic spoofers cannot easily imitate PRS signals. Additionally, Low-PRS adds an extra security layer, decrypting the messages inside the RAZ.
Low-PRS also has certain limitations. Unlike open services, Galileo PRS signal is specifically designed to offer enhanced robustness against radio frequency (RF) jamming through its encrypted and high-power signal structure. This makes it significantly more resilient in contested environments. However, the PRS signal cannot fully prevent RF jamming, especially from sophisticated and persistent sources. Additionally, while the cryptographic protections used in PRS make meaconing far more difficult, well-equipped adversaries may still attempt it under certain conditions. Neither PRS nor OSNMA can independently guarantee the absolute correctness of the underlying navigation data or provide complete immunity to faults in the satellite or ground segments.
Table 1: Comparison of OSNMA and PRS services
Feature | OSNMA | Low-PRS |
Access | Open to all users | Restricted to authorized users Regulated Access Zones (RAZ) |
Encryption | No (digital signatures) | Yes (fully encrypted) |
Purpose | Signal authentication | Secure, resilient navigation |
Target Users | General public and industry | Governmental, emergency services |
Cost | Free of charge | Government controlled |
Implementation of OSNMA and PRS in GEXTRECS
OSNMA and PRS, more specifically the so-called Low PRS, are the core Galileo services deployed within the scope of GEXTRECS, and their correct implementation has been possible through dedicated solutions developed by GMV. For instance, the ASGARD receiver enables secure positioning by supporting OSNMA authentication, allowing users to verify the authenticity of Galileo signals. To implement the PRS service, GMV had to provide necessary infrastructure for PRS signal decryption and secure positioning, ensuring access to Galileo’s encrypted and resilient navigation capabilities for authorized users.
ASGARD is an OSNMA-compatible, dual-frequency shipborne multi-constellation receiver that complies with various maritime regulations such as IEC 61108-1, IEC 61108-3, IMO: MSC 401 (95) and MSC 432 (98). ASGARD equipment is composed of a GNSS receiver, that stores configurations, checks thresholds and generates status/performance information, such as alerts. While ASGARD offers particularly strong performance in the maritime sector, its design and functionality are well-suited for a wide range of use cases covered under the GEXTRECS scope (i.e. emergency situations). ASGARD’s flexibility, reliability, and compatibility with Galileo’s OSNMA authentication make it the ideal choice as the main GNSS receiver for secure and resilient positioning. Its principal advantages include:
- Multi-GNSS, multi-frequency: GPS L1C/A, GPS L5, Galileo E1b, Galileo E5a.
- Receiver Autonomous Integrity Monitoring system (RAIM) through the IBPL (Isotropy-Based Protection Level).
- Better coverage at high latitudes (poles).
- Improved performance in areas of sky obscuration.
The integration of ASGARD within the GEXTRECS project is illustrated in Figure 1. As shown, the ASGARD receiver is directly connected to the GNSS antenna, through which it receives Galileo signals. These signals are processed by ASGARD’s Navigation Sensor following the OSNMA protocol, finally computing the Position, Velocity, and Time (PVT) solution, along with a Position Integrity Protection Level (IBPL). This processed information is then transmitted to a GNSS server. The GNSS server is responsible for managing the positioning solutions provided by both the ASGARD receiver and the PRS service. Positioning data is sent from the server to the Mission Control Center via satellite communications.
Figure 1: GNSS System Architecture in GEXTRECS
The integration of the Low-PRS solution introduced in GEXTRECS is also depicted in Figure 1. Unlike the ASGARD receiver, which processes Galileo signals locally, the Low-PRS architecture involves a remote processing workflow. In this case, Galileo signals are received and transmitted via an internet connection to GMV Headquarters. These signals are decrypted inside the Regulated Access Zone (RAZ) using government-provided keys to ensure compliance with PRS security protocols. After decryption, the signals are processed to validate the Position, Velocity, and Time (PVT) solution, which is then securely sent back to the GNSS Server.
It is important to note that unlike the ASGARD solution, the Low-PRS architecture does not provide an integrity protection level on the obtained position (IBPL) yet. This means that while Low-PRS ensures secure and encrypted positioning, it does not offer the same level of integrity monitoring as ASGARD’s OSNMA-enabled solution.
The Protection Level (PL) Concept
A Position Protection Level (PL) is a statistically derived, conservative bound that estimates the maximum possible error in a receiver’s computed position. In other words, it defines how far off the reported position could be with a very high level of confidence, which typically equals 99.999% or more. This metric is essential for applications where safety and integrity are critical, such as aviation, maritime navigation, or autonomous systems.
In practical terms, the Protection Level (PL) is often visualized as a circle around the computed position in 2D horizontal positioning or as a sphere or cylinder in 3D positioning. This graphical representation illustrates the maximum area within which the true position is expected to lie based on statistical confidence thresholds, as is shown in Figure 2.
Figure 2: Protection Level
The Protection Level is not the same as positional accuracy. While accuracy reflects how close the computed position is to the true location, the Protection Level represents an upper bound on the error, calculated to ensure that the system can make safe decisions even in the presence of uncertainties or degraded signal conditions.
The IBPL (Isotropy-Based Protection Level) is a computational algorithm developed by GMV and designed to compute real-time Protection Levels under the isotropy hypothesis (i.e., GNSS measurement errors distribute isotropically). Thanks to the IBPL algorithm design, it can be seamlessly integrated into receivers like ASGARD, supporting high-confidence navigation decisions in safety-critical applications. During the GEXTRECS Live Demonstration, the Protection Level (PL) was computed by the ASGARD receiver in parallel with the Position, Velocity, and Time (PVT) solution.
Presentation of OSNMA outputs
Upon receiving the request, both the computed position and its corresponding Protection Level were forwarded to a GNSS web application, which was used by the client at the Mission Coordination Center (Figure 3). This application visualizes the position and Protection Level on a map, with the latter depicted as a circular area surrounding the horizontal position.
Figure 3: GNSS Web appplication for GEXTRECS
The web application was designed to facilitate the interpretation of disaster-related location data. It ensures that decision-makers are provided not only with geospatial information but also with a quantified assessment of its reliability. This capability significantly enhances situational awareness and supports safer, more informed operational decision-making.
The transmission of data (both requests and responses) was carried out using standard AIS (Automatic Identification System) messages. To optimize the efficiency of this communication channel, the messages were compressed to reduce the required bandwidth. This compression conserves network resources and reduces latency, which is particularly beneficial in scenarios where timely data exchange is critical. By limiting the size of transmitted data packets, the system ensures faster and more reliable communication, even under constrained or degraded network conditions.
All specifications of demonstrated GNSS services depicted in this article were validated during the GEXTRECS Live Demonstration.
