How AtomiChron® Works (and Navigation Message Authentication in General)

Navigation Message Authentication

Any security mechanism that involves the transmission of authentication data for GNSS navigation messages, either via a different channel or over the native GNSS frequency band, for the purpose of verifying the authenticity of the navigation message, is referred to as Navigation Message Authentication or simply NMA.

While NMA is a long-established feature of military-grade GNSS (such as the high-precision encrypted P(Y)-code signal), NMA mechanisms for civilian use are still relatively novel, so there are still only a small number of manufacturers of commercial receivers that already support them—Meinberg being among those few.

A prospective civilian NMA implementation for the GPS constellation (currently still under development) is known as Chimera (Chips Message Robust Authentication) and is not supported by any commercially available receiver at this time. BeiDou and GLONASS do not yet offer any known NMA mechanisms for civilian use, although this may change in the future.

The Galileo constellation is currently the only GNSS constellation to provide native NMA for civilian use; the implementation is referred to as OSNMA (Open Service Navigation Message Authentication) and has only recently officially gone live. The IMS-GXL183 clock module features OSNMA support.

There are, however, currently two key drawbacks with OSNMA. Firstly, OSNMA only functions on Galileo's E1 band, which means that navigation messages on the E5a, E5b, or E6 bands cannot yet be authenticated. Secondly, its usefulness is limited in a multi-GNSS receiver context, as only the Galileo E1 signals can be authenticated. This means that, without the help of third-party services, the corresponding GPS, BeiDou, and GLONASS civilian signals cannot be authenticated.

AtomiChron®

AtomiChron® is a third-party NMA subscription service operated by Dutch geo-data specialists Fugro N.V. that addresses these shortcomings. It transmits its authentication data via a third-party signal, broadcast by the privately operated Inmarsat satellites on a separate frequency. This authentication data is generated by Fugro's numerous reference stations around the world, which collate and analyze GNSS data from all four major satellite constellations (GPS, Galileo, BeiDou, GLONASS). The global distribution of these reference stations makes it almost entirely impossible for an adversary to compromise the reference data at its source, as spoofed data from one or two reference stations is easily detected as an outlier.

A diagram roughly illustrating how AtomiChron® works

Each reference station transmits its data to Fugro, which then in turn forwards this authentication data (and other operational data) to the Inmarsat satellite constellation to be received by any AtomiChron®-capable receiver with a valid subscription.

Naturally, the transmissions to and from the Inmarsat satellites are encrypted and cryptographically signed and can only be decrypted and authenticated by a receiver with a valid AtomiChron® license. This ensures that incoming AtomiChron® data can be uniquely authenticated, and eliminates any risk of the AtomiChron® signal itself being spoofed.

Access to the AtomiChron® service requires a paid-up subscription. If subscribed via an IMS-GXL183 module, this subscription is concluded directly with Meinberg once the initial free six-month subscription has expired.

Meinberg's IMS-GXL183 module provides support for the AtomiChron® service for the purpose of authenticating incoming navigation messages.