Attachment_10--GPS_Security_Classification_Guide_2015.pdf

FOR OFFICIAL USE ONLY

J-1

(U) Annex J

(U) Global Positioning System - Acquisitions

(GPS)

(U) Security Classification and Declassification Guide

2 December 2015

(U) ISSUED BY: SMC/GPECS (GPS Program Protection Office) 483 N Aviation Blvd El Segundo CA 90245-2808

(U) APPROVED BY: SAMUEL A. GREAVES

Lieutenant General, USAF Air Force Program Executive Officer for Space

(U) SUPERCEDES: GPS SCG, dated 30 September 2008

(U) DISTRIBUTION STATEMENT C. Distribution authorized to U.S. Government agencies and their contractors to protect information on technologies essential to the design, development, production, operation, application, or maintenance of an article or service that makes or could make a significant contribution to the military potential of any country, including the United States. This includes, but is not limited to, design and manufacturing knowledge, technical data, keystone equipment, and inspection and test equipment or data that relate to a specific military deficiency of a potential adversary. Information of this type may be classified or unclassified.

Assigned pursuant to subpart 800.209 of title 31, CFR; ITAR; and EAR (30 September 2008).

Other requests for this document shall be referred to SMC/GPES.

(U) GLOBAL POSITIONING SYSTEM - ACQUISITION

(U) SECURITY CLASSIFICATION AND DECLASSIFICATION GUIDE

(U)FORWARD

(U) Description. The Navstar Global Positioning System (GPS) is a space-based radionavigation system that provides secure position, velocity, and time (PVT) data to properly equipped military and civilian users on a continuous worldwide basis. The GPS consists of three segments; Space, Control, and User. The GPS is a multi-use system managed by the National Space-Based Positioning, Navigation, and Timing Executive Committee and controlled by the United States (U.S.) Department of Defense (DoD). HQ Air Force Space Command (AFSPC) operates and maintains the space and control segments. The GPS Directorate of the Space and Missile Systems Center (SMC) is the lead procurement agent for the space and control segments. The GPS Directorate is the DoD's technical center of expertise for the GPS User Segment. Also, the GPS Directorate is the expert on technical matters regarding GPS and its interoperability with other space-based Positioning Navigation and Timing (PNT) services and their augmentations.

APPROVED BY:

1 i-/2/, ~ Lieutenant General, USAF Air Force Program Executive Officer for Space

J-2

Global Positioning System – Acquisitions (GPS) 2 December 2015 Security Classification and Declassification Guide

J-3

Table of Contents J1.1. (U) Purpose

J1.2. (U) Authority

J1.3. (U) Office of Primary Responsibility (OPR)

J1.4. (U) Classification Challenges

J1.5. (U) Reproduction, Extraction, and Dissemination

J1.6. (U) Public Release

J1.7. (U) Foreign Disclosure

J1.8. (U) Release of Program Data on the Internet

J1.9. Procure and Deploy a Modernized GPS Receiver

(U) Definitions

(U) Abbreviations and Acronyms

(U) References

(U) ANNEX J, SECTION 2: OVERALL EFFORT

(U) ANNEX J, SECTION 3: PERFORMANCE AND CAPABILITIES

(U) ANNEX J, SECTION 4: SPECIFICATIONS

(U) ANNEX J, SECTION 5: CRITICAL ELEMENTS

(U) ANNEX J, SECTION 6: VULNERABILITIES AND WEAKNESSES

(U) ANNEX J, SECTION 7: ADMINISTRATIVE DATA

(U) ANNEX J, SECTION 8: HARDWARE/SOFTWARE

Table V – 4 GPS Receiver Handling Classification Requirements, Non PPS-SM or Non SAASM UE 221

Table V – 5 PPS-SM UE Handling Classification Requirements

Table V – 6 SAASM UE Handling Classification Requirements

Table V – 7A Handling Classification Requirements, Modernized Receiver Configuration Item (CI) * for Operational use and Export

Table V – 7B Handling Classification Requirements, Modernized Receiver Configuration Item (CI) ** Not for

Export or OCONUS Operations

Table VI – 8A Handling Classification Requirements, Modernized Receiver Equipment, Not for Operational use or Export

J-4

Table VI – 8B Handling Classification Requirements, Components and Sub-Assemblies for a Modernized Receiver Equipment and Modernized Receiver Configuration Item (CI) Not for Operational use and Export

Table VI – 8 Handling Classification Requirements, Prototype Modernized Device or Chip

Table VI – 9 Handling Classification Requirements, Uncertified Prototype Modernized Equipment

Table VI – 10 Handling Classification Requirements, Certified Prototype Modernized Equipment

Table of Figures cFigure 1: Security Requirements for Procurement and Deployment of a Modernized GPS Receiver Figure 2: Location of Classification Guidance and its Application to the Modernized GPS Receiver Figure 3: Operational Environment, Other than Full Operational Capability (FOC) and deployment of Modernized GPS Receivers Figure 4: Process Flow to Protect SAASM Hardware During UE Development Figure 5: Process Flow to Protect SAASM Hardware During UE Manufacturing Figure 6: Process Flow to Protect SAASM UE Hardware Figure 7: Process Flow to Develop Devices or Chips Containing Classified GPS Security Algorithms Figure 8: Process Flow for Developing Prototype MUE Containing Classified GPS Security Algorithms 233

J-5

(U) ANNEX J, SECTION 1: GENERAL INSTRUCTIONS

(U) GLOBAL POSITIONING SYSTEM - ACQUISITION

(U) SECURITY CLASSIFICATION AND DECLASSIFICATION GUIDE

J1.1. (U) Purpose. To provide instructions and guidance on the classification of information involved in 1) the acquisition of the Global Positioning System (GPS) Space Segment, Control Segment, & User Segment and 2) the operations of GPS User Segment using, when possible, an unclassified identification of the effort.

J1.2. (U) Authority. This Security Classification Guide (SCG) is issued under authority of Executive Order 13526, Classified National Security Information, DoD Manual (DoDM) 5200.01, DoD Information Security Program, and Air Force Instruction (AFI) 31-401, Information Security Program Management. Classification of information involved in GPS is governed by, and is in accordance with the Air Force Space Command Security Classification and Declassification Guide. This SCG constitutes authority and may be cited as the basis for classification, regarding, or declassification of information and material involved in GPS.

Changes in classification required by application of this guide shall be made immediately.

Information identified in this guide for protection as classified information is classified by the Commander, Air Force Space Command.

J1.3. (U) Office of Primary Responsibility (OPR). This guide is issued by, and all inquiries concerning content and interpretation, as well as any recommendations for changes, should be addressed to:

SMC/GPECS (GPS Program Protection Office) 483 N Aviation Blvd El Segundo CA 90245-2808 SMC.GP.DAG2@us.af.mil

DSN 633-3631 / COMM: (310) 653-3631

J1.4. (U) Classification Challenges. If at any time, any of the security classification guidance contained herein is challenged, the items of information involved shall continue to be protected at the level prescribed by this guide until such time a final decision is made on the challenge by the OCA. Classification challenges should be addressed to the OPR.

J1.5. (U) Reproduction, Extraction, and Dissemination. Authorized recipients of this guide may reproduce, extract, and disseminate the contents of this guide, as necessary, for application by specified groups involved in GPS, including industrial activities. Copies of separate guides issued to operating activities in application of this guide shall be sent to the OPR.

J1.6. (U) Public Release. The fact that this guide shows certain details of information to be unclassified, including controlled unclassified information, does not allow automatic public release of this information. DoD information requested by media or members of the public or

J-6 proposed for release to the public by DoD civilians or military personnel or their contractors shall be processed in accordance with DoDM 5200.01, Volumes 1-4, DoD Directive 5230.09, Clearance of DoD Information for Public Release, DoD Instruction 5230.29, Security Policy Review of DoD Information for Public Release, DoD 5400.7-R_AFMAN 33-302, Freedom of Information Act Program, and AFI 35-102, Security and Policy Review Process, as applicable.

Proposed public disclosures of unclassified information regarding GPS shall be processed through SMC/PA by SMC/GPE.

J1.7. (U) Foreign Disclosure. Any disclosure to foreign officials of information classified by this guide shall be in accordance with the procedures set forth in DoD Directive 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations, and AFI 16-201, Air Force Foreign Disclosure and Technology Transfer Program. If a country with which the DoD has entered into a reciprocal procurement memorandum of understanding or offset arrangement, expresses an interest in this effort, a foreign disclosure review should be conducted prior to issuance of a solicitation. Proposed foreign disclosures of information regarding GPS shall be processed through SMC/PA by

SMC/GPE.

J1.8. (U) Release of Program Data on the Internet. Extreme care must be taken when considering information for release onto publicly accessible or unprotected Internet sites.

In addition to satisfying all of the aforementioned approval provisions, owners and/or releasers of information proposed for such release must ensure that it is not susceptible to compilation with other information to render sensitive or even classified data in the aggregate. Internet technology search and data mining capabilities must be assessed from a risk-management perspective. Information intended for publication on publicly accessible or unprotected Internet sites must be cleared for public release prior to publication according to AFI 35-102. Also refer to AFI 35-107, Public Web Communications. If there are any doubts, do not release the information.

J1.9. Procure and Deploy a Modernized GPS Receiver.

a. Under the Modernized Security Architecture (read Definitions), processing requirements to procure, develop and deploy a Y-code, M-code or Y- & M-code receiver (i.e. the Modernized GPS Receiver), for operational use and export, have been significantly revised. Security and program protection requirements in current use by U.S. Service Departments and U.S. Allies to procure and deploy a SAASM and Legacy receiver may no longer be used to procure/deployed a Modernized GPS Receiver. Review Figure 1.

Procurement of any modernized GPS receiver still requires the application of classification guidance found in this Guide as well as other guides. Modernized receivers intended for operational use and export require a GPS Directorate Security Approval. Security Approval has as prerequisites the application of two Directorate documents: a) the Process Requirement Document (PRD) for Security Certification and b) Appendix D Anti-Tamper (AT) Plan to the GPS Program Protection Plan (PPP). Compliance with the PRD and the AT Plan allows the

J-7 receiver to be handled as UNCLASSIFIED by the end user. The receiver must be handled as classified equipment if the design is approved to output classified GPS data.

Plan to procure a Modernized GPS Receiver

Start Here Define the Operating

Environment

Prepare the Procurement

Strategy

Procure Design, Develop, Test & Deploy/Operate

GPS SCG

For Operational

Use, Export or Other

Other

Apply in Strategy Operational Use &

Export

Apply in Strategy

SAP SCG

GPS PPP,

Appendix D

AT Plan

PRD – Security Certification

JAFAN

Manuals

End Here

Figure 1: Security Requirements for Procurement and Deployment of a Modernized GPS Receiver

b. Classification guidance for procuring a modernized GPS receiver is located in two sections of this SCG. To procure receivers, intended for operational use or export, use the classification guidance located in Section V starting at Paragraph J5.1.1.6. Classification guidance to support the procurement and use of a classified receiver designed to output classified GPS data is also located in this section. Use this section to support the procurement of a receiver intended for operational use and when there is no export requirement or OCONUS operations. The process is summarized in Figure 2.

To procure a modernized receiver such as a prototype, a qualification unit, for engineering & manufacturing development (EMD), or laboratory equipment use the classification guidance located in Section VII starting at Paragraph 1906.3.

J-8

Plan to procure a Modernized GPS Receiver

Start Here Define the Operating

Environment

For Operational

Use, Export or Other

Other

Operational Use & Export

Study this

SCG

GPS SCG

Section V Para 1401.6

Section V Para 1905.0

Apply to Procurement

Apply to Procurement

Design & up through Retirement End Here

Figure 2: Location of Classification Guidance and its Application to the Modernized GPS Receiver

c. In CY2015 development of the modernized GPS Control Segment (CS) continues. A modernized CS is required to properly command/control and monitor a modernized spacecraft and constellation operations. A modernized CS is required to send mission data to the modernized receiver. Modernized operational user keys are still in development; GPS cryptonets under the Modernized Security Architecture have not been defined. The U.S. DoD has not issued operational doctrine for use by the war fighter to issue operating procedures to operate, handle and conduct maintenance functions on the receiver. With these shortfalls senior security officials may impose on the Procuring Agency or the GPS Operator additional security requirements to restrict operational use of a modernized GPS receiver or general GPS operations.

Issuance and recipients of any interim Approval To Proceed (ATP) will be handled on a case by case basis. Review Figure 3.

J-9

Modernized GPS Receiver *

The design granted Security Certification by the GPS Directorate

Start Here Operational Use or Export

Modernized GPS Signal Declared

FOC?

User Segment Operational

Doctrine Issued?

Operational Key & Cryptonets

Available For Use?

Operate & Handle as UNCLAS or SECRET with

Interim Authority to Proceed

Operate & Handle as UNCLAS or SECRET

No No No

YesYesYes

End Here or Here

Figure 3: Operational Environment, Other than Full Operational Capability (FOC) and deployment of Modernized GPS Receivers

J-10

(U) Definitions.

All items in this table are UNCLASSIFIED Term Definition

Actual Y-code The Y-code waveform or bit stream derived through the use of cryptography. Unless noted otherwise in the GPS SCG, the term "Y-code" refers to the Actual Y-code.

Advance Encryption Standard Modernized Black Key Algorithm or AES MBKA

The security-related function within the Modernized Security Architecture that permits a MUE to process an encrypted (black) COMSEC key to derive the unencrypted (red) key for subsequent use.

Anti-Exploitation A protection scheme/measure, derived by the DoD, after coupling a validated or realized threat with a specific limitation or deficiency.

Anti-Spoofing; Evolution and Hierarchy (a) Y-code, the present, operational GPS signal in space (SIS). Y-code is also known as P(Y)-code. Legacy program documentation refers to Y-code as “Anti-Spoofing or A-S.” For example legacy documents refer to the GPS System Security Features as “SA/A-S.”

However, under GPS Modernization other EW countermeasures, technologies or techniques are being developed to prevent spoofing or jamming. These modernized concepts are also being referred to as anti-spoofing concept. In this SCG the term Y-code will be used instead of A-S or AS.

(b) Y-code plus Receiver Autonomous Integrity Monitoring (RAIM), Y-code performance is augmented through the use of receiver based RAIM algorithms. RAIM, though not specifically developed to perform an anti-spoofing function, performs an inherent "anti-spoof" role - tracks "all-in-view" SVs to discriminate a good signal from a bad signal.

The bad signal is no longer processed.

(c) Y-code plus RAIM plus Flex Power plus Navwar, Y-code and RAIM performance is further augmented. A flexible, higher-power GPS SIS will be available to support military operations in a hostile environment. Navwar adds further robustness by augmenting military operations by removing the source of intentional jamming/spoofing.

J-11

Term Definition

(d) Integrity Monitoring, represents the departure on reliance of Y-code to the reliance on the new MU SIS and advanced anti-spoofing receiver algorithms.

(U) Anti Spoofing (AS) Algorithms (U) Algorithms related to individual signals:

1. (U) AS Availability due to Jamming:

Determine whether or not jamming levels are sufficiently high to prevent receivers from finding authentic signals, preventing AS algorithms from working effectively.

2. (U) First Arrival/Fastest Arrival: If a receiver simultaneously receives multiple signals from the same PRN, identify the signal generated with the latest time as the authentic signal, and assume that other signals were generated by repeaters.

3. (U) Pseudorange Deviation: Identify a signal as spoofed if its pseudorange behaves erratically, caused by changes in code phase or navigation data.

4. (U) Deltarange Deviation: Identify a signal as spoofed if its deltarange behaves erratically, caused by changes in carrier phase.

5. (U) Signal Power: Evaluate whether or not signal strength is unusually high, as it would not likely be an authentic signal.

6. (U) Signal Power Stability Test:

Evaluate signal power over time and determine whether it is unstable enough to be considered likely to be inauthentic.

7. (U) Carrier-to-Noise Ratio (C/N0) Measurement: Evaluate whether a signal’s C/N0 value is unusually high, as they would not likely be authentic signals.

8. (U) Multiple Signal Presence: The presence of multiple copies of a PRN signal, where signals exhibit characteristic differences beyond those observed with multipath signals, indicates that spoofing is present.

9. (U) Dual Frequency Signal Consistency: Dual-frequency (e.g., L1 and L2) signals with the same PRN that have components on one frequency exhibiting

J-12

Term Definition unusually different signal characteristics and behavior than corresponding signals on the second frequency indicate that at least one of the signals might be inauthentic.

10. (U) Dual Code Consistency: Dual-code (e.g., M-Code and Y-Code) signals with the same PRN that have components on one code exhibiting unusually different signal characteristics and behavior than corresponding signals on the second code indicate that at least one of the signals might be inauthentic.

11. (U) NAV Message Consistency: If a receiver possesses navigation data (e.g., almanac, ephemeris data) that is assumed to be correct (e.g., by signal assurance or trusted upload), and a new signal has data that is inconsistent with the trusted data, then the signal carrying this data might be false.

12. (U) NAV Message Variation:

Significant changes in navigation data (e.g., almanac, ephemeris data) indicate the presence of an inauthentic signal.

13. (U) Signal Similarity: Sets of multiple signals with identical PRN, frequency, and code that exhibit close to identical behavior in the signal domain for various traits (e.g., Doppler or angle of arrival) can be assumed to be generated from the same source and therefore inauthentic.

14. (U) Side Correlator: Side correlators of a receiver’s acquisition engine can identify moving correlation peaks during tracking, indicating the presence of an unauthorized signal. Recognition of an approaching unauthorized signal could be Unclassified, but details about the implementation of mitigating methods related to this technique are Secret.

(U) Algorithms related to sets of signals:

15. (U) Self-Consistent Solutions/Fault Detection: Only sets of individual satellite measurements that form a consistent position, J-13

Term Definition velocity, and time (PVT) solution over time are viable candidates for a true solution. A set of signals can consist of five or more signals from different PRNs. Each subset of four signals produces a PNT solution. Sets of measurements that do not yield similar solutions for all combinations of four signal measurements must consist of at least one false signal. The concept of inconsistent solutions is Unclassified; details on identifying consistent sets and evaluating their assurance are Secret.

16. (U) Pseudorange RAIM/Pseudorange Fault Exclusion: Given a set of signals that can be used to calculate PNT, inconsistencies for one or more signals in pseudorange values, preventing a set of five signals from forming a consistent solution, indicate either a faulty signal or an inauthentic signal.

17. (U) Delta Range RAIM/Deltarange Fault Exclusion: Given a set of signals that can be used to calculate PNT, inconsistencies for one or more signals in deltarange values, preventing a set of five signals from forming a consistent solution, indicate either a faulty signal or an inauthentic signal.

18. (U) Clock Instability: Comparing the time calculated from a consistent set with time provided by a receiver’s internal clock, accounting for other expected clock behavior (e.g., clock drift, clock variance), can reveal inconsistencies in the calculated time, indicating that the solution uses one or more inauthentic signals.

19. (U) Aggregate Signal over Time:

Changes in characteristics (e.g., signal power, Doppler) that are consistent across multiple signals in a consistent set could be an indication that the signals originate from a single source and would be inauthentic.

20. (U) Non-sensor Aiding Consistency: If a receiver processes non-sensor aiding data (e.g., zero-velocity mode updates or elevation hold updates), and the calculated PNT is inconsistent with these independent updates, J-14

Term Definition than the receiver could be processing inauthentic signals. Basic information about data sources is Unclassified, but details about sensitivity thresholds are Secret.

21. (U) Sensor Aiding Consistency: If a receiver processes sensor aiding data (e.g., inertial measurement unit data), and the calculated PNT is inconsistent with these independent updates, than the receiver could be processing inauthentic signals. Basic information about data sources is Unclassified, but details about sensitivity thresholds are Secret.

(U) Algorithms related to individual signals:

At Rest The receiver is turned off and critical GPS functions remain in their power off state. The receiver is properly configured (e.g. integrated into the next level of assembly), contains operational user keys and capable of processing the operational GPS SIS.

Black Key Algorithm or BKA The security-related function within the SAASM Security Architecture that permits a SAASM receiver to process an encrypted (black) COMSEC key to derive the unencrypted (red) key for subsequent use. The Black Key Algorithm is not an element of the SAASM Security Critical Functions.

Boundary Scan A design-for-test approach for ICs whereby all device input and output pads are designed in test mode to connect as a serial shift register, allowing test data to be read out of a circuit while the circuit is in its target system. A chip-level diagnostic technique governed by IEEE 1149.1.

Broadcast Clock GPS time transmitted to user with United States Naval Observatory offset to meet time transfer requirements.

Broadcast Ephemeris Raw ephemeris data, uncorrected for the effects of SA, contained in the GPS Navigation Message. Previously designated as “Reference Ephemeris.”

Capability After a thorough system engineering process is complete, information about the design and theory of operation describes what the product

J-15

Term Definition

“will do” or “will not do.” This description becomes the product's technical baseline;

specifications are written and control by the appropriate Configuration Control Board (CCB). Tests verified the “will do” and “will not do.” Risks associated with "will not do" are accepted by responsible officials.

Channel Authentication The M-Code function within the M-Code Security Architecture that is used to validate the origin of M-Code signals

Classification by Compilation Read DoD 5200.1-R Information Security Program.

Common Fill Device Interface As defined by Section 5 Common Fill Device Interface (CFDI) of EMKS 308 EKMS Data Tagging and Delivery Standard.

Communication Security or COMSEC Measures and controls taken to deny unauthorized persons information derived from telecommunications and to ensure the authenticity of such telecommunications.

Communication security includes transmission security (CNSSI 4009).

COMSEC Material A component of Information Assurance that deals with measures and controls taken to deny unauthorized persons information derived from telecommunications and to ensure the authenticity of such telecommunications.

COMSEC includes crypto security, transmission security, emissions security, and physical security of COMSEC material.

(CNSSI 4009).

Concept of Operation or CONOPS A detailed written description of the GPS Space and Control Segment. The document may identify purpose, operational assumptions, the desired effects on the GPS User Segment (or individual GPS receiver), how the Space/Control Segment will be used, and who is envisioned to operate and use it. It may describe the operational nodes and the connections between the nodes, and how they relate to the elements of the GPS Space and Control Segments.

Control Segment All ground related elements necessary to update the navigation signal and to communicate and control the GPS SVs, i.e.

J-16

Term Definition receivers, data processors, Radio Frequency (RF) transmitters and antennas, and operational personnel. Also known as the Operational Control System (OCS).

Constellation Values Measure of the “goodness” of satellite constellation coverage.

Contingency Recovery or CR The security-related function within the SAASM Security Architecture that permits the GPS operator to support the mission need of the SAASM user. Contingency Recovery is an element of the SAASM Security Critical Functions.

Critical Program Information (CPI) CPI is program information, technologies, or systems that, if compromised, would degrade combat effectiveness, shorten the expected combat effective life of the system, or significantly alter program direction. This includes classified military information or unclassified controlled information about such critical programs, technologies, or systems.

Critical System Resources (CSR) CSR are those resources, that if unavailable or compromised, could seriously impact development, production, delivery, or operation of a system, component, or technology. An example of a CSR would be a patented chemical compound necessary to a critical production process that is produced at a single location. In this example neither the chemical nor the process, but the single manufacturing location and their ability to produce this compound is the CSR.

Crosslink The GPS RF link which permits the exchange of data and commands between two GPS SVs.

CRYPTO Marking or designator identifying COMSEC keying material used to secure or authenticate telecommunications carrying classified or sensitive U.S. Government or U.S.

Government derived information (CNSSI 4009)

Current (GPS) Operational Baseline For the purpose of this classification guidance, defined as GPS supporting SA/A-S operations with Generation I GPS Cryptography and associated keying material.

Deficiency When a system, subsystem, or component is

J-17

Term Definition declared operational and in use but there is a known design feature that does not meet the buyers specification.

Degradation The receiver can only generate a partial solution or a solution with degraded accuracy.

Degraded Operation When the mission is not fully accomplished.

Delta Change in data over a specific time interval.

Denial The inability of a GPS receiver to generate a navigation solution.

Deployment Strategy The plan for placing initial operational satellites in the proper orbit.

Details (or Detailed) [as in detailed knowledge] In this SCG, the "How" and some "When,"

"Where," and "Why" a particular GPS element or function exists or operates. In other words, the level of GPS information or data revealed is in whole or part sufficient for an adversary to: a) determine a vulnerability or shortfall which may be exploited, b) deploy a countermeasure, or c) deploy a copy. Read General (Knowledge).

Enhancements Any change (i.e. hardware, software, or procedural), temporary or permanent in nature, which alters a classified GPS design feature, function, or algorithm. The design feature, function or algorithm is under GPS configuration management control.

Ensemble The set of Satellites/Pseudolites used to generate the Navigation solution

(GPS) Ephemeris Ephemeris of a specific GPS satellite.

"Failed" Finding A Test and Evaluation "finding" that some aspect of a specific test criteria/point/parameter or performance evaluation was "failed" by the item under consideration.

General [as in general knowledge] In this SCG, the "What," and some "When," "Where," and "Why" a particular GPS element or function exists or operates. In other words, the level of GPS information or data revealed is otherwise available and not sufficient to allow an adversary to: a) determine a vulnerability or shortfall which may be exploited, b) deploy a countermeasure, or c) deploy a copy. Read Detail (Knowledge).

Generation I GPS Cryptography U.S. cryptography specifically developed for use by the GPS System Security Features.

J-18

Term Definition

Generation II GPS Cryptography U.S. cryptography specifically developed for use by the security critical functions embedded in the SAASM Security Architecture.

Generation III GPS Cryptography U.S. cryptography specifically developed for use by the Military Unique (MU) Signal Security Architecture.

GPS Builder The Navstar GPS Joint Program Office.

GPS COMSEC Material (a) Keys: Includes but not limited to the GPS

CVd, CVw, CVm, GUV, the MCS Cipher Tape, and the SAASM CD

(b) Documents: Adapts the definition contained in NSA Manual 90-1: a document that embodies or describes GPS cryptographic logic, the GPS key, a GPS security device, and their interdependencies/interface to certain GPS security-related algorithms (i.e. SA and A-S).

GPS Key Loading Device GPS PPS receivers or systems obtain COMSEC keying material through a KYK-13, KOI-18, CYZ-10, the Simple Key Loader (SKL), or equivalent.

GPS United States Nuclear Detonation (NUDET) Detection System (USNDS)

The interface between GPS and the USNDS mission. DoD and its GPS contractors furnish DoE and its NDS contractors technical specifications, and interface and performance standards for the GPS SV and CS. This information supports the proper integration of the NDS mission and its systems into GPS.

For example: a) GPS ground-to-space interface supports NDS SV payload operations; b) the GPS SV-to-SV interface supports data transfer;

and c) the GPS space to ground supports the transfer of data to the NDS user.

GPS Operator Air Force Space Command GPS PPS Procuring Agent Any Government or Contractor agency procuring the GPS Receiver. Per DoD GPS Security Policy, all Government or Contractor procuring agencies must obtain authorization to procure approval from the GPS Directorate.

GPS Receiver The electronic unit that performs a number of basic functions in order to derive position, velocity, and timing (PVT) data from the GPS PPS SIS. Classification guidance applies to the electronic unit commonly manufactured

J-19

Term Definition and referred to as a GPS PPS receiver, user equipment, card, (electronic) module, chip or other custom electronic component, or host application equipment.

GPS Security Algorithms The set of GPS security-related algorithms that may or may not include cryptographic algorithms, for the following:

(a) GPS System Security Features

(b) SAASM Security Architecture

(c) Modernized Security Architecture

(d) Navwar

(e) Advanced A-J

(f) Anti-Spoofing (not the legacy Y-code anti-spoofing design)

(h) Alternate System Access

GPS SPS Receiver In this SCG, classification guidance is issued to protect test and evaluation information, collected by the DoD that involves some civil, GPS SPS receivers. The term GPS SPS Receiver will be used on these civil receivers.

GPS Stakeholders To support the GPS Director and the Security Certification Process (key) GPS Stakeholders consist of SAF/AQL, SAF/AQS, AFSPC/A8Z, NSA, and Sandia Labs, at a minimum.

GPS System Security Features Current security-related functions in use by the operational GPS. The features are: a) SA, b) (Legacy) Y-code or A-S, c) Generation I GPS Cryptography, and d) Space, Control, and User keying material directly related to the operation of SA/A-S.

GPS (Three) III Architecture The GPS architecture that will: a) support the GPS and USNDS missions, b) host a new civil payload (e.g. DASS), c) use a high-power spot beam, and d) support Navwar. The architecture will adapt the policy guidance and requirements of Information Assurance (IA) for ensuring adequate protection of unclassified and classified information. The GPS III may interface the Global Information Grid.

Innovative [Background: GPS is fully operational and ensuring constellation performance standards are continuously met is of paramount importance. However, a mission need has

J-20

Term Definition could be defined and the need is not included in the approved GPS program baseline]. A systems review is conducted and innovative solution(s) are defined – a solution reveals: a) procedural changes must occur to SS or CS operations; b) receiver software must be altered to interface and support changes in SS/CS operations; and c) receivers, not selected to be compatible with the SS/CS change, will continue to operate on a non-interference basis when the SS/CS change is activated or deactivated. Also, may involve a capability that is significantly ahead of commercial or other nation’s publicized capabilities.

Integrity Monitoring Read definition Anti-Spoofing Evolution and Hierarchy above.

Launch Window The time allowed for the launch of a payload with a specific time duration from start to stop.

Legacy GPS PPS Receiver A non-SAASM based receiver specifically: a) designed to use a PPS-SM or b) designed not to use a PPS-SM. For example: the Miniature Airborne GPS Receiver uses a PPS-SM; a Receiver 3S (Phase III shipborne) does not use a PPS-SM.

Level of Data Available “Level of Data Available” encompasses all receiver inputs and outputs. A minimum set of inputs and outputs of a military receiver are defined and established by government controlled specifications. Military receivers also accommodate added inputs and outputs unique to each receiver manufacturer;

information related to these inputs/outputs are not documented in government specifications.

The Government has insight to all inputs and outputs. Based on a valid mission need the Government may allow use of a military receiver capable of outputting classified data.

Limitation The inability of a system, subsystem, or component, that has been deliver to the operator or user and is in use, to achieve a required or desired level of performance or standard.

Lm Satellite Service The GPS Military-Unique (MU) where a classified Transmission Security (TRANSEC)

J-21

Term Definition algorithm is used to derive the: a) ranging code (i.e. M-ode); b) acquisition codes (i.e. PA-code, and the FA-code); and the c) downlink system data (i.e. military navigation (MNAV) data). TRANSEC is provided by the Modernized Navstar Security Algorithm

(MNSA).

Lm Simulation Service The GPS MU signal where an unclassified cryptographic algorithm is used to derive the:

a) ranging code (i.e. Pseudo M-code); b) acquisition codes (i.e. Pseudo PA-code, and the Pseudo FA- code); and the c) downlink MNAV data. The cryptographic algorithm is provided by the Advanced Encryption Standard (AES).

Message Authentication The M-Code function within the M-Code Security Architecture that is used to validate the origin of M-Code data

Military Integrity Assures that authorized users can access and utilize the authentic modernized GPS SIS in all environments for which the system has been specified to provide PVT service Integrity Monitoring.

Military Exclusivity Denies unauthorized exploitation; assures that the authentic modernized military GPS SIS is exploited only by authorized users.

Military Specifications and Drawings A document prepared by the DoD or a DoD contractor that includes but not limited to GPS PPS system, technical, performance, product, process, or material specifications; interface control documents or equivalent; and GPS security design guidelines or equivalent. For drawings includes layouts; conceptual;

dimensional and assembly; exploded views, artist or computer-aided rendering; and photographs.

Modernized Anti-Spoofing (AS) Receiver-based algorithms designed to detect and mitigate the effects of intentional spoofing.

Modernized AS Information Processing and Data Flow

Background information used to develop receiver algorithm. Information can include the spectral characteristics of M-Code, Blue Force Electronic Attack (BFEA) waveforms, (user’s) operational details (i.e. tactics, techniques, procedures), (designer’s) decision choices (i.e.

thresholds, timing).

J-22

Term Definition

Modernized Black Key Algorithm or MBKA The security-related function within the Modernized Security Architecture that permits a MUE to process an encrypted (black) COMSEC key to derive the unencrypted (red) key for subsequent use.

Modernized GPS Receiver The receiver that implements the M-code, either in combination with the P(Y)-code and C/A-code or singly without the other codes.

The receiver where legacy and SAASM-related GPS security approval requirements no longer apply. There are two sub categories of receivers under the phrase Modernized GPS Receiver. The first category is the Modernized Receiver Configuration Item (CI). The second category is the Modernized Receiver Equipment.

Modernized GPS Security Certification The application of DoD Information Assurance (IA) requirements that will accommodate Modernized Security Architecture into the PPS receiver.

Modernized Receiver Configuration Item (CI)

A sub category of a Modernized GPS Receiver.

The phrase Modernized Receiver CI applies to the full spectrum of receivers: the traditional standalone unit through and including integrated GPS/INS design. The phrase also applies to the modernized security module such as the Common GPS Module (CGM).

The Modernized Receiver CI is designed and verified to meet requirements defined by a government-controlled technical specification.

The Modernized Receiver CI architecture complies with DoD requirements for Information Assurance and Anti-Tamper. The phrase Modernized Receiver CI also applies to a receiver manufactured by a contractor to the contractor’s technical specification. The Modernized Receiver CI is designed for operational use and export.

A phrase Modernized Receiver CI also applies to a receiver not intended for export or OCONUS operations and is restricted to CONUS operations under US control only.

Modernized Receiver Equipment A sub category of a Modernized GPS Receiver.

J-23

Term Definition

The term Modernized Receiver equipment primarily intended to apply to a receiver or radio receiving equipment not intended for operational use or export. This category of receiver includes prototype units, engineering & manufacturing development (EMD) models, qualification units and laboratory equipment.

In most cases the receiver’s architecture is not expected to comply with DoD requirements for Information Assurance and Anti-Tamper.

Modernized Security Architecture Also referred to as the GPS Military Signal Architecture, GPS Modernized System Security Features, or the MU-Signal Security Architecture. The architecture includes: a) Generation III GPS Cryptography, b) Over- The-Air Rekey, c) Modernized Black Key Algorithm, and d) GPS Space, Control, and User keying material directly related to the operation of Over-The-Air Rekey, Modernized Black Key Algorithm, and Generation III GPS Cryptography.

Modernized User Equipment (MUE) In this SCG the term is equivalent to MUE, MGUE, or receiver processing M-Code, Lm, or MNSA

Navigation Warfare (Navwar) The umbrella of technical and non-technical activities under which the DoD focused on validating technologies and CONOPS for implementing the objectives of electronic warfare (EW) military actions and countermeasure against space-based PNT systems including GPS. Navwar adapts the three major subdivisions of EW: a) electronic attack (EA), b) electronic protection (EP) and

c) electronic warfare support (ES).

NOFORN No Foreign (Dissemination) marking used to identify Intelligence Information that may not be released in any form to foreign governments (DoD 5220.22-M)

Program Protection Planning An acquisition and logistics managed program process that identifies a system’s critical program elements, threats, and vulnerabilities throughout the system’s life-cycle. Program Protection Planning is a comprehensive effort that encompasses all security, technology

J-24

Term Definition transfer, intelligence, and counterintelligence processes. through the integration of embedded system security processes, security manpower, equipment, and facilities.

Over-The-Air Rekey or OTAR and Over-the- Air Distribution or OTAD

The security-related function provided by the SAASM Security Architecture or the MU Signal Security Architecture that permits the re-keying of the properly design GPS PPS receiver without the need to visit a COMSEC custodian.

(Space-Based) Positioning, Navigation, and Timing (PNT) Systems

Synonymous with satellite navigation (SATNAV), global radio navigation satellite system (GRNSS), or global navigation satellite system (GNSS). Space-based systems that provide position, velocity, and timing (PVT) information to specially designed receiving equipment. These space-based systems may operate in conjunction with augmentation systems. Space-based systems include but not limited to the: a) Galileo, b) Geostationary Navigation Overlay System, c) GLONASS, or

d) Quasi-Zenith Satellite System (QZSS);

augmentations include: a) Wide Area Augmentation System (WAAS), b) Local Area Augmentation System (LAAS), or c) Multi- Function Satellite Augmentation System

Pre- and Post-Mission Data [Background. The GPS is undergoing a modernization effort (e.g. SAASM and M-code) to accommodate new or enhanced security-related features in the GPS SIS. Until these military capabilities are declared operational, the GPS Operator and Builder will institute controls to limit participation and access to the GPS SIS]. The raw or processed data, extracted by the DoD and its contractors, from a receiver that acquired, tracked and processed the GPS SIS. The data was extract from a PPS or SPS receiver, as well as any other PNT receiving equipment.

Premature Release In this SCG, a DoD official defines a mission need. During the process of identifying information requirements needed to support mission planning, information is gathered on various systems to include capabilities and

J-25

Term Definition limitations. Analysis reveals that the GPS can contribute to mission success. Analysis also reveals that a solution can be implemented by the GPS on a non-interfering basis (i.e.

receivers not selected for implementing the solution will continue to operate on a non-interference basis when the SS/CS solution is activated or deactivated.) However, exposure of the new GPS design and operation must be minimized and controlled to ensure maximum longevity of the mission. The GPS operator and builder drafts a security program to control development of and access to mission objectives, the design, and their associated operating plans and directives.

Prior GPS Knowledge In this SCG shall be considered any GPS information or data where that information/data is specifically withheld from public disclosure in compliance with the provisions of DoD 5420.25 Withholding of Unclassified Technical Data from the Public Disclosure.

Production Design The receiver design when declared by the US Government for operational use and export. In most cases, the design, having government approval after successful completion of the critical design review (CDR), may not be the design approved for operational use and export.

(GPS) Receiving Equipment To ensure uniform application of security classification requirements, the military PPS receiver, specialized equipment, or information processing systems. Examples of a receiver, equipment and system are:

(a) Military PPS receiver, user equipment, module, card, chip set, or equivalent that implements all or a subset of the following items:

• Selective Availability

• Y-code

• M-code

• Integrity Monitoring

• Navwar Algorithms

• Contingency Recovery

J-26

Term Definition

• Over-The-Air Rekey (SAASM & M-code)

• Signal Authentication (SAASM & M-code)

• Black Key Algorithm (SAASM & M-code)

• Generation I, II, or III GPS Cryptography

• Interfaces key fill or data loader devices for accepting and storing GPS COMSEC keys

• Interface adaptive anti-jam technologies (e.g.

null steering antenna systems, Space Time Adaptive Processing)

(b) Specialized equipment fitted with the items listed under the Military PPS Receiver; also designated as GPS Host Application Equipment (HAE) and includes the following:

• Equipment used to interface, test and validate the GPS signal broadcast from a GPS transmitter

• Equipment specifically designed to interface and support the GPS Master Control Station and includes the Monitor Station receiver, the modernized monitor station receiver element, or equivalent

• Differential GPS reference stations, National Geospatial-Intelligence Agency receivers, or Geodic System equipment

(c) Information processing system or data handling systems fitted with most of the items listed under the Military PPS Receiver and includes the following:

• Mission Planners (e.g. JUMPS, CLAS, etc.).

• Modeling/simulation tools or equivalent.

• Personal computers or automated information systems that post-process the GPS PPS signal in space.

Replenishment Strategy The plan for replacing GPS SVs as they wear out.

Residual Difference between actual and estimated/predicted measurements.

Reuse of Generation I GPS Cryptography Specifications or standards of Generation I GPS Cryptography are documented in GPS program documentation. For the purpose of this classification guidance, "reuse" is defined as altering the design or function of this cryptography that is contained in program documentation. The requirement to alter this

J-27

Term Definition cryptography supports a mission need. The requirement to alter the crypto is coordinated with NSA.

Rudimentary ES-Type Operation The fact that some handheld military receivers can be commanded to display to the operator the carrier-to-noise (C/N) or signal-to-noise ratios (S/N). With proper training, these values can be used in a direction-finding matter to locate source(s) of intentional jamming.

(GPS) Satellite Control To ensure uniform application of security classification requirements, the systems and its major components that commands and controls a satellite and provides navigation data to receiving equipment. Systems and components include but not limited to:

• Master Control Station, Back Up Master Control Station, or Alternate Master Control Station.

• Launch and Disposal Operations.

• Integrated Mission Operations Support Center.

• System Simulator.

• GPS Support Facility.

• GPS Support Center

• GPS Navwar Operations Center

• Major external and internal interfaces.

Satellite Reference Station A GPS PPS receiver specifically operated by a DoD test and evaluation agency to monitor the performance of the operational GPS constellation. The mission to monitor the constellation flows down from the GPS Operator.

SAASM Security Architecture Those security-related functions currently in development to enhance the GPS program baseline described by the GPS System Security Features. The architecture includes: a) Over- The-Air Rekey, b) Contingency Recovery, c) Signal Authentication, d) Generation II GPS Cryptography, e) Black Key Algorithm, and f) GPS Space, Control, and User keying material directly related to the operation of security architecture. SAASM requires the use of a tamper-resistant multi-chip module to protect the SAASM Security Architecture in receiving

J-28

Term Definition equipment. Lastly to support backwards compatibility requirements, the SAASM Security Architecture includes the functions of the GPS System Security Features (i.e. SA and (Legacy) A-S).

Security Certification (Process) The process defined by the GPS Directorate’s M-code Receiver Security Certification Process Requirements Document (PRD). The PRD is an extension of security and program protection activities under the GPS Program Protection Plan . The PRD defines the government infrastructure, government and contractor roles and responsibilities, design reviews, and the government’s security evaluation requirements. A Security Certification Board grants security certification of a Modernized GPS Receiver prior to operational use and export. The Broad is chaired by the GPS Director and acts on the recommendations of GPS Stakeholders.

(SAASM) Security Critical Functions The phrase established in GPS program documentation for Over-The-Air Rekey, Contingency Recovery, and Signal Authentication. SAASM SCF may or may not include the Black Key Algorithm.

Security Level of Algorithms A military GPS receiver implements system security and cryptographic algorithms to maintain the military advantage of GPS in the battlefield. These receivers are also implementing the latest generation of anti-spoof, anti-jam and other Navigation Warfare (Navwar) algorithms. In most cases, information which details these algorithms, and their associated GPS CPIs, are classified IAW their respective SCGs.

Shortfall The user/operator declares the lack of forces, equipment, personnel, material, or capabilities of system to accomplish a mission.