Assisted Commercial Authentication Service

• ACAS is a suite of frameworks that combine LLM-assisted, cryptographic, and GNSS signal authentication to enhance both digital-identity and navigation security.
• It leverages machine learning, secret-sharing, and delayed key disclosure to counter spoofing and usability limitations inherent in legacy systems.
• The framework offers configurable protocols with high true acceptance and low false-acceptance rates, ensuring auditability and resilience in diverse operational scenarios.

The Assisted Commercial Authentication Service (ACAS) is a suite of technical frameworks enabling robust, scalable, and formally resilient commercial authentication. ACAS encompasses both digital-identity authentication (notably LLM-assisted human authentication and threshold cryptographic password authentication) and signal-level authentication for navigation systems, exemplified by the Galileo satellite system’s GNSS semi-assisted authentication. The concept integrates emerging techniques—machine learning, cryptographic secret-sharing, and cryptographically anchored signal authentication—to counteract usability, security, and spoofing limitations in legacy mechanisms.

1. LLM-Assisted Authentication Protocols

One class of ACAS leverages LLMs to authenticate users by evaluating free-form responses to knowledge-based challenge questions drawn from a user’s protected profile. The protocol addresses the rigidity of exact string matching by incorporating semantic and statistical analysis:

• Document Retrieval and Segmentation: ACAS retrieves a user’s profile document at login, splitting it into $k$ equal segments to combat LLM positional bias.
• Question-Answer Generation: For each segment, ACAS prompts an LLM (e.g. Llama-3.3-70B) to generate question-answer pairs.
• Free-Form Response Collection: Users respond in natural language. The system supports paraphrased or memory-variant answers.
• Dual-Mode Evaluation:
  • Semantic Judgment: The LLM provides a semantic similarity score:

  $$s_{\mathit{sem}} = \mathrm{LLM\_score}(u_i, r_i) \in [0,1]$$

  where $u_i$ is the user answer and $r_i$ the reference. - Cosine Similarity: Answers are embedded (e.g., with SentenceTransformer). Statistical similarity is:

  $$s_{\cos} = \frac{\langle e(u_i), e(r_i) \rangle}{\|e(u_i)\|\|e(r_i)\|} \in [0,1]$$

• Hybrid Decision: Either a weighted-sum threshold

$$S_{\mathit{final}} = \alpha s_{\mathit{sem}} + (1-\alpha) s_{\cos}$$

or two-stage gating:

$$\begin{cases} s_{\mathit{sem}} \ge \tau_{\mathit{sem}} \ s_{\cos} \ge \tau_{\cos} \end{cases}$$

Typical parameters: $\tau_{\mathit{sem}}=0.5$, $\tau_{\cos}=0.85$, $\alpha=0.5$ yield a true acceptance rate of $$s_{\mathit{sem}} = \mathrm{LLM\_score}(u_i, r_i) \in [0,1]$$0 and false-acceptance rate of $$s_{\mathit{sem}} = \mathrm{LLM\_score}(u_i, r_i) \in [0,1]$$1 (Chan et al., 27 Jan 2026).

Empirical results show that ACAS’s LLM-assisted authentication admits almost all genuine, non-exact responses while sharply limiting fraudulent acceptance. The system’s explainability is enhanced by logging LLM rationales and numeric scores for post-hoc regulatory or security review.

2. Threshold Cryptographic Authentication with Shamir and Pedersen Commitments

An orthogonal ACAS realization applies information-theoretic security for password authentication via Shamir secret-sharing and Pedersen commitments (Bissoli et al., 2018). The workflow includes:

• Actors and Architecture:

  • Client: Holds a password $$s_{\mathit{sem}} = \mathrm{LLM\_score}(u_i, r_i) \in [0,1]$$2 (never transmitted), generates session randomness.
  • Dealer (Backend): Orchestrates secret sharing, issues shares to $$s_{\mathit{sem}} = \mathrm{LLM\_score}(u_i, r_i) \in [0,1]$$3 independent shareholders.
  • Shareholders: Cloud hosts, each holding a share $$s_{\mathit{sem}} = \mathrm{LLM\_score}(u_i, r_i) \in [0,1]$$4; no single party can reconstruct the secret.
  • External Service: Consumes opaque tokens, never gets password material.
• Key Mechanisms:
  • Shamir Threshold Sharing: Password-derived secret $$s_{\mathit{sem}} = \mathrm{LLM\_score}(u_i, r_i) \in [0,1]$$5 is split across $$s_{\mathit{sem}} = \mathrm{LLM\_score}(u_i, r_i) \in [0,1]$$6 hosts; any $$s_{\mathit{sem}} = \mathrm{LLM\_score}(u_i, r_i) \in [0,1]$$7 reconstruct, $$s_{\mathit{sem}} = \mathrm{LLM\_score}(u_i, r_i) \in [0,1]$$8 yield no info.

  $$s_{\mathit{sem}} = \mathrm{LLM\_score}(u_i, r_i) \in [0,1]$$9

  $u_i$0 is $u_i$1; coordinates $u_i$2 are random and secret. - Pedersen Commitments: Verifiable sharing using public commitments:

  $u_i$3

  Share authentication:

  $u_i$4 - Two-Phase Protocols: - Registration: Client encodes $u_i$5, submission via AES-encrypted channel. - Login: Lagrange interpolation reconstructs $u_i$6 from any $u_i$7 verified shares and $u_i$8.

• Security: Information-theoretic resistance to dealer/shareholder compromise; no exposure of $u_i$9; session updates rotate secrets; byzantine detection via failed commitment checks.

• Performance: With $r_i$0, $r_i$1, 830-bit field, login latency is sub-400ms (light load), scalable via distributed architecture.

3. ACAS in Satellite GNSS: Signal Authentication for Galileo

ACAS underpins Galileo’s signal authentication by leveraging “semi-assisted” code verification without modifying the navigation signal-in-space (Winkel et al., 2023, Fernandez-Hernandez et al., 2022). The mechanism is as follows:

• RECS Publication: The operator pre-publishes “re-encrypted code subsequences” (RECS) for the encrypted E6-C signal, time-tagged and accessible for download.

• Key Release: Corresponding OSNMA keys (derived with TESLA-style delayed disclosure) are broadcast after fixed latency ($r_i$2 s). Only with these keys can RECS be decrypted to original code snippets.

• Receiver Workflow:

1. Preload RECS+BGD for autonomy period.
2. For each RECS time window, buffer E6C band samples.
3. After key release, derive $r_i$3, decrypt RECS$r_i$4ECS via AES-256-CBC.

4. Perform correlation:

   $r_i$5

5. Authenticate if $r_i$6 peak matches expected offset and passes pseudorange consistency:

   $r_i$7

• No Signal Plan Modification: ACAS overlays cryptographic authentication atop existing E6-C via file distribution and key management, requiring no uplink or in-band protocol changes.

4. Threat Models and Multi-Level Mitigation in GNSS ACAS

ACAS specifies security levels (I–III) against spoofing, jamming, and meaconing in high-integrity navigation:

• Level 1: Correlator power verification at E1-predicted E6 offset; checks pseudorange consistency.

• Level 2: Adds AGC/C/N0 monitoring, vestigial signal search (VSS) with E1 handover, and PVT checks (clock drift, RAIM).

• Level 3: Implements full exhaustive VSS, OSNMA/ANMA bit assistance, cross-signal consistency, and bridging metrics.

ACAS exploits the “earliest signal wins” assumption: the authentic satellite E6-C code will arrive before any meaconed/fake replica. Early-signal detectors and VSS algorithms search over large code/Doppler offset spaces, constraining false alarm rate:

$r_i$8

Key statistics: in 100,000-sample simulation ($r_i$9 dB-Hz), ACAS achieves $$s_{\cos} = \frac{\langle e(u_i), e(r_i) \rangle}{\|e(u_i)\|\|e(r_i)\|} \in [0,1]$$0 and rapid recovery from advanced spoofing attacks (Winkel et al., 2023).

5. Implementation and Tuning Guidelines

• LLM Authentication: Vary $$s_{\cos} = \frac{\langle e(u_i), e(r_i) \rangle}{\|e(u_i)\|\|e(r_i)\|} \in [0,1]$$1 (number of question/answer pairs) for risk-adaptive access; e.g., 3–5 for self-service, 8–10 for high-value.

  • Thresholds: start with $$s_{\cos} = \frac{\langle e(u_i), e(r_i) \rangle}{\|e(u_i)\|\|e(r_i)\|} \in [0,1]$$2, adjust for sensitivity or usability.
  • Weighted sum parameter: $$s_{\cos} = \frac{\langle e(u_i), e(r_i) \rangle}{\|e(u_i)\|\|e(r_i)\|} \in [0,1]$$3, raise $$s_{\cos} = \frac{\langle e(u_i), e(r_i) \rangle}{\|e(u_i)\|\|e(r_i)\|} \in [0,1]$$4 for text sparsity.
  • Adaptive questioning and monitoring for metric drift.
• Threshold Cryptography: Set $$s_{\cos} = \frac{\langle e(u_i), e(r_i) \rangle}{\|e(u_i)\|\|e(r_i)\|} \in [0,1]$$5 to attacker model; rotate cryptographic parameters regularly; run cloud infrastructure with dealer/shareholder separation and strict API boundaries.
• Signal Authentication: Buffering, sample rate ($$s_{\cos} = \frac{\langle e(u_i), e(r_i) \rangle}{\|e(u_i)\|\|e(r_i)\|} \in [0,1]$$6 MHz), FFT-accelerated matching, sample windowing per published RECS schedule; computational requirements scale with code length and snapshot cadence.
• Autonomy/Storage: Receiver design must ensure sufficient non-volatile storage to retain multi-day RECS and maintain atomicity of key and code file management for security.

6. Auditability, Explainability, and User Experience

• Numeric and Rationale Logging: All ACAS authentication modes produce quantitative scores (e.g., $$s_{\cos} = \frac{\langle e(u_i), e(r_i) \rangle}{\|e(u_i)\|\|e(r_i)\|} \in [0,1]$$7, $$s_{\cos} = \frac{\langle e(u_i), e(r_i) \rangle}{\|e(u_i)\|\|e(r_i)\|} \in [0,1]$$8) and, in LLM-assistance, textual explanations for challenge evaluation. These enable detailed audits, incident reconstruction, and compliance with regulatory regimes.
• Accessibility Considerations: Natural language input and semantic scoring promote inclusion (e.g., for dyslexia, nonnative speakers).
• Support and Error Handling: Lower operational burdens via reduced lockout misfires; adaptive retry logic in LLM-based authentication and explicit error channels in cryptographic and GNSS regimes.

7. Performance and Security Evaluation

• LLM Approach: At the recommended thresholds ($$s_{\cos} = \frac{\langle e(u_i), e(r_i) \rangle}{\|e(u_i)\|\|e(r_i)\|} \in [0,1]$$9), nearly all legitimate answers are accepted; $$S_{\mathit{final}} = \alpha s_{\mathit{sem}} + (1-\alpha) s_{\cos}$$0 false accept rate.
• Threshold Scheme: Prototype performance is linear in field size and number of shareholders; sub-400ms login latency is achievable at reasonable (830-bit, $$S_{\mathit{final}} = \alpha s_{\mathit{sem}} + (1-\alpha) s_{\cos}$$1, $$S_{\mathit{final}} = \alpha s_{\mathit{sem}} + (1-\alpha) s_{\cos}$$2) parameters.
• GNSS ACAS: Simulation and analytic results confirm $$S_{\mathit{final}} = \alpha s_{\mathit{sem}} + (1-\alpha) s_{\cos}$$3 in non-spoofing, with rapid spoof nulling recovery in advanced attacks.

Empirically, ACAS frameworks provide scalable security with tunable trade-offs between friction, resilience, and auditability, spanning digital and physical-layer authentication domains (Chan et al., 27 Jan 2026, Bissoli et al., 2018, Winkel et al., 2023, Fernandez-Hernandez et al., 2022).