# Implementation Considerations for ACAS and Simulation Results

Jón Winkel, Ignacio Fernandez-Hernandez, Cillian O’Driscoll

###### Abstract

The Assisted Commercial Authentication Service (ACAS) is a semi-assisted
signal authentication concept currently being defined for Galileo, based on
the E6-C encrypted signal. Leveraging the assumption that the true E6-C
encrypted signal always arrives before any inauthentic signal, we define user
concepts for signal detection, including vestigial signal search. We define
three mitigation levels, each level defending against an increasing set of
threats, incorporating the described concepts and additional checks. The
concepts are analyzed and implemented in a simulation environment, and tested
in both nominal conditions and under advanced spoofing attacks. The results
suggest that even advanced attacks can be detected and mitigated by ACAS
receivers.

###### Index Terms:

GNSS, Galileo, Authentication, OSNMA, Assisted Commercial Authentication
Service, ACAS

##  I Introduction

Global Navigation Satellite Systems (GNSS) location is based on two main
inputs: positions and time information of the satellites, and measurements
(pseudorange, carrier phase etc.) obtained at the user receiver. Galileo OSNMA
already provides authentication of the data [1, 2], possibly with other
systems following suit in the future, such as GPS’s CHIMERA [3].

The measurements are more difficult to authenticate, as they are generated in
the receiver. The two main concepts currently under consideration are
encryption of the spreading code using symmetric encryption, and encryption of
the spreading code (or parts thereof) using delayed key (or signal)
disclosure, as is the case for CHIMERA [3] or OSNMA, at data level [4]. Both
schemes allow the user to (mostly) apply the crucial assumption that the
encrypted authentic signal will always arrive _before_ any inauthentic signal.

In the case of symmetric encryption, the keys must be kept secret, which is
possible for governmental services (e.g., Galileo PRS). However, for open
services this is usually not considered feasible and a delayed disclosure
scheme is preferred. A key property of the delayed disclosure scheme is that
the user must know for certain that the signal was received _before_ the key
was disclosed. This places requirements on absolute time synchronization on
the user, and inherently introduces a latency between the signal reception and
the availability of the PVT.

The delayed disclosure can be implemented in several forms. Ideally, the
stream of keys that were used to encrypt the signal is distributed to the
users with appropriate latency [5]. Alternatively, the recorded samples can be
transmitted to a trusted server with access to the keys or the signal, which
then returns the PVT solution back to the user[6]. The encrypted code chips
themselves can also be transmitted to the user via a trusted side channel
after signal in space transmission. In the case of ACAS (Assisted Commercial
Authentication Service), yet another approach is introduced: The symmetrically
encrypted signal on Galileo E6-C is re-encrypted using the OSNMA keys (so-
called re-encrypted code sequences or RECS) and made publicly available for
download up to a week before the encrypted E6 signal is transmitted via SIS.
Downloading these in advance, the user can decrypt the RECS, once the OSNMA
keys are received, obtaining the encrypted E6 code chips, ready for
correlation. The ACAS concept has already been prototyped[7, 8, 9], it is
being studied for various use cases [10], and it is expected to start an
initial capability once the Galileo E6-C signal is encrypted.

In this paper we first present a number of assumptions for the ACAS processing
and the receiver architecture, and then define a few user level algorithms
that we consider essential for good protection using ACAS. To accommodate
different levels of security requirements users may have, we define three
mitigation levels. Finally we present simulation results, demonstrating the
performance of an ACAS enabled receiver to both detect inauthentic signals as
well as even maintaining operation during an advanced spoofing attack.

##  II ACAS Assumptions and Errors Sources

Before starting the analysis we list and discuss some important general
assumptions as well as some assumptions on the receiver architecture.

Assumption 0: It is assumed that the basic requirements for ACAS are
fulfilled[11]

Assumption 1: It is assumed throughout that the cryptography remains intact.
That is, only attacks that are unable to break the cryptographic material are
considered.

Assumption 2: The true encrypted signal in E6 is assumed to always be
available, and to always reach the victim _before_ its inauthentic replica.

Assumption 2 only strictly holds if the true signal is received directly. If
the receiver tracks the signal via a multipath, then it is possible that a re-
radiated signal reaches the victim before the true signal. We do not consider
the reflected-only case of the true signal to be a viable attack, since only
in very rare and constructed cases can the attacker rely on this signal
configuration.

The assumption on the availability of the encrypted signal implies that an
attacker is unable to null the encrypted signal and that it is not being
blocked.

###  II-A Assumptions on the Receiver Architecture

The ACAS receiver implementation is expected to follow a number of assumptions
for the design:

  1. 1.

Full tracking on E1 is available continuously and pseudoranges, carrier phases
and Doppler values are available.

  2. 2.

The carrier phase measurements are used to estimate the range rate over the
integration interval of the samples.

  3. 3.

The front-end design is assumed to be compatible with a state-of-the-art dual
frequency implementation on E1 and E6. In particular:

    1. (a)

Both front-ends are assumed to be driven by the same oscillator.

    2. (b)

The front-ends are synchronized such that the sample count of a sample
acquired by one front-end can be associated with the sample count of a
corresponding sample acquired on the other front-end.

    3. (c)

All digital signal conditioning is assumed to be stable and constant and as
such calibratable. This is likely to be the case for static filtering.
However, if filters are dynamically turned on and off, for example to filter
interference, then this must be accounted for.

    4. (d)

The only non-calibratable delay difference is assumed to come from analog
components and sub-sample thermal variations of the ADC. Depending on the ADC,
this can easily become in the order of a nanosecond.

###  II-B Basic ACAS Processing and Receiver Errors

We propose to start from the E1 measurements and to hand over from
measurements performed in E1 over to E6. Since most of the errors on the
pseudorange are common on both E1 and E6, and because the timing of the RECS
is essentially the time of transmission, the hand-over can be achieved in a
relatively straight-forward manner from the definition of the pseudorange:
$P_{r}:=ct_{rx}-ct^{tx}\Rightarrow t^{tx}=t_{rx}-P_{r}/c$. The only remaining
error sources are:

  * •

Thermal noise: Present both in the E6 samples and on the E1 tracking process,
and typically in the order of 0.5-1 m. [12]

  * •

Broadcast Group Delay (BGD) between E1 and E6: This is accounted for by the
BGD files of the ACAS protocol [11].

  * •

Dispersive atmospheric effects (differential ionosphere error): The residual,
differential ionospheric error can be in the order of 30 ns (10 m)[13, 14].

  * •

Non-calibrated delay differences in the receiver (analogous to the BGD in the
satellite): HW offset between E6 and E1: The main contributor is typically the
digital processing. However, this is constant and can be completely
compensated. The residual analog component is typically smaller than 10 ns (3
m).

  * •

Multipath: The differential multipath error between E1 and E6 can be in the
order of 30 ns (10 m).

The magnitude of the errors mentioned above are just typical orders of
magnitude. The error modelling will be treated in more detail in sec. V.

Provided the assumptions previously stated hold, everything else (receiver
clock, satellite clock, ephemeris, troposphere etc.) cancels out, since it
affects the measurements on both frequencies in the same way [9].

When logging the samples from E6 and the measurements on E1, the sample batch
duration must be chosen such that it contains signals from all satellites,
accommodating the un-predictable RECS offsets[11]. The receiver should log the
measurements (pseudorange, phase, Doppler, Doppler rate) with a sufficient
data rate, such that the timing and frequency offsets of the E6 signals can be
interpolated with sufficient accuracy. This depends on the expected dynamics
on the line-of-sight and clock stability.

If the assumptions in the receiver architecture above are fulfilled, a very
limited signal search (~1-10 code offsets and no Doppler search) is required
in E6.

##  III ACAS User Level Processing

This section describes user algorithms that could be implemented in a
receiver. The emphasis is on the signal processing and it is assumed that the
cryptographic operations described in [11] are implemented.

In general, the basic ACAS processing can be separated into three steps:

  1. 1.

Detect the presence of the encrypted E6 signal.

  2. 2.

Estimate an authenticated E6 range either directly from the E6 snapshot or
extrapolating to the E1 measurements.

  3. 3.

A position based on measurements from the previous step and authenticated data
from OSNMA.

To improve protection additional measures are necessary, which will be
discussed further in sec. IV.

In this paper we define the following ACAS user algorithms:

  * •

Signal Detection: When detecting the signal in E6, at least two strategies can
be pursued: selecting the correlator with the maximum power, or select the
earliest correlator with enough power to exceed the detection threshold. Both
possibilities will be analyzed here.

  * •

Estimation of the E6 code phase through linear interpolation of the early,
late and punctual correlators.

  * •

Vestigial Signal Search (VSS): If a vestigial signal is found in E1, hand over
to E6 and verify its presence in E6 and select the earliest signal to be the
true signal. This is compared to an exhaustive search in E6.

###  III-A Maximum Signal Detection

A simple detection algorithm for detecting the ACAS signal is to scan a
certain range of correlation offsets and chose the maximum signal, as follows:

  1. 1.

Hand-over of the timing and frequency from E1 to E6, extracting the timing of
the signal from the E1 measurements.

  2. 2.

Correct for inter-frequency effects, mainly receiver calibration of inter-
front-end delays, broadcast group delay (BGD), and ionosphere.

  3. 3.

Perform a coherent integration over the entire RECS for a selected number of
code offsets (~1-10 offsets). In most cases, one frequency bin should be
sufficient, as the frequency offset can be estimated from the E1 carrier phase
or Doppler.

  4. 4.

Calculate the detection threshold, depending on desired false alarm
probability ($P_{\mathit{fa}}$) (see e.g., [15]).

  5. 5.

Check that the expected carrier-to-noise density ratio $C/N_{0}$ (inferred
from E1 and antenna and front-end calibration data) gives rise to the expected
minimum probability of detection ($P_{d}$).

  6. 6.

Select the correlator with the highest power, which is also above the
detection threshold.

This algorithm is sometimes assumed in the literature[16]. It will simply find
the strongest signal that is also above the detection threshold. If a spoofing
signal is present, it is to be expected that this algorithm will happily
capture the spoofing signal, if it is just slightly stronger than the true
signal.

###  III-B Early Signal Detection

The previous maximum signal detection algorithm does not leverage assumption
2, i.e., that the true signal is always the earliest signal. Therefore, we
consider it a better strategy to actively look for and identify the earliest
signal.

Note that this algorithm tries to deal with the presence of a close-in
spoofing signal. The goal is to identify the true signal and separate it from
a potential spoofing signal. This is important for the s-curve based range
estimate to function properly, which will be discussed in the next section.

Note also that a close-in spoofing signal that is within a few chips or even a
fraction of a chip implies that the spoofing signal is only delayed by a few
microseconds. This is a very difficult attack to implement in general and
places severe restrictions on the attacker (e.g. the attacker must be very
close to the victim.). However, in specific cases, it may be feasible to mount
such an attack. See the discussion in sec. II.

The early signal detection algorithm proposed, assumes the availability of the
magnitude of multiple correlators (or sequential evaluations of one
correlator) evaluated at equidistant offsets, arranged in a vector, $\vec{c}$,
with $N$ elements.

Increasing the correlator spacing can be useful when the signal is noisy, so
the correlator spacing used for the s-curve can be larger than the distance
between adjacent elements i.e., an integer $n\geq 1$. The correlator values
involved for the s-curve calculations are then $c_{i-n}$, $c_{i}$ and
$c_{i+n}$. The steps of the algorithm are as follows:

  1. 1.

Perform steps 1 to 5 of the maximum detection algorithm above.

  2. 2.

Scan the correlators ($c_{n},c_{n+1},\ldots,c_{N-n}$) from “early” to “late”
and select the first punctual correlator (i.e. $c_{i}$) that exceeds the
acquisition threshold.

  3. 3.

If the late correlator ($c_{i+n}$) has a higher value than the punctual one
($c_{i+n}>c_{i}$), increment the index of all three correlators by _one_
($i\rightarrow i+1$). Repeat until the local maximum has been identified.

  4. 4.

Evaluate $D_{i}:=|c_{i+n}-c_{i-n}|$ and minimize $D_{i}$ under the constraint
that $c_{i}>c_{i+n}\wedge c_{i}>c_{i-n}$.

  5. 5.

If no set of correlators $c_{i-n}$, $c_{i}$ and $c_{i+n}$ within the vector
$\vec{c}$ can be found that meet the criteria above, the signal is not
detected.

The steps in the algorithm are illustrated in the figure 1 below for the case
where the correlator spacing is 2 ($n=2$). In the first picture, the middle
correlator ($c_{4}$) is above threshold, but it is not the largest one. In the
second picture, the middle correlator ($c_{5}$) is above the threshold and it
is larger than the early ($c_{3}$) and late ($c_{7}$) correlators. However, it
is not the optimal position. Moving one correlator to the right
($c_{5}\rightarrow c_{6}$) will maximize the symmetry of the correlator
configuration ($D_{6}<D_{5}$).

Figure 1: Early signal detection algorithm. The blue triangle on the left
corresponds to the early true signal and the red triangle corresponds to the
inauthentic signal.

###  III-C Range Bias Detection (S-Curve Root-Finding)

When the signal has been detected, using either of the two detection
algorithms above, the range offset between E1 and E6 can be calculated. There
are several ways to do this. For simplicity we select the linear interpolation
defined in[17]. Other methods are described in [18].

Figure 2: Illustrating the s-curve root-finding using linear interpolation.

To take advantage of the punctual correlator value as well as the early and
late, we apply a linear interpolation to find the root of the s-curve (see
fig. 2). The two correlators located on the same flank (right side, in the
example in Fig. 2) are used to determine the slope of the correlation function
($\alpha:=\Delta y/\Delta x$ in Fig. 2). The root is then determined by the
intersection of two line-segments, one going through the punctual correlator
with slope $\alpha$ and the second one going through the higher “non-punctual”
correlator with slope $-\alpha$. Let us denote the early, late, and punctual
correlators by $c_{e}$, $c_{l}$ and $c_{p}$, respectively. Further, define
$c_{max}:=\max(c_{e},c_{l})$ and $c_{min}:=\min(c_{e},c_{l})$. Then the offset
relative to the location of the punctual correlator can be written as:

$\Delta\tau=\frac{c_{max}-c_{min}}{c_{p}-c_{min}}\Delta\tau_{c}$ (1)

where $\Delta\tau_{c}$ is the correlator spacing. The location of the s-curve
maximum is then given by $\tau=\tau_{p}+\Delta\tau$, where $\tau$ is the
estimate of the offset of the maximum of the correlation function, and
$\tau_{p}$ is the location of the punctual correlator.

###  III-D Vestigial Signal Search – Exhaustive Search in E6

Looking for vestigial signals, or in other words, multiple correlation peaks
around the tracked signal, has been studied as a measure against spoofing [19,
20]. In our case, since an attacker must expect that an ACAS enabled receiver
will verify a signal in E1 by looking for the corresponding signal in E6, the
attacker must ensure its presence in E6 corresponding to the inauthentic
signal in E1111If the user cannot verify the presence of the signal in E6, it
will be declared as inauthentic.. In that case two signals are present in E6:
the true signal and the inauthentic signal. From a defense point of view, this
means that we can expect to find both the true and the inauthentic signal in
E6. Further, due to assumption 2 in section II-A, we also know that the
_earliest_ signal within the time uncertainty interval has to be the true one.

Due to the delayed key disclosure concept of OSNMA222Remember that ACAS uses
the OSNMA key to decrypt the RECS, there is a time synchronization requirement
on the receiver[11]. For one I/NAV sub-frame key delay, this is 30 seconds,
which defines the search space for the VSS. Searching for the E6 signal over
the entire initial time uncertainty (e.g., 30 seconds), for all possible code
offsets, and over all possible Doppler bins, we refer to as an exhaustive
search. An exhaustive search for vestigial signals in E6 is expensive in terms
of computational load.

A further drawback is that due to the very large number of single-event
hypotheses tests required, a threshold corresponding to a very low single-
event false alarm probability must be used, in order to achieve an acceptable
over-all false alarm probability. The effect of ACAS signal detection
degradation due to high E6 search space was already discussed in [8].

As an example, consider time uncertainty of $\Delta T=$ 30 seconds, a coherent
integration time of $T_{I}=$ 4 ms, and the chip length $T_{c}=$ 60 m
(corresponding to a BPSK(5) signal). The width of the frequency bin is then
$\Delta F=1/(2T_{I})=$ 125 Hz [18].

If we wish to search every half chip, approximately $2\Delta T/T_{c}=3\cdot
10^{8}$ chip offsets must be searched for each frequency bin. A Doppler
uncertainty of $\pm$ 5 kHz, implies 80 Doppler bins to be searched. This
yields a staggering number of $N=2.4\cdot 10^{10}$ hypothesis to be calculated
and tested.

As explained in [11], the probability of false alarm corresponds to the case
that an inauthentic signal is declared present when it is not. If we denote
the single-event false alarm probability by $P_{\mathit{fa}}$, then the
overall false alarm probability $P_{\mathit{FA}}$ is given by

$P_{\mathit{FA}}=1-(1-P_{\mathit{fa}})^{N}\Rightarrow
P_{\mathit{fa}}=1-(1-P_{\mathit{FA}})^{1/N}$ (2)

For example, for the humble value of $P_{\mathit{FA}}=10^{-3}$ for the overall
false alarm probability, we obtain a required single-event false alarm
probability of $P_{\mathit{fa}}=4.16\cdot 10^{-14}$.

Theoretically, setting the detection threshold to this single-event false
alarm, would generate a probability of detection of 90% at a $C/N_{0}=$ 40.12
dBHz for this example (see e.g. [15]).

Increasing the integration times to 8 ms or 16 ms would imply a doubling or
quadrupling of the number of hypothesis, due to the narrower Doppler bins.
Taking this into account, the required $C/N_{0}$ reduces to 37.2 dBHz and
34.27 dBHz, respectively, an improvement by about 2.9 dB in each step.

While those are quite reasonable values of $C/N_{0}$, it should be noted that
they rely heavily on the strict Gaussian behavior of the noise process, since
the threshold is set for _very_ low values of $P_{\mathit{fa}}$. If for some
reason the signal contains anything other than Gaussian noise, e.g.,
interference or multipath, then the behavior may change.

We therefore seek to develop an algorithm to significantly reduce the number
of correlations to be evaluated, where advantage is taken of the assumption
that any authentic signal in E6 must have a corresponding signal in E1.

###  III-E Vestigial Signal Search – Handover from E1

The procedure is defined as a stand-alone process that relies only on samples
from E1 and E6, and the assumption that the _true_ signal is detectable in E1.
After the results from the VSS are available, the tracking status of E1 can be
updated.

Figure 3: Illustrating the vestigial signal search (VSS) on E6 with hand-over
from E1.

The vestigial signal search (VSS) concept is shown in Fig. 3. The light blue
area in the upper part of the figure symbolizes the E1 signal. It is assumed
that a spoofing signal is present in both E1 and E6. The triangles in the
upper part symbolize the 4 ms periodicity of the E1 signal and the solid
colored ones represent the correct code phase ambiguity. The upper and lower
row of triangles represent the inauthentic and true signals, respectively.

The idea is now to perform a full search in both time and frequency for one
period of the E1 signal. Due to the periodicity of the E1 signal, we search
over one period of E1, corresponding to the purple area in Fig. 3. Normally,
we expect to find only the true signal. However, if an inauthentic signal is
present as well, two signals should be found: the true and the inauthentic one
(two encircled triangles at 1 in Fig. 3).

For any signal that is detected in E1, a hand-over is done to E6 (2 in Fig.
3).

The E6 signal is aligned to the E1 signal, and must therefore be located at
the same offset in E6, modulo 4 ms. Potential locations in E6 shown as yellow
boxes in the lower part of Fig. 3. After the handover, the search is then
continued in E6, by incrementing the code offset by 4 ms (3 in Fig. 3).

If more than one signal is found in E6 (4 in Fig. 3), the receiver must
compare the timing of the signals in E6 and select the earliest one and
declare spoofing. Note that under the assumptions made, it is assumed safe to
use the true signal, even in the presence of the spoofing signal.

As an alternative to the acquisition step in E1 (1 in Fig. 3), the receiver
could simply fully track both the true and the inauthentic E1 signal, resolve
the code phase ambiguity (jumping straight to the solid triangles in the upper
part of Fig. 3.), and then do the hand-over, thus omitting the search over all
the yellow boxes. This may be a less resource demanding alternative in some
situations, but it would require a full extra channel and it would be more
intrusive in an existing receiver design. Besides, we expect the presence of
an inauthentic signal to be a seldom event, in which case the procedure
terminates before the actual the handover to E6 is done. We mention both
possibilities here as design choices.

Finally, it should be mentioned that the large search space (in the order of
30 seconds) must only be searched in the beginning, _if_ the search in E1
detects more than one signal. After the receiver has calculated the first
authentic PVT, the time uncertainty is much reduced for subsequent searches.

Denoting, as before, the overall time uncertainty by $\Delta T=30$s and the
period of the E1 signal by $\delta T=10^{-3}$s, we can then estimate the
number of hypothesis as follows $\Delta T/\delta T=30/4\cdot 10^{-3}=7500$
hypothesis per Doppler bin. Since we can predict the Doppler bin, there is
only one Doppler bin to search. Thus, the hand-over search is about a million
times less complex than the full exhaustive search333Using FFT based
techniques, having the complexity $n\log(n)$ will dramatically reduce this
ratio..

Comparing this to the case above with an overall false alarm probability of
$P_{\mathit{FA}}=10^{-3}$, we would require a single-event false alarm
probability of $P_{\mathit{fa}}=1.33\cdot 10^{-7}$ (compared to
$P_{\mathit{fa}}=4.16\cdot 10^{-14}$ for the exhaustive search case), which
would lead to a required $C/N_{0}=37.66$ dBHz for the same overall false alarm
probability (compared to $C/N_{0}=40.12$ dBHz for the exhaustive search
case.). The required $C/N_{0}$ is then about 2.46 dB less than in the
exhaustive search case.

However, if the attacker were able to mask out or null the true signal on E1,
this would potentially cause the victim receiver to miss the true signal and
only discover the spoofing signal during the handover process, or stay locked
to a meaconing E6 signal.

##  IV ACAS Threat Mitigation Levels

We define a set of measures that would give a good level of protection against
as large a set of attacks as possible. Since applications may have different
levels of required protection, we introduce three mitigation levels. Level one
is limited to the direct processing of the data (RECS, BGD, OSNMA) provided by
ACAS. The second level includes more defenses to mitigate more threats, at
reasonable cost and effort, and at the third mitigation level, we try to
maximize the defenses.

###  IV-A Mitigation Level 1

We first consider a “minimum defense strategy” that we refer to as a “level 1
defense”. This procedure is limited to only check for the ACAS signal and
compare it to the E1 measurements:

  1. 1.

Check that significant E6 correlation power is obtained at the expected
offset, based on the E1 measurement using the algorithms in Section III-A or
Section III-B. The test should be against a threshold established from the
post-correlation noise output. If the check is against the correlator output
using a code not present in the signal, this will also defend against attacks
that simply push the correlation power up444There may also be an issue with
the RF chain approaching saturation..

  2. 2.

Check that the difference in pseudorange between E1 and E6 is within an
acceptable range. This can be done in snapshot mode on E6 using the algorithm
described in Section III-C. The resulting offset relative to the corresponding
pseudorange measurement on E1 is compared against a threshold, as outlined in
[11].

This will defend against any spoofing attack that operates on E1 only, since
the check on E6 would raise an alarm with the corresponding probabilities
($P_{\mathit{FA}}$ and $P_{d}$) in this case.

We expect any attack that manages to place the E6 encrypted signal
consistently with the E1 measurements to be successful against the level 1
strategy. A simple meaconing attack on both frequencies could achieve this.

###  IV-B Mitigation Level 2

The next level aims to further reduce the set of successful attacks. The
following steps are assumed to be performed in _addition_ to the previously
described steps:

  1. 3.

Perform AGC and $C/N_{0}$ monitoring. See e.g. discussion in [21].

  2. 4.

Look for vestigial signals with handover from E1 (see sec. III-E)

  3. 5.

PVT-level monitoring

     * •

Monitor the clock drift

     * •

RAIM check

The level 2 strategy is expected to detect a plain jamming attack, due to item
3 above.

When a RECS is available, we expect this strategy to defend against a large
set of attacks. However, it is possible that a very advanced attacker uses a
smart jammer to null out the true signal in E1. Therefore, the assumption on
the simultaneous presence of signals in E1 and E6 may _not always_ hold, which
is the basis for the VSS with handover from E1.

Also, all the measurements between RECS are not protected, which would require
continuous monitoring. The AGC & $C/N_{0}$ monitoring and the PVT-level
monitoring will provide some protection between RECS, but we consider the
metrics proposed in [22] even better suited for this.

As explained in [23], a well-tuned weak jammer could prevent the user from
accessing the OSNMA data on I/NAV, by jamming the signal just enough to
generate enough bit errors, such that the data cannot be correctly
demodulated. We expect such an unnoticed denial-of-service attack to be
successful under the level 2 strategy.

###  IV-C Mitigation Level 3

With the third level strategy we try to remove any residual threat. We suggest
the following enhancement of the level 2 mitigation strategy, where steps 4
and 5 replace the corresponding steps in mitigation level 2.

  1. 4.

Obtain assisted OSNMA (ANMA)[24]555Although ANMA does not exist as an official
service, we reference it here as it has been analyzed in the literature, and
we consider such a service to be very useful.. Although the ACAS concept is
designed for unconnected users, this step is still considered valid in the
ACAS context since:

     * •

The data rate implied for ANMA is much lower than downloading the RECS.

     * •

An on-line version of ACAS is also conceivable for connected users.

  2. 5.

Look for vestigial signals using an exhaustive search in E6 (see sec. III-D),
to counter the possible nulling of the true signal in E1.

  3. 6.

PVT-level monitoring:

     * •

Monitor the Clock Drift

     * •

RAIM Check

  4. 7.

Bridging between ACAS authentications. To defend against this, we propose to
add the detection metrics researched in [22]. Using additional sensors like
IMU can also be helpful here.

Due to item 4, the OSNMA bit error attack discussed above [23] could be
detected, but not mitigated.

###  IV-D Summary and Residual Threats

In Fig. 4 the three mitigation levels are summarized, together with threats
that the mitigation levels are expected to defend against and residual
threats. Note that it is thinkable that there exist threats that have not been
taken into account. It is also not guaranteed that the threats are mitigated
to 100%, as there will always be a residual risk that a particular defense is
penetrated. This is related to the $P_{\mathit{fa}}$ and $P_{d}$ previously
discussed.

Regarding the residual threat of level 3, it is always assumed that given
enough interference power, it will always be possible to create enough
interference such that a PVT cannot be measured, regardless of the defense.

Figure 4: Overview of mitigation levels, threats mitigated and the residual
threats.

##  V ACAS Modelling

To verify the user algorithms and the mitigation levels, we developed a
simulator with the following main objectives:

  * •

Analyze the performance of the ACAS Authentication.

  * •

Emulate the receiver implementation concerning algorithms involving the
measurements.

  * •

Provide a framework to implement simulated spoofing attacks.

Note that the simulator is fundamentally a single line-of-sight simulation,
and our results are complemented by real-live data from e.g. [9]. In Fig. 5 an
overview of the ACAS simulator is given. The main components are:

  * •

Signal generator: Generates signal samples and applies range modelling

  * •

Receiver simulation: Emulates the sampling process, applies error modelling
(multipath, ionosphere etc.)

  * •

Spoofing module: Models spoofing signals and adds them to the “true” signal.

  * •

ACAS processor: High-level steering of the ACAS processing. Uses the sample
processor for low-level signal processing

  * •

Sample processor: Used by the ACAS processor to perform signal processing
(mainly RECS correlation) collected by the receiver model.

Figure 5: Overview of the ACAS Simulator architecture.

The signal generator module modulates the codes onto a complex RF signal. The
modulator is implemented as a continuous complex function of time that can be
sampled with arbitrary sample rates. Doppler is applied on both code and
carrier.

The simple line-of-sight range model in Eq.3 is applied to the samples. This
model is well suited to generate all kinds of dynamic situations as well as
any corner case, including user dynamics. However, this model does not
accurately model any orbit or user dynamics.

The ACAS Processor receives observables and the sample batches from the
receiver model and then performs the signal detection in E6 (see Section III).

The receiver model generates pseudorange, carrier phase and Doppler
measurements on E1 and samples on E6, with the input from the spoofing module.
The following error models are applied in the simulation:

  * •

Two-state receiver clock model, based on the Allan variance parameters $h_{0}$
and $h_{-2}$. In all simulations, the following values were used[25]:
$h_{0}=7.115\cdot 10^{-24}$, $h_{-2}=4.311\cdot 10^{-21}$.

  * •

Statistical multipath model described in [22]. This model was derived from the
Land Mobile Satellite Channel Model (LMSCM) described in [26, 27]. The model
is applied on sample-level to the simulated E6 samples.

  * •

Statistical ionosphere error model, based on measurement campaigns performed
by the gAGE group [28, 14]. The dataset spans a network of over 180 reference
stations world-wide, and the two full data sets of the years 2014 (solar
maximum) and 2017 (average solar activity) were used.

  * •

Noise modelling on the E1 measurements, based on the Betz theory [12].

  * •

Gaussian white noise is added to the samples, based on the configured
$C/N_{0}$ and bandwidth.

##  VI Simulation Results

Out of the many simulations performed, in this section we present the results
of two simulations, which we consider the most representative at this stage: A
non-spoofing scenario, and an advanced spoofing scenario with a zero-delay
attack, followed by signal lift-off. Both include all error models and harsh
signal conditions ($C/N_{0}=$ 35 dBHz). For the line-of-sight dynamics the
following model is used:

$s(t)=s_{0}+vt+at^{2}/2+A\sin(\omega t)$ (3)

with the following parameters:

  * •

$s_{0}$ = 0 m

  * •

$v$ = 51.023 m/s

  * •

$a$ = 0 m/s2

  * •

$A$ = 0.5012 m

  * •

$\omega=2\pi\cdot 0.5012$ rad/s

The parameters above imply a maximum line-of-sight acceleration of about $9g$.
The model could be considered quite dynamic and worse than nominal, but it is
maintained here for a more worst-case consideration.

###  VI-A ACAS Performance under Harsh Conditions, no Spoofing

The detection threshold for the single event detection for the RECS is set to
$P_{\mathit{fa}}=10^{-7}$. The ionospheric model uses the statistical data
from 2014 (high solar activity)[13, 14]. The multipath model was set to the
range of elevations of [5..30] degrees. The simulation was run for 100,000
seconds, using a RECS length of 16 ms, which corresponds to the maximum RECS
length currently expected in the specification [11]. The number of correlators
was set to 11 with a correlator spacing of 15 m, about a quarter of an E6-C
BPSK(5) chip.

Figure 6 shows the output of the correlator that was selected to detect the
signal. The red dots indicate the status of the signal detection: 1: signal
was detected, 0: signal was not detected. 52 missed detection events were
recorded for the 100,000 measurements, indicating a detection probability of
$P_{d}=$ 99.95%. The theoretical probability of detection for the
corresponding noise-only case (i.e., $C/N_{0}=$ 35 dBHz, $T_{I}=10^{-7}$,
$P_{\mathit{fa}}=10^{-7}$) is $P_{d}=$ 99.9995% and that for $C/N_{0}=$ 34
dBHz is $P_{d}=$ 99.96%.

Figure 6: Output of the detecting correlator. The orange curve: magnitude,
blue curve: phase. The red dots indicate signal detection (1: Signal detected,
0: Signal not detected.

Figures 7 and 8 show the correlator output and a histogram of the magnitude of
the detecting correlator, respectively. It should be noted that the histogram
for the signal detection events is cut off at the detection threshold. This is
because the signal is not defined if none of the correlators are above the
threshold.

Figure 7: Waterfall plot of the magnitude of the correlation function. 11
correlators were used with a correlator spacing of 15 m. Figure 8: Histogram -
Signal detection for the nominal scenario under harsh signal conditions
($C/N_{0}=$ 35 dBHz).

Fig. 9 and Fig. 10 show the s-curve range detection. Fig. 9 shows a histogram
in logarithmic scale and Fig. 10 shows the same data as a time-series. The
effect of the ionospheric error model is seen on the right side. The right
flank of the histogram falls off linearly. This is an indication that the
distribution of the ionospheric error is heavy tailed, invalidating Gaussian
approximations (see e.g. [29] on Gaussian over-bounding of heavy-tailed
distributions).

Figure 9: Histogram - Range detection for the nominal scenario under harsh
signal conditions ($C/N_{0}=$ 35 dBHz). Figure 10: Time series of the range
detection for the nominal scenario under harsh signal conditions ($C/N_{0}=$
35 dBHz).

To the left on the histogram there is a very small accumulation around -22.5
m. These events correspond to events where the early acquisition algorithm
triggers on the left flank of the correlation function.

###  VI-B ACAS Performance under Harsh Conditions and Spoofing

This section presents a simulated spoofing attack to demonstrate the
feasibility of the ACAS processing under such conditions. We consider the same
environment as in the previous simulation but including the spoofer. Two
separate runs are performed: one using the maximum signal detection algorithm
and one using the early signal detection algorithm.

The spoofing scenario is shown in the figure 11. The profile of the spoofing
signal starts at the front of the figure, and the distance between the true
signal and the spoofing signal is modelled as a sine wave, approaching the
true signal from the right.

The power of the spoofing signal is very low, both when approaching the true
signal and when it is directly on top of the true signal. This makes sense, as
it prevents excessive fading and too high amplitude. Before the spoofing
signal “leaves” the true signal, the magnitude must be increased relatively
fast to sustain a self-standing signal when both signals are not (or only
partly) added.

Figure 11: Waterfall plot of the correlators for the spoofing attack scenario
under harsh conditions ($C/N_{0}=$ 35 dBHz).

Note that this kind of spoofing attack would be _very difficult_ to mount, and
depending on the scenario, in some cases even impossible, as the true signal
will always arrive before the spoofing signal (assumption 2 above), while for
a zero-delay attack the delay of the inauthentic signal can be made
arbitrarily small. Note that just one E6-C chip of delay ($0.195\mu$s, or
58.7m) may render this attack impossible.

The plots in figures 12 and 13 show the output of the detecting correlator,
its phase and the signal detection status. In figure 12 the results from using
the early detector algorithm are shown, and in figure 13 the result from the
maximum detector can be seen. In both figures, the transition region at $T=$
600 seconds is evident, in which the spoofer attempts to carry off the signal.
As the spoofer comes in, the phase starts rotating and at the spot where the
spoofer transitions from approaching to pulling away, there is a small region
where the phase and the changes in amplitude calm down a bit. In case of the
maximum detector, the phase continues to rotate after the spoofer starts to
move away.

Figure 12: Early detector - Output of the detecting correlator for the
spoofing attack scenario. Figure 13: Maximum detector - Output of the
detecting correlator for the spoofing attack scenario.

In Fig. 14 and Fig. 15, the estimate of the s-curve error (using the true E1
signal as a reference) is shown. At the beginning when the spoofer sets in,
between $T=$ 500 seconds and $T=$ 750 seconds, we notice a small upward curve
in the range estimate in both cases.

Then when the spoofer turns up the power, it captures the range estimate at
the beginning in both cases. However, in the case of the early detector, the
range estimate goes back to the baseline after about $T=$ 1050 seconds, after
some fluctuations. For the maximum detector, this is not the case and it
follows the spoofer quite well. Note the toggling between the spoofer and the
baseline. There are at least three reasons for this:

  * •

Fading between the true and the spoofing signal

  * •

Thermal noise: sometimes the noise is higher in the “true correlator” and
sometimes it is higher in the “spoofing correlator”

  * •

The spacing between correlators: When the maximum of the signals are located
on a correlator, the magnitude is maximized.

Figure 14: Early detector - Estimate of the s-curve offset for the spoofing
attack scenario. Figure 15: Maximum detector - Estimate of the s-curve offset
for the spoofing attack scenario.

Note the one outlier in Fig. 14 at around $T=800$ seconds. This is the same
effect observed in Fig. 9 and Fig. 10, where the signal is detected on the
flank of the correlation function.

In summary, in the case of spoofing, even a zero-delay E6-meaconing attack can
be detected from the beginning, as shown in Fig. 12, and mitigated after some
minutes, as shown in Fig. 14.

##  VII Conclusions

The purpose of this work was to assess to which extent Galileo ACAS can
protect against spoofing, and how it can be strengthened by additional
receiver checks.

The receiver can assume that the true E6-C encrypted signal always arrives
before any other signal. Considering this assumption, two user algorithms are
presented and analyzed. Firstly, the proposed early signal detection algorithm
applied on the E6-C snapshot correlators detects the true E6-C signal even in
the presence of a stronger later spoofing signal. Secondly, vestigial signal
search (VSS) strategies are proposed and optimized. Vestigial search is
applied first in E1, before handing over to E6-C. The periodicity of the E1
open code reduces the computational complexity be a factor of a million, and
increases the sensitivity by about 2.5 dB compared to an exhaustive search in
E6.

We then define three receiver mitigation levels. The first one is limited to
basic ACAS processing, simply checking the presence of the E6 encrypted
signal. The second level adds E1-based vestigial signal search, $C/N_{0}$ and
total noise power monitoring, and E6-C early signal detection. Residual risks
(e.g. masking out E1 or other denial of service attacks) are covered by the
third level.

A detailed line-of-sight simulator was implemented to test the performance of
the user algorithms. The simulator models ionosphere, multipath, noise on both
measurements and samples, receiver clock and user dynamics. An advanced
spoofing attack, corresponding to a signal lift-off attack, was implemented as
well. We present results of two tests, both under harsh conditions, including
a $C/N_{0}=$ 35 dBHz, multipath and high ionospheric activity. The second
simulation introduces a lift-off type of spoofer under the same conditions.

The simulation results show that, in the absence of spoofing, ACAS RECS
performs reliably even in harsh conditions and with realistic ionosphere,
multipath and dynamic models. In particular, with 16-ms RECS and a false alarm
probability of $10^{-7}$, a probability of detection of $P_{d}=$ 99.95% is
obtained. In the case of spoofing, and under similar conditions, a zero-delay
E6 meaconing attack was detected from the beginning and mitigated after some
minutes, allowing the receiver to continue operation even under spoofing
conditions.

Further work will include expanding VSS and early signal detection testing
with further configurations and scenarios, and testing ACAS and the proposed
methods with real signals.

##  VIII Disclaimer

The content of this article does not necessarily reflect the official position
the authors’ organizations. Responsibility for the information and views set
out in this article lies entirely with the authors. In particular, future ACAS
publications, reference algorithms, standards or user scenarios may differ
from the algorithms or techniques proposed in this work.

## References

  * [1] I. Fernández-Hernández, V. Rijmen, G. Seco-Granados, J. Simon, I. Rodríguez, and J. D. Calle, “A navigation message authentication proposal for the galileo open service,” _NAVIGATION: Journal of the Institute of Navigation_ , vol. 63, no. 1, pp. 85–102, 2016.
  * [2] “Tests of Galileo OSNMA underway,” http://https://www.euspa.europa.eu/newsroom/news/tests-galileo-osnma-underway, accessed: 2021-02-11.
  * [3] J. M. Anderson, K. L. Carroll, N. P. DeVilbiss, J. T. Gillis, J. C. Hinks, B. W. O’Hanlon, J. J. Rushanan, L. Scott, and R. A. Yazdi, “Chips-message robust authentication (chimera) for GPS civilian signals,” in _Proceedings of the 30th International Technical Meeting of The Satellite Division of the Institute of Navigation (ION GNSS+ 2017)_. Institute of Navigation, nov 2017.
  * [4] I. Fernández-Hernández, T. Ashur, and V. Rijmen, “Analysis and recommendations for mac and key lengths in delayed disclosure gnss authentication protocols,” _IEEE Transactions on Aerospace and Electronic Systems_ , vol. 57, no. 3, pp. 1827–1839, 2021.
  * [5] L. Scott, “Anti-spoofing & authenticated signal architectures for civil navigation systems,” in _Proceedings of the 16th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GPS/GNSS 2003)_ , 2003, pp. 1543–1552.
  * [6] S. Lo, D. D. Lorenzo, P. Enge, D. Akos, and P. Bradley, “Signal Authentication: A Secure Civil GNSS for Today,” _Inside GNSS_ , Sep. 2009.
  * [7] I. Fernandez-Hernandez, S. Cancela, R. Terris-Gallego, G. Seco-Granados, J. A. López-Salcedo, C. O’Driscoll, J. Winkel, A. d. Chiara, C. Sarto, V. Rijmen _et al._ , “Semi-assisted signal authentication based on galileo acas,” _arXiv preprint_ , 2022.
  * [8] R. Terris-Gallego, J. A. López-Salcedo, G. Seco-Granados, and I. Fernandez-Hernandez, “Operating modes and performance evaluation of galileo assisted commercial authentication service,” in _Proceedings of the 35th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2022)_ , 2022, pp. 3393–3407.
  * [9] R. Terris-Gallego, J. A. Lopez-Salcedo, G. Seco-Granados, and I. Fernandez-Hernandez, “E1-E6 SDR platform based on bladeRF for testing Galileo Assisted Commercial Authentication Service,” in _Proc. European Navigation Conference (ENC)_ , Jun. 2023.
  * [10] F. Ardizzon, L. Crosara, N. Laurenti, S. Tomasin, and N. Montini, “Authenticated timing protocol based on galileo acas,” _Sensors_ , vol. 22, no. 16, p. 6298, 2022.
  * [11] I. Fernandez-Hernandez, J. Winkel, C. O’Driscoll, S. Cancela, R. Terris-Gallego, J. A. López-Salcedo, G. Seco-Granados, A. D. Chiara, C. Sarto, D. Blonski, and J. D. Blas, “Semi-assisted signal authentication for Galileo: Proof of concept and results,” _IEEE Transactions on Aerospace and Electronic Systems_ , pp. 1–13, 2023.
  * [12] J. W. Betz and K. R. Kolodziejski, “Extended Theory of Early-Late Code Tracking for Bandlimited GPS Receiver,” _Navigation: Journal of The Institute of Navigation_ , vol. 47, no. 3, pp. 211–226, 2000.
  * [13] A. Rovira-Garcia, J. M. Juan, J. Sanz, G. González-Casado, and D. Ibáñez, “Accuracy of ionospheric models used in GNSS and SBAS: methodology and analysis,” _Journal of Geodesy_ , vol. 90, no. 3, pp. 229–240, oct 2015.
  * [14] A. Rovira-Garcia, D. Ibáñez-Segura, R. Orús-Perez, J. M. Juan, J. Sanz, and G. González-Casado, “Assessing the quality of ionospheric models through GNSS positioning error: methodology and results,” _GPS Solutions_ , vol. 24, no. 1, p. 4, 2019. [Online]. Available: https://doi.org/10.1007/s10291-019-0918-z
  * [15] E. D. Kaplan and C. J. Hegarty, _Understanding GPS Principles and Applications_. Artech House, 2006.
  * [16] M. Psiaki and T. Humphreys, “GNSS Spoofing and Detection,” in _Proceedings of the IEEE_ , vol. 104, no. 6, 2016, pp. 1258–1270.
  * [17] G. Lopez-Risueno and G. Seco-granados, “Measurement and processing of indoor gps signals using one-shot software receiver,” in _Proceedings of ESA NAVITEC, Noordwijk, NL, pp. 1–9, 2004._ Noordwijk, The Netherlands: ESA, December 2004.
  * [18] K. Borre, I. Fernandez-Hernandez, J. A. López-Salcedo, and M. Z. H. Bhuiyan, _GNSS Software Receivers_. Cambridge University Press, 2022.
  * [19] C. Hegarty, B. O’Hanlon, A. Odeh, K. Shallberg, and J. Flake, “Spoofing detection in gnss receivers through cross-ambiguity function monitoring,” in _Proceedings of the 32nd International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2019)_ , 2019, pp. 920–942.
  * [20] S. Ahmed, S. Khanafseh, and B. Pervan, “Spoofing detection using decomposition of the complex cross ambiguity function with measurement correlation,” in _2023 IEEE/ION Position, Location and Navigation Symposium (PLANS)_. IEEE, 2023, pp. 500–510.
  * [21] S. Lo, F. Rothmaier, D. Miralles, D. Akos, and T. Walter, “Developing a Practical GNSS Spoofing Detection Thresholds for Receiver Power Monitoring,” in _Proceedings of the 34th International Technical Meeting of the Satellite Division of The Institute of Navigation (ION GNSS+ 2021)_ , St. Louis, Missouri, Sep. 2021, pp. 803–815.
  * [22] K. Wesson, J. Gross, T. Humphreys, and B. Evans, “Gnss signal authentication via power and distortion monitoring,” _IEEE Transactions on Aerospace and Electronic Systems_ , vol. 54, no. 2, pp. 739–754, 4 2018.
  * [23] J. T. Curran, M. Bavaro, P. Closas, and M. Navarro, “A Look at the Threat of Systematic Jamming of GNSS,” _InsideGNSS_ , 2017.
  * [24] C. O’Driscoll, J. Winkel, and I. F. Hernandez, “Assisted NMA proof of concept on android smartphones,” in _2023 IEEE/ION Position, Location and Navigation Symposium (PLANS)_. IEEE, apr 2023.
  * [25] J. McNeill, S. Razavi, K. Vedula, and D. R. Brown, “Experimental characterization and modeling of low-cost oscillators for improved carrier phase synchronization,” in _2017 IEEE International Instrumentation and Measurement Technology Conference (I2MTC)_. IEEE, may 2017.
  * [26] A. Steingass and A. Lehner, “Measuring the navigation multipath channel - a statistical analysis,” in _Proceedings of the 17th International Technical Meeting of the Satellite Division of The Institute of Navigation_ , Long Beach, Sep. 2004.
  * [27] A. Lehner, _Multipath Channel Modelling for Satellite Navigation Systems_ , ser. Berichte aus der Luft- und Raumfahrttechnik. Aachen: Shaker Verlag, 2007.
  * [28] J. Sanz, J. Miguel Juan, A. Rovira-Garcia, and G. González-Casado, “GPS differential code biases determination: methodology and analysis,” _GPS Solutions_ , vol. 21, no. 4, pp. 1549–1561, 2017. [Online]. Available: https://doi.org/10.1007/s10291-017-0634-5
  * [29] J. Larson, “Gaussian-Pareto overbounding: A method for managing risk in safety-critical navigation systems,” phdthesis, University of Minnesota, 2018.


FERMILAB-PUB-08-582-E

# Measurement of $\gamma+b+X$ and $\gamma+c+X$ production cross sections in
$p\bar{p}$ collisions at $\sqrt{s}=1.96~{}\text{TeV}$

V.M. Abazov36 B. Abbott75 M. Abolins65 B.S. Acharya29 M. Adams51 T. Adams49 E.
Aguilo6 M. Ahsan59 G.D. Alexeev36 G. Alkhazov40 A. Alton64,a G. Alverson63
G.A. Alves2 M. Anastasoaie35 L.S. Ancu35 T. Andeen53 B. Andrieu17 M.S.
Anzelc53 M. Aoki50 Y. Arnoud14 M. Arov60 M. Arthaud18 A. Askew49,b B. Åsman41
A.C.S. Assis Jesus3 O. Atramentov49 C. Avila8 J. BackusMayes82 F. Badaud13 L.
Bagby50 B. Baldin50 D.V. Bandurin59 P. Banerjee29 S. Banerjee29 E. Barberis63
A.-F. Barfuss15 P. Bargassa80 P. Baringer58 J. Barreto2 J.F. Bartlett50 U.
Bassler18 D. Bauer43 S. Beale6 A. Bean58 M. Begalli3 M. Begel73 C. Belanger-
Champagne41 L. Bellantoni50 A. Bellavance50 J.A. Benitez65 S.B. Beri27 G.
Bernardi17 R. Bernhard23 I. Bertram42 M. Besançon18 R. Beuselinck43 V.A.
Bezzubov39 P.C. Bhat50 V. Bhatnagar27 G. Blazey52 F. Blekman43 S. Blessing49
K. Bloom67 A. Boehnlein50 D. Boline62 T.A. Bolton59 E.E. Boos38 G. Borissov42
T. Bose77 A. Brandt78 R. Brock65 G. Brooijmans70 A. Bross50 D. Brown19 X.B.
Bu7 N.J. Buchanan49 D. Buchholz53 M. Buehler81 V. Buescher22 V. Bunichev38 S.
Burdin42,c T.H. Burnett82 C.P. Buszello43 P. Calfayan25 B. Calpas15 S.
Calvet16 J. Cammin71 M.A. Carrasco-Lizarraga33 E. Carrera49 W. Carvalho3
B.C.K. Casey50 H. Castilla-Valdez33 S. Chakrabarti72 D. Chakraborty52 K.M.
Chan55 A. Chandra48 E. Cheu45 D.K. Cho62 S. Choi32 B. Choudhary28 L.
Christofek77 T. Christoudias43 S. Cihangir50 D. Claes67 J. Clutter58 M.
Cooke50 W.E. Cooper50 M. Corcoran80 F. Couderc18 M.-C. Cousinou15 S. Crépé-
Renaudin14 V. Cuplov59 D. Cutts77 M. Ćwiok30 H. da Motta2 A. Das45 G. Davies43
K. De78 S.J. de Jong35 E. De La Cruz-Burelo33 C. De Oliveira Martins3 K.
DeVaughan67 F. Déliot18 M. Demarteau50 R. Demina71 D. Denisov50 S.P. Denisov39
S. Desai50 H.T. Diehl50 M. Diesburg50 A. Dominguez67 T. Dorland82 A. Dubey28
L.V. Dudko38 L. Duflot16 S.R. Dugad29 D. Duggan49 A. Duperrin15 S. Dutt27 J.
Dyer65 A. Dyshkant52 M. Eads67 D. Edmunds65 J. Ellison48 V.D. Elvira50 Y.
Enari77 S. Eno61 P. Ermolov38,‡ M. Escalier15 H. Evans54 A. Evdokimov73 V.N.
Evdokimov39 A.V. Ferapontov59 T. Ferbel61,71 F. Fiedler24 F. Filthaut35 W.
Fisher50 H.E. Fisk50 M. Fortner52 H. Fox42 S. Fu50 S. Fuess50 T. Gadfort70
C.F. Galea35 C. Garcia71 A. Garcia-Bellido71 V. Gavrilov37 P. Gay13 W. Geist19
W. Geng15,65 C.E. Gerber51 Y. Gershtein49,b D. Gillberg6 G. Ginther71 B.
Gómez8 A. Goussiou82 P.D. Grannis72 H. Greenlee50 Z.D. Greenwood60 E.M.
Gregores4 G. Grenier20 Ph. Gris13 J.-F. Grivaz16 A. Grohsjean25 S.
Grünendahl50 M.W. Grünewald30 F. Guo72 J. Guo72 G. Gutierrez50 P. Gutierrez75
A. Haas70 N.J. Hadley61 P. Haefner25 S. Hagopian49 J. Haley68 I. Hall65 R.E.
Hall47 L. Han7 K. Harder44 A. Harel71 J.M. Hauptman57 J. Hays43 T. Hebbeker21
D. Hedin52 J.G. Hegeman34 A.P. Heinson48 U. Heintz62 C. Hensel22,d K. Herner72
G. Hesketh63 M.D. Hildreth55 R. Hirosky81 T. Hoang49 J.D. Hobbs72 B.
Hoeneisen12 M. Hohlfeld22 S. Hossain75 P. Houben34 Y. Hu72 Z. Hubacek10 N.
Huske17 V. Hynek9 I. Iashvili69 R. Illingworth50 A.S. Ito50 S. Jabeen62 M.
Jaffré16 S. Jain75 K. Jakobs23 C. Jarvis61 R. Jesik43 K. Johns45 C. Johnson70
M. Johnson50 D. Johnston67 A. Jonckheere50 P. Jonsson43 A. Juste50 E.
Kajfasz15 D. Karmanov38 P.A. Kasper50 I. Katsanos70 V. Kaushik78 R. Kehoe79 S.
Kermiche15 N. Khalatyan50 A. Khanov76 A. Kharchilava69 Y.N. Kharzheev36 D.
Khatidze70 T.J. Kim31 M.H. Kirby53 M. Kirsch21 B. Klima50 J.M. Kohli27 J.-P.
Konrath23 A.V. Kozelov39 J. Kraus65 T. Kuhl24 A. Kumar69 A. Kupco11 T. Kurča20
V.A. Kuzmin38 J. Kvita9 F. Lacroix13 D. Lam55 S. Lammers70 G. Landsberg77 P.
Lebrun20 W.M. Lee50 A. Leflat38 J. Lellouch17 J. Li78,‡ L. Li48 Q.Z. Li50 S.M.
Lietti5 J.K. Lim31 J.G.R. Lima52 D. Lincoln50 J. Linnemann65 V.V. Lipaev39 R.
Lipton50 Y. Liu7 Z. Liu6 A. Lobodenko40 M. Lokajicek11 P. Love42 H.J.
Lubatti82 R. Luna-Garcia33,e A.L. Lyon50 A.K.A. Maciel2 D. Mackin80 R.J.
Madaras46 P. Mättig26 A. Magerkurth64 P.K. Mal82 H.B. Malbouisson3 S. Malik67
V.L. Malyshev36 Y. Maravin59 B. Martin14 R. McCarthy72 M.M. Meijer35 A.
Melnitchouk66 L. Mendoza8 P.G. Mercadante5 M. Merkin38 K.W. Merritt50 A.
Meyer21 J. Meyer22,d J. Mitrevski70 R.K. Mommsen44 N.K. Mondal29 R.W. Moore6
T. Moulik58 G.S. Muanza15 M. Mulhearn70 O. Mundal22 L. Mundim3 E. Nagy15 M.
Naimuddin50 M. Narain77 H.A. Neal64 J.P. Negret8 P. Neustroev40 H. Nilsen23 H.
Nogima3 S.F. Novaes5 T. Nunnemann25 D.C. O’Neil6 G. Obrant40 C. Ochando16 D.
Onoprienko59 N. Oshima50 N. Osman43 J. Osta55 R. Otec10 G.J. Otero y Garzón1
M. Owen44 M. Padilla48 P. Padley80 M. Pangilinan77 N. Parashar56 S.-J.
Park22,d S.K. Park31 J. Parsons70 R. Partridge77 N. Parua54 A. Patwa73 G.
Pawloski80 B. Penning23 M. Perfilov38 K. Peters44 Y. Peters26 P. Pétroff16 M.
Petteni43 R. Piegaia1 J. Piper65 M.-A. Pleier22 P.L.M. Podesta-Lerma33,f V.M.
Podstavkov50 Y. Pogorelov55 M.-E. Pol2 P. Polozov37 B.G. Pope65 A.V. Popov39
C. Potter6 W.L. Prado da Silva3 H.B. Prosper49 S. Protopopescu73 J. Qian64 A.
Quadt22,d B. Quinn66 A. Rakitine42 M.S. Rangel2 K. Ranjan28 P.N. Ratoff42 P.
Renkel79 P. Rich44 M. Rijssenbeek72 I. Ripp-Baudot19 F. Rizatdinova76 S.
Robinson43 R.F. Rodrigues3 M. Rominsky75 C. Royon18 P. Rubinov50 R. Ruchti55
G. Safronov37 G. Sajot14 A. Sánchez-Hernández33 M.P. Sanders17 B. Sanghi50 G.
Savage50 L. Sawyer60 T. Scanlon43 D. Schaile25 R.D. Schamberger72 Y.
Scheglov40 H. Schellman53 T. Schliephake26 S. Schlobohm82 C. Schwanenberger44
R. Schwienhorst65 J. Sekaric49 H. Severini75 E. Shabalina51 M. Shamim59 V.
Shary18 A.A. Shchukin39 R.K. Shivpuri28 V. Siccardi19 V. Simak10 V.
Sirotenko50 P. Skubic75 P. Slattery71 D. Smirnov55 G.R. Snow67 J. Snow74 S.
Snyder73 S. Söldner-Rembold44 L. Sonnenschein17 A. Sopczak42 M. Sosebee78 K.
Soustruznik9 B. Spurlock78 J. Stark14 V. Stolin37 D.A. Stoyanova39 J.
Strandberg64 S. Strandberg41 M.A. Strang69 E. Strauss72 M. Strauss75 R.
Ströhmer25 D. Strom53 L. Stutte50 S. Sumowidagdo49 P. Svoisky35 A. Sznajder3
A. Tanasijczuk1 W. Taylor6 B. Tiller25 F. Tissandier13 M. Titov18 V.V.
Tokmenin36 I. Torchiani23 D. Tsybychev72 B. Tuchming18 C. Tully68 P.M. Tuts70
R. Unalan65 L. Uvarov40 S. Uvarov40 S. Uzunyan52 B. Vachon6 P.J. van den
Berg34 R. Van Kooten54 W.M. van Leeuwen34 N. Varelas51 E.W. Varnes45 I.A.
Vasilyev39 P. Verdier20 L.S. Vertogradov36 M. Verzocchi50 D. Vilanova18 F.
Villeneuve-Seguier43 P. Vint43 P. Vokac10 M. Voutilainen67,g R. Wagner68 H.D.
Wahl49 M.H.L.S. Wang50 J. Warchol55 G. Watts82 M. Wayne55 G. Weber24 M.
Weber50,h L. Welty-Rieger54 A. Wenger23,i N. Wermes22 M. Wetstein61 A. White78
D. Wicke26 M.R.J. Williams42 G.W. Wilson58 S.J. Wimpenny48 M. Wobisch60 D.R.
Wood63 T.R. Wyatt44 Y. Xie77 C. Xu64 S. Yacoob53 R. Yamada50 W.-C. Yang44 T.
Yasuda50 Y.A. Yatsunenko36 Z. Ye50 H. Yin7 K. Yip73 H.D. Yoo77 S.W. Youn53 J.
Yu78 C. Zeitnitz26 S. Zelitch81 T. Zhao82 B. Zhou64 J. Zhu72 M. Zielinski71 D.
Zieminska54 L. Zivkovic70 V. Zutshi52 E.G. Zverev38 (The DØ Collaboration)
1Universidad de Buenos Aires, Buenos Aires, Argentina  2LAFEX, Centro
Brasileiro de Pesquisas Físicas, Rio de Janeiro, Brazil  3Universidade do
Estado do Rio de Janeiro, Rio de Janeiro, Brazil  4Universidade Federal do
ABC, Santo André, Brazil  5Instituto de Física Teórica, Universidade Estadual
Paulista, São Paulo, Brazil  6University of Alberta, Edmonton, Alberta,
Canada, Simon Fraser University, Burnaby, British Columbia, Canada, York
University, Toronto, Ontario, Canada, and McGill University, Montreal, Quebec,
Canada  7University of Science and Technology of China, Hefei, People’s
Republic of China  8Universidad de los Andes, Bogotá, Colombia  9Center for
Particle Physics, Charles University, Prague, Czech Republic  10Czech
Technical University, Prague, Czech Republic  11Center for Particle Physics,
Institute of Physics, Academy of Sciences of the Czech Republic, Prague, Czech
Republic  12Universidad San Francisco de Quito, Quito, Ecuador  13LPC,
Université Blaise Pascal, CNRS/IN2P3, Clermont, France  14LPSC, Université
Joseph Fourier Grenoble 1, CNRS/IN2P3, Institut National Polytechnique de
Grenoble, Grenoble, France  15CPPM, Aix-Marseille Université, CNRS/IN2P3,
Marseille, France  16LAL, Université Paris-Sud, IN2P3/CNRS, Orsay, France
17LPNHE, IN2P3/CNRS, Universités Paris VI and VII, Paris, France  18CEA, Irfu,
SPP, Saclay, France  19IPHC, Université Louis Pasteur, CNRS/IN2P3, Strasbourg,
France  20IPNL, Université Lyon 1, CNRS/IN2P3, Villeurbanne, France and
Université de Lyon, Lyon, France  21III. Physikalisches Institut A, RWTH
Aachen University, Aachen, Germany  22Physikalisches Institut, Universität
Bonn, Bonn, Germany  23Physikalisches Institut, Universität Freiburg,
Freiburg, Germany  24Institut für Physik, Universität Mainz, Mainz, Germany
25Ludwig-Maximilians-Universität München, München, Germany  26Fachbereich
Physik, University of Wuppertal, Wuppertal, Germany  27Panjab University,
Chandigarh, India  28Delhi University, Delhi, India  29Tata Institute of
Fundamental Research, Mumbai, India  30University College Dublin, Dublin,
Ireland  31Korea Detector Laboratory, Korea University, Seoul, Korea
32SungKyunKwan University, Suwon, Korea  33CINVESTAV, Mexico City, Mexico
34FOM-Institute NIKHEF and University of Amsterdam/NIKHEF, Amsterdam, The
Netherlands  35Radboud University Nijmegen/NIKHEF, Nijmegen, The Netherlands
36Joint Institute for Nuclear Research, Dubna, Russia  37Institute for
Theoretical and Experimental Physics, Moscow, Russia  38Moscow State
University, Moscow, Russia  39Institute for High Energy Physics, Protvino,
Russia  40Petersburg Nuclear Physics Institute, St. Petersburg, Russia  41Lund
University, Lund, Sweden, Royal Institute of Technology and Stockholm
University, Stockholm, Sweden, and Uppsala University, Uppsala, Sweden
42Lancaster University, Lancaster, United Kingdom  43Imperial College, London,
United Kingdom  44University of Manchester, Manchester, United Kingdom
45University of Arizona, Tucson, Arizona 85721, USA  46Lawrence Berkeley
National Laboratory and University of California, Berkeley, California 94720,
USA  47California State University, Fresno, California 93740, USA
48University of California, Riverside, California 92521, USA  49Florida State
University, Tallahassee, Florida 32306, USA  50Fermi National Accelerator
Laboratory, Batavia, Illinois 60510, USA  51University of Illinois at Chicago,
Chicago, Illinois 60607, USA  52Northern Illinois University, DeKalb, Illinois
60115, USA  53Northwestern University, Evanston, Illinois 60208, USA
54Indiana University, Bloomington, Indiana 47405, USA  55University of Notre
Dame, Notre Dame, Indiana 46556, USA  56Purdue University Calumet, Hammond,
Indiana 46323, USA  57Iowa State University, Ames, Iowa 50011, USA
58University of Kansas, Lawrence, Kansas 66045, USA  59Kansas State
University, Manhattan, Kansas 66506, USA  60Louisiana Tech University, Ruston,
Louisiana 71272, USA  61University of Maryland, College Park, Maryland 20742,
USA  62Boston University, Boston, Massachusetts 02215, USA  63Northeastern
University, Boston, Massachusetts 02115, USA  64University of Michigan, Ann
Arbor, Michigan 48109, USA  65Michigan State University, East Lansing,
Michigan 48824, USA  66University of Mississippi, University, Mississippi
38677, USA  67University of Nebraska, Lincoln, Nebraska 68588, USA
68Princeton University, Princeton, New Jersey 08544, USA  69State University
of New York, Buffalo, New York 14260, USA  70Columbia University, New York,
New York 10027, USA  71University of Rochester, Rochester, New York 14627, USA
72State University of New York, Stony Brook, New York 11794, USA  73Brookhaven
National Laboratory, Upton, New York 11973, USA  74Langston University,
Langston, Oklahoma 73050, USA  75University of Oklahoma, Norman, Oklahoma
73019, USA  76Oklahoma State University, Stillwater, Oklahoma 74078, USA
77Brown University, Providence, Rhode Island 02912, USA  78University of
Texas, Arlington, Texas 76019, USA  79Southern Methodist University, Dallas,
Texas 75275, USA  80Rice University, Houston, Texas 77005, USA  81University
of Virginia, Charlottesville, Virginia 22901, USA  82University of Washington,
Seattle, Washington 98195, USA

(January 6, 2009)

###### Abstract

First measurements of the differential cross sections
$\mathrm{d}^{3}\sigma/(\mathrm{d}p_{T}^{\gamma}\mathrm{d}y^{\gamma}\mathrm{d}y^{\text{jet}})$
for the inclusive production of a photon in association with a heavy quark
($b$, $c$) jet are presented, covering photon transverse momenta
$30<p_{T}^{\gamma}<150$ GeV, photon rapidities $|y^{\gamma}|<1.0$, jet
rapidities $|y^{\text{jet}}|<0.8$, and jet transverse momenta $p_{T}^{\rm
jet}>15$ GeV. The results are based on an integrated luminosity of $1$ fb-1 in
$p\bar{p}$ collisions at $\sqrt{s}=1.96~{}\text{TeV}$ recorded with the D0
detector at the Fermilab Tevatron Collider. The results are compared with
next-to-leading order perturbative QCD predictions.

###### pacs:

13.85.Qk, 12.38.Qk

Photons ($\gamma$) produced in association with heavy quarks $Q$ ($\equiv c$
or $b$) in the final state of hadron-hadron interactions provide valuable
information about the parton distributions of the initial state hadrons
Aurenche et al. (1996); Pumplin et al. (2007). Such events are produced
primarily through the QCD Compton-like scattering process $gQ\to\gamma Q$,
which dominates up to photon transverse momenta ($p_{T}^{\gamma}$) of $\sim
90$ GeV for $\gamma+{c}+X$ and up to $\sim 120$ GeV for $\gamma+{b}+X$
production, but also through quark-antiquark annihilation $q\bar{q}\to\gamma
g\to\gamma Q\bar{Q}$. Consequently, $\gamma+Q+X$ production is sensitive to
the $b$, $c$, and gluon ($g$) densities within the colliding hadrons, and can
provide constraints on parton distribution functions (PDFs) that have
substantial uncertainties Wu-Ki et al. (2005); D. Stump et al. (2003). The
heavy quark and gluon content is an important aspect of QCD dynamics and of
the fundamental structure of the proton. In particular, many searches for new
physics, e.g. for certain Higgs boson production modes Brodsky et al. (2006);
He et al. (2006); K.A.Assamagan et al. (2003); Gluck et al. (2008), will
benefit from a more precise knowledge of the heavy quark and gluon content of
the proton.

This Letter presents the first measurements of the inclusive differential
cross sections
$\mathrm{d}^{3}\sigma/(\mathrm{d}p_{T}^{\gamma}\mathrm{d}y^{\gamma}\mathrm{d}y^{\text{jet}})$
for $\gamma+b+X$ and $\gamma+c+X$ production in $p\bar{p}$ collisions, where
$y^{\gamma}$ and $y^{\text{jet}}$ are the photon and jet rapidities rapidity .
The results are based on an integrated luminosity of 1.02$~{}\pm~{}0.06$ fb-1
Andeen et al. (1994) collected with the D0 detector Abazov et al. (2006) at
the Fermilab Tevatron Collider at $\sqrt{s}=1.96~{}\text{TeV}$. The highest
$p_{T}$ (leading) photon and jet are required to have $|y^{\gamma}|<1.0$ and
$|y^{\text{jet}}|<0.8$, and transverse momentum $30<p_{T}^{\gamma}<150$ GeV
and $p_{T}^{\rm jet}>15$ GeV. This selection allows one to probe PDFs in the
range of parton-momentum fractions $0.01\lesssim x\lesssim 0.3$, and hard
scatter scales of $9\times 10^{2}\lesssim
Q^{2}\equiv(p_{T}^{\gamma})^{2}\lesssim 2\times 10^{4}~{}\text{GeV}^{2}$.
Differential cross sections are presented for two regions of kinematics,
defined by $y^{\gamma}y^{\text{jet}}>0$ and $y^{\gamma}y^{\text{jet}}<0$.
These two regions provide greater sensitivity to the parton $x$ because they
probe different sets of $x_{1}$ and $x_{2}$ intervals, as discussed in Ref.
Abazov et al. (2008).

The triggers for this analysis identify clusters of large electromagnetic (EM)
energy, and are based on $p_{T}^{\gamma}$ and on the spatial distribution of
energy in the photon shower. The trigger efficiency is $\approx$96% for photon
candidates with $p_{T}^{\gamma}=30$ GeV and rises to nearly 100% for
$p_{T}^{\gamma}>40$ GeV.

To reconstruct photon candidates, towers Abazov et al. (2006) with large
depositions of energy are used as seeds to create clusters of energy in the EM
calorimeter in a cone of radius ${\cal R}=0.4$, where ${\cal
R}\equiv\sqrt{(\Delta\eta)^{2}+(\Delta\phi)^{2}}$ etaphi . Once an EM energy
cluster is formed, the final energy $E_{\text{EM}}$ is defined by a smaller
cone of ${\cal R}=0.2$. Photon candidates are required to be isolated within
the calorimeter, and must also have $>96$% of their energy in its EM section.
We require the sum of the total energy inside a cone of ${\cal R}=0.4$, after
the subtraction of $E_{\text{EM}}$, to be $<7$% of $E_{\text{EM}}$. We also
require the width of the energy-weighted shower in the most finely segmented
part of the EM calorimeter to be consistent with that expected for an
electromagnetic shower, and the probability for any track spatially matched to
the photon EM cluster to be $<$0.1%. Background from dijet events containing
$\pi^{0}$ and $\eta$ mesons that can mimic photon signatures is also rejected
using an artificial neural network for identifying photons ($\gamma$-ANN),
described in Ref. Abazov et al. (2008). The requirement that the $\gamma$-ANN
output be $>0.7$, combined with all other photon selection critera, reduces
the dijet event efficiency to 0.1–0.5%. We calculate photon detection
efficiencies using a Monte Carlo (MC) simulation. Signal events are generated
using pythia Sjöstrand et al. (2001) and processed through a geant-based Brun
and Carminati (2001) simulation of the detector geometry and response, and
reconstructed using the same software as for the data. The MC efficiencies are
calibrated to those in data using small correction factors measured in $Z\to
e^{+}e^{-}$ samples. The total efficiency of the above photon selection
criteria is 63–80%, depending on $p_{T}^{\gamma}$. The systematic
uncertainties on these values are 5%, and are mainly due to uncertainties in
the isolation, the track-match veto, and the $\gamma$-ANN requirements.

At least one jet must be present in each event. Jets are reconstructed using
the D0 Run II algorithm Zeppenfeld et al. (1994) with a radius of $0.5$. The
efficiency for a jet to be reconstructed and to satisfy the jet identification
criteria is 93%, 96.5%, and 94.5% for light ($u$, $d$, $s$ quark or $g$), $c$,
and $b$ jets at $p_{T}^{\gamma}=30~{}\text{GeV}$ and increases to $\approx
98$% at $p_{T}^{\gamma}=150$ GeV, independent of the jet flavor. The impact
from uncertainties on jet energy scale, jet energy resolution, and difference
in energy response between light and $b(c)$ jets is found to be between 8 %(6
%) and 2 %(2 %) for $p_{T}^{\rm jet}$ between 15 GeV and 150 GeV. The leading
jet is also required to have at least two associated tracks with $p_{T}>0.5$
GeV and the track leading in $p_{T}$ must have $p_{T}>1.0$ GeV, and each track
must have at least one hit in the silicon microstrip tracker. These criteria
ensure that the jet has sufficient information to be classified as a heavy-
flavor (HF) candidate. Light jets are suppressed using a dedicated artificial
neural network ($b$-ANN) c:bNN  that exploits the longer lifetimes of heavy-
flavor hadrons relative to their lighter counterparts. The leading jet is
required to have a $b$-ANN output $>0.85$. Depending on $p_{T}^{\gamma}$, this
selection is 55–62% efficient for $\gamma+b$ jet, and 11–12% efficient for
$\gamma+c$ jet events, with 3–5% relative uncertainties on these values. Only
0.2–1% of light jets are misidentified as heavy-flavor jets.

A primary collision vertex with $\geq$3 tracks is required within 35 cm of the
center of the detector along the beam axis. The missing transverse momentum in
the event is required to be $<0.7p_{T}^{\gamma}$ so as to suppress background
from cosmic-ray muons and $W\to\ell\nu$ decays. Such a requirement is highly
efficient for signal, achieving an efficiency $\geq 96\%$ even for events with
semi-leptonic heavy-flavor quark decays.

About 13,000 events remain in the data sample after applying all selection
criteria. Background for photons, stemming mainly from dijet events in which
one jet is misidentified as a photon, is still present in this sample. To
estimate the photon purity, a template fitting technique is employed Barlow et
al. (1993). The $\gamma$-ANN distribution in data is fitted to a linear
combination of templates for photons and jets obtained from simulated
$\gamma~{}+$ jet and dijet samples, respectively. An independent fit is
performed in each $p_{T}^{\gamma}$ bin, yielding photon purities between 51%
and 93% for $30<p_{T}^{\gamma}<150~{}\text{GeV}$. The fractional contributions
of $b$ and $c$ jets are determined by fitting templates of $P_{\text{HF-
jet}}=-\ln\prod_{i}{P_{\rm track}^{i}}$ to the data, where $P_{\rm track}^{i}$
is the probability that a track originates from the primary vertex, based on
the significance of the track’s distance of closest approach to the primary
vertex. All tracks within the jet cone are used in the fit, except the one
with lowest value of $P_{\rm track}$. Jets from $b$ quarks usually have large
values of $P_{\text{HF-jet}}$, whereas light jets mostly have small values, as
their tracks originate from the primary vertex. Templates are used for the
shape information of the $P_{\text{HF-jet}}$ distributions. For $b$ and $c$
jets these are extracted from MC events whereas the light jet template is
taken from a data sample enriched in light jets, which is corrected for
contributions from $b$ and $c$ quarks.

Figure 1: Distribution of observed events for $P_{\text{HF-jet}}$ after all
selection criteria for the bin $50<p_{T}^{\gamma}<70$ GeV. The distributions
for the $b$, $c$, and light jet templates are shown normalized to their fitted
fraction. Error bars on the templates represent combined uncertainties from
statistics of the MC and the fitted jet flavor fractions, while the data
contain just statistical uncertainties. Fits in the other $p_{T}^{\gamma}$
bins are of similar quality.

The result of a maximum likelihood fit, normalized to the number of events in
data, is shown in Fig. 1 for $50<p_{T}^{\gamma}<70~{}\text{GeV}$. The
estimated fractions of $b$ and $c$ jets in all $p_{T}^{\gamma}$ bins vary
between 25–34% and 40–48%, respectively. The corresponding uncertainties range
between 7-24%, dominated at higher $p_{T}^{\gamma}$ by the limited data
statistics.

The differential cross sections are extracted in five bins of $p_{T}^{\gamma}$
and in the two regions of $y^{\gamma}y^{\text{jet}}$, and are all listed in
Table 1. The measured cross sections are corrected for the effect of finite
calorimeter energy resolution affecting $p_{T}^{\gamma}$ using the unfolding
procedure described in Ref. Abbott et al. (2001). Such corrections are 1–3%.
The measured differential cross sections are shown in Fig. 2 for
$\gamma+{b}+X$ and $\gamma+{c}+X$ production as a function of $p_{T}^{\gamma}$
for the jet and photon rapidity intervals in question. The cross sections fall
by more than three orders of magnitude in the range
$30<p_{T}^{\gamma}<150~{}\text{GeV}$. The statistical uncertainty on the
results ranges from 2% in the first $p_{T}^{\gamma}$ bin to $\approx 9\%$ in
the last bin, while the total systematic uncertainty varies between 15% and
28%. The main uncertainty at low $p_{T}^{\gamma}$ is due to the photon purity
(10.5%) and the heavy-flavor fraction fit (9%). At higher $p_{T}^{\gamma}$,
the uncertainty is dominated by the heavy-flavor fraction. Other significant
uncertainties result from the jet-selection efficiency (between 8% and 2%),
the photon selection efficiency (5%), and the luminosity (6.1%) Andeen et al.
(1994). Systematic uncertainties have a 60–68% correlation between adjacent
$p_{T}^{\gamma}$ bins for $30<p_{T}^{\gamma}<50$ GeV and 20–30% for
$p_{T}^{\gamma}>$70 GeV.

Figure 2:  The $\gamma+{b}+X$ and $\gamma+{c}+X$ differential cross sections as a function of $p_{T}^{\gamma}$ in the two regions $y^{\gamma}y^{\text{jet}}>0$ and $y^{\gamma}y^{\text{jet}}<0$. The uncertainties on the data points include statistical and systematic contributions added in quadrature. The NLO pQCD predictions using cteq6.6M PDFs are indicated by the dotted lines. Figure 3: The data-to-theory ratio of cross sections as a function of $p_{T}^{\gamma}$ for $\gamma+{b}+X$ and $\gamma+{c}+X$ in the regions $y^{\gamma}y^{\text{jet}}>0$ and $y^{\gamma}y^{\text{jet}}<0$. The uncertainties on the data include both statistical (inner line) and full uncertainties (entire error bar). Also shown are the uncertainties on the theoretical pQCD scales and the cteq6.6M PDFs. The scale uncertainties are shown as dotted lines and the PDF uncertainties by the shaded regions. The ratio of the standard cteq6.6M prediction to two models of intrinsic charm is also shown. Table 1: The $\gamma+{b}+X$ and $\gamma+{c}+X$ cross sections in bins of $p_{T}^{\gamma}$ in the two regions $y^{\gamma}y^{\text{jet}}>0$ and $y^{\gamma}y^{\text{jet}}<0$ together with statistical, $\delta\sigma_{\text{stat}}$, and systematic, $\delta\sigma_{\text{syst}}$, uncertainties. The theory cross sections $\sigma_{\text{theory}}$ are taken from Ref. Stavreva et al. (2003). |  |  | $y^{\gamma}y^{\text{jet}}>0$ |  | $y^{\gamma}y^{\text{jet}}<0$
---|---|---|---|---|---
|  $p_{T}^{\gamma}$ bin |  | $\langle p_{T}^{\gamma}\rangle$ | Cross section | $\delta\sigma_{\text{stat}}$ | $\delta\sigma_{\text{syst}}$ | $\sigma_{\text{theory}}$ |  | $\langle p_{T}^{\gamma}\rangle$ | Cross section | $\delta\sigma_{\text{stat}}$ | $\delta\sigma_{\text{syst}}$ | $\sigma_{\text{theory}}$
| (GeV) |  | (GeV) | (pb/GeV) | ($\%$) | ($\%$) | (pb/GeV) |  | (GeV) | (pb/GeV) | ($\%$) | ($\%$) | (pb/GeV)
$\gamma+{b}+X$ | 30–40 |  | 34.1 | 2.73$\times 10^{-1}$ | 1.5 | 18.5 | 2.96$\times 10^{-1}$ |  | 34.1 | 2.23$\times 10^{-1}$ | 1.6 | 19.1 | 2.45$\times 10^{-1}$
| 40–50 |  | 44.3 | 1.09$\times 10^{-1}$ | 2.5 | 15.5 | 9.31$\times 10^{-2}$ |  | 44.2 | 9.53$\times 10^{-2}$ | 2.6 | 16.0 | 8.18$\times 10^{-2}$
| 50–70 |  | 57.6 | 2.72$\times 10^{-2}$ | 3.3 | 15.2 | 2.66$\times 10^{-2}$ |  | 57.4 | 2.67$\times 10^{-2}$ | 3.3 | 15.3 | 2.22$\times 10^{-2}$
| 70–90 |  | 78.7 | 6.21$\times 10^{-3}$ | 6.6 | 20.8 | 6.39$\times 10^{-3}$ |  | 78.3 | 6.10$\times 10^{-3}$ | 6.7 | 20.8 | 5.49$\times 10^{-3}$
| 90–150 |  | 108.3 | 1.23$\times 10^{-3}$ | 8.2 | 26.2 | 1.11$\times 10^{-3}$ |  | 110.0 | 1.09$\times 10^{-3}$ | 8.9 | 25.7 | 1.05$\times 10^{-3}$
$\gamma+{c}+X$ | 30–40 |  | 34.1 | 1.90 | 1.5 | 18.1 | 2.02 |  | 34.1 | 1.56 | 1.6 | 18.7 | 1.59
| 40–50 |  | 44.3 | 5.14$\times 10^{-1}$ | 2.5 | 17.7 | 5.82$\times 10^{-1}$ |  | 44.2 | 4.51$\times 10^{-1}$ | 2.6 | 18.1 | 4.56$\times 10^{-1}$
| 50–70 |  | 57.6 | 1.53$\times 10^{-1}$ | 3.3 | 17.9 | 1.41$\times 10^{-1}$ |  | 57.4 | 1.50$\times 10^{-1}$ | 3.3 | 18.0 | 1.10$\times 10^{-1}$
| 70–90 |  | 78.7 | 4.45$\times 10^{-2}$ | 6.6 | 21.3 | 2.85$\times 10^{-2}$ |  | 78.3 | 4.39$\times 10^{-2}$ | 6.7 | 21.3 | 2.22$\times 10^{-2}$
| 90–150 |  | 108.3 | 9.63$\times 10^{-3}$ | 8.2 | 27.5 | 3.69$\times 10^{-3}$ |  | 110.0 | 8.57$\times 10^{-3}$ | 8.9 | 27.0 | 3.28$\times 10^{-3}$

Next-to-leading order (NLO) perturbative QCD (pQCD) predictions, with the
renormalization scale $\mu_{R}$, factorization scale $\mu_{F}$, and
fragmentation scale $\mu_{f}$, all set to $p_{T}^{\gamma}$, are also given in
Table 1 and compared to data in Fig. 2. These predictions Stavreva et al.
(2003) are are based on techniques used to calculate the cross section
analytically Harris et al. (2002), and the ratios of the measured to the
predicted cross sections are shown in Fig. 3.

The uncertainty from the choice of the scale is estimated through a
simultaneous variation of all three scales by a factor of two, i.e., to
$\mu_{R,F,f}=0.5p_{T}^{\gamma}$ and $2p_{T}^{\gamma}$. The predictions utilize
cteq6.6M PDFs D. Stump et al. (2003), and are corrected for effects of parton-
to-hadron fragmentation. This correction for $b\,(c)$ jets varies from $7.5$%
($3$%) at $30<p_{T}^{\gamma}<40~{}\text{GeV}$ to 1% at
$90<p_{T}^{\gamma}<150~{}\text{GeV}$.

The pQCD prediction agrees with the measured cross sections for $\gamma+{b}+X$
production over the entire $p_{T}^{\gamma}$ range, and with $\gamma+{c}+X$
production for $p_{T}^{\gamma}<70$ GeV. For $p_{T}^{\gamma}>70$ GeV, the
measured $\gamma+{c}+X$ cross section is higher than the prediction by about
1.6–2.2 standard deviations (including only the experimental uncertainties)
with the difference increasing with growing $p_{T}^{\gamma}$.

Parameterizations for two models containing intrinsic charm (IC) have been
included in cteq6.6 Pumplin et al. (2007), and their ratios to the standard
cteq predictions are also shown in Fig. 3. Both non-perturbative models
predict a higher $\gamma+{c}+X$ cross section. In the case of the BHPS model
Pumplin et al. (2007) it grows with $p_{T}^{\gamma}$. The observed difference
may also be caused by an underestimated contribution from the $g\to Q\bar{Q}$
splitting in the annihilation process that dominates for
$p_{T}^{\gamma}>90~{}\text{GeV}$ Amsler et al. (2008).

In conclusion, we have performed the first measurement of the differential
cross section of inclusive photon production in association with heavy flavor
($b$ and $c$) jets at a $p\bar{p}$ collider. The results cover the range
$30<p_{T}^{\gamma}<150~{}\text{GeV}$, $|y^{\gamma}|<1.0$, and $|y^{\rm
jet}|<0.8$. The measured cross sections provide information about $b$, $c$,
and gluon PDFs for $0.01\lesssim x\lesssim 0.3$. NLO pQCD predictions using
cteq6.6M PDFs Stavreva et al. (2003) for $\gamma+{b}+X$ production agree with
the measurements over the entire $p_{T}^{\gamma}$ range. We observe
disagreement between theory and data for $\gamma+{c}+X$ production for
$p_{T}^{\gamma}>70$ GeV.

We are very grateful to the authors of the theoretical code, Tzvetalina
Stavreva and Jeff Owens, for providing predictions and for many fruitful
discussions. We thank the staffs at Fermilab and collaborating institutions,
and acknowledge support from the DOE and NSF (USA); CEA and CNRS/IN2P3
(France); FASI, Rosatom and RFBR (Russia); CNPq, FAPERJ, FAPESP and FUNDUNESP
(Brazil); DAE and DST (India); Colciencias (Colombia); CONACyT (Mexico); KRF
and KOSEF (Korea); CONICET and UBACyT (Argentina); FOM (The Netherlands); STFC
(United Kingdom); MSMT and GACR (Czech Republic); CRC Program, CFI, NSERC and
WestGrid Project (Canada); BMBF and DFG (Germany); SFI (Ireland); The Swedish
Research Council (Sweden); CAS and CNSF (China); and the Alexander von
Humboldt Foundation (Germany).

## References

  * (1) Visitor from Augustana College, Sioux Falls, SD, USA.
  * (2) Visitor from Rutgers University, Piscataway, NJ, USA.
  * (3) Visitor from The University of Liverpool, Liverpool, UK.
  * (4) Visitor from II. Physikalisches Institut, Georg-August-University, Göttingen, Germany.
  * (5) Visitor from Centro de Investigacion en Computacion - IPN, Mexico City, Mexico.
  * (6) Visitor from ECFM, Universidad Autonoma de Sinaloa, Culiacán, Mexico.
  * (7) Visitor from Helsinki Institute of Physics, Helsinki, Finland.
  * (8) Visitor from Universität Bern, Bern, Switzerland.
  * (9) Visitor from Universität Zürich, Zürich, Switzerland.
  * (10) Deceased.

## References

  * Aurenche et al. (1996) B. Bailey, E.L. Berger, L.E. Gordon, Phys. Rev. D 54, 1896 (1996).
  * Pumplin et al. (2007) J. Pumplin, H.L. Lai, W.K. Tung, Phys. Rev. D 75, 054029 (2007).
  * Wu-Ki et al. (2005) W.K. Tung, eprint arXiv:hep-ph/0409145 (2004).
  * D. Stump et al. (2003) D. Stump et al., JHEP 0310, 046 (2003).
  * Brodsky et al. (2006) S.J. Brodsky, B. Kopeliovich, I. Schmidt, J. Soffer, Phys. Rev. D 73, 113005 (2006).
  * He et al. (2006) H.J. He, C.P. Yuan, Phys. Rev. Lett. 83, 28 (1999); C. Balazs, H.J. He, C.P. Yuan, Phys. Rev. D 60, 114001 (1999).
  * K.A.Assamagan et al. (2003) K.A. Assamagan, eprint arXiv:hep-ph/0406152 (2003).
  * Gluck et al. (2008) M. Glück et al., Phys. Lett. B 664, 133 (2008).
  * (9) Rapidity is defined as $y=-\ln[(E+p_{Z})/(E-p_{Z})]$, where $E$ is the energy and $p_{Z}$ is the momentum component along the proton beam direction.
  * Andeen et al. (1994) T. Andeen et al., FERMILAB-TM-2365 (2007).
  * Abazov et al. (2006) V.M. Abazov et al. (D0 Collaboration), Nucl. Instrum. Methods Phys. Res. A 565, 463 (2006).
  * Abazov et al. (2008) V.M. Abazov et al. (D0 Collaboration), Phys. Lett. B 666, 435 (2008).
  * (13) Pseudorapidity $\eta$ is defined as $\eta=-\ln[\tan(\theta/2)]$, where $\theta$ is the polar angle with respect to the proton beam direction, with origin at the center of the detector. $\phi$ is defined as the azimuthal angle in the plane transverse to the proton beam direction.
  * Sjöstrand et al. (2001) T. Sjöstrand et al., Comput. Phys. Commun. 135, 238 (2001).
  * Brun and Carminati (2001) R. Brun and F. Carminati, CERN Program Library Long Writeup W5013, (1993), unpublished.
  * Zeppenfeld et al. (1994) G.C. Blazey et al., arXiv:hep-ex/0005012 (2000).
  * (17) T. Scanlon, Ph.D. thesis, FERMILAB-THESIS-2006-43.
  * Barlow et al. (1993) R. Barlow, C. Beeston, Comput. Phys. Commun. 77, 219 (1993).
  * Stavreva et al. (2003) T. Stavreva, J.F. Owens, eprint arXiv:0901.3791v1 (2009).
  * Abbott et al. (2001) B. Abbott et al. (D0 Collaboration), Phys. Rev. D 64, 032003 (2001).
  * Harris et al. (2002) B.W. Harris, J.F. Owens, Phys. Rev. D 65, 094032 (2002).
  * Amsler et al. (2008) C. Amsler, Phys. Lett. B 667, 1 (2008).