Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This study investigates the vulnerabilities of GNSS timing receivers under spoofing attacks, revealing that a recorded spoofing event caused a significant discrepancy between the reported time and the actual time, with a gap of approximately 1.01 ms compared to a reported maximum of 51 ns. The authors establish that no finite unconditional bound on undetected time error exists when an adversary can manipulate the ramp rate, leading to the introduction of a conditional Timing Protection Level (TPL) that provides a reproducible detectability floor under specific conditions. By calibrating their findings against the recorded attack, they demonstrate that their model-free monitor can significantly outperform traditional clock-aided tests, offering a budget of 114 ns at one-second recovery, which is thousands of times more precise than the spoofed time error.
A GNSS timing receiver can be misled by spoofing to report time with a discrepancy of over 20,000 times less accuracy than the actual error, exposing critical vulnerabilities in timing integrity.
A GNSS timing receiver under spoofing has no nominal-geometry fault for position-domain RAIM to bound: the threat is a slow, common-mode pull of served clock time that the receiver's own time-accuracy flag need not reveal. We make three graded contributions. First, a field measurement: solving the receiver clock trajectory from raw L1 pseudoranges and broadcast ephemeris, we show a recorded over-the-air spoof from the public JammerTest 2024 campaign pulled a u-blox ZED-F9P by about 1.01 ms of served time while it reported at most 51 ns, a gap near 20,000x. Second, an impossibility: against an adversary free to choose the ramp rate, no finite unconditional bound on undetected time error exists under a single self-referential clock-aided monitor, because a ramp slow enough to keep the disciplined reference in lock-step is never alarmed while the error grows without limit, so any finite guarantee is conditional. Third, the conditional bound: the Timing Protection Level (TPL), a model-free monitor's static detectability floor plus the oscillator's coast over the detection latency, holds given detection by an independent cross-satellite consistency check a coherent spoofer does not drive in lock-step. Each term is a closed form over a primitive verified in the open Kshana simulator, so the sum is reproducible by hand. Calibrated on the recorded attack, the budget is 114 ns at one-second recovery and 458 ns at a 60-second coast, thousands of times below the 1.01 ms accepted; a clock-aided sequential test alone gives essentially no protection on this slow ramp (it alarms only near the ~1 ms capture), while the model-free monitor alarms during the ramp. We are explicit: the bound is calibrated, not field-validated; carries no integrity-risk budget; and is reported as a band at long coast. The simulator, bound, and calibration example are open source under AGPL-3.0.