Modern critical infrastructure heavily depends on precise time synchronization. Telecommunications networks, financial trading platforms, smart power grids, and 5G base stations all rely on GNSS-disciplined timing as their primary reference. A single GNSS spoofing attack targeting one time server can silently corrupt timing across an entire synchronization system, cascading errors through hundreds of connected devices without triggering a single alarm.
This article describes a multilayered architecture that protects complete synchronization infrastructures, including sites with multiple time servers, redundant GNSS receivers, and backup antennas. The approach combines the GP-Probe TGE2 multi-antenna detection system, GP-Blocker RF isolation devices, and GP-Cloud centralized analytics to detect and mitigate all categories of GNSS attacks, including coherent spoofing.
The problem is simple: a single successful GNSS spoofing attack on one time server can silently corrupt timing across an entire network — without triggering any alarms.
Why Synchronization Systems Need External GNSS Protection
A time server equipped with a GNSS receiver module delivers timestamp and Pulse Per Second (PPS) synchronization with a maximum error of 60 ns under clear sky conditions. This level of accuracy is essential for 5G TDD networks (requiring ±390 ns for 60 kHz subcarriers), financial timestamping under MiFID II regulations (requiring 100 μs accuracy), and power grid Phase Measurement Units operating under IEEE C37.238.
The fundamental problem is that GNSS signals arrive at Earth’s surface at approximately –160 dBW power level. A spoofing device built with an SDR platform costing under $500 can overpower these signals from several kilometers away. Standard time servers trust the incoming signal by default. They have no mechanism to verify whether the GNSS data feeding their clock is authentic or manipulated.
The consequences are measurable. In October 2025, GNSS interference in Qatar caused ports, air traffic control, and telecom networks to lose synchronization simultaneously. The Ras Laffan LNG port experienced a 30–40% throughput reduction, with estimated losses of $8–10 million per day. A NIST-commissioned study estimated the cost of GPS disruption to the US economy at $1.6 billion per day.
The following experiment demonstrates how GNSS spoofing affects real time servers in practice, including both non-coherent and coherent attack scenarios, and how PPS signals can be silently shifted without triggering any alarms:
Understanding the Threat: Non-Coherent and Coherent Spoofing
GNSS attacks fall into two categories with fundamentally different detection requirements.
Non-Coherent (Asynchronous) Spoofing
A non-coherent spoofer generates fake GNSS signals that are not synchronized with authentic signals. The attack typically requires jamming the receiver first, then transmitting a stronger counterfeit signal. Because the fake signals differ in code phase, carrier phase, and Doppler frequency, the attack produces detectable anomalies: sharp jumps in signal power, large pseudorange residuals, and abrupt coordinate or time shifts. These indicators can be identified by analyzing raw GNSS data from a single receiver channel. A time server can have its clock shifted in as little as 15 seconds under this type of attack.
Coherent Spoofing: The Critical Threat to Synchronization Infrastructure
Coherent spoofing first aligns the fake signal with the authentic GNSS signal in code phase, carrier phase, and Doppler, then gradually pulls the receiver’s tracking loops away. The spoofer increases power above the authentic signal level and slowly shifts time or position. A time server under a coherent attack displays no errors, no warnings, and no loss of lock. The clock drifts to the attacker’s desired offset while the server reports normal operation.
This makes coherent spoofing the most dangerous threat to synchronization infrastructure. Conventional detection methods (signal power monitoring, pseudorange residual analysis, position-jump detection) fail because the gradual, aligned nature of the signal evades all threshold-based metrics. The only reliable detection method is multi-antenna spatial analysis, which compares the direction of arrival of signals across spatially separated antennas.
GPSPATRON Layered Protection Architecture for Synchronization System Defense
Since time servers support critical infrastructure, the protection solution must be highly dependable. GPSPatron addresses this requirement through a layered architecture that combines detection, monitoring, and active protection. The system operates through two complementary layers. The Detection and Monitoring layer continuously analyzes the GNSS signal environment using GP-Probe TGE2 units and GP-Cloud to detect interference, jamming, and spoofing attempts, and verifies the integrity of time server outputs. The Protection and Mitigation layer actively prevents compromised signals from reaching GNSS receivers using GP-Blocker devices, and enables targeted response when threats are detected.
This diagram illustrates a high-resilience protection architecture for a mission-critical synchronization site, such as a data center or telecom facility, where timing errors are unacceptable and multiple layers of verification are required. Three master clocks are protected by multiple GP-Blockers, two GP-Probe TGE2 units, and GP-Cloud centralized analytics. Each time server uses dual GNSS receivers and dual antennas for receiver-level redundancy, while the two spatially separated TGE2 detectors provide independent signal authentication and continuous PPS accuracy monitoring. This design is intended for environments where spoofing or jamming attacks may be complex and intentional.
GNSS Spoofing Detection with GP-Probe TGE2
The GP-Probe TGE2 is designed to protect time servers against all categories of GNSS threats, including advanced intentional spoofing, jamming, ionospheric scintillation, and system errors. It operates with three spatially separated GNSS antennas forming a controlled antenna array.
Authentic GNSS signals originate from satellites distributed across the sky and produce predictable spatial patterns across the antenna array. Signals from a nearby coherent spoofer, regardless of how precisely aligned they are in code and carrier phase, exhibit different spatial characteristics because all counterfeit signals share the same direction of arrival. The TGE2’s 60 MHz FPGA-powered RF signal analyzer (12-bit ADC, 122 dB dynamic range) provides real-time spectrum monitoring for interference classification.
GPSPATRON validated this approach at JammerTest 2022, 2023, and 2024 in Norway, achieving 100% detection rate and 98.3% classification accuracy against all types of spoofing scenarios.
GP-Cloud: Centralized Processing and Real-Time Analytics
GP-Cloud provides centralized processing of GNSS signal parameters and spatial measurements from monitoring probes. The platform uses advanced anomaly detection and classification algorithms to analyze streaming data at 1 Hz from each probe, delivering detection latency of 1–2 seconds from threat identification to GP-Blocker activation. The spoofing false-positive rate is 0.1% in real urban environments.
The platform evaluates signal quality per constellation individually (GPS, GLONASS, Galileo, BeiDou), which is essential for the constellation-level protection strategy described below. Key capabilities include historical baseline comparison for identifying abnormal signal behavior, interactive visualization tools for investigating anomalies, real-time monitoring dashboards showing timing accuracy and jamming/spoofing indicators, and event logging with automated notifications via email, RabbitMQ, and Webhooks.
Active Protection with GP-Blocker: RF Isolation and Signal Mitigation
The Protection and Mitigation layer uses GP-Blocker devices installed between GNSS antennas and time server receivers. Each GP-Blocker provides 110 dB of RF isolation through a two-stage RF switch and includes an embedded L-band noise-modulated jammer covering GPS L1, Galileo E1, BeiDou B1, and GLONASS frequencies, achieving approximately 200 dB of effective “equivalent” blocking level.
Constellation-Level Protection Strategy
The most sophisticated capability of this architecture is constellation-level protection. Since each GP-Blocker can be controlled independently, and GP-Cloud monitors each constellation (GPS, Galileo, GLONASS, BeiDou) separately, the system responds selectively to attacks targeting specific constellations.
The recommended deployment configures each GNSS receiver to use a different combination of satellite constellations. When the TGE2 detects that interference affects only one constellation while others remain clean, the system can identify which constellations are compromised, selectively activate GP-Blockers to prevent affected signals from reaching specific receivers, allow unaffected constellations to remain operational, and, if all constellations are under attack, trigger holdover and failover to an alternative time source via PTP protocol from an unaffected site.
This selective response strategy allows the synchronization system to continue operating even under partial interference conditions, rather than losing all GNSS timing when a single constellation is attacked.
Integration Options for Existing Synchronization Infrastructure
GPSPATRON offers two integration approaches that can be combined depending on site requirements.
Hardware Integration via GP-Blocker
The GP-Blocker installs physically between the GNSS antenna and the time server receiver using standard SMA connectors. When the TGE2 and GP-Cloud detect a threat, the GP-Blocker closes the RF switch and activates its embedded jammer within 3 seconds of latency. The time server loses satellite signals and enters holdover mode on clean oscillator data rather than corrupted data. No software modification to the time server is required.
API Integration with Synchronization Management Software
GP-Cloud’s REST API (documented via Swagger) and RabbitMQ/Webhook notifications enable integration with the customer’s existing synchronization management platform. When GP-Cloud detects a constellation-level anomaly, it sends a structured event notification to the management system. The management platform then commands the time server to switch to a clean constellation, disable GNSS input, or failover to a PTP time source from an unaffected site.
This approach is essential for large-scale synchronization networks where the response to an attack must be coordinated across multiple time servers simultaneously. The Lua 5.3.1 scripting engine embedded in the TGE2 also supports custom automation logic, enabling site-specific response strategies without modifying GP-Cloud.
Key Benefits for Critical Synchronization System Infrastructure
Protection Against All Attack Types: Multi-antenna spatial analysis detects coherent spoofing that single-channel methods cannot identify, validated at 100% detection rate in controlled field tests.
Multiple Server Protection: A single TGE2 controls up to 4 GP-Blockers, enabling protection of multiple time servers from one probe. Two TGE2 units provide site-wide redundancy.
Sub-3-Second Response: Detection-to-blocking latency under 3 seconds prevents spoofing-induced clock drift before it exceeds critical thresholds.
Constellation-Level Selectivity: Per-constellation monitoring and selective blocker activation maintain partial synchronization rather than total GNSS loss.
Continuous PPS Accuracy Monitoring: Real-time PPS offset measurement provides immediate visibility into synchronization health across all connected time servers.
Multi-Antenna Spoofing Detection
Detects all major GNSS threat types, including coherent spoofing, using three spatially separated antennas.
Active GNSS Signal Protection
Physically isolates protected receivers from compromised GNSS signals and enables selective blocking of affected signal paths.
Centralized Analytics and Control
Processes probe data in real time, verifies synchronization health, and coordinates selective response across the protected infrastructure.
Conclusion
The growing GNSS threat landscape, with over 1,000 daily interference incidents recorded globally in 2025, makes external protection of synchronization infrastructure a necessity rather than an option. Coherent spoofing represents the most dangerous threat because it corrupts timing without triggering holdover or generating alarms on the time server itself.
GPSPatron’s combination of TGE2 multi-antenna spatial analysis, GP-Blocker RF isolation, and GP-Cloud centralized analytics provides the only commercially available architecture capable of detecting and mitigating all categories of GNSS attacks, including deliberately precision-executed coherent spoofing. For operators responsible for the most vital synchronization systems, this configuration delivers the assurance that timing integrity is maintained under any threat scenario.
Contact GPSPATRON today to request a project evaluation and discover how this architecture can protect your synchronization infrastructure.
