GPS Spoofing Resilience: Implementing NIST IR 8323 Foundational PNT Profile

NIST IR 8323 maps CSF functions (Identify, Protect, Detect, Respond, Recover) to PNT-specific subcategories. The report's core contribution is a structured approach to PNT risk that most organizations have not applied:

Identify phase -- PNT dependency inventory: Critical infrastructure operators must identify every system that depends on GPS/GNSS for position, navigation, or timing. The inventory must distinguish between direct dependencies (the system has a GPS receiver) and indirect dependencies (the system receives time from a network time server that itself uses GPS).

Protect phase -- PNT resilience controls:

• GNSS signal authentication (OSNMA for Galileo receivers, commercial spoofing detection receivers)
• Alternative timing sources (NTS, PTP, atomic clocks, eLoran)
• Receiver Autonomous Integrity Monitoring (RAIM) for navigation applications
• Signal quality monitoring for detection of spoofing or jamming

Detect phase -- PNT anomaly monitoring:

• Monitor GPS receivers for anomalous signals (signal strength spikes, position jumps, clock discrepancies)
• Monitor time synchronization infrastructure for drift relative to multiple independent time sources
• Correlate GPS anomalies across multiple receivers to distinguish localized interference from spoofing

Respond and Recover:

• Procedures for switching to backup timing sources when primary GPS is unavailable or suspected spoofed
• Procedures for systems that cannot operate without GPS timing (manual or degraded mode documentation)
• Recovery procedures for systems that accumulated errors during a GPS disruption event

The PNT dependency inventory is the starting point for NIST IR 8323 implementation and is frequently the most difficult step because GPS receivers are often embedded in infrastructure without explicit documentation.

Direct GPS receiver inventory: Search procurement records and equipment manuals for GPS receiver keywords. Common GPS-dependent equipment categories:

• Network timing: GPS-disciplined oscillators (GPSDO), Network Time Protocol (NTP) servers with GPS reference, IEEE 1588 grandmaster clocks
• Power grid: Phasor Measurement Units (PMUs/synchrophasors), protection relay timing, grid synchronization equipment
• Financial services: Trading system time stamps, market data feed timestamps, payment clearinghouse synchronization
• Telecommunications: Cellular base station synchronization (all generations), DWDM network synchronization
• Navigation systems: AIS transponders, vessel GPS, aviation avionics (outside direct control of most critical infrastructure operators)

Indirect GPS dependencies: Inventory all systems that receive time from an NTP or PTP server and trace the time source hierarchy back to its root. If the root is a GPS-disciplined oscillator (which it almost always is for accurate timing), all downstream systems have an indirect GPS dependency.

Tool-assisted inventory: For large networks, use network scanning to discover NTP client/server relationships (UDP port 123) and PTP sources (UDP ports 319/320). Tools like ntpq, Kismet (for RF receiver detection), and commercial network discovery platforms can accelerate the inventory.

Detection of GPS spoofing requires monitoring that the standard GPS receiver does not perform. Options in order of sophistication:

Multi-receiver cross-validation: Deploy two or more GPS receivers at the same location and compare their reported position and time. A spoofing signal usually affects all receivers equally, but the cross-validation comparison can detect if one receiver has drifted relative to others. This approach is effective only if the multiple receivers use different physical antennas with different spatial separation.

GNSS signal quality monitoring: Monitor the signal strength (C/N0 ratio) and signal-to-noise ratio of received GPS signals. A spoofing transmitter typically produces stronger-than-expected signals because it must overpower the authentic satellite signals. Anomalous signal strength is a spoofing indicator. Commercial spoofing-detection receivers (Septentrio mosaic, NovAtel OEM7) implement this monitoring automatically.

OSNMA for Galileo authentication: Galileo's Open Service Navigation Message Authentication (OSNMA) is the first operational GNSS authentication protocol. Receivers that support OSNMA can cryptographically verify that received Galileo navigation messages originated from authentic Galileo satellites. OSNMA does not apply to GPS signals, but multi-constellation receivers that use both GPS and Galileo can use OSNMA to detect when GPS and Galileo report inconsistent positions or times -- an indicator of GPS spoofing.

Cross-reference with independent time sources: Compare GPS-derived time against an independent time source (NTS-authenticated NTP, a local atomic clock, or a TrueTime server that uses multiple inputs). A GPS spoofing attack that shifts the apparent time will create a discrepancy with the independent reference. Alert when GPS time deviates from the independent reference by more than a configured threshold (typically 1 microsecond for financial services applications, more relaxed for less sensitive applications).

NIST IR 8323's Protect function requires that critical timing infrastructure have alternative time sources that do not depend on GNSS. Options:

Network Time Security (NTS, RFC 8915): NTS adds cryptographic authentication to NTP using TLS 1.3 and AEAD authentication. This prevents man-in-the-middle NTP attacks that inject false time. NTS does not make the underlying NTP server GPS-independent -- if the NTP server's time source is a GPS-disciplined oscillator, an NTS-authenticated NTP client will receive authenticated but potentially spoofed time. NTS must be combined with an NTP server that uses a GPS-independent time source.

Precision Time Protocol (PTP / IEEE 1588) with hardware timestamping: PTP achieves sub-microsecond timing accuracy with hardware-assisted timestamping. PTP is not inherently GPS-independent, but PTP grandmaster clocks can be disciplined by atomic clocks, eLoran, or other non-GNSS sources. For financial services and power grid applications requiring very high timing accuracy, PTP with an atomic clock or Rubidium oscillator backup source provides GPS-independent timing during GNSS outages.

Enhanced Long Range Navigation (eLoran): eLoran is a ground-based radio navigation system that provides GPS backup timing and navigation. eLoran transmitters broadcast on the 100 kHz band and are receivable at ranges of 1,000+ km. The US, South Korea, and several European countries operate or are building eLoran infrastructure. eLoran receivers in timing applications can serve as a GPS-independent backup time source that automatically activates when GPS quality degrades.

Local atomic clock or Rubidium oscillator holdover: For applications that can tolerate a limited period of GPS independence (hours to days), a local atomic clock or Rubidium oscillator provides GPS holdover: when GPS is lost or suspected spoofed, the clock maintains accurate time from its own oscillator until GPS is restored or an alternative source is available. Accuracy degrades over time (atomic clocks drift at 10^-13 per day; Rubidium oscillators at 10^-10 per day).

NIST IR 8323's risk framework requires assessing the impact of GPS disruption on each critical function that depends on PNT. The assessment framework:

Function-level impact categories:

• Safety-of-life: GPS disruption causes direct risk of injury or death (aviation navigation, emergency services dispatch)
• Mission-critical: GPS disruption prevents a critical function from operating (power grid synchrophasor monitoring without which grid instability goes undetected)
• Operational degradation: GPS disruption degrades but does not prevent operation (trading system timestamps shift, causing regulatory reporting issues but not preventing trading)
• Administrative impact: GPS disruption affects non-critical operations (facility access control timestamps become inaccurate)

Time sensitivity: For each GPS-dependent function, determine how long it can tolerate GPS disruption or degradation:

• Instantaneous (sub-second): Trading systems, power grid protection relays -- cannot tolerate any timing disruption without fallback
• Short-term (minutes to hours): Cellular network base station synchronization -- can tolerate GPS loss for minutes using crystal oscillator holdover before frame synchronization degrades
• Long-term (hours to days): Navigation applications that use GPS for position -- can operate on dead reckoning or chart position for hours without GPS

Cascading failure identification: For each identified GPS dependency, trace the downstream impact: if the GPS-disciplined NTP server fails, which systems lose time synchronization, and what are the downstream operational impacts? Map the dependency graph to identify single points of failure in the PNT supply chain.

NIST IR 8323 recommends a risk-based implementation approach. Prioritization by impact and time sensitivity:

Highest priority (safety-of-life and instantaneous-impact functions):

• Deploy spoofing-detection receivers at all critical GPS reference points
• Implement GNSS cross-validation at primary timing infrastructure
• Configure NTS-authenticated NTP using GPS-independent backup reference
• Test backup timing source activation procedures quarterly

Medium priority (mission-critical with short-term tolerance):

• Implement NTS for all organizational NTP clients
• Evaluate eLoran or atomic clock holdover for systems with 1-4 hour GPS tolerance
• Document manual operating procedures for degraded GPS scenarios
• Configure monitoring alerts for GPS quality degradation

Lower priority (operational degradation and administrative impact):

• Document GPS dependency in system risk registers
• Include GPS disruption scenarios in annual tabletop exercises
• Monitor vendor security advisories for GPS receiver firmware vulnerabilities

Regulatory drivers: FERC Order 2222 (distributed energy resources) and NERC CIP-002 (bulk electric system) have implicit PNT dependencies through PMU timing requirements. The financial services sector (SEC, FINRA) requires accurate timestamping for trade reporting. Including regulatory timing requirements in the impact assessment ensures that compliance deadlines drive prioritization for mission-critical PNT-dependent systems.