GNSS Vulnerabilities Mitigation for Timing Applications GNSS Protection 9 Layer Model GNSS Vulnerabilities Mitigation for Timing Applications Omer Sharar – Focus Telecom

GNSS Vulnerabilities - Jamming Common GNSS jammers available online: Critical Infrastructures, both Commercial & Defense, are totally GPS dependent A good, Rubidium based atomic clock (like the MAC) helps maintain good holdover which is a great short term solution for jamming BUT even the greatest Rb based timing system will not comply with today’s stringent timing requirements for a long time without GPS DIY GPS jammer diagram:

GNSS Vulnerabilities- Spoofing A spoofing attack tricks the receiver with false position / time Could cause SEVERE damage for any network

Introducing: The GNSS Protection 9-Layer Model The Front-End Layer: GPSdome front-end protection APTS PTP The Mask Layer: Configurable Antenna Elevation Mask The Cutoff Layer: External GPS Switch The Firewall Layer: BlueSky GPS Firewall The Receiver Layer: GNSS Multiple constellation The Management Layer: TimePictra The Network Layer: PTP with APTS The Holdover Layer: ePRTC / Rb / OCXO 1 The Client Layer: DomainTime II 2 3 4 5 6 7 8 9

Layer 1: The Front-end Layer – GPSdome Standalone, retrofit, dual antenna module Applies CRPA, null steering algorithm Rejects disruptions by nullifying their energy Compatible with any GPS system Introduces minimal latency to RF signal (50ns) Deterministic fixed delay Qualified by INPL

Layer 2: The Mask Layer A SW configurable option of Microsemi timing systems receivers Allows for rejection of lower-elevation satellites Allows for protection from multi-path Allows for rejection of spoofing attempts

Layer 3: The Cutoff Layer – Focus Telecom’s GPS Switch An external, standalone module which cuts off the GNSS feed to the receiver and the DC back to the antenna Minimizes exposure to GNSS With 2 modes of operation: Remote controlled: remotely turned on or off from control center Preprogrammed: Disconnected GPS for X hours/days, then connect for Y hours/days

Layer 4: The Firewall Layer – Microsemi’s BlueSky GPS Firewall Microsemi’s BlueSky GPS FW assures correct GPS data and autonomous time scale Analyzes GPS data and flags anomalies according to IS-GPS-200H with user configurable abilities When anomaly is flagged, GNSS is cut off and hardened GPS data is synthesized allowing the receiver to continue working uninterrupted Optional external input from atomic standard enables extended holdover and enhanced detection capabilities Validated GNSS data “Hardened” GPS data

Layer 5: The Receiving Layer A multiple-constellation GNSS receiver receives satellites from more than a single constellation Allows for more satellites in view Allows for sanity checks of constellation Avoids dependency on US owned GPS system More resistant to narrow-band jamming

Layer 6: The Management Layer – Microsemi’s TimePictra NMS Monitor all sync elements in the network Allows for comparison between multiple units geographically apart Allows to track anomalies e.g. shifting position in stationary units Allows for statistical data of satellite reception trends Provides gauges on time quality the network provides (PTP)

Layer 7: The Holdover Layer – From OCXOs to ePRTC Optimal time HO is achieved Microsemi’s ePRTC (ITU-T G.8272.1 and G.811.1) Better than PRTC (100ns) to UTC for over 2 weeks without GPS Microsemi’s Rb technology (MAC and XPRO) provides for optimal local holdover (<1uS and <250ns @ 24 hours) Patented temperature-compensation technology allows for <25uS holdover with an OCXO

Layer 8: The Network Layer – PTP with APTS Backup network edge timing from Core IEEE 1588 PTP with APTS (Assisted Partial Timing Support) allows for accurate source of time Implementation of Microsemi’s APTS at the network edge compensates for network asymmetry of 30 different paths from the Core When GNSS is not available, a fallback on PTP will not compromise accuracy at the network edge

Layer 9: The Client Layer – Microsemi’s DomainTime II Time Management system (for IT NTP/PTP networks) Monitors time all the way to the client Implemented on the DC, DTII SW could receive time from multiple sources and compare them for inconsistencies With auditing capabilities, the accuracy of each client could be measured, recorded and analyzed