GNSS Spoofing Detection in TDD Networks: A 3GPP Standards-Based Security Framework

Q: Why is GNSS timing critical in TDD mobile networks?

TDD operation requires precise time and phase synchronization between base stations, with an air-interface timing accuracy requirement of ±1.5 µs (3GPP TS 38.104). GNSS-disciplined grandmaster clocks are the predominant timing source and distribute time through a PTP-based synchronization chain to gNB-DUs.

Q: What makes GNSS spoofing difficult to detect compared with GNSS signal loss?

GNSS signal loss typically triggers holdover mode and is more readily detectable. Spoofing can introduce gradual timing drift that evades simple threshold-based detection, while still corrupting the timing delivered to downstream units.

Q: How does the proposed 3GPP standards-based framework detect and report GNSS spoofing?

The framework introduces GNSS timing alarms and performance counters aligned with TS 28.111 and TS 28.552, then applies topology-aware correlation that classifies anomalies by grouping gNB-DUs by serving grandmaster. It also bridges fault management with SECHAND incident handling (TR 33.894), without requiring new interfaces.

Jul 16, 2026

Upload by Genevieve

Time Division Duplex (TDD) mobile networks must meet stringent synchronization accuracy of ±1.5 µs (3GPP TS 38.104), typically relying on GNSS-disciplined grandmaster clocks. GNSS spoofing corrupts timing across downstream base stations, yet existing 3GPP management and security frameworks (SA5/SA3) lack standardized detection and reporting mechanisms. This paper presents an in-framework monitoring approach using GNSS timing alarms, performance counters (TS 28.111/TS 28.552), topology-aware anomaly correlation, and a security event bridge aligned with TR 33.894. Monte Carlo results show >95% detection with <1% false positives for drift rates above 0.5 ns/s.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages13

Reading Time33 min

Introduction

TDD synchronization requirements

GNSS-based timing architecture

Threat impact and detection challenges

Motivation from zero-trust and regulation

Proposed framework (overview)

GNSS timing alarms and performance counters

Topology-aware correlation mechanism

Security event integration and validation

GNSS Spoofing Detection in TDD Networks: A 3GPP Standards-Based Security Framework Ravi Kant Sharma, John Owens, Kevin Kiernan Ericsson {ravi.kant.sharma, john.owens, [kevin.kiernan](kevin.kiernan}@ericsson.com)[}](kevin.kiernan}@ericsson.com)[@ericsson.com](kevin.kiernan}@ericsson.com) arXiv :2607 . 1 1398v 1 [ cs .NI] 13 Jul 2026 Abstract—Time Division Duplex (TDD) mobile networks require synchronization accuracy of ±1.5 µs (3GPP TS 38.104), with GNSS-disciplined grandmaster clocks as the predominant timing source. GNSS spoofing—now a documented operational threat—can corrupt timing across all downstream base stations, yet neither the 3GPP management framework (SA5) nor the security framework (SA3) provides standardized mechanisms to detect or report such attacks. This paper proposes a detection and monitoring framework operating within existing 3GPP management structures. The framework introduces GNSS timing alarms and performance counters aligned with TS 28.111 and TS 28.552, a topology-aware correlation mechanism that classifies anomalies by grouping gNB-DUs by serving grandmaster, and a security event bridging fault management with SECHAND incident handling (TR 33.894). Monte Carlo simulation demonstrates detection probability exceeding 95% for drift rates above 0.5 ns/s with false positive rates below 1% under well-provisioned PTP network conditions (σptp ≤ 5ns). The framework requires no new interfaces, is generation-agnostic, and is validated through scenario analysis distinguishing spoofing from signal loss, equipment faults, and maintenance transients. Index Terms—GNSS spoofing, TDD synchronization, 3GPP management, timing security, zero trust, anti-spoofing, 5G/6G network resilience I. INTRODUCTION Fifth-generation (5G) wireless networks and their successors operating in Time Division Duplex (TDD) mode require precise time and phase synchronization between base stations. The 3GPP specification TS 38.104 [1] mandates a timing accuracy of ±1.5 µs at the air interface for TDD operation. Violation of this requirement results in inter-cell interference, degraded throughput, and potential service outages. As TDD dominates current 5G deployments—particularly in the midband spectrum (3.3–4.2 GHz and 4.4–5.0 GHz)—and is expected to remain the primary duplexing mode in 6G, timing accuracy is not merely a quality metric but a fundamental operational requirement that will persist across network generations. In many mobile network deployments, the primary timing source is the Global Navigation Satellite System (GNSS) . In atypical deployment, GNSS receivers embedded in grandmaster clocks derive Coordinated Universal Time (UTC) from satellite signals. This timing is distributed through the transport network via the Precision Time Protocol (PTP, IEEE 1588) following ITU-T telecom PTP profiles [2] to boundary clocks and ultimately to the gNB Distributed Units (gNB-DUs) 1. The resulting synchronization chain follows the path: GNSS satellite → grandmaster clock → boundary clocks → gNBDU. In deployments where a GNSS-disciplined grandmaster is the primary timing source, this architecture introduces a single point of vulnerability at the GNSS interface. GNSS spoofing—the transmission of counterfeit satellite signals that cause receivers to compute incorrect position or time—has transitioned from a theoretical risk to a documented operational threat. In the Baltic region during 2024, aviation authorities recorded 985 GPS disruption events over a two-month period [3] . In June 2025, 13 EU Member States formally requested the European Commission to take immediate action against GNSS interference; EASA and EUROCONTROL subsequently published a joint Action Plan in March 2026 establishing coordinated detection, monitoring, and mitigation measures for aviation [4] . The GNSS signals affected in these incidents are the same signals used by mobile network grandmaster clocks. While aviation has initiated institutional-level

FAQs

Why is GNSS timing critical in TDD mobile networks?

TDD operation requires precise time and phase synchronization between base stations, with an air-interface timing accuracy requirement of ±1.5 µs (3GPP TS 38.104). GNSS-disciplined grandmaster clocks are the predominant timing source and distribute time through a PTP-based synchronization chain to gNB-DUs.

What makes GNSS spoofing difficult to detect compared with GNSS signal loss?

GNSS signal loss typically triggers holdover mode and is more readily detectable. Spoofing can introduce gradual timing drift that evades simple threshold-based detection, while still corrupting the timing delivered to downstream units.

How does the proposed 3GPP standards-based framework detect and report GNSS spoofing?

The framework introduces GNSS timing alarms and performance counters aligned with TS 28.111 and TS 28.552, then applies topology-aware correlation that classifies anomalies by grouping gNB-DUs by serving grandmaster. It also bridges fault management with SECHAND incident handling (TR 33.894), without requiring new interfaces.

Jul 16, 2026

Upload by Genevieve