Most precision timing infrastructure — NTP servers, PTP grandmasters, GPS clocks — ultimately traces its accuracy back to signals received from GNSS satellites (GPS, and depending on the receiver, GLONASS, Galileo, BeiDou or NavIC). Those signals are extremely weak by the time they reach a ground receiver, broadcast from satellites roughly 20,000 km away, which makes them inherently vulnerable to two distinct kinds of interference: jamming and spoofing.
Jamming vs spoofing
Jamming is the simpler of the two: a transmitter broadcasts noise or a strong signal on or near the GNSS frequency bands, overpowering the genuine satellite signal so a receiver can no longer acquire or track it. A jammed receiver typically knows something is wrong — it loses satellite lock and can report a fault or fall back to another time source, if one is configured.
Spoofing is more insidious. Rather than drowning out the genuine signal, a spoofing transmitter broadcasts a counterfeit GNSS signal designed to be accepted by the receiver as legitimate — potentially reporting a false position, and critically for timing applications, a false time. A receiver that is successfully spoofed may show no obvious fault indication at all, because as far as its tracking loop is concerned, it has a valid satellite lock — just to fabricated signals rather than real ones. This makes spoofing significantly harder to detect than jamming without receivers or systems specifically designed to look for the signs of it.
Why this matters for timing, not just navigation
Public discussion of GNSS interference tends to focus on navigation and positioning — an aircraft, ship or vehicle receiving a false location. For timing infrastructure, the more relevant impact is on the clock, not the position: a GPS-disciplined time server that loses lock (jamming) stops receiving fresh corrections and drifts on its internal oscillator; one that is spoofed may actively be pushed to an incorrect time while appearing to function normally. Because so much downstream infrastructure — NTP and PTP distribution, IRIG-B time code, logging and audit timestamps — ultimately depends on that one GPS-referenced source, a compromised or degraded GNSS input can propagate an incorrect time base to an entire network before anyone notices.
General mitigation approaches
Timing equipment and network design address this risk through several complementary approaches, used in combination rather than as alternatives to each other:
Holdover oscillators. A disciplined local oscillator (ranging from a simple temperature-compensated crystal oscillator up to an oven-controlled or rubidium oscillator in more demanding equipment) continues generating an accurate time base for a period after GNSS lock is lost, using the discipline it accumulated while lock was good. The length and accuracy of usable holdover depends heavily on the oscillator grade — a rubidium reference typically holds significantly longer and tighter than a basic crystal oscillator — which is why holdover performance is a meaningful specification to check when evaluating timing equipment for environments where GNSS availability can't be guaranteed.
Multi-constellation reception. Receivers capable of tracking more than one GNSS constellation (for example GPS alongside GLONASS, Galileo, BeiDou or India's own NavIC) are harder to spoof convincingly across every constellation simultaneously, and are more resilient to jamming that targets one constellation's specific frequency band rather than the full spectrum used by all of them.
Anomaly detection. Because a genuine GNSS receiver's reported position and clock behaviour follow physically consistent patterns, receivers and timing systems can monitor for signs of spoofing — implausible position jumps, signal strength inconsistent with genuine satellite geometry, or a sudden step change in indicated time — and raise an alarm or fall back to another reference rather than silently accepting a compromised signal.
Alternative and redundant references. Systems that cannot tolerate a GNSS outage or compromise are typically designed with a secondary, independent time reference — a second GNSS receiver on a different antenna and constellation set, a terrestrial reference, or simply a second, independently sourced time server — so a single point of GNSS failure or manipulation doesn't take down the whole timing chain.
Why this matters most for critical infrastructure
These risks scale with the consequences of getting time wrong. For general enterprise IT logging, a brief timing anomaly is an inconvenience. For secure radio links, power grid protection, telecom networks and other critical infrastructure, a manipulated or degraded time reference can have consequences well beyond a logging discrepancy — which is why resilience against GNSS jamming and spoofing is treated as a core design requirement, not an optional extra, in critical timing infrastructure.
A resilience strategy, not a single product
No single component — a better oscillator, a multi-constellation receiver, or an anomaly detector on its own — fully solves GNSS spoofing and jamming risk. Meaningful resilience comes from combining several of these approaches, matched to how critical the application is and how long an outage or compromised reference can be tolerated before it becomes a real operational problem.
Related products
ORNATE 7000 TSDRNT GPS time server → ORNATE 7000 TSDR secure GPS time server → All products →