A Conditional Timing Protection Level: Holdover-Limited Undetected Time Error Under GNSS Spoofing

Electrical Engineering and Systems Science > Signal Processing [Submitted on 23 Jun 2026] A Conditional Timing Protection Level: Holdover-Limited Undetected Time Error Under GNSS Spoofing Chakshu Baweja A GNSS timing receiver under spoofing has no nominal-geometry fault for position-domain RAIM to bound: the threat is a slow, common-mode pull of served clock time that the receiver's own time-accuracy flag need not reveal. We make three graded contributions. First, a field measurement: solving the receiver clock trajectory from raw L1 pseudoranges and broadcast ephemeris, we show a recorded over-the-air spoof from the public JammerTest 2024 campaign pulled a u-blox ZED-F9P by about 1.01 ms of served time while it reported at most 51 ns, a gap near 20,000x. Second, an impossibility: against an adversary free to choose the ramp rate, no finite unconditional bound on undetected time error exists under a single self-referential clock-aided monitor, because a ramp slow enough to keep the disciplined reference in lock-step is never alarmed while the error grows without limit, so any finite guarantee is conditional. Third, the conditional bound: the Timing Protection Level (TPL), a model-free monitor's static detectability floor plus the oscillator's coast over the detection latency, holds given detection by an independent cross-satellite consistency check a coherent spoofer does not drive in lock-step. Each term is a closed form over a primitive verified in the open Kshana simulator, so the sum is reproducible by hand. Calibrated on the recorded attack, the budget is 114 ns at one-second recovery and 458 ns at a 60-second coast, thousands of times below the 1.01 ms accepted; a clock-aided sequential test alone gives essentially no protection on this slow ramp (it alarms only near the ~1 ms capture), while the model-free monitor alarms during the ramp. We are explicit: the bound is calibrated, not field-validated; carries no integrity-risk budget; and is reported as a band at long coast. The simulator, bound, and calibration example are open source under AGPL-3.0. Comments: 8 pages, 5 figures, 2 tables. Calibrated on the public JammerTest 2024 dataset (Zenodo https://doi.org/10.5281/zenodo.15911589). TPL primitives, CUSUM detector, and calibration example open source in the Kshana simulator (AGPL-3.0) Subjects: Signal Processing (eess.SP); Cryptography and Security (cs.CR) Cite as: arXiv:2606.24210 [eess.SP]   (or arXiv:2606.24210v1 [eess.SP] for this version)   https://doi.org/10.48550/arXiv.2606.24210 Focus to learn more Submission history From: Chakshu Baweja [view email] [v1] Tue, 23 Jun 2026 06:52:58 UTC (55 KB) Access Paper: HTML (experimental) view license Current browse context: eess.SP < prev   |   next > new | recent | 2026-06 Change to browse by: cs cs.CR eess References & Citations NASA ADS Google Scholar Semantic Scholar Export BibTeX Citation Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Demos Related Papers About arXivLabs Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)