Multilateration Method for Locating GNSS Spoofing Attacks Affecting Substation Clocks

Modern electricity substations are reliant on precision time synchronization for operation of protection and control systems. It is common for substations to be synchronized by means of Global Navigation Satellite System (GNSS) signals. This represents a cyber physical vulnerability to the electrical infrastructure in the form of jamming and spoofing attacks. In previous work, the authors describe a mechanism whereby multiple substation GNSS clocks can be used in tandem to identify a GNSS spoofing attack. This paper describes a method to identify the point of origin of a GNSS spoofing signal attacking an electricity substation using multilateration. A full derivation of the method is presented, and a worked example given.