Malicious GNSS Spoofing Causing False Trips in IEC 61850 Multivendor Substations

Time alignment governs the correctness of phasor and sampled value processing across modern substations: Protection, measurement, and control functions rely on accurate time stamps to fuse data streams. When timing fails, systems may suffer loss of service or, more critically, misoperation. Although Global Navigation Satellite System (GNSS) based time synchronization is a well-known attack surface, empirical end-to-end evidence linking GNSS-layer timing manipulation to utility-grade protection misoperation remains scarce.This paper presents, to the best of our knowledge, the first fully IEC 61850-compliant multivendor laboratory demonstration in which an RF-only GNSS-layer timing attack without substation-network access triggers false trips of transformer differential protection (ANSI 87T). We quantify consistency-gap durations (relay-independent exposure) and trip onset/success rates (relay-dependent realization) under commanded time steps of up to ±10 ms across three Merging Unit pairings. We observe strong pairing- and sign-dependent behavior, including non-monotonic behavior for large backward steps, consistent with defensive blanking/blocking. ... mehrFinally, we outline pragmatic countermeasures, including GNSS source hardening and interoperability improvements.