السياق
UAV telemetry and command paths fail in ways that look like “the radio is fine.” Spoofed identifiers, delayed packets, and unverified control messages are architecture problems, not UI problems.
حدود النظام
ضمن النطاق
- vehicle sensors
- transport
- ground ingestion
- validation
- time-series store
- operator control
خارج النطاق
airframe design
البنية
The vehicle is untrusted relative to the ground station. Telemetry is authenticated and validated before it is stored. Control is a separate path with a tighter trust boundary than observation.
- Vehicle
- Transport
- Ingestion
- Validation
- Persistence
- Monitor / control
- Dashed = trust boundary
- Control is a separate path
- Vehicle
- Transport
- Ingestion
- Validation
- Persistence
- Monitor / control
أعداد من السجل المنشور. تصف البنية، وليست نتيجة مقاسة.
ما الذي يعبر حدود الثقة؟
Untrusted field
- خارجيVehicle
transit
- واجهةTransport
Ground trust
- خدمةIngestion
- عمليةValidation
- مخزنPersistence
Control plane
- واجهةMonitor / control
- VehicleTransport
- TransportIngestion
- IngestionValidation
- ValidationPersistence
- PersistenceMonitor / control
التدفقات الحرجة
Vehicle emits telemetry
transport (NATS/MAVLink-class)
ingestion
schema and anomaly validation
Timescale persistence
observe/control surfaces. Command traffic does not share the telemetry write path.
المراحل
القرارات
Separate observe and command
A compromised telemetry writer must not become a command issuer. Boundaries are in the topology, not in comments.
Validate before persist
Storage is not a dump. Identifier, clock, and envelope checks happen on the way in.
Edge inference is a peer, not a plugin
EO/IR models run at the edge with their own health, not as a side effect of the GCS UI.
عندما يتعطل
| الحالة | الكشف | الاستجابة |
|---|---|---|
| Identity or envelope violation | Ingest validator | Drop; increment security counter; do not store |
| Clock skew / replay | Monotonic timestamp window | Quarantine stream; alert control |
| Transport partition | Heartbeat loss | Hold last validated state; freeze command unless policy allows |
| Store write failure | Commit error | Local WAL on ingest; backfill when store returns |
البنية التحتية
- Field radio
- NATS
- ingest services
- TimescaleDB
- edge GPU/CPU
- ground control host
- audit log
النتيجة
A field topology where telemetry can be distrusted, validated, and stored without collapsing into a single “GCS application.”
الحالة الحالية
Active field architecture. Security and telemetry research continues against this topology.