Context
UAV telemetry and command paths fail in ways that look like “the radio is fine.” Spoofed identifiers, delayed packets, and unverified control messages are architecture problems, not UI problems.
System boundary
In scope
- vehicle sensors
- transport
- ground ingestion
- validation
- time-series store
- operator control
Out of scope
airframe design
Architecture
The vehicle is untrusted relative to the ground station. Telemetry is authenticated and validated before it is stored. Control is a separate path with a tighter trust boundary than observation.
- Vehicle
- Transport
- Ingestion
- Validation
- Persistence
- Monitor / control
- Dashed = trust boundary
- Control is a separate path
- Vehicle
- Transport
- Ingestion
- Validation
- Persistence
- Monitor / control
Counts from the published record. They describe structure, not a measured result.
What crosses the trust boundary?
Untrusted field
- externalVehicle
transit
- interfaceTransport
Ground trust
- serviceIngestion
- processValidation
- storePersistence
Control plane
- interfaceMonitor / control
- VehicleTransport
- TransportIngestion
- IngestionValidation
- ValidationPersistence
- PersistenceMonitor / control
Critical flows
Vehicle emits telemetry
transport (NATS/MAVLink-class)
ingestion
schema and anomaly validation
Timescale persistence
observe/control surfaces. Command traffic does not share the telemetry write path.
Stages
Decisions
Separate observe and command
A compromised telemetry writer must not become a command issuer. Boundaries are in the topology, not in comments.
Validate before persist
Storage is not a dump. Identifier, clock, and envelope checks happen on the way in.
Edge inference is a peer, not a plugin
EO/IR models run at the edge with their own health, not as a side effect of the GCS UI.
When it fails
| Condition | Detection | Response |
|---|---|---|
| Identity or envelope violation | Ingest validator | Drop; increment security counter; do not store |
| Clock skew / replay | Monotonic timestamp window | Quarantine stream; alert control |
| Transport partition | Heartbeat loss | Hold last validated state; freeze command unless policy allows |
| Store write failure | Commit error | Local WAL on ingest; backfill when store returns |
Infrastructure
- Field radio
- NATS
- ingest services
- TimescaleDB
- edge GPU/CPU
- ground control host
- audit log
Outcome
A field topology where telemetry can be distrusted, validated, and stored without collapsing into a single “GCS application.”
Current state
Active field architecture. Security and telemetry research continues against this topology.