Secure Coordination for Vertiport Sequencing in Advanced Air Mobility

Technical Summary: Secure Coordination for Vertiport Sequencing in Advanced Air Mobility

Problem Statement
Advanced Air Mobility (AAM) operations near vertiports require reliable coordination mechanisms to manage dense traffic under limited landing capacity and uncertain arrival times. Current coordination relies heavily on self-reported data, such as Remote-ID, which provides vehicle identity and position. However, this reliance creates a vulnerability: self-interested vehicles may strategically misreport their estimated time of arrival (ETA) to secure favorable landing slots, while malicious actors may spoof data to disrupt sequencing or induce congestion.

While comparing self-reported data with external surveillance (e.g., radar or optical tracking) offers a defense, surveillance estimates are inherently uncertain due to measurement noise and estimation errors. Consequently, falsified reports that remain consistent with the surveillance uncertainty region cannot be immediately rejected. This creates a strategic coordination problem where the coordinator must assign separation-feasible arrival schedules despite the possibility of undetectable, yet potentially harmful, false reports.

Methodology
The paper proposes a framework for secure vertiport sequencing that distinguishes between two distinct sources of false information and formulates robust sequencing rules to counter them.

1. System Model:

   • The system involves $N$ vehicles approaching a shared vertiport.
   • Each vehicle $i$ has a true ETA ($\tau_i$) and reports an ETA ($\hat{\tau}_i = \tau_i + \delta_i$), where $\delta_i$ is the reporting deviation.
   • A coordinator utilizes an active surveillance system to infer an independent ETA estimate. Due to sensing uncertainty, deviations $\delta_i$ are constrained to an uncertainty-consistent set $\mathcal{U}_i$ (e.g., an interval $[-\varepsilon_i, \varepsilon_i]$). Reports outside this set are rejected; those inside are treated as potentially false but indistinguishable from truthful ones.
   • The objective is to minimize the system-level sequencing cost, defined as the sum of squared adjustments between assigned arrival times ($a_i$) and true ETAs ($\tau_i$), subject to minimum temporal separation constraints ($s_{min}$).

2. Robust Formulations:
   The paper models the interaction between the coordinator and the reporting entities using two robust optimization approaches:

   • Self-Interested Misreporting (Strategic Deviation): Modeled as a Stackelberg game. Self-interested vehicles observe the coordinator's robustification parameter ($\theta$) and select a deviation $\delta_i \in \mathcal{U}_i$ to minimize their own schedule-adjustment cost. The coordinator anticipates this best-response behavior and selects $\theta$ to minimize the resulting system cost.
   • Malicious Spoofing (Adversarial Disturbance): Modeled as a min-max problem. An external attacker injects false reports for a subset of vehicles ($\mathcal{M}$) to maximize the system-level sequencing cost (e.g., causing congestion or delays). The coordinator selects $\theta$ to minimize the worst-case system cost induced by these adversarial deviations.

3. Sequencing Rule:
   The coordinator employs a parameterized sequencing rule $S_\theta$ that maps reported arrival times to an assigned schedule. The parameter $\theta$ represents robustification measures, such as confidence thresholds or uncertainty-reduction rules, designed to make the sequencing outcome less sensitive to reports within the uncertainty set.

Key Contributions and Planned Results
As an extended abstract, this paper primarily establishes the theoretical framework and outlines planned numerical studies rather than presenting finalized experimental results. Its contributions include:

• Formal Distinction of Threat Models: The paper explicitly differentiates between strategic misreporting (aimed at individual gain) and malicious spoofing (aimed at system degradation), proposing distinct robust formulations for each.
• Robust Design under Sensing Uncertainty: It formulates vertiport sequencing as a robust design problem over surveillance-consistent uncertainty sets, acknowledging that perfect detection is impossible due to sensor noise.
• Planned Evaluation Strategy: The authors propose a comprehensive numerical study to evaluate the proposed rules. The study plans to compare:
  • Baseline Sequencing: Using reported times directly.
  • Self-Interested Robust Sequencing: Optimized against strategic deviations.
  • Malicious Robust Sequencing: Optimized against adversarial disturbances.
• Metrics for Evaluation: The planned experiments aim to quantify:
  • The efficiency loss of robustness (comparing robust vs. baseline performance under truthful reporting).
  • The security benefit of robustness (comparing performance under false reporting with and without robust rules).
  • Sensitivity to traffic density, separation requirements, surveillance noise, and the size of the potentially untrusted vehicle set ($\mathcal{M}$).

Significance
The paper argues that as AAM traffic density increases and sequencing margins tighten, the operational impact of false information will become more pronounced than in conventional air traffic management. By integrating surveillance data with self-reported information through robust optimization, the proposed framework aims to preserve the reliability of sequencing mechanisms. It seeks to protect against both the "tragedy of the commons" (where individual vehicles game the system) and active adversarial attacks, ensuring that vertiport operations remain safe and efficient even when sensing capabilities are imperfect.

The authors note that future work will extend this framework to include surveillance resource allocation, where the coordinator dynamically allocates sensing resources (e.g., resolution or power) to reduce uncertainty for specific vehicles, thereby hardening the sequencing decisions against likely sources of false information.