Cyber-Resilience and Trust-Aware Command Authorization for Autonomous UAV Swarms in GPS-Denied Environments

Imagine a flock of drones flying together without GPS, navigating by sensing their surroundings and talking to one another. In this high-stakes environment, a single drone must decide whether to obey a command sent by a human operator or a neighboring drone. The core challenge is not just verifying that the message came from a known source, but determining if it is safe to follow that message right now. A command might be perfectly authentic—signed with the correct digital key—yet still be dangerous if the drone's location sensors are failing, its battery is low, or the person who sent the command is no longer trusted. This paper addresses the gap between cryptographic security and physical safety, proposing a system that treats every incoming order as a potential risk until it passes a rigorous, multi-layered check. The researchers built a framework that acts as a gatekeeper, ensuring that a drone never executes a remote instruction unless the entire context of its flight, its health, and its trust in the sender aligns perfectly.

The work focuses on autonomous drone swarms operating in GPS-denied environments, where the usual satellite navigation is unavailable. In these conditions, the drones rely on peer-to-peer communication and onboard sensors to maintain formation and mission integrity. The author argues that traditional security models, which often stop at verifying a digital signature, are insufficient for physical machines. A signature proves who sent a message, but it does not prove that the message is safe to act upon. To solve this, the researchers developed a "fail-closed" runtime supervisor. This is a piece of software that constantly monitors the drone's internal state and its external environment. It looks at nine distinct factors, including the quality of the wireless connection, the confidence in the drone's own location estimate, the battery level, and the trustworthiness of the entity issuing the command. Based on these inputs, the system assigns the drone to one of nine specific security states, ranging from fully trusted to immediately isolated.

The system operates on a principle of strict hierarchy. If the drone detects a critical failure, such as a battery dropping below a safe threshold or a sudden loss of communication, it immediately enters a state where it ignores all remote commands and executes a pre-programmed safety maneuver, such as landing or returning home. This decision is automatic and cannot be overridden by a remote operator, even if that operator is authenticated. The researchers implemented this logic in a C++ software platform and tested it against various scenarios. They found that the system successfully rejected commands that were technically valid but contextually unsafe. For instance, if a drone's location confidence dropped below a specific threshold, the system would refuse a formation-hold command, even if the command came from a trusted leader and was fresh. Similarly, if the system detected signs of a replay attack—where an old, valid command is sent again to confuse the drone—it would switch to a suspicious state and block further remote control.

A key finding of the study is that a single composite score of "health" is not enough to make these decisions. The researchers demonstrated that relying on a weighted average of different factors could be dangerous. For example, a drone with excellent battery and strong trust in the sender might still have a terrible wireless connection. If the system only looked at an average score, it might allow a command through despite the broken link. Instead, this framework uses hard thresholds. If the wireless link drops below a certain quality, or if the sender's trust score falls below a specific number, the system immediately restricts authority, regardless of how good the other numbers look. This ensures that a failure in one critical area cannot be masked by success in another. The system also tracks "tamper evidence," accumulating points for different types of anomalies like replayed messages or clock mismatches. If enough evidence accumulates, the drone shifts to a state where it trusts only its own local safety systems.

The researchers tested their software framework using a repository of unit tests and scenario simulations. They confirmed that the system correctly rejected tampered messages, replayed commands, and instructions from senders with low trust scores. They also measured the time it took for the software to process these security checks. The results showed that the authentication path took a median of 12.219 milliseconds, with an average of 22.603 milliseconds. While this is fast enough for many software applications, the author is careful to note that these numbers come from a local computer simulation and do not represent a certified real-time guarantee for actual flight hardware. The study explicitly states that it does not include physical flight tests, radio jamming experiments, or formal mathematical proofs of the code's perfection. Instead, it provides a software-grounded, mathematically explicit model for how security evidence should be converted into physical control authority.

The framework also includes a special exception for emergency commands. If a command is flagged as an emergency landing, the system allows it to bypass some of the usual trust and freshness checks, provided the message has passed the initial cryptographic verification. This design choice prioritizes immediate physical safety over strict protocol adherence, acknowledging that in a crisis, a verified command to land is more important than a command to wait for further confirmation. However, this exception is tightly controlled; it only works if the message comes through the secure, authenticated channel. The researchers emphasize that this emergency override is a deliberate trust boundary that must be carefully managed.

Ultimately, this work demonstrates that for autonomous machines, security is not just about keeping hackers out; it is about ensuring that the machine knows when to say no. The proposed system creates a defense-in-depth chain where a command must pass through authentication, freshness checks, trust evaluation, and safety constraints before it can influence the drone's motors. By separating the question of "who sent this" from "should we do this," the researchers have created a model that could make autonomous swarms more resilient to both cyber attacks and physical failures. The study concludes that while the software logic is sound and the rejection of unsafe commands is deterministic, the full validation of this approach requires future work involving hardware testing and real-world adversarial scenarios. For now, it stands as a clear, software-based blueprint for how autonomous systems can maintain safety when the world around them becomes uncertain.