A Provenance-Aware Operational Audit Contract for Low-Altitude Unmanned Aircraft Evidence
This paper proposes and validates a provenance-aware operational audit contract for low-altitude unmanned aircraft that ensures cross-organizational evidence interpretability by distinguishing between intended, observed, and claimed states through a versioned nine-component record, successfully verified across 19 runs and 475 audit queries.
Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine a sky filled with small, unmanned aircraft, buzzing like a swarm of bees to deliver packages, inspect power lines, or monitor traffic. As these machines become more common, they will need to talk to each other, to ground stations, and to air traffic controllers to stay safe and organized. But a new problem arises: when something goes wrong, or when a regulator needs to check a flight, how can anyone be sure what actually happened? The records are scattered across different computers, held by different companies, and often speak different technical languages. A flight plan sent by a pilot might look different from the position data recorded by the drone's computer, which might look different again from the signal broadcast to a nearby observer. Without a way to link these pieces together, the story of a flight remains broken, making it impossible to know who was in charge, what was intended, and what was actually seen.
This is the challenge researchers at VNU University of Engineering and Technology and Antaja Company Limited set out to solve. They did not try to build a new drone or a new communication network. Instead, they designed a strict set of rules for how flight records should be written and kept. Think of it as a universal ledger for the sky, a system that forces every piece of evidence to carry its own history. Their goal was to create a method that can reconstruct the full story of a flight, even when data is missing, delayed, or comes from conflicting sources. They wanted to know if it is possible to look at a collection of digital records and clearly distinguish between what a pilot planned to do, what the drone's sensors reported seeing, and what the drone actually broadcast to the world.
The team developed what they call an operational audit contract. In simple terms, this is a template for recording flight data that treats three different types of information as separate, distinct things. First, there is the "intended" state: the plan, the command, or the target the pilot or computer set. Second, there is the "observed" state: the actual measurements of where the drone was, how fast it was moving, and how it was oriented, as recorded by its own sensors. Third, there is the "claimed" state: the information the drone chose to broadcast to others, such as its identification number or its reported position. The researchers found that these three things often do not match perfectly, and that is okay. The problem arises when they are mixed up or when the source of the data is lost. Their new system ensures that every record keeps these three views separate, while also tagging them with who created them, when they were created, and where the data came from.
To make this work, the researchers created a nine-part record for every moment of a flight. This record includes not just the numbers, but also the context: who owns the data, what mission was being flown, and who had the authority to control the aircraft at that specific time. Crucially, the system is designed to handle gaps. If a piece of data is missing, the record does not pretend it is there. Instead, it explicitly states that the information is missing, unavailable, or that a link to a previous record cannot be found. This might sound like a failure, but in the world of evidence, admitting what is unknown is far more valuable than guessing. By keeping a clear trail of these gaps and the history of who held the data, the system allows auditors to reconstruct the flight story without filling in the blanks with assumptions.
The team tested this system using a computer simulation that mimicked a real flight environment. They ran nineteen different scenarios, including situations where communication links failed, where the pilot handed over control to an automated system, and where data arrived late. In every single case, the system successfully reconstructed the expected story. When the researchers intentionally broke the data by removing a link or hiding a timestamp, the system correctly reported that the story was incomplete rather than inventing a fake connection. They found that even when data was missing or stale, the system could still tell the difference between a planned action and an observed reality. For example, in one test, the system correctly identified that a drone had lost its connection to a ground station, and it recorded exactly when that happened and what the last known position was, without trying to guess where the drone went next.
The researchers also tested their idea in a more realistic setting using software that runs on a single computer but simulates multiple separate systems, like a drone, a ground station, and an observer. They flew a simulated route over a university campus, creating a digital twin of a real-world environment. Even in this complex setup, where different parts of the system were running separately, the nine-part record kept the history clear. The system could show that the drone's internal sensors and the external observer's records shared a common origin, proving they were not independent sources of truth, but rather two views of the same event. This distinction is vital for safety; if two records look the same but come from the same broken sensor, they cannot be used to verify each other. The system flagged this shared origin, preventing a false sense of security.
The results of this work are not a magic solution that makes all drones safe or guarantees that every flight will be perfect. The researchers were careful to state that their system does not prove the physical truth of a flight; it only proves that the records are consistent and that the story can be reconstructed as it was intended. They did not find a way to prevent crashes or to stop hackers from sending false signals. Instead, they found a way to make the evidence of a flight transparent. If a drone crashes, or if a flight violates a rule, investigators will be able to look at the records and see exactly what was planned, what was observed, and what was claimed, along with a clear map of who was responsible and what data was missing.
This approach changes the way we think about accountability in the skies. Instead of hoping that all the data will line up perfectly, the system accepts that data will be messy, incomplete, and sometimes contradictory. By building a structure that can hold these imperfections without breaking, the researchers have created a foundation for a future where many different organizations can share the sky safely. The system works by keeping the story honest, even when parts of it are missing. It ensures that when we look back at a flight, we see the truth of what happened, not a smoothed-over version of events. This clarity is the first step toward a future where low-altitude aviation can grow into a complex, multi-user network without losing the ability to understand what is happening in the air.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.