FlyBlind: Cross-Slice Timeliness Attacks on UAV Situational Awareness over 5G
Cryptography and Security
Summary
The authors studied a way that drones controlled over 5G networks can have their control information become outdated without anyone noticing. They found that if another authorized user shares the network, it can slow down important updates to the drone's control system even though the connection looks fine. This problem, called Silent State Staleness, means operators might think everything is working well when actually the drone is using old location data. The authors showed this issue in tests where the drone continued flying normally but with a position error and no alerts. They suggest it's important to check how fresh the control data is, not just the basic network connection quality.
Authors
Wagner Comin Sonaglio, Ágney Lopes Roth Ferraz, André Elias Melo, Guevara Noubir, Lourenço Alves Pereira Júnior
Abstract
Beyond Visual Line of Sight (BVLOS) Uncrewed Aerial Systems (UAS) operating over 5G Standalone (SA) networks use a shared User Plane for both command-and-control (C2) data and video feedback. Operators assess link quality through latency and availability, relying on soft isolation between network slices. However, the risk that an authorized co-tenant could make the Ground Control Station (GCS) state outdated without disrupting the connection remains underexplored. This work introduces FlyBlind, a timeliness attack in which an authorized co-tenant on a neighboring slice maintains legitimate uplink demand, causing state aging at the GCS without a rogue gNB or direct interference with C2 traffic. Our key insight is that, under soft isolation, sharing idle resources turns authorized competition for grants into state aging that conventional link monitors fail to detect. We formalize this effect, termed Silent State Staleness, as a falsifiable false-healthy predicate. On a dedicated testbed, telemetry age at the GCS saturates at approximately 12 seconds, with discrepancies of tens of meters between the GCS position estimate and ground truth, while the one-way delay (OWD) p99 remains in the tens of milliseconds, availability exceeds 99.9%, and the vehicle keeps operating in GUIDED mode without triggering failsafe mechanisms. These findings indicate that, in deployments with asymmetric uplink enforcement, verifying state freshness at the destination is essential rather than relying solely on link health.