Hardening of Long-Range UAS Control Links (HOLUL)

Description

Open-source radio control protocols like ExpressLRS have become standard for FPV drones requiring high update rates and long operational range. These systems were engineered for low latency and hardware interoperability without defensive security measures. Because over-the-air packets rely on unkeyed integrity checks and unencrypted payloads, and frequency-hopping sequences follow deterministic algorithms seeded by non-secret identifiers, an observer using commodity radio hardware can reconstruct hopping schedules, inspect control telemetry, inject unauthorized commands, in some cases seizing control of the aircraft.

Our work investigates how to introduce cryptographic confidentiality and authenticated integrity into the protocol, while preserving flight performance. We develop methods to fit authenticated encryption and anti-replay mechanisms into limited packet boundaries, alongside pseudorandom frequency hopping that prevents adversaries from predicting upcoming channels.