Sequence-, Epoch-, and Integrity-Aware Detection of Replay and Peer-Spoofing Attacks in Decentralized UAV Mesh Networks: A Software-Validated Security Framework
Year: 2026
Type: preprint
Abstract: Decentralized unmanned aerial vehicle (UAV) swarms depend on rapidly changing peer-to-peer links in which a stale but previously valid state, a forged sender identity, or an unauthenticated emergency message can influence collective behavior before a centralized authority can intervene. This paper develops and analyzes a packet-admission framework for replay and peer-spoofing resistance that is grounded in the implemented edge-swarm security path of an open GPS-denied UAV research platform. Each peer packet is represented by sender identity, timestamp, time-to-live, trust epoch, sequence number, source tag, payload, and authentication hook. The implemented admission chain canonicalizes the packet with the authentication field removed, authenticates the canonical CBOR representation with a full HMAC-SHA256 tag, enforces a bounded timestamp/TTL window, requires equality with the configured trust epoch, and rejects any sequence number that is not strictly greater than the last authenticated value. Authentication failure occurs before state-cache mutation or safety-relevant peer action. We formalize this compound predicate, derive replay-rejection, tamper-rejection, epoch-isolation, and pre-action authorization properties, and quantify the operational trade-off introduced by strict monotonic sequencing under packet reordering. Source-level tests cover valid HMAC verification, payload and sender tampering, missing signatures, simulation-only unsigned exceptions, stale epochs, stale sequences, unsupported post-quantum placeholders, cache-update suppression, and authentication of emergency-corridor messages. A repository benchmark reports a swarm-authentication path median of 12.219 ms and mean of 22.603 ms, but the harness includes process-launch overhead and is therefore treated only as a coarse software-path proxy rather than isolated cryptographic latency. The analysis also identifies the principal residual risk: a shared-secret member that is fully compromised can generate valid HMACs and impersonate other identifiers. The resulting framework provides an evidence-bounded baseline for lightweight anti-replay and peer-spoof protection and a clear migration path toward per-node keys, replay windows, hardware-bound identity, and post-quantum authentication.
Source: Research Square
Author: Md Shahanur Islam Shagor
Language: English
Subfield: Computer Networks and Communications
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7204198523