发表机构
Aeronautics Institute of Technology; Northeastern University（航空技术学院; 东北大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本研究提出FlyBlind时效性攻击，利用5G网络切片软隔离特性，通过授权同租户的上行链路竞争使无人机GCS状态陈旧，相关发现强调需验证目的地状态新鲜度而非仅依赖链路健康。
AI 中文摘要
在5G独立组网（SA）网络下运行的超视距（BVLOS）无人机系统（UAS），其控制与指挥（C2）数据和视频反馈共享用户平面，操作员通过延迟和可用性评估链路质量，依赖网络切片间的软隔离。然而，授权的同租户能否在不中断连接的情况下使地面控制站（GCS）状态过时，这一风险尚未得到充分研究。本研究提出FlyBlind，这是一种时效性攻击：相邻切片上的授权同租户维持合法上行链路需求，在不使用恶意gNB或直接干扰C2流量的情况下，导致GCS处的状态老化。关键见解在于，在软隔离下，共享空闲资源会使授权的授权竞争转化为状态老化，而传统链路监控无法检测到这种情况。我们将这种效应形式化为可证伪的假健康谓词，命名为“静默状态陈旧”。在专用测试平台上，GCS处的遥测年龄饱和于约12秒，GCS位置估计与真实值存在数十米的偏差，而单向延迟（OWD）的p99保持在数十毫秒，可用性超过99.9%，飞行器保持在GUIDED模式运行，未触发故障安全机制。这些发现表明，在上行链路执行不对称的部署中，验证目的地的状态新鲜度至关重要，而非仅依赖链路健康。
英文摘要
Beyond Visual Line of Sight (BVLOS) Uncrewed Aerial Systems (UAS) operating over 5G Standalone (SA) networks use a shared User Plane for both command-and-control (C2) data and video feedback. Operators assess link quality through latency and availability, relying on soft isolation between network slices. However, the risk that an authorized co-tenant could make the Ground Control Station (GCS) state outdated without disrupting the connection remains underexplored. This work introduces FlyBlind, a timeliness attack in which an authorized co-tenant on a neighboring slice maintains legitimate uplink demand, causing state aging at the GCS without a rogue gNB or direct interference with C2 traffic. Our key insight is that, under soft isolation, sharing idle resources turns authorized competition for grants into state aging that conventional link monitors fail to detect. We formalize this effect, termed Silent State Staleness, as a falsifiable false-healthy predicate. On a dedicated testbed, telemetry age at the GCS saturates at approximately 12 seconds, with discrepancies of tens of meters between the GCS position estimate and ground truth, while the one-way delay (OWD) p99 remains in the tens of milliseconds, availability exceeds 99.9%, and the vehicle keeps operating in GUIDED mode without triggering failsafe mechanisms. These findings indicate that, in deployments with asymmetric uplink enforcement, verifying state freshness at the destination is essential rather than relying solely on link health.
Comments17 pages
