How Secure Are BVLOS Drone Communications? Encryption, Redundancy, and Link Risk

Define the outcome before naming the control

"Uses encryption," "dual carrier," and "private network" describe features. They do not state what the complete system can be trusted to do. Start with the security outcome for each information flow in the UAS data-link model.

The list should be tailored to the operation. A confidentiality failure in an ordinary framing feed and an integrity failure in a flight command do not have the same consequence. Giving every flow one generic "high security" label hides that distinction.

The NIST Cybersecurity Framework 2.0 organizes outcomes under Govern, Identify, Protect, Detect, Respond, and Recover. It is not an aviation approval standard, but its lifecycle structure prevents a design review from stopping after protection is installed.

Draw the end-to-end trust boundary

A BVLOS path commonly includes more than an airborne radio and a handheld controller. The 2024 NIST paper on cybersecurity risk for uncrewed systems describes a connected risk surface spanning the aircraft, operator control unit, planning, maintenance, logistics, and external systems. That paper focuses on uncrewed systems and risk management, not certification of a particular link.

An architecture record should identify:

• flight-control and mission-computer boundaries on the aircraft;
• radios, modems, antennas, routers, network interfaces, and power sources;
• ground-control hardware, applications, displays, and local networks;
• users, roles, devices, credentials, certificates, and administrative access;
• terrestrial, satellite, or mixed communications providers;
• handoffs, gateways, Internet or private backhaul, and routing dependencies;
• cloud, identity, update, time, logging, map, and support services;
• payload, navigation, weather, traffic, detect-and-avoid, and UTM interfaces; and
• maintenance tools, configuration stores, backups, and recovery media.

Mark where information is encrypted and decrypted, where it is translated, who controls each component, and which flight functions depend on it. A provider can sit outside the aircraft integrator's control while remaining essential to the claimed C2 service. A private ground server can remove one cloud dependency and create a different patching and recovery obligation.

Map threats to properties and evidence

Threat categories are useful only when they lead to a bounded requirement and a testable control. The matrix below stays at the assurance level and omits attack instructions.

The 2022 FAA BVLOS Aviation Rulemaking Committee report discusses a risk-based cybersecurity posture and threats such as spoofing, replay, and false-data injection. It is a committee recommendation, not a current operating rule. Its useful contribution here is the link between C2 consequence, operational risk, and system architecture.

Keep positioning threats in the correct part of the model. GNSS interference or false position data affects a positioning, navigation, and timing dependency. C2 interference or command spoofing affects the communications service. The failures can interact, but one is not evidence that the other occurred.

An encryption label needs scope

Encryption may protect data in transit, at rest, or both. Authenticated-encryption protocols can also provide defined integrity and authenticity properties. The result still depends on the protocol, endpoint, implementation, keys, and failure handling.

Ask eight scope questions:

1. Which commands, telemetry, payload, metadata, logs, and management traffic are protected?
2. Where does protection begin and end, and where can plaintext exist?
3. How are aircraft, control stations, services, users, and administrators authenticated?
4. How are credentials provisioned, stored, rotated, revoked, backed up, and recovered?
5. How are old, duplicated, or replayed messages rejected?
6. How are software and configuration updates authorized and verified?
7. What happens when a certificate, clock, key store, or identity service is unavailable?
8. Which logs prove acceptance, rejection, change, and recovery?

Protocol names need the same precision. The MAVLink FAQ states that MAVLink 2 signing can authenticate a message's source, while MAVLink itself does not provide encryption. Signing is not a reason to infer confidentiality, and an outer VPN is not a reason to infer that the flight application correctly checks message age, vehicle identity, or operator authority.

Availability is end to end

Signal strength is only one input to availability. A healthy air interface can feed a failed gateway, expired credential, congested tunnel, stopped application, or frozen display. Useful measures include message age, successful delivery, latency distribution, path state, transition interruption, provider state, and time to detect and recover from a defined failure.

The bandwidth sizing method is relevant because security and resilience consume capacity. Tunnels, cryptographic framing, health messages, duplicate traffic, and failover can change goodput and queueing. Measure the protected configuration with every required flow active.

The physical bearer also does not settle the security question. RF, cellular, satellite, and mesh services expose different coverage, administration, and dependency patterns. The communications transport comparison keeps those bearer choices separate from the end-to-end assurance claim.

Redundancy must name the failure it covers

Two modems can share an antenna, power rail, onboard computer, account, provider core, gateway, ground network, identity service, software process, or faulty configuration. Count independent failure coverage, not icons on a display.

NASA's technical memorandum on UAS flight-demonstration best practices describes a secondary link that may have less capacity and more latency than the primary, and discusses prioritizing C2 when traffic shares a degraded path. It is research guidance from specific demonstrations, not a universal design rule. It shows why a connected backup that is saturated by payload traffic may not preserve the required command service.

For each alternate path, record:

• the failure or coverage gap it is intended to address;
• dependencies shared with the primary path;
• traffic that remains supported after transition;
• detection, selection, and transition timing;
• authentication and routing state after transition;
• crew indication and control authority;
• behavior if paths alternate rapidly; and
• the condition for returning to the primary path.

When every C2 path becomes unavailable, the aircraft response belongs in a mission-specific lost-link procedure. Security controls and flight contingencies should connect through the same state model, but neither substitutes for the other.

Procurement claims should produce records

NIST's 2024 UAS workshop outcomes publish preliminary questions about attack surface, testing, data protection, external inputs, continuity, and whether recovery shares the affected system. The workshop output is not a standard. It is a useful prompt for demanding a specific evidence package.

Ask a supplier or integrator for:

• a controlled architecture and data-flow diagram;
• a role and privilege matrix for operators, maintainers, services, and vendors;
• protection scope at each endpoint and trust boundary;
• credential and key lifecycle procedures;
• software and hardware inventory, update policy, support period, and end-of-life plan;
• security and communications tests with configuration, conditions, and results;
• known limitations, open findings, and remediation ownership;
• primary, alternate, and shared-dependency evidence;
• alert, logging, time-synchronization, incident-response, and recovery behavior; and
• notification and evidence-preservation responsibilities after an event.

"Uses AES," "uses a VPN," "dual network," or "penetration tested" is not an answer unless the record states what was evaluated, which configuration was in scope, what passed, what failed, and what remains outside the claim. The C2 interface contract provides the corresponding message, timing, state, electrical, and recovery boundaries for the installed system.

Treat security as a maintained configuration

Track aircraft and ground hardware, radio and modem firmware, applications, operating systems, certificates, accounts, provider services, routing, payload interfaces, and recovery material. Define which changes require analysis or retest. A security assessment expires when its relevant configuration and dependencies can no longer be reconstructed.

Monitoring should distinguish command freshness, aircraft-state freshness, endpoint authentication, primary and alternate path state, payload service, and ground-application health. A single green indicator should not hide a stale downlink, expired credential, failover state, or local display fault.

The final security statement should be narrow: a named configuration preserved defined properties for named functions under stated conditions and credible failures. Encryption, redundancy, protected spectrum, and onboard contingency logic can each support that case. None establishes the security of an entire BVLOS operation by itself.