Security Best Practices

This guide covers security best practices for deploying and operating the Drone Swarm Communication System.

Table of Contents

• Security Overview
• Key Management
• Cryptographic Best Practices
• Network Security
• Deployment Security
• Monitoring and Incident Response
• Security Checklist

Security Overview

The system implements defense in depth with multiple security layers:

1. Cryptographic Layer: ChaCha20-Poly1305 encryption + Ed25519 signatures
2. Network Layer: Byzantine fault tolerance + mesh routing
3. Consensus Layer: Raft-based agreement prevents rogue commands
4. Application Layer: Role-based access control + intrusion detection
5. Physical Layer: Tamper detection + secure boot

Key Management

DO: Use Hardware-Based Key Generation

Never use static seeds in production!

// ❌ BAD - Predictable keys
let seed = [42u8; 32];
let crypto = CryptoContext::new(seed);

// ✅ GOOD - Hardware RNG
use getrandom::getrandom;

let mut seed = [0u8; 32];
getrandom(&mut seed).expect("RNG failure");
let crypto = CryptoContext::new(seed);

DO: Use Hardware Security Modules (HSM)

For production deployments, store private keys in secure hardware:

• TPM (Trusted Platform Module): For general-purpose platforms
• Secure Element: For embedded systems (e.g., ATECC608)
• HSM: For high-security environments

// Example with TPM
use tpm2::{Tpm2Context, KeyHandle};

let mut tpm = Tpm2Context::new()?;
let key_handle = tpm.create_primary_key()?;

// Keys never leave the TPM
let signature = tpm.sign(key_handle, message)?;

DO: Implement Key Rotation

Rotate cryptographic keys periodically:

pub struct KeySchedule {
    current_key: [u8; 32],
    next_key: [u8; 32],
    rotation_interval: Duration,
    last_rotation: Instant,
}

impl KeySchedule {
    pub fn should_rotate(&self) -> bool {
        self.last_rotation.elapsed() > self.rotation_interval
    }

    pub fn rotate(&mut self) {
        // Retire current key, promote next key
        self.current_key = self.next_key;

        // Generate new next key
        getrandom(&mut self.next_key).unwrap();

        self.last_rotation = Instant::now();
    }
}

DO: Implement Perfect Forward Secrecy

Use ephemeral key exchange for each session:

use x25519_dalek::{EphemeralSecret, PublicKey};
use rand_core::OsRng;

// Generate ephemeral key pair
let secret = EphemeralSecret::random_from_rng(OsRng);
let public = PublicKey::from(&secret);

// Exchange public keys, compute shared secret
let shared_secret = secret.diffie_hellman(&peer_public);

// Derive session keys
let session_key = hash_kdf(&shared_secret);

Cryptographic Best Practices

Nonce Management

CRITICAL: Never reuse nonces with the same key!

use std::sync::atomic::{AtomicU64, Ordering};

pub struct NonceGenerator {
    counter: AtomicU64,
    random_prefix: [u8; 4],
}

impl NonceGenerator {
    pub fn new() -> Self {
        let mut random_prefix = [0u8; 4];
        getrandom(&mut random_prefix).unwrap();

        Self {
            counter: AtomicU64::new(0),
            random_prefix,
        }
    }

    pub fn next(&self) -> [u8; 12] {
        let mut nonce = [0u8; 12];

        // Random prefix (4 bytes)
        nonce[0..4].copy_from_slice(&self.random_prefix);

        // Timestamp (4 bytes)
        let timestamp = SystemTime::now()
            .duration_since(UNIX_EPOCH)
            .unwrap()
            .as_secs() as u32;
        nonce[4..8].copy_from_slice(&timestamp.to_be_bytes());

        // Counter (4 bytes)
        let counter = self.counter.fetch_add(1, Ordering::SeqCst) as u32;
        nonce[8..12].copy_from_slice(&counter.to_be_bytes());

        nonce
    }
}

Replay Attack Prevention

Track used nonces to prevent replay attacks:

use std::collections::HashSet;
use std::time::{Instant, Duration};

pub struct ReplayDetector {
    seen_nonces: HashSet<[u8; 12]>,
    window: Duration,
    last_cleanup: Instant,
}

impl ReplayDetector {
    pub fn check_and_insert(&mut self, nonce: &[u8; 12]) -> bool {
        // Periodic cleanup
        if self.last_cleanup.elapsed() > Duration::from_secs(60) {
            self.cleanup();
        }

        // Check if nonce was already seen
        !self.seen_nonces.insert(*nonce)
    }

    fn cleanup(&mut self) {
        // Remove nonces older than window
        self.seen_nonces.clear();
        self.last_cleanup = Instant::now();
    }
}

Constant-Time Operations

Use constant-time comparisons to prevent timing attacks:

use subtle::ConstantTimeEq;

pub fn verify_mac(computed: &[u8], received: &[u8]) -> bool {
    // ❌ BAD - Vulnerable to timing attacks
    // computed == received

    // ✅ GOOD - Constant time
    computed.ct_eq(received).into()
}

Network Security

Rate Limiting

Implement rate limiting to prevent DoS attacks:

use std::collections::HashMap;
use std::time::{Instant, Duration};

pub struct RateLimiter {
    requests: HashMap<DroneId, Vec<Instant>>,
    max_requests: usize,
    window: Duration,
}

impl RateLimiter {
    pub fn check(&mut self, drone_id: DroneId) -> bool {
        let now = Instant::now();
        let timestamps = self.requests.entry(drone_id).or_default();

        // Remove old timestamps
        timestamps.retain(|&t| now.duration_since(t) < self.window);

        // Check limit
        if timestamps.len() >= self.max_requests {
            return false; // Rate limit exceeded
        }

        timestamps.push(now);
        true
    }
}

Input Validation

Always validate inputs at trust boundaries:

pub fn validate_message(msg: &Message) -> Result<(), ValidationError> {
    // Check message size
    if msg.payload.len() > MAX_MESSAGE_SIZE {
        return Err(ValidationError::MessageTooLarge);
    }

    // Check timestamp (prevent old/future messages)
    let now = SystemTime::now().duration_since(UNIX_EPOCH).unwrap().as_secs();
    let msg_time = msg.timestamp;

    if msg_time < now - 300 || msg_time > now + 300 {
        return Err(ValidationError::InvalidTimestamp);
    }

    // Check hop count (prevent routing loops)
    if msg.hop_count > MAX_HOPS {
        return Err(ValidationError::TooManyHops);
    }

    Ok(())
}

Intrusion Detection

Monitor for suspicious behavior:

pub struct IntrusionDetector {
    failed_auth: HashMap<DroneId, usize>,
    anomaly_score: HashMap<DroneId, f32>,
}

impl IntrusionDetector {
    pub fn record_failed_auth(&mut self, drone_id: DroneId) {
        let count = self.failed_auth.entry(drone_id).or_insert(0);
        *count += 1;

        if *count > 5 {
            self.trigger_alert(drone_id, "Excessive failed authentications");
        }
    }

    pub fn detect_anomaly(&mut self, drone_id: DroneId, behavior: &Behavior) {
        let score = compute_anomaly_score(behavior);
        self.anomaly_score.insert(drone_id, score);

        if score > 0.8 {
            self.trigger_alert(drone_id, "Anomalous behavior detected");
        }
    }

    fn trigger_alert(&self, drone_id: DroneId, reason: &str) {
        // Log to secure audit trail
        log_security_event(drone_id, reason);

        // Optionally quarantine drone
        // quarantine(drone_id);
    }
}

Deployment Security

Secure Boot

Verify firmware integrity before execution:

use sha3::{Sha3_256, Digest};

pub fn verify_firmware(firmware: &[u8], expected_hash: &[u8; 32]) -> bool {
    let mut hasher = Sha3_256::new();
    hasher.update(firmware);
    let hash = hasher.finalize();

    hash.as_slice() == expected_hash
}

Firmware Updates

Always use signed firmware updates:

pub fn update_firmware(
    new_firmware: &[u8],
    signature: &Signature,
    public_key: &PublicKey
) -> Result<(), UpdateError> {
    // 1. Verify signature
    if !verify_signature(new_firmware, signature, public_key) {
        return Err(UpdateError::InvalidSignature);
    }

    // 2. Verify version (prevent downgrade attacks)
    let new_version = parse_version(new_firmware)?;
    let current_version = get_current_version();

    if new_version < current_version {
        return Err(UpdateError::DowngradeAttempt);
    }

    // 3. Verify hash
    let expected_hash = get_expected_hash(new_version)?;
    if !verify_firmware(new_firmware, &expected_hash) {
        return Err(UpdateError::HashMismatch);
    }

    // 4. Apply update
    flash_firmware(new_firmware)?;

    Ok(())
}

Time Synchronization

Use authenticated NTP to prevent time-based attacks:

use ntp::packet::NtpPacket;

pub fn sync_time_secure(ntp_server: &str) -> Result<SystemTime, TimeError> {
    // Send NTP request
    let packet = NtpPacket::new();
    let response = send_ntp_request(ntp_server, &packet)?;

    // Verify NTP-MAC (Message Authentication Code)
    if !verify_ntp_mac(&response) {
        return Err(TimeError::AuthenticationFailed);
    }

    // Extract time
    let time = response.transmit_timestamp();

    Ok(time)
}

Monitoring and Incident Response

Secure Logging

Log security events to tamper-resistant storage:

use sha3::{Sha3_256, Digest};

pub struct AuditLog {
    entries: Vec<LogEntry>,
    chain_hash: [u8; 32],
}

impl AuditLog {
    pub fn append(&mut self, event: SecurityEvent) {
        let mut entry = LogEntry {
            timestamp: SystemTime::now(),
            event,
            previous_hash: self.chain_hash,
        };

        // Chain hash (prevents tampering)
        let mut hasher = Sha3_256::new();
        hasher.update(&entry.previous_hash);
        hasher.update(&serialize(&entry.event));
        self.chain_hash = hasher.finalize().into();

        entry.chain_hash = self.chain_hash;
        self.entries.push(entry);
    }

    pub fn verify_integrity(&self) -> bool {
        // Verify hash chain
        let mut expected_hash = [0u8; 32];

        for entry in &self.entries {
            let mut hasher = Sha3_256::new();
            hasher.update(&expected_hash);
            hasher.update(&serialize(&entry.event));
            expected_hash = hasher.finalize().into();

            if entry.chain_hash != expected_hash {
                return false;
            }
        }

        true
    }
}

Incident Response

Implement automated incident response:

pub fn handle_security_incident(incident: SecurityIncident) {
    match incident {
        SecurityIncident::FailedAuthentication(drone_id) => {
            // Temporarily block drone
            block_drone(drone_id, Duration::from_secs(300));
            alert_operator("Repeated failed auth", drone_id);
        }

        SecurityIncident::MalformedPacket(source) => {
            // Drop packets from source
            blacklist_source(source, Duration::from_secs(600));
            alert_operator("Malformed packets detected", source);
        }

        SecurityIncident::ConsensusAnomaly => {
            // Trigger re-election
            force_leader_election();
            alert_operator("Consensus anomaly detected", DroneId::new(0));
        }

        SecurityIncident::TamperDetected => {
            // Emergency shutdown
            initiate_safe_landing();
            erase_keys();
            alert_operator("Physical tamper detected", DroneId::new(0));
        }
    }
}

Security Checklist

Before Deployment

• Keys generated using hardware RNG
• Firmware signatures verified
• Secure boot enabled
• Debug interfaces disabled
• Default passwords changed
• Audit logging enabled
• Time synchronization configured
• Rate limiting enabled
• Intrusion detection active
• Backup recovery procedures tested

Runtime Monitoring

• Monitor failed authentication attempts
• Track anomalous network behavior
• Verify consensus health
• Check log integrity
• Monitor resource usage (DoS detection)
• Validate firmware integrity
• Test failover mechanisms

Incident Response

• Security incident response plan documented
• Emergency contact list maintained
• Forensic data collection procedures
• Backup systems ready
• Key revocation procedures

Security Reporting

Reporting Vulnerabilities

If you discover a security vulnerability:

1. DO NOT open a public issue
2. Email: security@swarm-manager.example.com
3. Use PGP encryption (key on website)
4. Include: description, reproduction steps, impact assessment
5. Wait for acknowledgment before public disclosure

Responsible Disclosure

We follow a 90-day disclosure policy:

1. Day 0: Report received
2. Day 2: Acknowledgment sent
3. Day 14: Fix developed and tested
4. Day 30: Patch released
5. Day 90: Public disclosure (if agreed)

---

Security is everyone's responsibility. Stay vigilant!

Back to Documentation Home