Traceability Chain

GNSS receivers can be tricked by counterfeit satellite signals broadcast from nearby transmitters, causing the platform to believe it is in a different place or time. A resilient design detects anomalies (signal strength, RAIM, multi-constellation cross-check) and falls back to inertial navigation (INS) or alternative sources without aborting the mission silently.

The command-and-control link is the most direct path to take over a USV. Mutual authentication (both sides prove identity), replay protection (recorded packets cannot be reused), and scheduled key rotation prevent hijack even if an attacker records traffic for later attack.

Sweep results and contact reports drive operational decisions; a forged sonar frame could falsely declare an area clear. Cryptographically binding sensor frames to the originating device (signed at the sensor, verified at the consumer) prevents in-line tampering.

Every firmware/software update must be cryptographically signed by a controlled key, and the device must verify the signature before accepting it. This blocks the classic 'malicious update' supply chain attack — the highest-impact path into deployed equipment.

If the build toolchain (compiler, linker, signing tools) is tampered with, every binary it produces is suspect — the classic Ken Thompson attack. Reproducible builds let independent parties verify that source code maps deterministically to the released binary.

Without telemetry there is no monitoring. The SOC must receive signed (tamper-evident) operational and security telemetry, and must be staffed and tooled for OT analysis — IT-only SOCs miss protocol-level and physical-process anomalies entirely.

If only the original vendor can sign firmware, and that vendor disappears or refuses to patch a vulnerability, the buyer is stuck. Source escrow plus custody of signing keys (or a co-signing arrangement) preserves the buyer's ability to patch.