A Programmable SDN+NFV-based Architecture for UAV Telemetry Monitoring Kyle J. S. White∗, Ewen Denney†, Matt D. Knudson‡ Angelos K. Marnerides§, Dimitrios P. Pezaros∗ ∗ School of Computing Science, University of Glasgow, G12 8QQ, Scotland [email protected], [email protected] SGT/NASA†, NASA‡ Ames Research Center, Moffett Field, CA 94035, USA ewen.denney, [email protected] §InfoLab21, School of Computing & Communications, Lancaster University, LA1 4WA, UK [email protected] Abstract—The explosive growth in the worldwide use of frastructure through NextGen1, and a similar modernisation Unmanned Aerial Vehicles (UAVs) has raised a critical concern program taking place in Europe through SESAR2, the op- withrespecttotheadequatemanagementoftheiradhocnetwork portunities to embed state-of-the-art networking infrastructure configurationasrequiredbytheirmobilitymanagementprocess. support for the emerging UAS needs are currently ideal. As UAVs migrate among ground control stations, associated Present safety regulation ensures early UAV activities take network services, routing and operational control must also placeinareasabovelowpopulationdensityoutwithcontrolled rapidly migrate to ensure a seamless transition. In this paper, airspace. Perhaps consequently, existing core applications for we present a novel, lightweight and modular architecture which UAVs of this size have used such regions for tasks including supports high mobility and situational-awareness through the application of Software Defined Networking (SDN) and Network agricultural work, environmental monitoring, oil exploration, Function Virtualization (NFV) principles on top of the UAV wildlife and land management. These distributed areas of infrastructure. By combining SDN+NFV programmability we operation often suffer from poor networking infrastructure can achieve a robust migration of UAV-related network services, (in terms of both bandwidth and connectivity) even for low such as network monitoring and anomaly detection as well as levelsofdemand.ToachievereliableandsafeUASintegration smoothUAVmigrationthatconfrontshighmobilityrequirements. into the wider controlled airspace worldwide, resilient, reli- Theproposedcontainer-basedmonitoringandanomalydetection able, recoverable, and low-latency network infrastructures and Network Functions (NFs) as employed within our architecture systems are vital. Most currently deployed UAV systems are can be tuned to specific UAV types providing operators better isolated, operating independently, and often employing their insight during live, high-mobility deployments. We evaluate our own bespoke protocols, hardware infrastructures and software architecture against telemetry from over 80 flights from a scientificresearchUAVinfrastructureshowingourabilitytotune systems.Asstandardisationimproves,systemswhichallowfor and detect emerging challenges. multiple UAV operations management will become the norm. Existing UAS have begun simplifying, easing the process of Keywords—SDN, NFV, Unmanned Aerial Vehicles, Air Traffic integration and compatibility. Early military UAV systems Management, Situational Awareness required three large rugged server racks for their Ground Control Systems (GCS) comprising radio, pilot-in-command and mission payload racks. Much of this equipment can now be run from a laptop with control software, e.g., the Piccolo I. INTRODUCTION controller3. Forsafeandsecureoperations,UAVoperatorsrequirereal- The Federal Aviation Administration (FAA) forecasts that time telemetry monitoring, alert systems, and mission payload therewillbe2.7million[8]non-hobbyist(>55lbs)commercial processing as part of the GCS. This information is especially UAVs in the U.S. National Airspace System by 2020. On critical for BVLOS operations. Increasingly, there is demand the anticipated introduction of further policy and regulatory for tailored functionality [10] which can assist the operator frameworks which allow for Beyond Visual Line of Sight withthecurrenttask,particularenvironmentandpayloadse.g., (BVLOS) flight, expected numbers look set to increase signif- visual surveillance equipment, heat mapping or crop dusting icantly.ThispredictedexplosionandintegrationofUnmanned tools. Since long complex operations can involve multiple AerialSystems(UAS)inwhichUAVsarepartofhasnumerous tasks, environments and strains, flexibility and both reactive consequences for the infrastructure of Air Traffic Manage- and pro-active adaptability of this functionality over time ment (ATM) systems worldwide. Among wider challenges are also highly desirable attributes. Significant replication of including spectrum allocation, and data security and safety, standardtelemetry-basedmonitoringfunctionalityisprevalent, a core concern is the ad hoc network configuration required yet with isolated, independent implementations spread across for mobility management for UAS. With integrated UAS, different vendor-specific ground control systems, this scale the network infrastructure will require the ability to migrate network configuration, including network functions associated with specific UAVs, to ensure resilient, uninterrupted service. 1https://www.faa.gov/nextgen;Accessed:June2016 Numerous UAS offer migration functionality including the 2http://www.sesarju.eu;Accessed:June2016 Viking 400. With the FAA transitioning to an IP-based in- 3http://www.cloudcaptech.com;Accessed:June2016 cannot be beneficially exploited. In this paper, we propose a modular programmable network architecture which, through exploiting the latest paradigms of SDN and NFV, aims to: • Increasedsituational-awarenessavailabletopilotsand payload operators during UAV missions through dy- namic deployment and migration of modular context- specific processing functionality; • Increased continuity of service in deployments with potentiallyweakbackbonenetworks,suchasonships and moving vehicles; • Reduce the latency of telemetry monitoring and ap- plications related to situational-awareness such as anomalydetectionthroughadistributedapproachem- bodied in our architecture; • Reduce backbone utilisation volumes required for UASoperationsinthefaceofoutagesortrafficspikes. Fig.1. UASConOpsforhigh-mobilitycommunicationsinfrastructure Applying our new architecture which places Virtual Net- work Functions (VNF) at edge switches allows for pro- grammableNFstobedeployedon-demandonthemorereliant others, e.g., WiFi, microwave) are used to connect mobile and greater bandwidth backbone links to GCS, while different GCS with each other in an abstracted ad hoc mesh network types of UAV can remain more lightweight hosts, specialising topology. There is also a remote, centralised command and in their sensor capabilities. Middlebox functionality for UAVs control centre. Some of these links are very costly, such as, is a vital next step to increase the overall resilience of the e.g., satellite communications. Currently, telemetry analysis, wider UAS. This need is emphasised by Tvaryanas’ [13] such as any anomaly detection, takes place on data streamed findings that the U.S. military UAV accident rate was as high to the centralised control centre via such expensive links or as 1 per 1,000 flight hours, on aggregate. In comparison, the not at all. Many of the UAV GCS uplinks are unreliable, accident rate for general aviation (manned) flight in the U.S. leading to loss of streamed data, where packet latency and is 1 per 100,000 flight hours. With greater insight available out-of-order delivery is equivalent to data loss. Interference on demand through tailored NFs which migrate with UAVs, from particles or being out of range are some of the common more information will be available to operators to detect and causes of lost link failures. As a result, deploying code to run diagnose emerging issues. As Pastor et al. [16] state, in the onUAVsoversuchlinksisapoordesignchoice.Figure1also briefhistoryofUASaccidents,manyaredirectlyattributableto showsUAVstransitioningfromseatolandandfromhigherto errors by pilots attempting to manage unexpected challenging loweraltitudes.Duringsuchtransitions,differentUAV-specific incidents without an adequate situational awareness. Another monitoring and detection modules can assist operators, e.g., high-profile UAV accident study found that for most of the calculations for icing alerts at higher, colder altitudes or the aircraft systems, electromechanical failure was more of a rate of increased fuel burn at lower altitudes. The ConOps causal factor than human error [12]. One critical finding from also shows the lowest UAV transitioning from control on the an analysis of the data is that each of the existing systems is leftmost GCS to the rightmost GCS. There is a hand-over verydifferent,leadingtovaryingkindsofaccidentsandhuman phase when a UAV migrates to the command and control of factors issues, which strengthens the need for integration and another GCS, e.g., due to a change in range or a primary standardisation through a common network architecture and GCSbecomingunavailable.Autopilotsystemsareavailableto the ability to deploy programmable detection modules which fly during the transition. For the purposes of our networking can operate in high mobility environments. architectureandwhencomparingagainstrelatedwork,wecan consider the UAVs to be (migrating) hosts, the local GCS to InSectionII,weexamineadetailedConceptofOperations be switches and the command and control centre to be the (ConOps) before presenting our new architecture with design, network controller. implementation and routing details in Section III. An evalua- tion of our architecture is presented as a UAS incident case III. ARCHITECTURE study in Section IV. We review related work in Section V and Section VI explores future work before concluding the paper. Traditional function-specific middleboxes and in-network devices such as, e.g., firewalls, are placed on the traffic path II. CURRENTCONCEPTOFOPERATIONS betweenthesourceanddestination.Inourapproach,weextend and configure the GCS to become a UAS VNF server. Our Figure1detailstheConOpswhereournetworkarchitecture UAS VNF architecture, developed and adapted from our early contributions can be evaluated. The figure represents a typical design [11], meets the following objectives: reconnaissance set up with multiple UAVs of diverse types, operatinginvariousregionswithdifferentpayloadcapabilities, a)High-mobilitylightweightdeployments: Deployment e.g., visual or IR cameras. Mobile GCS are on land and ofNFsissimple,transparent,andfastforthesubscribinghosts, at sea, connecting and communicating control information to taking<250mstostartaNFandredirectthetrafficthroughit. UAVs within range using radio antennas. Satellite links (and Simplicity arises from the lack of a provisioning cycle either in the lead time to acquire the appliance or to setup a new commontobothtypesofUAV,trafficcanberoutedtothesame server and associated routing rules. NFs. The chained containers hosting the VNFs are situated at the GCS with the SDN controller located at the central b)Distributed processing for lower utilisation and la- command centre where it can be logically centralised and tency: Moving programmable, adaptable, modular processing physicallydistributedforresilientoversightofthearchitecture. from the command centres to the GCS reduces the traffic on Considering the PIC and MPO are also Hosts, the architecture themoreexpensiveandoftenstrainedbackbonelinksfromthe canbeconfiguredtoroutetrafficfromtheGCStotheUAVvia remote GCS to the command centres. Streamed telemetry no a set of NFs. For example, access control or further security longer needs to traverse these links, and processing NFs are measures for sensitive environments for protection against, lightweight to move and more infrequent. Latency of anomaly e.g., replay or (D)DoS attacks via firewalls and rate limiters. detectionisalsoreduced.ByplacingdetectionnearertheUAV, anomalies are detected ‘locally’, without the need to route Chaining containers allows for smaller modular function- traffic over high latency links. ality to act independently. For example, a NF can run on a relatively inexperienced pilot’s GCS to monitor the number c) Increased situation-awareness: Operators can de- of commands sent. If this NF flagged a series of anoma- ploy context-specific NFs on-demand to better understand op- lies, the wider GCS team or central command centre could erational challenges and to inform their decision-making, e.g., deploy another NF configured to watch for anomalous pilot deploying a granular connectivity monitoring NF to observe command sequences through, e.g., frequent repetition of a more detail on an intermittent loss link fault. set or individual commands. This could help diagnosis if d)Infrastructure independence: Traffic routing is han- the UAV was being unresponsive or if human factors such dled independently from default routing policies, allowing as anxiety were involved. The ability to monitor and detect forwardingoftrafficfromhoststoephemeralNFsinOpenFlow all issues simultaneously is infeasible due to the processing (OF) enabled environments. Decoupling default routing from and storage capabilities available, especially in mobile remote policy enforcement routing reduces the risk of misconfigura- environments. By chaining NFs and allowing for real-time tion of the individual network elements. updates, the processing and hardware available can be utilised to host a vast array of context and UAV-specific network e) Open Innovation: By using Linux-based containers, functions which can inform and alert operators. NFscanutilisetheexistingwealthoftoolsandprogramsavail- ablefornativeLinux,withouthavingtoadaptthesetoworkin Figure2shows‘SDN-traps’which,similartoSNMP-traps, a bespoke environment. Containers are more lightweight than act as monitoring notifications for traditional data network VMs, ensuring migration is quick and highly mobile. operators. Our UAS VNF architecture allows NFs to be configured to send SDN-traps to both the PIC and SDN- Controller. For example, if a fuel monitoring NF with a SDN- trapconfiguredforwhenfuel<15%,themission-controlteam for a multi-UAV-GCS operation can see where coverage will belostandmoveUAVcapabilityasrequiredtoensuremission objectives are met. A. Routing Fig.3. UASVNFOpenFlowroutingarchitecture Fig.2. UASVNFarchitecturedesignedforhigh-mobilityUAV-specificNFV Switch Match Action Figure 2 shows our UAS VNF architecture as deployed in GCS in port: 2, src ip: UAV1 out port: 4 the field. The UAVs are Hosts with Open vSwitch instances Local in port: 1, src ip: GCS out port: 2 located at the mobile GCS vehicles. These switches route Local in port: 3, src ip: NF1 out port: 4 traffic from the host UAV to the Pilot in Command (PIC) GCS in port: 4, src ip: local switch out port: 2,3 and Mission Payload Operator (MPO) displays. The switches have OF rules to route traffic based on particular rules to the TABLEI. OPENFLOWTABLEENTRIESFORUASVNFMANAGEMENT configured NF. With no NFs configured, telemetry from the UAVgoesviatheGCSswitchtothePICandMPOdirectly.If multiple UAVs of different types are operating from a single Figure 3 details the routing design in the GCS Open GCS, the OF tables can be configured to route traffic from vSwitch. The GCS switch is connected to the UAV host on each UAV to a different set of NFs designed for the operating port 1. Other UAVs can connect to new ports. PIC and MPO parametersofthatUAVtype.Similarly,ifNFsexistwhichare are connected on ports 2 and 3 respectively, a single laptop environment would require only one port for both roles. The IV. EVALUATION:SIERRACASESTUDY UASVNFserverconnectsonport4,withanotherlocalswitch routing traffic through the containerised VNFs. In this case, GCS source traffic is forwarded from port 1 to 3, and traffic egressing the NF is sent back to local switch port 3 and on to GCS port 4. Incoming traffic on port 4 is mirrored and sent to both the PIC or MPO displays, if applicable. This routing design allows for additional NFs to be deployed withoutinterferingwiththeGCSswitchroutingfortheUAVs. Table I shows the OF routing table entries for this setup. B. Implementation In a multi-display GCS set up, the current GCS switching capabilitieswhichroutetraffictothePICandMPOprocessors would be replaced with an Open vSwitch. In a single laptop controller GCS environment, the OF switching can take place in situ with the laptop acting as both a switch and a host. Our UAS VNF server comprises lightweight Linux-based chained containers,eachofwhichperformsavirtualNFbeforerouting thetrafficontothenextprocess,reportinganyalertstothePIC orcentralisedcontrollerasconfigured.Thearchitectureisbuilt using the Python SDN-Controller, RYU [15]. This lightweight controller is component-based with pre-defined components which can be modified and extended to create a customised controller application allowing for easy programmability of both the north and southbound SDN interfaces. Fig.4. SIERRAflightclassifiedbyInFlightformetresAboveGroundLevel (AGL)overtime OurUASVNFarchitectureusesLinuxcontainersthatpro- videa lightweightequivalent toVMs,allowing eachcontainer To evaluate our UAS VNF architecture, we created a suite tousethehostOSkerneltoisolateprocesses,networkrouting of NFs to assist operators with issues commonly cited by tables, and their associated resources. This approach does not subject experts: NASA UAV pilots. Our initial efforts focused require each isolated function to run on a separate OS image, ontheissueofUAVssaturatingoperatorswithalertsofcurrent henceallowingamuchhighernetworkfunction-to-hostdensity operating conditions. An example scenario would be a UAV and smaller overall footprint. Using containers, commodity with fuel reserves for 10 hours of flight, and a warning computedevices,suchas,e.g.,laptops,arenowabletohostup notification built into the aircraft hardware to notify the pilot tohundredsofNFs.Theminimalcostofstartingandstopping every minute when fuel levels are below a threshold, e.g., < containers as well as the single package encapsulation allows 10%. Under planned or emergency circumstances where these for NFs to roam alongside the UAV. As the UAV roams, the warnings would come into effect, it is likely this notification associated NFs can be started on a different GCS and traffic frequency would be an unhelpful distraction to pilots. To rerouted to it through modifying the corresponding OF rules. mitigate this, we generated Python templates which aggregate suchnotificationsensuringthat,whenunderspecialconditions C. Migration whichmaydemandpushingtheUAVbeyondnormaloperating When a UAV moves between GCSs, the operators at the thresholds, the pilot will not be adversely distracted. Our NF SDN-controller can manually migrate the required NFs by scripts allow for the setting of new thresholds in software, clicking on the web app user interface, deploying the required which are easily programmable and adaptable during live NFs on the new GCS UAS VNF server. Operators at the GCS deployment, unlike those set in the UAV hardware sensor sys- can also place requests for NFs. Automated migration is also tems.ThenextsetofNFswedevelopedweremorespecifically possible if the entire environment is defined with static IP- tailored to UAV types. The telemetry of all UAVs have multi- addresses assigned to each of the UAVs in the operating envi- variateinter-dependencies,withphysicsunderlyingthemodels ronment. To achieve this, NFs are associated with individual of many of these such as the relationship between altitude UAVs.WhentheGCSOFswitchesreceivepacketsfromanew and pressure, altitude and fuel burn rates, and outside air IP address (a new UAV which has migrated to this GCS), the temperature and internal temperature readings. These models initial packets are sent to the SDN-controller. The controller are an excellent definition of normal operating behaviour then follows the standard SDN paradigm by receiving these which can be used to rapidly detect unexpected, anomalous forwarded packets and replying with the OF rules and NFs to behaviour.Whileoperatorsreceivereal-timereadingsofmany install based on the allocation configurations for the particular of these values, it is often in the subtle emerging trends UAV. This network configuration and NF migration incurs no where problems can first be observed. To show the ease delay to the overall current ConOps migration process. NFs of which our architecture can be tailored to different UAV can migrate between GCSs (<250ms) well within the time it types,weusedtelemetryfromtheunmannedSensorIntegrated takes for secure handshakes to establish control between the Environmental Remote Research Aircraft’s (SIERRA) historic UAV and new GCS (>1 second). flights (80+ flights worldwide over a number of years) to Fig.5. SIERRAaggregateclassifiedflighthistoryforThrottlevsRPM Fig.6. SIERRAaggregateInFlightdatawithpolynomialregressionmodels tune the initial models in our NF suite based on the normal SIERRA InFlight and our polynomial regression models with operating parameters observed. Telemetry relationships vary the appropriate confidence intervals and tuned our detection heavily across the different flight phases: takeoff, inflight and NF in Python for deviations from the norm. landing. We began by developing a simplified classification with input from our domain expert, to determine InFlight OnJuly26,2013theSIERRAlostenginepower4.5hours status. We determined the simplified InFlight classification as: into its 6 hour scheduled flight and crashed into the Beaufort Sea, 65 nautical miles north of Oliktok Point, Alaska, where • True Airspeed>26 m/s the controlling GCS was located. The UAV was undertaking a sea ice survey for the Marginal Ice Zone Observations and • Throttle Acceleration(cid:54)=0 Processes EXperiment (MIZOPEX) project. The MIZOPEX • Revolutions Per Minute (RPM) >2000 reconnaissance mission involved multiple UAVs of different types. The NASA mishap accident investigation report [14] Figure 4 shows the application of our classifier to a flight found that the only indications to the SIERRA team of the recording from the dataset. The graph shows the flight profile impendingcrashweretheA/Cengine’srevolutionsperminute with points classified as InFlight (red) and other flight phases readingofzeroRPMandtheelectricalbusvoltageat4Vlower. (blue).Themodelisverysuccessfulwithnear-perfectaccuracy The lower voltage confirmed the engine had stopped turning. for this flight. This is seen through the flight profile, with At this time, the report states no pilot instructions could have the vast majority of InFlight (red) points with AGL > 0 and avoided the loss of the UAV. However, on further analysis grounded, takeoff and landing phases coloured blue. Figure 5 of the telemetry prior to the engine failure, investigators shows this same classification applied to the aggregation of discovered the throttle demand increased by over 40% and all historic SIERRA flights, with the polynomial regression continued to rise, while the engine struggled to maintain its model for throttle against RPM for all InFlight data in black. cruisingRPMof6,000asmuchasonehourpriortothecrash. Theclassificationremovesmuchofthenoiseseenfromtakeoff With 6,000 RPM, 0.15 throttle and consistent TAS, a 40% and landing phases. There is a great deal of variance from the increase in Throttle and steady RPM, would show telemetry model, which mitigates the successful detection of abnormal points transitioning over polynomial models 4 through 2 over behaviour. Figure 6 shows only the InFlight data with the time. This information was not displayed to the pilot through True Airspeed (TAS) coloured on a red to yellow spectrum the real-time GCS information. The RPM also plummeted from 26-40+ m/s, respectively. Four polynomial models are at times to anomalous lows of 4,000, only seen on Model also shown, highlighting the variance in Throttle to RPM 1 without very few observed InFlight data points, and the relationshipasTASincreases.Thistightensouroverallmodel, enginebehaviourwasdescribedassporadic.Hadtheteambeen allowing for a better understanding of any emerging deviance notified of these anomalies and returned SIERRA to base, the among these three parameters behaviours against the norm. report concludes the mishap could have been prevented. Should one of these parameters cause data points to lie nearer a different polynomial model than expected, this is likely the This incident highlights the need for greater monitoring beginning of an electromechanical or sensor failure. Along and anomaly detection systems. Prior to the SIERRA crash with other dependencies, we took these pre-conditions for and following the 40% increase in throttle, there were eight icewarningalertsina25minutewindow,asignificantincrease VI. CONCLUSIONS&FUTUREWORK in frequency. In discussions with domain experts, it was clear In this paper, we have presented a novel UAS VNF archi- this sensor had a significant safety margin and for operations tecture which, through a suite of lightweight, container-based in cold environments had to be ignored to some degree. To monitoring and detection NFs statistically tuned to specific evaluate our system, we replayed the SIERRA crash flight UAV types, enhances the situation-awareness and the highly data in our simulated architecture ConOps with our suite demanding mobility requirements of the overall UAS envi- of SIERRA calibrated NFs. On replaying the crash flight ronment. Through exploiting state-of-the-art SDN and NFV telemetryinreal-time,ourUASVNFarchitecturedetectedthe principles, our platform and UAV independent architecture increased frequency in ice warning alerts, issuing an SDN- gives mission controllers the opportunity to adapt their live trap notification to both the SDN-controller and PIC. The telemetry monitoring and anomaly detection capabilities on deviation in throttle was also detected shortly after the >40% demand. Situation-awareness is increased with the ability to increasewithoutacorrespondingincreaseinRPM,atransition program the network to provide a better understanding of acrossmodels4through2inFigure6,alsothrowingnumerous emerging challenges in times of need and further contribute SDN-trap alerts to both the PIC and the SDN-controller. The totheoverallresiliencedomain.HighmobilityUAVandGCS results of this case study show our UAS VNF architecture deploymentsaresupportedthroughrapidmigrationofmodules empowers UAS operators to deploy and adapt the monitoring and a distributed approach placing demands on the strongest, and detection functionality in live operations, also helping to mostresilientlinksinthewidernetworkinfrastructure.Linux- adapt and rectify the sensor sensitivity of built-in alerting based containers implemented within our architecture ensure systems of various UAV types. Using our modular suite of openinnovationwithreuseofexistinglibrarieswithoutmodifi- NFs tuned to the SIERRA in our replay experiment, we cationandreducedutilisationontraditionallystrainednetwork successfully detected real-world anomalous behaviour as the infrastructures in low density regions. We have demonstrated transitioningacrossthreeoftheUAV-tunedmodelsinFigure6 the applicability of our architecture through an evaluation and with consistent TAS. From this case study, we have a set of case study where our generic detection models, tuned to the modelsforuseinarangeofdeploymentswhichcanbetailored SIERRA, detected the pre-conditions as much as 1 hour prior tospecificcontextsanddistinctUAVswithhistoricflightdata. toitscrashunderreplayconditions.Futureworkwillfocuson tuning our NF suite to further UAV types, such as the Viking V. RELATEDWORK 400,anddevelopingaswellasdeployingareal-worldtest-bed. In recent years, the state-of-the-art in networking has ACKNOWLEDGMENTS centred on two complementary, yet distinct, concepts: SDN and NFV. SDN [3] is a network architecture which allows The work has been supported in part by the UK Engineer- for abstraction and virtualisation through the decoupling of ingandPhysicalSciencesResearchCouncil(EPSRC)projects the network’s control and data planes. OpenFlow [4] is the EP/L026015/1, EP/N033957/1, and EP/L005255/1. first and most widely used SDN implementation NFV [2] is a transformation in the delivery of network functions from be- REFERENCES spoke, specialised hardware, to network functions in software [1] R. Cziva, S. Jouet, K. J. S. White and D. P. Pezaros, Container-based which can run on a range of commodity hardware which can network function virtualization for software-defined networks, IEEE be migrated to, or instantiated at, various locations within the SymposiumonComputersandCommunication,Larnaca,2015. network topology, on demand. This paper builds on our prior [2] E.T.S.Institute.2012NetworkFunctionsVirtualisation,WhitePaper. SDN+NFV work designed for efficient enterprise networks, [3] OpenNetworkingFoundation.SDNArchitecture.Tech.rep.Feb.2016. GlasgowNetworkFunctions(GNF)[1],tailoringittomeetthe [4] N.McKeownetal.OpenFlow:enablinginnovationincampusnetworks. needs of UAS ConOps with a suite of specific NFs, modified InACMSIGCOMMComputerCommunicationReview2008. migration and routing configuration. [5] E. Khalastchi et al. Online anomaly detection in unmanned vehicles. Khalastchi et al. present the case for anomaly detec- 2011Int.ConferenceonAutonomousAgentsandMultiagentSystems. tion in unmanned vehicles [5], arguing for computationally [6] J.Martinsetal.ClickOSandtheartofNFV.InUSENIXNSDI,2014. lightweight systems to avoid additional computational load on [7] J. Kunz et al. Openedge: A dynamic and secure open service edge network.InIEEE/IFIPNOMS,2016. the vehicle, potentially introducing more faults. However, all functionality is located on the UAV. Having NFs at GCSs al- [8] FAA.AerospaceForecastFiscalYears2016-2036. lows for more rapid NF migration and deployment. Increasing [9] M.Bezahaf,A.Abdul,andM.Laurent.Flowos:Aflow-basedplatform for middleboxes. In Proceedings of Hot Topics in Middleboxes and the processing andcomplexity of different UAVswill increase NetworkFunctionVirtualization,2013,ACM. vendorlock-inandreducetheopennessrequiredforwide-scale [10] P.Royo,J.Lopez,E.Pastor,C.Barrado.Serviceabstractionlayerfor integration. UAVflexibleapplicationdevelopment.In46thAIAA2008. Other network edge services (e.g. OpenEdge [7]) and [11] K. J. S. White, D. P. Pezaros, and C. W. Johnson. Principles for NFV frameworks (e.g., ClickOS [6] or FlowOS [9]) rely on increasedresilienceincriticalnetworkedinfrastructures.ICRAT2014. bespoke platforms, hypervisors, or commodity x86 servers [12] K.Williams,Asummaryofunmannedaircraftaccident/incidentdata: with resource-hungry VMs preventing their use in wide- Humanfactorsimplications.FAA,2004. area deployments where high NF density and mobility is [13] A.Tvaryanas,W.Thompson.HFACSanalysisof221mishapsover10 paramount. These bespoke architectures also prevent widely- years.Aviation,space,andenvironmentalmedicine,2006. used applications and tools being deployed without modifi- [14] NASA,AmesResearchCenter.SIERRAMishapClassification2013. cation. In the UAS context, it is therefore preferable to use [15] RYUSDNController.https://osrg.github.io/ryu/.Accessed:June2016. a container-based Linux architecture where lightweight VNFs [16] E.Pastoretal.In-flightcontingencymanagementforunmannedaerial can run native Linux tools and be migrated on demand. vehicles.JournalofAerospaceComputingandCommunication9,2012.