Project Details

Quadcopter Atropos is the concept evolution of the rover texas Ranger. It has all the tweaks of the rover but also many other features, required to make it work. Also made with wood and paper, the only bought parts are the motors, controllers, battery and blades.

Atropos is based on OpenWRT La Fonera 2201 router. It is auto-stabilized by a entirely home made Inertial Measurement Unit, using Wii console controls.

In order to mantain minimum hardware components, attitude sensors (Wii motion plus -gyroscope- and Wii nunchuck -accelerometer-) are connected directly to the router using the LED lines. LED Lines are used as software emulated I2C ports.

Illustration 7: LEDs lines attached to I2C Wii sensors on La Fonera 2201 router

Wii nunchuck analog joystick is unmounted. This leaves available two 8-bit Analog to Digital conversors. Currently one of these is used to measure battery voltage.

Once the router has the sensors readings, it fusions them via a Director Cosine Matrix, to translate all movements, relative to aircraft, to relative to the Earth, and compensates gyroscope drift. This give us three angular velocities (one for each plane -pitch -roll -yaw ) and three absolute angles.

To command the four motors, a nested Porportional+Proportional-Integral-Derivative (P+PID) controller (connected with these values) is implemented and tuned to calculate the correct motor attitude for each moment.

To send this information to the motors, La Fonera is connected via rs232 to a PIC16F876. This micro receives the final commands and generates Pulse Width Modulation pulses, readable by Motor Electronic Speed Controllers.

-> ESC are the trifasic motor controllers

All spendable processes are uninstalled/killed on the Fonera in order to obtain maximum performance. Linux watchdog is disabled, DHCP, etc.

The whole process is performed inside the router except PIC stuff. To make the stabilization process as smooth as possible, an especial kernel-level, real-time schedule policy is issued once the program starts (SCHED_FIFO kernel policy). A SIGUSR1 is issued every 13ms to launch the whole loop process. This is to make all readings as time-sliced as possible, and make gyro integration more stable.

magnetometer is also used in order to cancel gyro drift on the yaw axis.

On t user interface side, the first attempt was to control the quadcopter entirely by key strokes and mouse movemets, via Javascript events and AJAX requests. It is theoretically possible, but it is not comfortable nor secure.

A tiny C program on a Linux Box is used to read USB joypad analog controls and send it via http requests to the router httpd server. This makes the server too busy, because requets take too much process on the server, and also could disturb main control process. To mitigate this, httpd is modified. When a control request arrives at server, it puts the GET data on a shared memory allocation and inmediatelly exits to make room for the next request.

User interface is javascript AJAX+Server PUSH based and shows several telemetry and attitude data. No plugin, program, or applet is needed for this. All controller tuning has been performed using CANVAS graphs on the same web interface.isassoc Aireplay attack mitigation

Although on the event of a wifi signal loss, Atropos autodetects it and enters in a neutral self-balanced state, this is a dangerous situation, specially if somebody is sending deauthentication packets to the legitimate control client to make a DOS attack. All of the wifi based drones are vulnerable to this attack.

To mitigate this, a redundant wifi device has been installed on the quadcopter and connected via ethernet to the Fonera (a small TPLink WR703) that it doesn't act as an Access Point nor Wifi client.

Instead of that it is in Monitor Mode, and reads all packets destinated to this device via libpcap. From the client control side, an additional Wifi adapter is used, in monitor mode too, this time injecting raw custom forged packets with the same C program that reads data from USB joypad. To avoid MITM attacks to this solution, a simmetric key encryption has been implemented.

Packet also includes a packet sequence counter field to avoid encrypted malicious reinjection. If tplink receives a packet that has less packet count compared with last received, this packet is discarded.

Simmetric key exange will be random generated on client side, and sent before each flight using the ordinal WPA/PSK communication. (If the attack is produced before the key exange, it will not be exanged, but user notices this and avoids a risky flight).

Atropos has an IP camera, that will be replaced by Web camera and stream server on TPLink once the system will be full working.

With this redundant unassociated Wifi solution, more control range can be achieved. There is no 2-ways negotiation that has to be accomplished to establish the communication. TPLink only has to be able to hear, and client USB adapter only has to be able to inject in monitor mode.