Secure GNSS telemetry on ESP32 using kinematic validation, adaptive logging, and hardware-accelerated AES encryption

Global navigation satellite system (GNSS) telemetry is vulnerable to spoofing attacks, while conventional tracking systems often store potentially compromised coordinates before performing server-side validation. This paper presents an ESP32-based secure GNSS telemetry system that performs edge-level kinematic validation prior to data encryption and logging. The proposed method combines a reachability constraint for detecting physically impossible coordinate changes, alpha-beta filtering for trajectory smoothing, zero-velocity anchoring for suppressing navigation drift during stops, and adaptive spatial, angular, and time-based sampling. Validated telemetry records are encrypted in real time using hardware-accelerated AES-256 in counter mode, with session-specific initialization vectors and cryptographic key isolation in the ESP32 eFuse memory. A desktop audit application provides local decryption, trajectory reconstruction, distance calculation, and retrospective analysis of the collected data. Software-in-the-Loop experiments achieved 100% recall for injected coordinate jumps exceeding the calculated reachability limit, with a false-positive rate of 0.33%. In the 42 km route test, adaptive logging reduced the log-file size by 68% compared with fixed-rate one-second logging. The hardware-assisted encryption time for one telemetry record did not exceed 45 µs, which confirms the suitability of the proposed architecture for real-time embedded applications. The developed solution provides a resource-efficient approach to improving the plausibility and confidentiality of GNSS telemetry while supporting retrospective analysis in fleet monitoring and other autonomous tracking systems.