Patent Application
20250094548
This application relates to a control for an assembly that allows limited access to user, and wherein there is an authentication process.
Modern assemblies are being provided with more and more complex controls. One example is an aircraft having gas turbine engines. A main control for the gas turbine engine is known as a full authority digital electronic controller (“FADEC”).
In existing controllers, users, authorized or not, often have undesirably broad access.
In a featured embodiment, an embedded processing system and access combination includes processing circuitry, a memory system, and a plurality of user credential files. The user credential files include an encrypted user identifier, and an encrypted list of authorized task roles the particular user would have within the embedded processing system. Expected credentials from the user credential files are stored in the memory system. The processing system is programmed to receive a user credential file from a user, and compare expected credentials within the memory system to identify if the user is an authorized user. The processing system is programmed to allow access to an authorized user and deny access to an unauthorized user and determine what task roles are authorized for the authorized user, and deny access for the authorized user to other tasks.
In another embodiment according to the previous embodiment, the user credential file is digitally signed.
In another embodiment according to any of the previous embodiments, if the received user credential file is not validated, then a failure is logged and stored in a log memory including the identity of the unauthorized user.
In another embodiment according to any of the previous embodiments, if the user attempts to perform a task that is not authorized, access is denied, and the incident is logged and stored in a log memory.
In another embodiment according to any of the previous embodiments, one level of access is a security access to the log memory.
In another embodiment according to any of the previous embodiments, one level of access is the ability to re-program the embedded processing system.
In another embodiment according to any of the previous embodiments, one level of access is at least one of maintenance, repair or overhaul.
In another embodiment according to any of the previous embodiments, one level of access is at least one type of testing.
In another featured embodiment, a method of operating an embedded processing system includes providing a plurality of user credential files that include an identifier for each of a plurality of users, and tasks that are authorized for each of the plurality users, and encrypting the credential files. Expected valid user information and access information is stored at a memory within the embedded processing system. One of the user credential files is stored at the embedded processing system, and checking the received user credential file against the stored expected valid user information and access information. Access is denied should the received user credential file not be validated from the expected user information. The user is allowed access if the received user credential file matches the expected valid user information. An access control list of authorized task roles is set by accessing the access information in the memory. Allowing access for the user to the authorized task roles during a session and denying access for any other task roles.
In another embodiment according to any of the previous embodiments, the credential file is digitally signed.
In another embodiment according to any of the previous embodiments, if the received user credential file is not validated, then the failure is logged, and stored in a log memory, including the user's identity.
In another embodiment according to any of the previous embodiments, if the user attempts to perform a task role that is not authorized, access is denied, and the incident is logged and stored in the log memory.
In another embodiment according to any of the previous embodiments, one level of authorized access is a security access to the log memory.
In another embodiment according to any of the previous embodiments, one level of authorized access is the ability to re-program the embedded processing system.
In another embodiment according to any of the previous embodiments, one level of access is one of maintenance, repair or overhaul.
In another embodiment according to any of the previous embodiments, one level of access is at least one type of testing.
In another embodiment according to any of the previous embodiments, a session is ended after a period of time without activity, or when the user requests an exit.
In another featured embodiment, an assembly includes a mechanical system and an embedded processing system for the mechanical system. The embedded processing system includes an embedded processing system and access combination including processing circuitry, a memory system, and a plurality of user credential files. The user credential files include an encrypted user identifier, and an encrypted list of authorized task roles the particular user would have within the embedded processing system. Expected credentials from the user credential files are stored in the memory system. The processing system is programmed to receive a user credential file from a user, and compare expected credentials within the memory system to identify if the user is an authorized user. The processing system is programmed to allow access to an authorized user and deny access to an unauthorized user and determine what task roles are authorized for the authorized user, and deny access for the authorized user to other tasks.
In another embodiment according to any of the previous embodiments, the credential file is digitally signed.
In another embodiment according to any of the previous embodiments, the assembly is a gas turbine engine.
The present disclosure may include any one or more of the individual features disclosed above and/or below alone or in any combination thereof.
These and other features of the present invention can be best understood from the following specification and drawings, the following of which is a brief description.
As shown, an embedded processing system 102 communicates with a control 94 on the aircraft 90. The embedded processing system 102 may be a full authority digital electronic controller or FADEC for engine 91.
The
Examples of effectors can include one or more motors, solenoids, valves, relays, pumps, heaters and/or other such actuation control components.
As also shown, systems 145 and 148 may have control nodes 144 and 146 that communicate to the embedded processing system 102. As an example, the system 145 may be an anti-ice system.
A plurality of sensors 110 can capture state data associated with the controlled system 104 and provide sensed values 112 as feedback to a module 142 in the embedded processing system 102 to enable closed-loop control of the controlled system 104 according to one or more control laws.
Examples of the sensors can include one or more temperature sensors, pressure sensors, strain gauges, level sensors, accelerometers, rate sensors, and the like.
While modules 140 and 142 are shown as part of the embedded processing system 102, nodes 144 and 146 are outside but communicating with embedded processing system 102.
While the controlled assembly is disclosed as a gas turbine engine, it can be other types of engines, a vehicle, a heating ventilating and air conditioning (“HVAC”) system, an elevator system, industrial machinery, or the like.
For purposes of explanation, embodiments are primarily described with respect to a gas turbine engine system for an aircraft 90 as the controlled system and assembly, and in particular, the gas turbine engine 91.
In the
In embodiments, the memory system may include volatile memory 118 such as random access memory, and non-volatile memory 120, such as flash memory, read only memory, and/or other electronic, optical, magnetic, or any other computer readable medium onto which is stored data and algorithms in a non-transitory form.
The embedded processing system 102 can also include one or more of an input/output interface 122, a communication interface 124, a reprogramming control 126, and/or other elements.
The input/output interface 122 can include support circuitry for interfacing with the effectors 106 and sensors 110, such as filters, amplifiers, digital-to-analog converters, analog-to-digital converters, and other such circuits to support digital and/or analog interfaces. Further, the input/output interface 122 can receive or output signals to/from other sources. As one example, discrete inputs 128 can be input to the input/output interface to establish an operating mode of the embedded processing system 102, or to trigger actions by the embedded processing system 102.
A reset signal 130 may also be internally introduced as a result of power detected by power conditioning circuitry, and by specific hardware or software direction. The communication interface 124 can be coupled to a communication system 132, which can include one or more direct or network communication links to systems such as a reprogramming system 134, a data repository 136, or another system. The communication system 132 may also communicate with the control 94 on the associated aircraft 90.
The reprogramming system 134 can be any type of computer system operable to load new/updated configuration items to the embedded processing system 102 for storage in the memory system 116. The reprogramming system 134 can interface to the communication system 132 to a wired, wireless, optical, or magnetic coupling. The data repository 136 can serve as a data source for updating the memory system 116, for instance, with control system data, or as a data sync to offload and clear data from the memory systems, such as fault data, history data, and the like.
Access to an embedded processing system such as that disclosed above is required for many purposes such as diagnostics testing, reprogramming, data collection, etc. In the past users may have gained access to such a system without appropriate limits on access to unauthorized users. Moreover, it is often true that an authorized user for one purpose has access beyond that one purpose.
It has been proposed in the past to have access limited to such a processing system based upon a user's defined role. However, it is desirable to provide further details of how to best do so.
As shown in
This credential is digitally signed, for example, by post quantum cryptography (“PQC”) or RSA. Further, the information is all encrypted. Once the embedded processing system 102 is operational, test system access would be determined at 152. A user would supply their credential file. The processing system 102 would have access inhibited until an appropriate credential file is loaded and validated. A connection is terminated after either user inactivity for a period of time, or a specific request. The test system being used may also be provided with validation functions.
This would allow tests to take place on the processing system and the associated assembly over its lifetime.
The processing system 102 is shown schematically. Further development tests, production delivery, fuel delivery, programming, maintenance repair or overall and data collection would also occur across the lifetime of the processing system. Again, individual access will typically be implemented. However, group access may be required at some facilities but still with limited user role.
At 168 typical user roles are listed, to provide examples of the roles that may be appropriate for particular individuals. As can be seen, some individuals may be authorized to test. A security administrator may need access to logs, as explained below. In particular, attempts to gain improper access are logged and an administrator may need access. There may be a re-programmer or a production maintenance individual. This is not an exhaustive list.
As shown in
At step 210 if the credential file is found valid at step 206, the credential validated user variable is set to TRUE in a protected memory space, and a section timer is started. At step 212 the user role type is also stored in memory to allow access to certain areas, and deny access in others.
A worker of skill in this art would recognize that if the embedded processing system is say a FADEC there would be hundreds of different test protocols as an example. Not all test engineers would have access to all such tests. Thus, the access is typically not as broad as all testing. At step 228 the system exits at the end of the session.
An embedded processing system and access combination under this disclosure could be said to include processing circuitry, a memory system, and a plurality of user credential files. The user credential files include an encrypted user identifier, and an encrypted list of authorized task role the particular user would have within the embedded processing system. Expected credentials from the user credential files is stored in the memory system. The processing system is programmed to receive a user credential file from a user, and compare expected credentials within the memory system to identify if the user is an authorized user. The processing system allows access to an authorized user and denies access to an unauthorized user and determines what task roles are authorized for the validated user, and deny access for the authorized user to other task roles.
A method of operating an embedded processing system under this disclosure could be said to include providing a plurality of user credential files that include an identifier for the particular user, and task roles that are authorized for each of the users, and encrypting the user credential files. Expected valid user information and access information is stored at a memory within the embedded processing system. One of the user credential files is received at the embedded processing system, and checking the received user credential file against the stored expected valid user information and access information. Access is denied should the received user credential file not be validated from the expected user information. The user is allowed access if the received user credential file matches the expected valid user information. An access control list is set by accessing the access information in the memory. Allowing access for the authorized user to the authorized tasks during a session and denying access for any unauthorized tasks.
Although embodiments of this disclosure have been shown, a worker of ordinary skill in this art would recognize that several modifications would come within the scope of this disclosure. For that reason, the following claims should be studied to determine the true scope and content of this disclosure.
