Various example embodiments relate to distributed trust between mobile computers.
This section illustrates useful background information without admission of any technique described herein representative of the state of the art.
Mobile computers and particularly drones may operate in very sensitive environments, such as in border patrol. In such environments, the drones may be attacked with falsified updates, incorrect/malicious commands or even be joined by malicious drones pretending to be part of a drone swarm or group. Notably, drones on longer missions may require updating their firmware, guidance, and operations during mission time.
It is desirable to allow new drones to join in a swarm or updates being made in the operation of the drones also even without connectivity any central stations.
The scope of protection sought for various embodiments of the invention is set out by the independent claims. The embodiments and features, if any, described in this specification that do not fall under the scope of the independent claims are to be interpreted as examples useful for understanding various embodiments of the invention.
According to a first example aspect of the present invention, there is provided a method in a mobile computer, comprising:
maintaining a local copy of a distributed blockchain that is shared by a group of state machine replication protocol members;
according to the state machine replication protocol, identifying a leader of the group of state machine replication protocol members;
according to the state machine replication protocol, assuming a role of a rank member, the method further comprising performing in the rank member role at least:
wirelessly receiving a command or operation request from a requester and responsively wirelessly transmitting the request to the leader;
wirelessly receiving from the leader an assessment matrix defining a plurality of attesters that are different members of the group and one or more requesters, when being one of the plurality of attesters;
locally assessing each of the requesters of the assessment matrix based on local knowledge of the requesters;
according to the state machine replication protocol, attempting wirelessly exchanging with all other attesters of the matrix corresponding local assessments of each requester;
according to the state machine replication protocol, locally computing group trust assessments for each requester of the assessment matrix based on all obtained local assessments of each requester;
attempting to wirelessly exchange the locally computed group trust assessments with all other attesters;
defining a global assessment for each requester of the assessment matrix based on all obtained group trust assessments; and
appending the global assessment for each requester to the blockchain.
The appending the global assessment may comprise appending the global assessment for each requester to a local copy of the blockchain.
The local assessments may be values computed using a ruleset. The ruleset may be defined in the closed blockchain. The ruleset may combine parameters of different types or units using feature scaling. The ruleset may refer to an appraisal policy for evidence or to an appraisal policy for attestation results. One attester may have same or different ruleset than another attester. A common ruleset may be used. The common ruleset may be written in the blockchain, e.g., for protecting the integrity of the ruleset applied by the attesters.
The local assessment may be based on a manufacturer of the requester. The local assessment may be based on that whether the requester has a same manufacturer with the attester. The local assessment may be based on an operating system of the requester. The local assessment may be based on that whether the requester has a same operating system with the attester. The local assessment may be based on one or more internal factors. The local assessment may be based on one or more external factors.
The group trust assessment may refer to local assessments being computed and shared during the protocol.
The blockchain may be a permissioned blockchain. The method may further comprise authenticating to the blockchain. The blockchain may have as its permitted members a group of state machine replication protocol members. Alternatively, the blockchain may be a permissionless blockchain.
The method may further comprise granting or refusing the request of the requester depending on the global assessment.
The local assessment may be defined as a numeric value. The local assessment may be defined as a Boolean value. The global assessment may be defined as a numeric value. The global assessment may be defined as a Boolean value.
The state machine replication protocol may be a practical byzantine fault tolerant protocol, PBFT. The state machine replication protocol may be based on Quorum. The state machine replication protocol may be based on Multichain. In an example embodiment, regardless of the chosen state machine replication protocol, a global trust assessment is decided if consensus is reached on a decided ruleset.
The global assessment may be formed using at least a statistical characterization function. The statistical characterization function may be average. The statistical characterization function may be a mean function. The statistical characterization function may be logarithmic average function. The statistical characterization function may be a root mean square function.
The global assessment may be defined as a value between a minimum and maximum. The granting of the request may be performed if the global assessment meets or exceeds a given threshold. The threshold may be 50% between the minimum and maximum. The threshold may be ⅔ of the range between the minimum and maximum. The threshold may be increased for given requests. The threshold may be lowered for given requests.
The method may further comprise updating locally maintained global assessment for each requester of the assessment matrix according to the global assessment.
According to a second example aspect of the present invention or as an addition to the first example aspect, there is provided a method in a mobile computer, comprising:
authenticating to a permissioned and distributed blockchain that has as its permitted members a group of state machine replication protocol members;
according to the state machine replication protocol, assuming a role of a leader of the group of state machine replication protocol members and performing in the leader role at least:
wirelessly collecting from other members of the group one or more requests for a command or operation request originating from one or more requesters and wirelessly transmitted to the other members of the group;
forming an assessment matrix defining a plurality of attesters that are different members of the group and one or more requesters;
providing the assessment matrix wirelessly to other attesters and using the assessment matrix locally as one of the attesters;
locally assessing each of the requesters of the assessment matrix based on local knowledge of the requesters;
according to the state machine replication protocol, attempting wirelessly exchanging with all other attesters of the matrix corresponding local assessments of each requester;
according to the state machine replication protocol, locally computing group trust assessments for each requester of the assessment matrix based on all obtained local assessments of each requester;
attempting to wirelessly exchange the locally computed group trust assessments with all other attesters;
defining a global assessment for each requester of the assessment matrix based on all obtained group trust assessments; and
appending the global assessment for each requester to the closed blockchain.
The mobile computer may operate in the rank member role at one point of time and in a leader role at another point of time.
The mobile computer may be or comprise or be comprised by a drone.
The mobile computer may be or comprise or be comprised by a vehicle.
The mobile computer may be or comprise or be comprised by a robot.
The mobile computer may be autonomously mobile.
According to a third example aspect of the present invention, there is provided a method for operating drones or other mobile computers in sensitive environments, where the drones may be attacked with updates, incorrect/malicious commands or even be joined by malicious drones pretending to be part of the drone swarm or group.
The method may include leveraging both trusted computing capabilities and that each individual drone can decide on the level of assurance and trust of any other drone. We can construct a consensus algorithm such that if a drone wishes to perform a sensitive operation then all drones can attest that drone and decide on its level of assurance.
According to a fourth example aspect of the present invention, there is provided a computer program comprising computer executable program code configured to execute any preceding example aspect.
The computer program may be stored in a computer readable memory medium.
Any foregoing memory medium may comprise a digital data storage such as a data disc or diskette, optical storage, magnetic storage, holographic storage, opto-magnetic storage, phase-change memory, resistive random access memory, magnetic random access memory, solid-electrolyte memory, ferroelectric random access memory, organic memory, or polymer memory. The memory medium may be formed into a device without other substantial functions than storing memory or it may be formed as part of a device with other functions, including but not limited to a memory of a computer, a chip set, and a sub assembly of an electronic device.
According to a fifth example aspect of the present invention, there is provided an apparatus comprising a memory and a processor that are configured to cause the apparatus to perform the method of any example aspect.
According to a sixth example aspect of the present invention, there is provided an apparatus comprising means for performing the method of any example aspect.
Different non-binding example aspects and embodiments of the present invention have been illustrated in the foregoing. The embodiments in the foregoing are used merely to explain selected aspects or steps that may be utilized in implementations of the present invention. Some embodiments may be presented only with reference to certain example aspects of the invention. It should be appreciated that corresponding embodiments may apply to other example aspects as well.
For a more complete understanding of example embodiments of the present invention, reference is now made to the following descriptions taken in connection with the accompanying drawings in which:
An example embodiment of the present invention and its potential advantages are understood by referring to
210. Request(Dx): a client drone CD receives an attestation request from a drone Dx and has to decide whether to trust the latter or not (see
220. TrustAssessment(Dx): the attestation request is sent from the CD to a current leader drone LD asking to obtain a global assessment on the trustworthiness of the client drone Dx. In this example, the global assessment on the trustworthiness will be computed as the average value of all local assessments computed by the validating drones VD in the fleet or group of a state machine replication protocol members (see
The Leader drone LD buffers any received attestation requests for a given time (such as at least 5 s, at least 10 s, at least 30 s, at least 60 s, at least 300 s, or at least 1000 s) and then proceeds.
230. CreateOrderedList(D1, . . . , Dx, . . . , Dn): The Leader drone LD collects all the requests for global assessment received by and from the different drones and creates an ordered list. For using Practical Byzantine Fault Tolerance, PBFT, permissioned block chain, each state machine replication protocol member authenticates itself.
240. Pre-prepare( ): the ordered list is sent in broadcast to the client drone CD and to the validating drones VD. This message officially starts the PBFT protocol (see
Pre-prepare( ), prepare( ), commit( ) functions are in an example embodiment standard functions of the PBFT protocol.
250. ShareAssessment( ): before proceeding with the PBFT protocol, the Client drone CD, Leader drone LD, and Validating drones VD must exchange their local assessment values for all the drones specified within the ordered list (
260. Prepare( ): a standard PBFT-like message used to make sure that the Client drone CD, the Leader Drone LD, and the Validating drones VD receive the local assessment matrices and can continue with the consensus protocol.
270. Commit® a step of a PBFT-like protocol in which the Client drone CD, the Leader drone LD, and the Validating drones VD reach (for each drone specified in the ordered list) an agreement on the trustworthiness of Dx. To this end, the Client drone CD, the Leader drone LD, and the Validating drones VD may apply a specific function on the local assessments received by the other drones (see
275. Compute ranking: As each state machine replication protocol member has the knowledge of every other member (or those that did reply), the members compute their ranking for each requestor and also they each compute and share the global assessment to each other.
Average is taken if a consensus is found, in which case the result comes from a set of rules based on various properties obtained by the PBFT protocol of the Dx. In an example embodiment, the average and consensus have different goals in the protocol. The consensus per-se may only regulate how to reach an agreement between attesters. The average may regulate on what to reach agreement. In an example embodiment, if the ruleset being used during the consensus is the average function and the consensus is reached (e.g., the majority of attesters agree on the computed average values), then the average may be taken as the global assessment.
An attestation protocol has mechanisms, such as Remote ATtestation ProcedureS (RATS) described in charter-ietf-rats-01, which may[SF1][SL2] distribute details by a set of claims generated by suitable hardware. Forensic evidence is acquired using the attestation protocol by the validating drones and may include an initial registration on sending the attestation request. In an example embodiment, assessments (or attestations) of elements are made by an attester and generate a claim. The claim contains, e.g., a cryptographically verifiable (provenance and by implication identity of the element) assessment which is then passed on for matches against expected values through a rule mechanism. In an example embodiment, it is at this point we obtain one assessment of trust in that element.
8. UpdateGlobalTrust( ): for each drone listed in the Leader drone LD request, drones update their global assessment values. In this context, updating refers to, for example, that new assessment is added or changed assessment replaces the old one.
9. AppendNewBlock( ): the new agreed block is added to the local blockchain data structure by all drones (see
290. AppendNewBlock( ): the Client drone CD, the Leader drone LD, and the Validating drones VD append a new block.
The apparatus 500 comprises a memory 540 including a persistent computer program code 550. The apparatus 500 further comprises a processor 520 for controlling the operation of the apparatus 500 using the computer program code 540, a communication unit 510 for communicating with other nodes. The communication unit 510 comprises, for example, a local area network (LAN) port; a wireless local area network (WLAN) unit; Bluetooth unit; cellular data communication unit; or satellite data communication unit. The processor 520 comprises, for example, any one or more of: a master control unit (MCU); a microprocessor; a digital signal processor (DSP); an application specific integrated circuit (ASIC); a field programmable gate array; and a microcontroller.
As used in this application, the term “circuitry” may refer to one or more or all of the following:
(a) hardware-only circuit implementations (such as implementations in only analogue and/or digital circuitry) and;
(b) combinations of hardware circuits and software, such as (as applicable):
(c) hardware circuit(s) and or processor(s), such as a microprocessor(s) or a portion of a microprocessor(s), that requires software (e.g., firmware) for operation, but the software may not be present when it is not needed for operation.
This definition of circuitry applies to all uses of this term in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers an implementation of merely a hardware circuit or processor (or multiple processors) or portion of a hardware circuit or processor and its (or their) accompanying software and/or firmware. The term circuitry also covers, for example and if applicable to the particular claim element, a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in server, a cellular network device, or other computing or network device.
Without in any way limiting the scope, interpretation, or application of the claims appearing below, a technical effect of one or more of the example embodiments disclosed herein is that trust relationship of mobile computers can by dynamically updated without centralised control. Another technical effect of one or more of the example embodiments disclosed herein is that rogue mobile computer attacks can be mitigated based on group assessment. Another technical effect of one or more of the example embodiments disclosed herein is that local assessments can be efficiently shared with other attesters in matrices using a predefined structure. Another technical effect of one or more of the example embodiments disclosed herein is that resilience against communications interference or failures may be enhanced by sharing the local assessments with the matrices in relatively brief bursts. Another technical effect of one or more example embodiments disclosed herein is combining two kinds of assessments, local and global, which are different in nature (aka in the way they are computed) and thus provide different properties.
Embodiments of the present invention may be implemented in software, hardware, application logic or a combination of software, hardware, and application logic. In an example embodiment, the application logic, software, or an instruction set is maintained on any one of various conventional computer-readable media. In the context of this document, a “computer-readable medium” may be any non-transitory media or means that can contain, store, communicate, propagate, or transport the instructions for use by or in connection with an instruction execution system, apparatus, or device, such as a computer, with one example of a computer described and depicted in
If desired, the different functions discussed herein may be performed in a different order and/or concurrently with each other. Furthermore, if desired, one or more of the before-described functions may be optional or may be combined.
Although various aspects of the invention are set out in the independent claims, other aspects of the invention comprise other combinations of features from the described embodiments and/or the dependent claims with the features of the independent claims, and not solely the combinations explicitly set out in the claims.
It is also noted herein that while the foregoing describes example embodiments of the invention, these descriptions should not be viewed in a limiting sense. Rather, there are several variations and modifications which may be made without departing from the scope of the present invention as defined in the appended claims.
Number | Date | Country | Kind |
---|---|---|---|
20215389 | Mar 2021 | FI | national |