Patent Application
20070043489
The present invention relates to systems and methods for controlling access to vehicular or other mobile devices. More specifically, the present invention concerns a system and method for controlling access to, and especially protecting against unauthorized attempts to provide input to, e.g., program, or elicit output from, a vehicular or other mobile device, such as an electronic control unit, wherein a determined location of the device or an inputted user acknowledgment provides a basis or an additional basis for allowing or denying the attempt at access.
In the prior art, programming a vehicle's electronic control unit (ECU) requires that the vehicle be present at an authorized location (e.g., a manufacturing or assembly facility, a dealership, or an authorized repair facility) and directly hardwired to a programming tool. Recently, remote wireless programming of ECUs has been introduced, which allows for greater programming flexibility. With this change, security has shifted from physical mechanisms to password and cryptographic authentication mechanisms for controlling access. Unfortunately, the security afforded by password and cryptographic access-control mechanisms does not provide a sufficiently high level of assurance against malicious attacks, such as, for example, the communication of viruses or other harmful or undesired programs to ECUs.
It will be appreciated that this concern extends to both providing input to ECUs or other vehicular devices as well as eliciting output from such devices. Thus, for example, toll booths or parking garages might be adapted to wirelessly query vehicles for identification or even for payment information but, as mentioned, password and cryptographic mechanisms do not afford sufficient security against the illicit collection of such information.
It will also be appreciated that this concern extends to a variety of other programmable or otherwise accessible mobile devices including, for example, mobile telephones and mobile computing devices.
Thus, an improved access-control mechanism is needed to more effectively control access to vehicular or other mobile devices.
The present invention provides a system and method for controlling access to, and especially protecting against unauthorized attempts to provide input to, e.g., program, or elicit output from, a vehicular or other mobile device, such as an ECU, wherein a determined location of the device or an inputted user acknowledgment provides a basis or an additional basis for allowing or denying the attempt at access.
In a first preferred embodiment the present invention provides a system and method of using location to authorize an attempt to provide input to or elicit output from a mobile device, such as an ECU which is onboard a vehicle, wherein the determined location of the device provides a basis for allowing or denying the attempt at access. In the vehicle, a gateway is provided connected to or otherwise having access to a GPS or other location-determining device or technology and a location database of authorized locations. When the gateway detects an attempt to access the ECU the gateway requests the vehicle's current location from the GPS device and compares the current location with entries in the location database. If the current location does not correspond to an entry in the location database, indicating that the vehicle is not at an authorized location, then the gateway denies access.
In a second preferred embodiment the present invention provides a system and method of using a user acknowledgement to authorize an attempt to provide input to or elicit output from the ECU. The user acknowledgement preferably takes the form of one or more input actions entered by a first party, such as the owner of the vehicle, in response to a request, notice, or other communication or indication by a second party, such as a technician in a remote repair facility, desiring access. In the vehicle, the gateway is provided connected to or otherwise receiving input from one or more conventional vehicular input mechanisms, such as, for example, a brake pedal, an accelerator pedal, a horn, a steering wheel, a turn signal switch, or an emergency flasher switch, and an action database of authorized input actions. The gateway receives the inputted user acknowledgement from the conventional vehicular input mechanisms, and compares the input actions with entries in the action database. If the input actions are not provided or do not correspond to an entry in the action database, indicating that the party attempting access is not authorized for such access, then the gateway denies access.
In both embodiments, the authorization mechanism of the present invention is preferably used in conjunction with one or more other independent access-control mechanisms, such as physical, password, or cryptographic authentication mechanisms, which may be encountered and must be satisfied either or both before or after the access-control mechanism of the present invention in order to gain access to a device.
These and other features of the present invention are discussed in greater detail in the section below titled DESCRIPTION OF THE PREFERRED EMBODIMENT(S).
A preferred embodiment of the present invention is described in detail below with reference to the attached drawing figures, wherein:
With reference to the figures, a system and method is herein described and otherwise disclosed in accordance with a preferred embodiment of the present invention. Broadly, the present invention concerns a system and method for controlling access to, and especially protecting against unauthorized attempts to provide input to or elicit output from, a vehicular or other mobile device, wherein a determined location of the device or inputted user acknowledgment provides a basis or an additional basis for allowing or denying the attempt at access. Though described hereafter in terms of a vehicular device located onboard or otherwise associated with a vehicle, it should be understood that the present invention can be used to control access to substantially any mobile device, such as a mobile telephone or a mobile computing device (e.g., laptop, notebook, personal digital assistant).
In a first preferred embodiment the present invention provides a system and method of using location to authorize an attempt to provide input to or elicit output from a device, such as an ECU, which is onboard or otherwise physically associated with a vehicle, such as a car or truck, wherein the determined location of the vehicle provides a basis for allowing or denying the attempt at access. Preferably, the access-control mechanism of the present invention is used to supplement one or more other independent access-control mechanisms, such as physical, password, or cryptographic authentication mechanisms, rather than as a stand-alone alternative to those mechanisms. More specifically, the authorization mechanism of the present invention is preferably combined with one or more authentication mechanisms of the prior art in order to even more effectively control access. Thus, for example, accessing a particular device may require both that the party attempting to access the device provide a correct password and that either the vehicle, the device, or the party attempting to access the device be located at an authorized location such as, e.g., a manufacturing or assembly facility, dealership, or authorized repair facility. Also, the present invention may be used to control access for either or both hardwired or wireless processes requiring access to the device.
Referring to
As mentioned, the access-control mechanism of the present invention is preferably used in conjunction with one or more other access-control mechanisms which may be encountered and must be satisfied, as indicated by box 108, either or both before or after the mechanism of the present invention. Thus, for example, the party attempting to gain access to the vehicular device 14 may be required, before access is granted, to enter a password either or both before or after the gateway 12 has determined that the device 14 is at a location authorized to make the requested access.
It will be appreciated that the entries in the location database 18 may be categorized with respect to the type of access for which each such location entry is authorized. Thus, for example, the location of a tollbooth may be an authorized location for wirelessly eliciting identification or toll payment information but not for programming an ECU, while the location of a repair facility may be an authorized location for programming an ECU and for eliciting identification information but not for eliciting toll payment information.
In a non-limiting simplified first example of use and operation of the first preferred embodiment of the present invention, a repair technician wishing to program the vehicle's ECU 14 requests access. In response, the technician is prompted to enter a password, which he or she does. The password is authenticated. Before granting access, however, the gateway 12 requests the vehicle's current location from the GPS device 16. The gateway 12 receives the determined location and compares it to those entries in the location database 18 which are authorized for programming access. The gateway 12 determines that the current location is an authorized location and so it allows the requested access.
In a non-limiting simplified second example of use and operation of the first preferred embodiment of the present invention, a vandal wishing to introduce a virus into the vehicle's ECU 14 requests access. In response, the vandal is prompted to enter a password, which, having stolen, discerned, or otherwise discovered the password, he or she does. The password is authenticated. Before granting access, however, the gateway 12 requests the vehicle's current location from the GPS device 16. The gateway 12 receives the determined location and compares it to those entries in the location database 18 which are authorized for programming access. The gateway 12 determines that the current location is not an authorized location and so it does not grant the requested access, thereby prohibiting the vandal from introducing the virus.
In a non-limiting simplified third example of use and operation of the first preferred embodiment of the present invention, as the vehicle 10 passes a tollbooth, the tollbooth requests access to the vehicle's identification for billing or other recordkeeping purposes. Before granting access to the desired information, the gateway 12 requests the vehicle's current location from the GPS device 16. The gateway 12 receives the determined location and compares it to those entries in the location database 18 which are authorized for identification access. The gateway 12 determines that the current location is an authorized location and so it allows the requested access.
In a second preferred embodiment the present invention provides a system and method of using an inputted user acknowledgement to authorize an attempt to provide input to or elicit output from the mobile device 114. The user acknowledgement preferably takes the form of one or more input actions entered by a first party in response to a request, notice, or other communication or indication by a second party desiring access, wherein the input action is provided using one or more of the device's conventional input mechanisms, such as, for example, pedals, switches, buttons, or keys, and wherein the received input actions provide a basis for allowing or denying the attempt at access. It is contemplated, for example, that the first party may be an owner of the vehicle and the second party may be a technician at a remote repair facility desiring to program the ECU, in which case the owner would provide the input action in response to a prior or substantially simultaneous communication by the technician. It is also contemplated that the first party and the second party may be the same, e.g., the vehicle would be available to the technician so that he or she could provide the input action to authorize his or her own access. In one contemplated implementation, performance of the input action places the device at issue in a particular “mode” (e.g., input mode, output mode, program mode, information mode) which determines the type or types of access that are authorized. Preferably, the access-control mechanism of the present invention is used to supplement one or more other independent access-control mechanisms, such as physical, password, or cryptographic authentication mechanisms, rather than as a stand-alone alternative to those mechanisms. More specifically, the authorization mechanism of the present invention is preferably combined with one or more authentication mechanisms of the prior art in order to even more effectively control access. Thus, for example, accessing a particular device may require both that the second party attempting to access the device provide a correct password and that the first party enter the proper input action to indicate that the second party is trustworthy. Also, the present invention may be used to control access for either or both hardwired or wireless processes requiring access to the device.
Referring to
As in the first preferred embodiment, the mechanism of the present invention is preferably used in conjunction with one or more other security mechanisms which may be encountered and must be satisfied, as indicated by box 208, either or both before or after the mechanism of the present invention. Thus, for example, the party attempting to gain access to the vehicular device 114 may be required, before access is granted, to enter a password either or both before or after the gateway 112 has determined that the input action indicates authorization to make the requested access.
Also as in the first preferred embodiment, it will be appreciated that the entries in the action database 118 may be categorized with respect to the type of access for which each such input entry is authorized. Thus, for example, the input action required for programming an ECU may be different than the input action required for eliciting historical operating information from the vehicle's memory.
In a non-limiting simplified example of the use and operation of the second preferred embodiment of the present invention, a repair technician at a remote location wishing to program the vehicle's ECU 114 contacts the vehicle's owner and indicates the date and time at which such access is desired, and requests that the owner provide the input action in order to authorize the access. At the appointed date and time the owner provides the input action by, for example, depressing the brake pedal for one second before turning the ignition switch to ON. The gateway 112 receives the input action and compares it to those entries in the action database which are authorized for programming access. The gateway 112 determines that the input action is proper, and therefore authorizes the access by causing the ECU 114 to enter the operational mode appropriate for the type of access. The technician is, however, still required to enter a password before achieving access, and so he or she is prompted to enter the password, which he or she does. The password is authenticated and the technician is granted access.
Although the present invention has been described with reference to the preferred embodiments illustrated in the drawings, it is noted that equivalents may be employed and substitutions made herein without departing from the scope of the invention as recited in the claims.
