Using Supplemental Encrypted Signals to Mitigate Man-in-the-Middle Attacks on Teleoperated Systems

• US 20150295949A1
• Filed: 10/30/2013
• Published: 10/15/2015
• Est. Priority Date: 11/02/2012
• Status: Active Grant

• Current Assignee: University of Washington
• Original Assignee: University of Washington
• Inventors: Chizeck, Howard Jay, Bonaci, Tamara
• Granted Patent: US 9,686,306 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: A61B 34/30 Surgical robots
• CPC Class Codes: G16H 20/40 relating to mechanical, radiation or invasive therapies, e.g. surgery, laser therapy, dialysis or acupuncture
• CPC Class Codes: G16H 40/67 for remote operation
• CPC Class Codes: H04L 12/12 Arrangements for remote connection or disconnection of substations or of equipment thereof
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Methods and systems for securing remotely-operable devices are provided. A remotely-operable device can receive a command related to a component of the remotely-operable device operating in an environment. The remotely-operable device can include a reality-rules database (RRDB) that is configured to store a plurality of reality rules with each reality rule relating to a constraint on the remotely-operable device. The remotely-operable device can determine a reasonableness value for the command based on a constraint, where the constraint is determined based on a constraint related to at least one reality rule of the plurality of reality rules stored in the RRDB. The remotely-operable device can encode the reasonableness value for the command in a feedback message. The remotely-operable device can send the encoded feedback message from the remotely-operable device.

Claims

1. A method, comprising:

receiving, at a remotely-operable device, a command related to a component of the remotely-operable device operating in an environment, the remotely-operable device comprising the component and a reality-rules database (RRDB), wherein the RRDB is configured to store a plurality of reality rules, and wherein each reality rule relates to a constraint on the remotely-operable device;

determining a reasonableness value for the command based on at least one constraint on the remotely-operable device, wherein the at least one constraint is determined based on at least one reality rule of the plurality of reality rules stored in the RRDB of the remotely-operable device;

encoding the reasonableness value for the command in a feedback message for the remotely-operable device; and

sending the encoded feedback message from the remotely-operable device.

2. The method of claim 1, wherein determining a reasonableness value for the command comprises:

determining a current status of the component of the remotely-operable device;

determining a possible-future status of the component based on the current status, wherein the possible-future status indicates a status in the event the command was executed;

providing a query to the RRDB related to the component;

in response to the query, receiving data regarding the at least one constraint on the remotely-operable device; and

determining the reasonableness value based on the future status and the data regarding the at least one constraint on the remotely-operable device.

3. The method of claim 1, further comprising:

determining whether the reasonableness value exceeds a threshold reasonableness value; and

after determining that the reasonableness value exceeds the threshold reasonableness value, at least partially executing the command at the remotely-operable device.

4. The method of claim 1, wherein the command comprises a backup command.

5. The method of claim 4, further comprising:

determining whether the reasonableness value exceeds a threshold reasonableness value; and

after determining that the reasonableness value does not exceed the threshold reasonableness value, determining that the command is not feasible for at least partial execution.

6. The method of claim 5, further comprising:

after determining that the command is not feasible for at least partial execution, determining whether the backup command is feasible for at least partial execution; and

after determining that the backup command is feasible for at least partial execution, at least partially executing the backup command.

7. The method of claim 6, further comprising:

after determining that the backup command is not feasible for at least partial execution, performing a default operation for the remotely-operable device; and

sending information indicating that the default operation has been performed from the remotely-operable device.

8. The method of claim 1, wherein the feedback message comprises a plurality of fields, and wherein encoding the reasonableness value for the command comprises encoding at least one field of the plurality of fields of the feedback message with the reasonableness value.

9. The method of claim 8, wherein the reasonableness value for the command comprises one or more bits, and wherein encoding the reasonableness value for the command comprises encoding at least one field of the plurality of fields with at least one bit of the one or more bits of the reasonableness value.

10. The method of claim 1, wherein the feedback message comprises an image, and wherein encoding the reasonableness value for the command comprises encoding the image with the reasonableness value.

11. The method of claim 10, wherein the reasonableness value for the command comprises one or more bits, and wherein encoding the image with the reasonableness value comprises encoding the image with the one or more bits of the reasonableness value using a steganographic technique.

12. The method of claim 1, wherein the plurality of reality rules comprise at least one rule selected from the group of rules consisting of:

a rule about a range of motion of the component, a range of motion of the remotely-operable device, a rule about maximum velocity of the component, a rule about a maximum velocity of the remotely-operable device, a rule about a maximum acceleration of the component, a rule about a maximum acceleration of the remotely-operable device, a rule about a location for operating the remotely-operable device, a rule about a location for not operating the remotely-operable device, a rule about a stress on the component, a rule about a stress on the remotely-operable device, a rule about a distance between the component and another component of the remotely-operable device, and a rule about a minimum distance between the remotely-operable device and another device.

13. A method, comprising:

determining a first command for a remotely-operable device at an operator device;

determining a future status of the remotely-operable device and a backup command of the remotely-operable device at the operator device, wherein the future status includes a predicted status after an associated command is at least partially executed by the remotely-operable device, and wherein the backup command is configured to be carried out by the remotely-operable device after the remotely-operable device determines that the associated command is not feasible for at least partial execution;

generating a command message using the operator device, wherein the command message includes the first command, the future status, and the backup command; and

sending the command message from the operator device.

14. The method of claim 13, wherein the associated command is the first command.

15. The method of claim 13, wherein the associated command is a command other than the first command.

16. The method of claim 15, wherein the associated command is a command sent prior to the first command.

17. The method of claim 13, further comprising:

receiving a report that a default operation of the remotely-operable device has been performed, wherein the default operation differs from both the first command and the associated command.

18. The method of claim 13, wherein the command message comprises a plurality of fields, each field comprising one or more bits, wherein the future status is configured to be encoded as a first set of bits, and wherein generating the command message comprises encoding at least the first set of bits into one or more bits of at least one field of the plurality of fields.

19. The method of claim 13, wherein the feedback message comprises a plurality of fields, each field comprising one or more bits, wherein the backup command is configured to be encoded as a second set of bits, and wherein generating the command message comprises encoding at least the second set of bits into one or more bits of at least one field of the plurality of fields.

20. A remotely-operable device, comprising:

a component;

a processor; and

a non-transitory tangible computer readable medium configured to store at least a reality-rules database (RRDB) and executable instructions, wherein the RRDB is configured to store a plurality of reality rules, wherein each reality rule relates to a constraint on the remotely-operable device, and wherein the executable instructions, when executed by the processor, cause the remotely-operable device to perform functions comprising;

receiving a command related to the component operating in an environment;

determining a reasonableness value for the command based on at least one constraint on the remotely-operable device, wherein the at least one constraint is determined based on at least one constraint related to at least one reality rule of the plurality of reality rules stored in the RRDB;

encoding the reasonableness value for the command in a feedback message; and

sending the encoded feedback message.