SYSTEM FOR AUTHENTICATING AND AUTHORIZING ACCESS TO AND ACCOUNTING FOR WIRELESS ACCESS VEHICULAR ENVIRONMENT CONSUMPTION BY CLIENT DEVICES

• US 20180004933A1
• Filed: 06/30/2017
• Published: 01/04/2018
• Est. Priority Date: 07/01/2016
• Status: Active Grant

• Current Assignee: Paxgrid Cdn Inc.
• Original Assignee: Paxgrid Cdn Inc.
• Inventors: Nathanson, Martin D.
• Granted Patent: US 10,187,767 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 9/54 Interprogram communication
• CPC Class Codes: H04L 2101/659 Internet protocol version 6 [IPv6] addresses
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2209/84 Vehicles
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 12/086 using security domains
• CPC Class Codes: H04W 4/24 Accounting or billing
• CPC Class Codes: H04W 4/44 for communication between vehicles and infrastructures, e.g. vehicle-to-cloud [V2C] or vehicle-to-home [V2H]
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]
• CPC Class Codes: H04W 84/005 : Moving wireless networks
• CPC Class Codes: H04W 88/02 : Terminal devices
• CPC Class Codes: H04W 88/08 : Access point devices
• CPC Class Codes: H04W 88/14 : Backbone network devices
• CPC Class Codes: H04W 92/02 : Inter-networking arrangements
• CPC Class Codes: H04W 92/045 : between access point and backbone network device
• CPC Class Codes: H04W 92/10 : between terminal device and access point, i.e. wireless air interface

Abstract

A system and method are disclosed for authenticating and authorizing access to and accounting for consumption of bandwidth for IPv6 connectivity to the Internet over Wireless Access Vehicular Environment (WAVE) service channels by client devices using an Authentication, Authorization and Accounting (AAA) server. The AAA server authenticates and authorizes client devices to access WAVE service channels, and accounts for bandwidth consumption by the client devices using WAVE service channels to access the Internet. The AAA server enables an RSU infrastructure operator to quantify wireless bandwidth consumption by in-vehicle devices using the WAVE Service Channels, on a per-device basis.

Claims

1. An AAA server operated by, or on behalf of a Dedicated Short-Range Communications infrastructure authority, transmitting messages among and between On-board Units (OBU) and Roadside Units (RSU), said AAA server comprising at least one processor running at least one computer program adapted to communicate through the Internet with a plurality of user devices and/or an OBU operating a subnet for one or more user devices, with a plurality of RSUs, in order to carry out the functions of Authentication, Authorization and Accounting (AAA), enabling the authority to account for Wireless Access Vehicular Environment service channel bandwidth consumption by each of said user devices having been duly provisioned by said AAA server.

2. An AAA server, as defined in claim 1, configured as a Certificate Management Entity and operable to issue Internet Subscription digital certificates for IPv6-addressable user devices and to transmit said certificates to said user devices over a secure communications channel, said certificates including the domain name of said AAA server.

3. An AAA server, as defined in claim 2, linked to a PKI chain of trust between components of a Security Credentials and Management System (SCMS), operable to process requests from DSRC OBUs for said digital certificates, said requests encapsulating Personal Identifying Information (PII) for said OBUs and secured by the asymmetrical encryption algorithm specified in IEEE 1609.2, using an enrollment certificate issued to said OBUs by the SCMS and operable to establish said secure communications channel for sending said certificate to said OBU using the encryption key of said enrollment certificate.

4. An AAA server, as defined in claim 3, operable to process requests from non-DSRC mobile devices for said digital certificates, said requests encapsulating PII for said mobile device, each mobile device initiating a handshaking protocol to establish a secure, symmetrically encrypted communications channel with said AAA server.

5. An AAA server, as defined in claim 3, operable to receive combined authorization and authentication requests from OBUs, said requests incorporating credentials in the form of digital signatures generated using keys from said Internet Subscription certificates issued to said OBUs by said AAA server;

operable to receive said combined authorization and authentication requests forwarded from one or more remote AAA servers on behalf of OBUs that have received said Internet Subscription certificates from said remote AAA servers;

operable to process requests from both said OBUs and said remote AAA servers by cryptographic validation of the credentials presented correspondingly by said OBUs and said remote AAA servers, for each request querying a non-remote AAA database for a match with PII contained in the request, and returning a message to the requesting OBU or remote AAA, either granting or denying authorization with a code representing a reason for denial.

6. An AAA server, as defined in claim 3, operable to receive authorization requests from said OBUs on behalf of non-DSRC mobile devices, to send UDP/IP authentication challenge messages directly or indirectly to IPv6 address of said non-DSRC mobile devices;

to process responses to said authentication challenges which incorporate credentials in the form of digital signatures generated using keys from said Internet Subscription certificates issued to said non-DSRC mobile devices by said AAA server; and

operable to receive said authorization requests forwarded from a remote AAA server on behalf of non-DSRC mobile devices that have received Internet Subscription credentials from said AAA server;

operable to process said requests from both non-DSRC mobile devices and remote AAA servers by cryptographic validation of the credentials presented, querying the local AAA database for a match with PII contained in the request, and returning a message to the requester either granting or denying authorization with a code explaining the reason for denial.

7. An AAA server, as defined in claim 3, operable, in the case where the domain name of the Certificate Management Entity having issued credentials used by a user device to request authentication and authorization, identifies a remote AAA server, to forward said request to said remote AAA server, using credentials obtained from said SCMS chain of trust to secure communications with said remote server.

8. An AAA server, as defined in claim 3, operable, in the case where the domain name of the certificate management entity having issued the credentials used by a user device to respond to an authentication challenge from said AAA server, identifies a remote AAA server, to forward said request to said remote AAA server, using credentials obtained from said SCMS chain of trust to secure communications with said remote AAA server.

9. An AAA server, as defined in claim 1, operable to use Remotely Triggered Black Hole (RTBH) filtering with internal bBorder Ggateway Protocol to send UPDATE messages to RSUs within a same Autonomous System, said UPDATE messages being triggered by, and encapsulating the results of an authentication and authorization request for Internet Subscription services received from a user device, said results being either the failure to authenticate said mobile device, or the granting or denial of authorization to said user device.

10. An Roadside Unit (RSU) configured with an extended IPv6 Management Information Base (MIB) operable to determine packet and byte count statistics for Wireless Access Vehicular Vehicle (WAVE) service channel usage per client device, said client device being either an On-board Unit (OBU), a non-DSRC mobile device that is IPv6-reachable through an OBU, or a DSRC-enabled user device;

said IPv6 MIB being also operable to retrieve, for each datagram received from an IPv6 node operating in a route optimization mode of Mobile IPv6, a fixed “

home address”

of the mobile node carried in the Mobile IPv6 routing header of said datagram;

said RSU being operable to accumulate, in Non-volatile Random Access Memory (NOVRAM), said packet and byte count statistics for WAVE service channel usage per client device and periodically to send said statistics to a AAA server, encapsulated in a UDP/IP message, only refreshing said NOVRAM table when the AAA server has acknowledged reception of said UDP/IP message.

11. An RSU as defined in claim 10, compliant with the USDOT specifications found in http:

//docplayer.net/11087167-Dsrc-roadside-unit-rsu-specifications-document.html or a functional equivalent thereof.

12. An RSU, as defined in claim 11, operable to process RTBH filtering instructions from a AAA server within a same Autonomous System.

13. An OBU, compliant with WAVE and IEEE 802.11p and configurable with dual-radio capability, running at least one application level computer program adapted to request authentication and authorization from a AAA server, for IPv6 connectivity to the Internet, either on behalf of a neighboring non-DSRC mobile device or for itself, and configured with an extended IPv6 MIB operable to retrieve the addresses of neighboring devices when a new entry is inserted in a routing table, using either a synchronous method based on SNMP GET to retrieve the routing table periodically, or an asynchronous method based on SNMP TRAP to report “

real-time”

changes in the routing table.

14. An OBU, as defined claim in 14, operable to request “

Internet Subscription”

credentials from a AAA server, using its SCMS enrollment certificate from encryption of the request to, and decryption of the response from, said AAA server, and operable to use said credentials when requesting authentication and authorization from said AAA server for said IPv6 connectivity to the Internet.

15. A system facilitating communication between and among On-board Units (OBU) and Roadside Units (RSU) utilizing Dedicated Short-Range Communications (DSRC) to communicate through the Internet with a plurality of user devices and/or an OBU operating a subnet for one or more user devices, said system comprising:

a server transmitting messages among and between the OBU and the RSU, said server comprising at least one processor running at least one computer program adapted to authenticate the user device, authorize the user device to have access to Wireless Access Vehicular Environment (WAVE) service channels, and account for bandwidth consumption by each of said user devices having been duly authenticated and authorized by said AAA server.

16. A system as defined in claim 15, comprising a plurality of servers operated by, or on behalf of a Dedicated Short-Range Communications (DSRC) infrastructure authority.