Secure pairing of end user devices with instruments

• US 9,532,225 B2
• Filed: 06/12/2014
• Issued: 12/27/2016
• Est. Priority Date: 06/12/2014
• Status: Active Grant

• Current Assignee: GE Digital Holdings LLC (GE Aerospace)
• Original Assignee: General Electric Company
• Inventors: MacKenzie, Patricia Denise, Bjorkesten, Lennart, Liu, Shaopeng, Holovashchenko, Viktor, Smith, David, Franzen, Erik Nils Patrik
• Primary Examiner(s): TAYLOR, NATHAN SCOTT
• Application Number:
  US14/302,967
• Publication Number:
  US 20150365512A1
• Time in Patent Office: 929 Days
• Field of Search: 455/420, 455/411, 725/25, 725/110, 726/4, 370/310
• US Class Current: 1/1
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/082 using revocation of authorisation

Abstract

A role-based access control method and/or system permits end users to securely pair their mobile devices via a pairing apparatus with one or more instruments to, for example, remotely monitor operations of the instruments. In an embodiment, the process includes a pairing apparatus receiving a pairing request from an instrument including a unique access code, and receiving a pairing request from an end user mobile device that includes an end user mobile device identifier and an access code. If the unique access code matches the end user'"'"'s access code, then the end user mobile device identifier is added to a security group and a successful pairing message is transmitted to at least one of the instrument and the end user mobile device.

Claims

1. A computer-implemented method, comprising:

receiving a pairing request from an instrument including a unique access code;

receiving a pairing request from an end user mobile device comprising an end user mobile device identifier, end user identification data, and an access code;

determining that the unique access code from the instrument matches the access code from the end user mobile device;

transmitting a pairing confirmation message to the end user mobile device;

determining that the end user identification data is adequate;

transmitting a pairing confirmation message to the instrument deleting the unique access code; and

adding the end user mobile device identifier to a security group.

2. The computer-implemented method of claim 1, further comprising, subsequent to receiving the pairing request from the instrument:

determining that a predetermined time interval expired without receiving a pairing request from an end user mobile device concerning the instrument; and

transmitting a failure message to the instrument.

3. The computer-implemented method of claim 2, further comprising deleting the unique access code.

4. The computer-implemented method of claim 1, further comprising, subsequent to receiving the pairing request from the end user mobile device:

determining that the access code from the end user mobile device does not match the unique access code from the instrument; and

transmitting a failure message to the end user mobile device.

5. The computer-implemented method of claim 1,

further comprising, subsequent to determining that the unique access code from the instrument matches the access code from the end user mobile device:

transmitting a pairing confirmation message to the end user mobile device;

determining that the end user identification data is inadequate; and

transmitting a failure message to the end user device.

6. The computer-implemented method of claim 1, further comprising permitting the end user mobile device to at least one of monitor, assess, and remotely control the instrument.

7. A method comprising:

receiving, by a processor from an instrument, a pairing request including a unique access code;

receiving, by the processor from an end user mobile device, a pairing request comprising an access code, end user identification data, and a mobile device identifier;

determining, by the processor, that the unique access code matches the access code;

transmitting, by the processor, a pairing confirmation message to the end user mobile device;

determining, by the processor, that the end user identification data is adequate;

transmitting, by the processor, a pairing confirmation message to the instrument deleting, by the processor, the unique access code; and

adding, by the processor, the end user mobile device identifier to a security group.

8. The method of claim 7, further comprising, subsequent to receiving the pairing request from the instrument:

determining, by the processor, that a predetermined time interval expired without receiving a pairing request from the end user mobile device concerning the instrument; and

transmitting, by the processor to the instrument, a failure message.

9. The method of claim 8, further comprising deleting, by the processor, the unique access code.

10. The method of claim 7, further comprising, subsequent to receiving the pairing request from the end user mobile device:

determining, by the processor, that the access code does not match the unique access code; and

transmitting by the processor to the end user mobile device, a failure message.

11. The method of claim 7,

further comprising, subsequent to determining that the unique access code from the instrument matches the access code from the end user mobile device:

transmitting, by the processor to the end user mobile device, a pairing confirmation message;

determining, by the processor, that the end user identification data is inadequate; and

transmitting, by the processor to the end user device, a failure message.

12. The method of claim 7, further comprising permitting the end user mobile device to at least one of monitor, assess, and emotely control the instrument.

13. A non-transitory computer-readable medium storing instructions configured to cause a processor to:

receive a pairing request including a unique access code from an instrument;

receive a pairing request from an end user mobile device, the pairing request comprising an access code, end user identification data, and a mobile device identifier;

determine that the unique access code matches the access code;

transmit a pairing confirmation message to the end user mobile device;

determine that the end user identification data is adequate;

transmit a pairing confirmation message to the instrument;

delete the unique access code; and

add the end user mobile device identifier to a security group.

14. The non-transitory computer-readable medium of claim 13, further comprising instructions, subsequent to the instructions for receiving the pairing request from the instrument, configured to cause the processor to:

determine that a predetermined time interval expired without receiving a pairing request from the end user mobile device concerning the instrument; and

transmit a failure message to the instrument.

15. The non-transitory computer-readable medium of claim 14, further comprising instructions configured to cause the processor to delete the unique access code.

16. The non-transitory computer-readable medium of claim 13, further comprising, subsequent to the instructions for receiving the pairing request from the end user mobile device, instructions configured to cause the processor to:

determine that the access code does not match the unique access code; and

transmit a failure message to the end user mobile device.

17. The non-transitory computer-readable medium of claim 13, further comprising, subsequent to the instructions for determining that the unique access code from the instrument matches the access code from the end user mobile device, instructions configured to cause the processor to:

transmit a pairing confirmation message to the end user mobile device;

determine that the end user identification data is inadequate; and

transmit a failure message to the end user device.

18. The non-transitory computer-readable medium of claim 13, further comprising instructions configured to cause a processor to permit the end user mobile device to at least one of monitor, assess, and remotely control the instrument.

19. A pairing apparatus, comprising:

at least one processor;

a communications device operably connected to the at least one processor; and

a non-transitory storage device operably connected to the at least one processor, the non-transitory storage device storing program instructions configured to cause the at least one processor to;

receive via the communications device a pairing request including a unique access code from an instrument;

receive via the communications device a pairing request from an end user mobile device, the pairing request comprising an access code, end user identification data, and a mobile device identifier;

determine that the unique access code matches the access code;

transmit a pairing confirmation message to the end user mobile device;

determine that the end user identification data is adequate;

transmit a pairing confirmation message to the instrument;

delete the unique access code; and

add the end user mobile device identifier to a security group.

20. The pairing apparatus of claim 19, wherein, subsequent to the instructions for receiving the pairing request from the instrument, the at least one processor is further operative with the program instructions to:

determine that a predetermined time interval expired without receiving a pairing request from the end user mobile device concerning the instrument; and

transmit via the communications device a failure message to the instrument.

21. The pairing apparatus of claim 20, wherein the at least one processor is further operative with the program instructions to delete the unique access code.

22. The pairing apparatus of claim 20, wherein the at least one processor is further operative with the program instructions to permit the end user mobile device to at least one of monitor, assess, and remotely control the instrument.

23. The pairing apparatus of claim 19, wherein the at least one processor, communications device and the non-transitory computer readable medium comprise one of a remote server computer or a server computer associated with a cloud system.