Authenticated messages between unmanned vehicles

• US 9,930,027 B2
• Filed: 03/27/2015
• Issued: 03/27/2018
• Est. Priority Date: 03/27/2015
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Canavor, Darren Ernest, Gopalakrishnan, Varadarajan, Johansson, Jesper Mikael, McClintock, Jon Arron, Porter, Brandon William, Roths, Andrew Jay
• Primary Examiner(s): Tran, Khoi H
• Assistant Examiner(s): Nguyen, Robert T
• Application Number:
  US14/671,264
• Publication Number:
  US 20160285864A1
• Time in Patent Office: 1,096 Days
• Field of Search: 700213
• CPC Class Codes: B64C 39/024 of the remote controlled vehicle type, i.e. RPV
• CPC Class Codes: B64U 2201/20 Remote controls
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/102 Route integrity, e.g. using trusted paths
• CPC Class Codes: H04W 4/12 Messaging; Mailboxes; Announcements

Abstract

An unmanned vehicle communicates with other unmanned vehicles. When the unmanned vehicle receives a message from another unmanned vehicle, the unmanned vehicle verifies authenticity of the message. For at least some types of messages, if determined that the message is authentic, the unmanned vehicle updates a set of operations the unmanned vehicle will perform in accordance with information in the message.

Claims

1. A computer-implemented method, comprising:

under the control of an on-board computer system of an unmanned vehicle,

storing information specifying a set of operations to be performed by the unmanned vehicle;

receiving, from a second unmanned vehicle, a message and authentication information for the message, the authentication information specific to an originator of the message;

cryptographically determining, based at least in part on the authentication information, that the message is authentic;

modifying the information specifying the set of operations based at least in part on the message;

receiving a second message from the second unmanned aerial vehicle and cryptographically verify whether the second message originated from a command and control facility computer system; and

fulfilling a command of the second message contingent on successful verification that the second message originated from the command and control facility computer system.

2. The computer-implemented method of claim 1, wherein:

the authentication information comprises a digital signature for the message and a first digital certificate; and

cryptographically determining that the message is authentic includes using a second digital certificate to verify the first digital certificate and using the first digital certificate to validate the digital signature.

3. The computer-implemented method of claim 1, wherein:

the information specifies a set of tasks each with a corresponding subset of the set of operations; and

the method further comprises selecting a task based at least in part on the message and updating the task.

4. The computer-implemented method of claim 1, wherein modifying the information specifying the set of operations comprises modifying a route to a destination based at least in part on information in the message.

5. The computer-implemented method of claim 1, further comprising transmitting the message to a second unmanned vehicle that is different from the other unmanned vehicle.

6. The computer-implemented method of claim 1, wherein the unmanned vehicle and the other unmanned vehicle are unmanned aerial vehicles.

7. The computer-implemented method of claim 1, wherein:

the message indicates untrustworthiness of a second unmanned vehicle different from the other unmanned vehicle;

at least a portion of the information is reliant on information in a message received from the second unmanned vehicle; and

modifying the information specifying the set of operations includes updating the portion of the information independently of the information received in the message from the second unmanned vehicle.

8. The computer-implemented method of claim 1, wherein:

the message has a type of a plurality of message types; and

modifying the information specifying the set of operations is further based at least in part on the type.

9. A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by one or more processors of a computer system of an unmanned vehicle, cause the computer system to at least:

store an operational plan specifying a set of operations the unmanned vehicle is to perform;

receive, from a second unmanned aerial vehicle, a message;

use authentication information specific to the second unmanned aerial vehicle to cryptographically verify whether the message originated from the second unmanned vehicle;

update the operational plan in accordance with information in the message if the message is cryptographically verified as having originated from the second unmanned aerial vehicle;

receive a second message from the second unmanned aerial vehicle, the second message specifying a command;

cryptographically verify whether the second message originated from a command and control facility computer system; and

fulfill the command contingent on successful verification that the second message originated from the command and control facility computer system.

10. The non-transitory computer-readable storage medium of claim 9, wherein:

the message is received with a digital signature and a digital certificate; and

the instructions that cause the computer system to cryptographically verify whether the message originated from the second unmanned aerial vehicle, when executed by the one or more processors, cause the computer system to;

verify the digital certificate; and

use the digital certificate to verify the digital signature.

11. The non-transitory computer-readable storage medium of claim 9, wherein:

the message includes a command to delete stored information; and

the instructions that cause the computer system to update the operational plan, as a result of the command, include instructions that cause the computer system to delete the operational plan.

12. The non-transitory computer-readable storage medium of claim 9, wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to:

generate a digital signature for the received message; and

provide the received message and the generated digital signature to a third unmanned vehicle different from the second unmanned aerial vehicle.

13. The non-transitory computer-readable storage medium of claim 9, wherein:

the message indicates revocation of a digital signature; and

the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to;

store the message;

determine to transmit another message to a third unmanned vehicle different from the second unmanned aerial vehicle; and

as a result of determining to transmit the other message, transmit the other message with the stored message to the third unmanned vehicle.

14. The non-transitory computer-readable storage medium of claim 9, wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to reject the message if the computer system is unable to cryptographically verify that the message originated from the second unmanned aerial vehicle.

15. The non-transitory computer-readable storage medium of claim 9, wherein the unmanned vehicle is an unmanned aerial vehicle.

16. An unmanned aerial vehicle, comprising:

a propulsion subsystem configured to propel the unmanned aerial vehicle between locations;

a transceiver configured to receive and transmit messages; and

an on-board computer system including;

one or more processors; and

memory that stores;

a set of tasks to be completed by the unmanned aerial vehicle; and

instructions that, when executed by the one or more processors, cause the on-board computer system to;

determine a task for the set of tasks based at least in part on a first message received via the transceiver;

at a time after determining the task, receive, through the transceiver and from a second unmanned aerial vehicle, a second message;

cryptographically verify that the second message received through the transceiver originated from a command and control facility computer system;

as a result of cryptographically verifying that the second message originated from the command and control facility computer system, update the task based at least in part on information in the second message; and

control at least the propulsion subsystem to complete the task.

17. The unmanned aerial vehicle of claim 16, wherein:

the second message is received through the transceiver with a first digital certificate and a digital signature; and

the instructions that cause the on-board computer system to cryptographically verify that the second message is trustworthy, when executed by the one or more processors, cause the on-board computer system to;

use a locally stored second digital certificate to verify the received first digital certificate; and

use the first digital certificate to verify the received digital signature.

18. The unmanned aerial vehicle of claim 16, wherein updating the task comprises updating a route for the task to avoid an area corresponding to a location specified in the second message.

19. The unmanned aerial vehicle of claim 16, wherein the instructions that cause the on-board computer system to update the task, when executed by the one or more processors, cause the on-board computer system to select the task as a result of information in the second message being applicable to fulfillment of the task.