System and Method for Protecting Train Event Data

• US 20160014111A1
• Filed: 02/24/2014
• Published: 01/14/2016
• Est. Priority Date: 03/04/2013
• Status: Active Grant

• Current Assignee: Wabtec Corporation (Westinghouse Air Brake Technologies Corporation)
• Original Assignee: Wabtec Corporation (Westinghouse Air Brake Technologies Corporation)
• Inventors: Kurz, Brian E.
• Granted Patent: US 9,813,405 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: B61L 15/0072 On-board train data handling
• CPC Class Codes: B61L 15/0094 Recorders on the vehicle
• CPC Class Codes: B61L 27/40 Handling position reports or trackside vehicle data
• CPC Class Codes: B61L 27/70 Details of trackside communication
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 2209/84 Vehicles
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

Systems and methods for protecting and preventing unauthorized transfer or downloading of recorded train event data for use in a train event recording system of a train. A train event recording system and an authenticated data storage device are also disclosed. According to one preferred and non-limiting embodiment, provided is a system for protecting recorded train event data, the system including at least one external memory device having encrypted authentication data stored thereon, the encrypted authentication data including authentication data encrypted with at least one first key.

Claims

1. A system for protecting recorded train event data, comprising:

at least one external memory device comprising encrypted authentication data, the encrypted authentication data comprising authentication data encrypted with at least one first key; and

a train event recording system on a train and in communication with a train management computer, the train event recording system configured to;

record train event data for the train from the train management computer;

determine if the at least one external memory device comprises the encrypted authentication data when the at least one external memory device is in communication with the train event recording system;

decrypt the encrypted authentication data based at least partially on at least one second key;

determine if the authentication data is valid; and

facilitate a transfer or cause the transfer of at least a portion of the event data to the at least one external memory device if the authentication data is determined to be valid.

2. The system of claim 1, wherein the at least one first key and the at least one second key are different, and wherein the authentication data is encrypted with an asymmetrical encryption algorithm.

3. The system of claim 2, wherein the at least one first key comprises at least one private key and the at least one second key comprises at least one public key.

4. The system of claim 1, wherein the authentication data comprises at least one of the following:

railroad data, user data, a device serial number, an expiration date, or any combination thereof.

5. The system of claim 1, wherein the train event recording system is further configured to detect when the at least one external memory device is in communication with the train event recording system.

6. The system of claim 1, further comprising a computer-readable medium including program instructions which, when executed by at least one processor of a computer, cause the computer to:

receive user input;

generate the authentication data based at least in part on the user input; and

encrypt at least a portion of the authentication data.

7. The system of claim 1, further comprising at least one authentication token stored on the at least one external memory device, the at least one authentication token including at least a portion of the encrypted authentication data.

8. The system of claim 1, further comprising a verification server configured to receive at least a portion of the decrypted authentication data, and transmit an indication to the train event recording system that the at least one external storage device is valid or invalid.

9. A method of preventing unauthorized transfer of train event data from a train event recording system, comprising:

providing a plurality of memory devices, wherein each memory device comprises authentication data encrypted with at least one first key;

storing at least one second key on a computer-readable medium in communication with the train event recording system;

determining, with the train event recording system or a train management computer, if the encrypted authentication data is on at least one memory device of the plurality of memory devices;

decrypting, with the train event recording system or the train management computer, the encrypted authentication data based at least partially on the at least one second key;

determining if the at least one memory device is valid based at least partially on the authentication data; and

preventing at least a portion of the event data from being transferred to the at least one memory device if the at least one memory device is not determined to be valid.

10. The method of claim 9, wherein the at least one first key and the at least one second key are different, and wherein the authentication data is encrypted with an asymmetrical encryption algorithm.

11. The method of claim 9, wherein the at least one first key comprises at least one public key and the at least one second key comprises at least one private key.

12. The method of claim 9, wherein the authentication data comprises at least one of the following:

railroad data, user data, a memory device serial number, an expiration date, or any combination thereof.

13. The method of claim 9, further comprising detecting a connection of the at least one memory device to the train event recording system.

14. The method of claim 9, wherein, before the providing step, the method further comprises:

receiving user input at a management computer;

generating the authentication data based at least in part on the user input; and

encrypting at least a portion of the authentication data with the at least one first key.

15. A method of preventing unauthorized download of event data from a train event recording system, comprising:

generating at least one authentication token for at least one storage device;

storing the at least one authentication token on the at least one storage device; and

providing an event recording system on a train, wherein the event recording system is configured to selectively facilitate access to at least a portion of recorded event data based at least partially on the at least one authentication token.

16. The method of claim 15, wherein the at least one authentication token is generated by encrypting authentication data with at least one encryption key.

17. The method of claim 16, wherein the event recording system is further configured to decrypt the authentication token with at least one decryption key.

18. The method of claim 17, wherein the at least one encryption key is different than the at least one decryption key, and wherein the authentication data is encrypted based at least partially on an asymmetrical encryption algorithm.

19. The method of claim 15, wherein the authentication data comprises at least one of the following:

railroad data, user data, a device serial number, an expiration date, or any combination thereof.

20. The method of claim 15, further comprising detecting a connection of the at least one storage device to the event recording system.

21. The method of claim 15, further comprising:

receiving user input at a management computer;

generating authentication data based at least in part on the user input; and

encrypting at least a portion of the authentication data.

22. A train event recording system comprising at least one processor, the train event recording system configured to:

record train event data;

detect an external storage device communicating with the train event recording system;

determine if the external storage device is valid based at least partially on encrypted authentication information stored on the external storage device and at least one decryption key; and

prevent transfer of at least a portion of the train event data to the external storage device if the external storage device is not valid.

23. The train event recording system of claim 22, wherein the encrypted authentication information is encrypted with at least one encryption key, and wherein the at least one encryption key is different than the at least one decryption key.

24. The train event recording system of claim 23, wherein the at least one encryption key comprises at least one private key and the at least one decryption key comprises at least one public key.

25. The train event recording system of claim 22, wherein the encrypted authentication data comprises at least one of the following:

railroad data, user data, a device serial number, an expiration date, or any combination thereof.

26. The train event recording system of claim 22, wherein the train event recording system is further configured to detect when the external storage device is brought into communication with the train event recording system.

27. An authenticated data storage device for downloading train event data from a train event recording system, the device comprising:

a portable data storage device comprising;

at least one interface adapted to facilitate communication between the portable data storage device and the train event recording system; and

an authentication token including encrypted authentication data, wherein the authentication token is configured to authenticate the portable data storage device when the portable data storage device is in communication with the train event recording system.

28. The authenticated data storage device of claim 27, wherein the encrypted authentication data comprises at least one of the following:

railroad data, user data, a device serial number, an expiration date, or any combination thereof.

29. The authenticated data storage device of claim 27, wherein the at least one interface comprises at least one of the following:

a universal serial bus interface, a radio frequency interface, a network interface, or any combination thereof.

30. The authenticated data storage device of claim 27, wherein the encrypted authentication data is encrypted with at least one first key, and wherein the encrypted authentication data is configured to be decrypted with at least one second key after establishing communication with the train event recording system.