UNMANNED VEHICLE ROLLBACK

• US 20160280371A1
• Filed: 03/27/2015
• Published: 09/29/2016
• Est. Priority Date: 03/27/2015
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Canavor, Darren Ernest, Gopalakrishnan, Varadarajan, Johansson, Jesper Mikael, McClintock, Jon Arron, Porter, Brandon William, Roths, Andrew Jay
• Granted Patent: US 9,714,088 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: B64C 39/024 of the remote controlled vehicle type, i.e. RPV
• CPC Class Codes: B64U 2201/10 autonomous, i.e. by navigating independently from ground or air stations, e.g. by using inertial navigation systems [INS]
• CPC Class Codes: B64U 2201/20 Remote controls
• CPC Class Codes: G05D 1/104 involving a plurality of aircrafts, e.g. formation flying traffic control systems for aircraft G08G5/00
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2209/84 Vehicles
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/102 Route integrity, e.g. using trusted paths
• CPC Class Codes: H04W 12/104 Location integrity, e.g. secure geotagging
• CPC Class Codes: H04W 12/106 Packet or message integrity
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/40 : for vehicles, e.g. vehicle-to-pedestrians [V2P]

Abstract

An unmanned vehicle determines how to perform a task based at least in part on a message received from another unmanned vehicle. At a later time, the unmanned vehicle detects that the other unmanned vehicle has become untrusted. The unmanned vehicle recalculates how to perform the task such that the recalculation is independent of any messages from the other unmanned vehicle. The unmanned vehicle may also transmit messages to other unmanned vehicles to provide notification of untrustworthiness of the other unmanned vehicle.

Claims

1. An unmanned aerial vehicle, comprising:

a propulsion subsystem configured to propel the unmanned aerial vehicle between locations; and

a transceiver configured to receive and transmit messages;

an on-board computer system including;

one or more processors; and

memory that stores;

a set of tasks to be performed by the unmanned aerial vehicle; and

instructions that, when executed by the one or more processors, cause the on-board computer system to;

determine a task for the set of tasks based at least in part a message received via the transceiver;

at a time after determining the task, determine that the message is untrustworthy;

recalculate the task independently from the untrustworthy message; and

control at least the propulsion subsystem to perform the recalculated task.

2. The unmanned aerial vehicle of claim 1, wherein:

the message is a first message; and

the instructions that cause the on-board computer system to determine that the message is untrustworthy, when executed by the one or more processors, cause the on-board computer system to;

obtain a second message received via the transceiver, the message received with a digital signature and a digital certificate;

verify trustworthiness of the second message based at least in part on at least one of the digital signature and the digital certificate; and

determine trustworthiness of the first message based at least in part on trustworthiness of the second message.

3. The unmanned aerial vehicle of claim 2, wherein:

the second message indicates untrustworthiness of an unmanned aerial vehicle that originated the first message; and

the instructions cause the on-board computer system to determine that the first message is untrustworthy as a result of determining that the second message is trustworthy.

4. The unmanned aerial vehicle of claim 1, wherein recalculation of the task comprises recalculation of a route of the task.

5. A computer-implemented method, comprising:

under the control of an on-board computer system of an unmanned vehicle,

storing a set of tasks for the unmanned vehicle to perform, the set of tasks including a subset of tasks determined in reliance on at least one message from another unmanned vehicle;

determining that the at least one message is untrustworthy;

updating the stored set of tasks as a result of determining that the at least one message is untrustworthy; and

causing the unmanned vehicle to perform the updated stored set of tasks.

6. The computer-implemented method of claim 5, wherein updating the stored set of tasks comprises recalculating at least one task of the subset of tasks independently from the at least one message.

7. The computer-implemented method of claim 6, wherein:

the subset of tasks comprises multiple tasks; and

updating the stored set of tasks is performed to leave at least one task of the subset of tasks reliant on the at least one message.

8. The computer-implemented method of claim 5, wherein updating the stored set of tasks comprises cancelling at least one task of the stored set of tasks.

9. The computer-implemented method of claim 5, further comprising transmitting another message to at least one additional unmanned vehicle, the other message indicating untrustworthiness of the other unmanned vehicle.

10. The computer-implemented method of claim 9, wherein:

the method further comprises generating a digital signature of the other message using a cryptographic key maintained by the unmanned vehicle as a secret; and

transmitting the other message further comprises transmitting the generated digital signature.

11. The computer-implemented method of claim 5, wherein determining that the at least one message is untrustworthy comprises verifying a digital signature of another message.

12. The computer-implemented method of claim 5, wherein the unmanned vehicle is an unmanned aerial vehicle.

13. The computer-implemented method of claim 5, wherein updating the stored set of tasks includes adding a task to the stored set of tasks.

14. A non-transitory computer-readable storage medium having stored thereon executable instructions that, when executed by one or more processors of a computer system of an unmanned vehicle, cause the computer system to at least:

receive, from another unmanned vehicle, a message;

update a set of tasks to be performed by the unmanned vehicle based at least in part on information in the received message;

at a time after updating the set of tasks, determine that the received message is untrustworthy; and

as a result of determining that the received message is untrustworthy, update the set of tasks.

15. The non-transitory computer-readable storage medium of claim 14, wherein the instructions that cause the computer system to update the set of tasks as a result of determining that the received message is untrustworthy, when executed by the one or more processors, cause the computer system to roll back at least one task of the set of tasks to a previous state.

16. The non-transitory computer-readable storage medium of claim 14, wherein the instructions that cause the computer system to update the set of tasks as a result of determining that the received message is untrustworthy, when executed by the one or more processors, cause the computer system to recalculate at least one task of the set of tasks based at least in part on a current state of the unmanned vehicle.

17. The non-transitory computer-readable storage medium of claim 14, wherein the instructions that cause the computer system to determine that the received message is untrustworthy, when executed by the one or more processors, cause the computer system to:

receive a second message indicating that a digital certificate of the unmanned vehicle is revoked; and

select the message as a result of a digital signature of the message having been verified based at least in part on a public cryptographic key of the digital certificate.

18. The non-transitory computer-readable storage medium of claim 14, wherein:

the message indicates information about a location; and

the instructions that cause the computer system to update the set of tasks, when executed by the one or more processors, cause the computer system to modify a route of a task of the set of tasks to avoid the location.

19. The non-transitory computer-readable storage medium of claim 14, wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to, as a result of determining that the message is untrustworthy, transmit a message indicating that the other unmanned vehicle is untrustworthy.

20. The non-transitory computer-readable storage medium of claim 14, wherein the instructions further comprise instructions that, when executed by the one or more processors, cause the computer system to reject a future message from the other unmanned vehicle.

21. The non-transitory computer-readable storage medium of claim 14, wherein the instructions that cause the computer system to determine that the received message is untrustworthy, when executed by the one or more processors, cause the computer system to cryptographically verify authenticity of a second message from a command and control facility, the second message indicating that the other unmanned vehicle is untrustworthy.