Secure machine-to-machine communication protocol

• US 8,762,725 B2
• Filed: 10/19/2012
• Issued: 06/24/2014
• Est. Priority Date: 10/19/2012
• Status: Active Grant

• Current Assignee: Caterpillar Incorporated
• Original Assignee: Caterpillar Incorporated
• Inventors: Jorden, Caleb M., Schulz, Robert F.
• Primary Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US13/656,233
• Publication Number:
  US 20140115335A1
• Time in Patent Office: 613 Days
• Field of Search: 713/169, 713/153, 701/1
• US Class Current: 713/169
• CPC Class Codes: G07C 5/008 communicating information to a remotely located station transmission systems for measured values G08C
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/61 taking into account QoS or priority requirements
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: Y04S 40/18 Network protocols supporting networked applications, e.g. including control of end-device applications over a network
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

A task list server supports secure asynchronous communications between both a workstation and one or more machines. The task list server stores requests and responses initiated by either side and establishes secure communication channels used to forward the data between parties. The communication between workstation and machine may be delayed by hours or even days, depending on the work schedule and network access of both the workstation operator and machine. The machine may process requests in order from highest priority to lowest priority and from oldest to newest. Public key encryption may be used to establish secure channels between the task list server and the workstation or the one or more machines using a combination of certificate authorities including both manufacturers and owner/operators.

Claims

1. A system for securely communicating requests and responses between a workstation and a machine using a task list server, the system comprising:

the machine communicatively coupled to the task list server that receives, from the task list server, an instruction corresponding to a request from the workstation, the instruction being a task instruction or a status instruction corresponding to the request and develops a response to the instruction without human operator intervention; and

the task list server having executable instructions that when executed by a processor of the task list server cause the task list server to;

establish a first communication session between the task list server and the workstation, the first communication session mutually authenticated and encrypted, wherein the first communication session communicates the request from the workstation to the task list server and the request includes at least one of a task request or a status request, wherein the task list server receives priority information for the request stored at the task list server; and

asynchronously to the first communication session, establish a second communication session, according to the received priority information, between the task list server and the machine, the second communication session mutually authenticated and encrypted, wherein the second communication session communicates the response to the instruction to the task list server.

2. The system of claim 1, wherein the priority information is included in the request.

3. The system of claim 1, wherein the machine stores a plurality of instructions and develops the response to a particular instruction based on a priority of the instruction and within a given priority in an order from oldest to newest.

4. The system of claim 1, wherein the task list server sends a status message including a status of a previous request to the workstation.

5. The system of claim 4, wherein the status message includes information selected from a set comprising:

completed successfully, failed, pending at the machine, and pending delivery to the machine.

6. The system of claim 5, wherein the task list server uses the second communication session to communicate the status message to the workstation.

7. The system of claim 1, wherein the task list server uses the second communication session to communicate the instruction to the machine.

8. The system of claim 1, wherein the task list server i) receives and stores a plurality of requests from one or more workstations, the plurality of requests directed at one or more machines, ii) receives and stores a plurality of responses from the one or more machines, and iii) presents the one or more of the plurality of responses to authorized workstations.

9. The system of claim 1, wherein the machine is directly coupled to the task list server without intervening computational nodes and the workstation is directly coupled to the task list server without intervening computational nodes.

10. A system for securely communicating requests and responses between a workstation and a machine, the system comprising:

a task list server including;

a server processor;

a communication port coupled to the server processor,

the communication port supporting secure and authenticated session-based communications between the task list server and the workstation and between the task list server and the machine, the communication port configured to receive a priority level for the communications for use in prioritizing communications at the task list server;

a memory configured to store operational data, keys, and executable commands for execution on the server processor that cause the task list server to store data and communicate data traffic over the communication port; and

the machine including;

a machine processor;

a machine communication port coupled to the machine processor and communicatively coupled to the communication port of the task list server;

a memory configured to store executable commands for execution on the machine processor that implement;

a communication routine that receives an instruction from the task list server;

a queue storing the instruction received from the task list server and a response to the instruction for sending to the task list server; and

a dispatch routine that causes the instruction to be executed and determines the response to the instruction.

11. The system of claim 10, wherein the machine further comprises a priority management routine that determines the priority level and a time reference for each of a plurality of instructions in the queue and causes the dispatch routine to execute each pending instruction in an order first by the priority level and second by the time reference from oldest to newest.

12. The system of claim 10, wherein the dispatch routine determines the response to the instruction as a numerical value related to execution of the instruction.

13. The system of claim 10, wherein the dispatch routine determines the response as one of completed successfully or failed.

14. The system of claim 10, wherein the machine is one of an earthmoving machine, a mining machine, and a power generation machine.

15. A method of asynchronous communication between a plurality of workstations and a plurality of machines using a task list server, the method comprising:

establishing a first communication session between the task list server and a workstation;

receiving, at the task list server, a request from the workstation, the request including at least one of a status request for a status at one or more of the plurality of machines or a job request to be executed at one or more of the plurality of machines;

receiving, at the task list server, a priority level for the request;

storing the request in a machine-specific queue at the task list server;

establishing a second communication session between the task list server and a one machine of the plurality of machines;

determining that the machine-specific queue has a stored request for the one machine;

dispatching, to the one machine, an instruction corresponding to the stored request in the queue according to the priority level;

marking the stored request in the queue as pending;

disconnecting the second communication session;

establishing a third communication session between the task list server and the one machine;

receiving from the one machine a response to the instruction;

storing the response in a workstations specific queue at the task list server; and

sending, from the task list server to an authenticated workstation, a status message corresponding to the response stored in the queue.

16. The method of claim 15, further comprising sending from the task list server to the workstation, responsive to a query from the workstation, a pending status message of the request following dispatching the instruction and before receiving the response from the machine corresponding to the instruction.

17. The method of claim 15, wherein sending the status message comprises establishing a fourth communication session between the task list server and the authenticated workstation.

18. The method of claim 15, wherein establishing the first communication session comprises creation of a secure channel, performing a mutual authentication between the task list server and the workstation and confirming login credentials associated with a user at the workstation.

19. The method of claim 15, further comprising serving a web page from the task list server to the workstation wherein the web page includes information used by a browser at the workstation to present a list of machines available for requests and a set of available requests specific to each machine in the list of machines.

20. The method of claim 15, further comprising execution of instructions in the queue in an order determined by a priority of the instruction.