System and method for enabling secure transactions using flexible identity management in a vehicular environment

• US 8,863,256 B1
• Filed: 01/26/2011
• Issued: 10/14/2014
• Est. Priority Date: 01/14/2011
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Addepalli, Sateesh K., Maino, Fabio R., Bonomi, Flavio, Dai, Lillian Lei, Ermagan, Vina, Noll, Landon Curt, Loukissas, Alexander, Lee, Erick D.
• Primary Examiner(s): Patel, Nirav B
• Application Number:
  US13/014,605
• Time in Patent Office: 1,357 Days
• Field of Search: 726 2- 7, 705/64, 455/410, 455/411, 713/168, 713/192
• US Class Current: 726/7
• CPC Class Codes: B60R 16/023 for transmission of signals between vehicle parts or subsystems
• CPC Class Codes: B60W 50/10 Interpretation of driver requests or demands
• CPC Class Codes: G06F 21/45 Structures or tools for the administration of authentication
• CPC Class Codes: G06F 3/017 Gesture based interaction, e.g. based on a set of recognized hand gestures interaction based on gestures traced on a digitiser G06F3/04883
• CPC Class Codes: G06F 3/167 Audio in a user interface, e.g. using voice commands for navigating, audio feedback
• CPC Class Codes: G06F 9/542 Event management; Broadcasting; Multicasting; Notifications
• CPC Class Codes: H04L 1/008 where the control data relates to payload of a different packet
• CPC Class Codes: H04L 43/0811 by checking connectivity
• CPC Class Codes: H04L 43/0858 One way delays
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 45/12 Shortest path evaluation
• CPC Class Codes: H04L 51/02 using automatic reactions or user delegation, e.g. automatic replies or chatbot-generated messages
• CPC Class Codes: H04L 61/2592 using tunnelling or encapsulation
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/60 Scheduling or organising the servicing of application requests, e.g. requests for application data transmissions using the analysis and optimisation of the required network resources admission control or resource allocation H04L47/70
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
• CPC Class Codes: H04Q 9/00 Arrangements in telecontrol or telemetry systems for selectively calling a substation from a main station, in which substation desired apparatus is selected for applying a control signal thereto or for obtaining measured values therefrom
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 28/0215 based on user or device properties, e.g. MTC-capable devices services for machine-to-machine communication [M2M] or machine type communication [MTC] H04W4/70; wireless resource selection or allocation plan definition based on terminal or device properties H04W72/51
• CPC Class Codes: H04W 28/06 : Optimizing the usage of the radio link, e.g. header compression, information sizing , discarding information system modifying transmission characteristic according to link quality by modifying frame length H04L1/0007; dynamic adaptation of the packet size for flow control or congestion control H04L47/365
• CPC Class Codes: H04W 36/0009 : for a plurality of users or terminals, e.g. group communication or moving wireless networks user group management H04W4/08; processing of subscriber group data H04W8/186
• CPC Class Codes: H04W 36/08 : Reselecting an access point
• CPC Class Codes: H04W 4/00 : Services specially adapted for wireless communication networks; Facilities therefor
• CPC Class Codes: H04W 4/10 : Push-to-Talk [PTT] or Push-On-Call services
• CPC Class Codes: H04W 4/40 : for vehicles, e.g. vehicle-to-pedestrians [V2P]
• CPC Class Codes: H04W 40/02 : Communication route or path selection, e.g. power-based or shortest path routing
• CPC Class Codes: H04W 40/20 : based on geographic position or location
• CPC Class Codes: H04W 48/02 : Access restriction performed under specific conditions
• CPC Class Codes: H04W 48/06 : based on traffic conditions
• CPC Class Codes: H04W 48/16 : Discovering, processing access restriction or access information
• CPC Class Codes: H04W 48/18 : Selecting a network or a communication service
• CPC Class Codes: H04W 52/0206 : in access points, e.g. base stations access point devices per se H04W88/08
• CPC Class Codes: H04W 52/0219 : where the power saving management affects multiple terminals
• CPC Class Codes: H04W 52/0264 : by selectively disabling software applications
• CPC Class Codes: H04W 52/12 : Outer and inner loops
• CPC Class Codes: H04W 52/143 : Downlink power control
• CPC Class Codes: H04W 52/225 : Calculation of statistics, e.g. average, variance
• CPC Class Codes: H04W 52/241 : taking into account channel quality metrics, e.g. SIR, SNR, CIR, Eb/lo
• CPC Class Codes: H04W 52/346 : distributing total power among users or channels
• CPC Class Codes: H04W 72/20 : Control channels or signalling for resource management
• CPC Class Codes: H04W 72/23 : in the downlink direction of a wireless link, i.e. towards a terminal
• CPC Class Codes: H04W 72/53 : based on regulatory allocation policies
• CPC Class Codes: H04W 76/45 : for Push-to-Talk [PTT] or Push-to-Talk over cellular [PoC] services
• CPC Class Codes: H04W 8/06 : Registration at serving network Location Register, VLR or user mobility server
• CPC Class Codes: H04W 8/08 : Mobility data transfer
• CPC Class Codes: H04W 8/26 : Network addressing or numbering for mobility support
• CPC Class Codes: H04W 80/02 : Data link layer protocols
• CPC Class Codes: H04W 84/005 : Moving wireless networks
• CPC Class Codes: H04W 84/12 : WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 92/18 : between terminal devices
• CPC Class Codes: Y02A 30/60 : Planning or developing urban green infrastructure
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

A method in one embodiment includes detecting an event for a transaction on an on-board unit (OBU) of a vehicle, where the event has a trigger associated with an agent. The method also includes determining whether the transaction is authorized, identifying network credentials in an identity profile that corresponds to the agent, providing network credentials to a transaction application corresponding to the transaction, and accessing a remote network using the network credentials. Certain embodiments include selecting the network credentials from a plurality of available network credentials corresponding to the agent. In more specific embodiments, the network credentials include one or more virtual subscriber identity modules (VSIMs) of a plurality of VSIMs provisioned on the OBU. In specific embodiments, the network credentials are mapped to a combination of two or more of the agent, the transaction application, and a predefined current location of the vehicle.

Claims

1. A method, comprising:

detecting an event for a transaction on an on-board unit (OBU) of a vehicle, the event having a trigger associated with an agent that is authenticated to the OBU, wherein the agent is one of a plurality of authenticated agents provisioned to access the OBU, wherein the agent is associated with a first set of one or more authentication requirements that enable access to the OBU by the agent when the agent is authenticated based on the first set of one or more authentication requirements, and wherein the agent is associated with one or more network credentials provisioned in the OBU to enable a network connection to be established between the OBU and a remote network;

determining whether at least one of a transaction application or any transaction type that corresponds to the transaction application is mapped to the agent in a mapping database of the OBU, wherein the transaction application corresponds to the transaction associated with the detected event, and wherein the mapping is based on a level of authorization of the agent;

determining the transaction application is authorized based on a determination that at least one of the transaction application or a transaction type that corresponds to the transaction application is mapped to the agent in the mapping database of the OBU;

identifying particular network credentials of the one or more network credentials associated with the agent; and

providing the particular network credentials to the transaction application,

wherein the network connection is established by the transaction application using the particular network credentials,

wherein at least one other agent of the plurality of authenticated agents is associated with one or more other network credentials to enable another network connection, initiated by the other agent, to be established between the OBU and the remote network.

2. The method of claim 1, wherein the agent includes the transaction application, the trigger being a request from the transaction application for the particular network credentials, wherein the transaction application establishes the network connection between the OBU and an authorized entity via the remote network.

3. The method of claim 1, wherein the agent is a detector, the trigger being a signal received by the detector from a transaction system external to the vehicle.

4. The method of claim 1, wherein the agent is a human, the trigger being a command from the human through the OBU to initiate the transaction application.

5. The method of claim 1, wherein the agent is a mobile device connected to the OBU through a local network, the trigger being a request from the mobile device for the particular network credentials.

6. The method of claim 1, wherein an identity profile associated with the agent is provisioned in the OBU, the identity profile including information indicating the one or more network credentials.

7. The method of claim 6 further comprising:

providing application programming interfaces (APIs) to the transaction application to enable the transaction application to access one or more of a plurality of pieces of information of the identity profile.

8. The method of claim 7, further comprising:

providing payment information to the transaction application, the payment information being one of the plurality of pieces of information included in the identity profile of the agent.

9. The method of claim 1, further comprising:

detecting a second event for a second transaction on the OBU, the second event having a second trigger associated with the agent;

identifying second network credentials of the one or more network credentials associated with the agent;

determining whether the agent needs to be authenticated for the second transaction; and

determining a second set of one or more authentication requirements associated with the agent if it is determined that the agent needs to be authenticated for the second transaction, wherein the second network credentials are not accessible to a second transaction application that corresponds to the second transaction unless the agent successfully authenticates based on the second set of one or more authentication requirements.

10. The method of claim 9, wherein the second transaction is blocked if the second transaction is not authorized.

11. The method of claim 1, further comprising:

establishing a second network connection with a second agent via the remote network;

detecting the second agent in the established second network connection;

determining a second set of one or more authentication requirements associated with the second agent;

receiving, from the second agent, updated network credentials associated with the second agent if the second agent successfully authenticates based on the second set of one or more authentication requirements; and

storing the updated network credentials in a memory element of the OBU.

12. At least one non-transitory machine readable media that includes code for execution and when executed by a processor is operable to perform operations comprising:

detecting an event for a transaction on an on-board unit (OBU) of a vehicle, the event having a trigger associated with an agent that is authenticated to the OBU, wherein the agent is one of a plurality of authenticated agents provisioned to access the OBU, wherein the agent is associated with a first set of one or more authentication requirements that enable access to the OBU by the agent when the agent is authenticated based on the first set of one or more authentication requirements, and wherein the agent is associated with one or more network credentials provisioned in the OBU to enable a network connection to be established between the OBU and a remote network;

determining whether at least one of a transaction application or any transaction type that corresponds to the transaction application is mapped to the agent in a mapping database of the OBU, wherein the transaction application corresponds to the transaction associated with the detected event, and wherein the mapping is based on a level of authorization of the agent;

determining the transaction application is authorized based on a determination that at least one of the transaction application or a transaction type that corresponds to the transaction application is mapped to the agent in the mapping database of the OBU;

identifying particular network credentials of the one or more network credentials associated with the agent; and

providing the particular network credentials to the transaction application,

wherein the network connection is established by the transaction application using the particular network credentials,

wherein at least one other agent of the plurality of authenticated agents is associated with one or more other network credentials to enable another network connection, initiated by the other agent, to be established between the OBU and the remote network.

13. The at least one non-transitory machine readable medium of claim 12, wherein an identity profile associated with the agent is provisioned in the OBU, the identity profile including information indicating the one or more network credentials.

14. The at least one non-transitory machine readable medium of claim 13, the operations further comprising:

providing application programming interfaces (APIs) to the transaction application to enable the transaction application to access one or more of a plurality of pieces of information of the identity profile.

15. The at least one non-transitory machine readable medium of claim 12, the operations further comprising:

detecting a second event for a second transaction on the OBU, the second event having a second trigger associated with the agent;

identifying second network credentials of the one or more network credentials associated with the agent;

determining whether the agent needs to be authenticated for the second transaction; and

determining a second set of one or more authentication requirements to associated with the agent if it is determined that the agent needs to be authenticated for the second transaction, wherein the second network credentials are not accessible to a second transaction application that corresponds to the second transaction unless the agent successfully authenticates based on the second set of one or more authentication requirements.

16. The at least one non-transitory machine readable medium of claim 12, the operations further comprising:

establishing a second network connection with a second agent on the remote network;

detecting the second agent in the established second network connection;

determining a second set of one or more authentication requirements associated with the second agent;

receiving, from the second agent, updated network credentials associated with the second agent if the second agent successfully authenticates based on the second set of one or more authentication requirements; and

storing the updated network credentials in a memory element of the OBU.

17. The at least one non-transitory machine readable medium of claim 12, wherein the agent includes the transaction application, the trigger being a request from the transaction application for the particular network credentials, wherein the transaction application establishes the network connection between the OBU and an authorized entity via the remote network.

18. The at least one non-transitory machine readable medium of claim 12, wherein the agent is a detector, the trigger being a signal received by the detector from a transaction system external to the vehicle.

19. The at least one non-transitory machine readable medium of claim 12, wherein the agent is a human, the trigger being a command from the human through the OBU to initiate the transaction application.

20. The at least one non-transitory machine readable medium of claim 12, wherein the agent is a mobile device connected to the OBU through a local network, the trigger being a request from the mobile device for the particular network credentials.

21. The at least one non-transitory machine readable medium of claim 14, the operations further comprising:

providing payment information to the transaction application, the payment information being one of the plurality of pieces of information included in the identity profile of the agent.

22. The at least one non-transitory machine readable medium of claim 15, wherein the second transaction is blocked if the second transaction is not authorized.

23. An apparatus, comprising:

a memory element configured to store data and a mapping database;

an authentication and secure transaction module; and

a processor operable to execute instructions associated with the data, wherein the processor, the memory element, and the authentication and secure transaction module cooperate such that the apparatus is configured for;

detecting an event for a transaction on the apparatus, the apparatus configured for operation in a vehicle as an on-board unit (OBU), the event having a trigger associated with an agent that is authenticated to the OBU, wherein the agent is one of a plurality of authenticated agents provisioned to access the OBU, wherein the agent is associated with a first set of one or more authentication requirements that enable access to the OBU by the agent when the agent is authenticated based on the first set of one or more authentication requirements, and wherein the agent is associated with one or more network credentials provisioned in the OBU to enable a network connection to be established between the OBU and a remote network;

determining whether at least one of a transaction application or any transaction type that corresponds to the transaction application is mapped to the agent in a mapping database of the OBU, wherein the transaction application corresponds to the transaction associated with the detected event, and wherein the mapping is based on a level of authorization of the agent;

determining the transaction application is authorized based on a determination that at least one of the transaction application or a transaction type that corresponds to the transaction application is mapped to the agent in the mapping database of the OBU;

identifying particular network credentials of the one or more network credentials associated with the agent; and

providing the particular network credentials to the transaction application,

wherein the network connection is established by the transaction application using the particular network credentials,

wherein at least one other agent of the plurality of authenticated agents is associated with one or more other network credentials to enable another network connection, initiated by the other agent, to be established between the OBU and the remote network.

24. The apparatus of claim 23, wherein the apparatus is further configured for:

providing application programming interfaces (APIs) to the transaction application to enable the transaction application to access one or more of a plurality of pieces of information of an identity profile provisioned in the OBU and associated with the agent.

25. The apparatus of claim 24, wherein the identity profile is downloaded to the OBU from a remote identity service provider and stored in the memory element of the apparatus in an encrypted format.

26. The apparatus of claim 23, wherein the apparatus is further configured for:

establishing a second network connection with a second agent on the remote network;

detecting the second agent in the established second network connection;

determining a second set of one or more authentication requirements associated with the second agent;

receiving, from the second agent, updated network credentials associated with the second agent if the second agent successfully authenticates based on the second set of one or more authentication requirements; and

storing the updated network credentials in the memory element of the OBU.

27. The apparatus of claim 23, wherein the agent includes the transaction application, the trigger being a request from the transaction application for the particular network credentials, wherein the transaction application establishes the network connection between the OBU and an authorized entity via the remote network.

28. The apparatus of claim 23, wherein the agent is a detector, the trigger being a signal received by the detector from a transaction system external to the vehicle.

29. The apparatus of claim 23, wherein the agent is a human, the trigger being a command from the human through the OBU to initiate the transaction application.

30. The apparatus of claim 23, wherein the agent is a mobile device connected to the OBU through a local network, the trigger being a request from the mobile device for the particular network credentials.

31. The apparatus of claim 24, wherein the apparatus is further configured for:

providing payment information to the transaction application, the payment information being one of the plurality of pieces of information included in the identity profile of the agent.

32. The apparatus of claim 23, wherein the apparatus is further configured for:

detecting a second event for a second transaction on the OBU, the second event having a second trigger associated with the agent;

identifying second network credentials of the one or more network credentials associated with the agent;

determining whether the agent needs to be authenticated for the second transaction; and

determining a second set of one or more authentication requirements to associated with the agent if it is determined that the agent needs to be authenticated for the second transaction, wherein the second network credentials are not accessible to a second transaction application that corresponds to the second transaction unless the agent successfully authenticates based on the second set of one or more authentication requirements.

33. The apparatus of claim 32, wherein the second transaction is blocked if the second transaction is not authorized.

34. The apparatus of claim 23, wherein an identity profile associated with the agent is provisioned in the OBU, the identity profile including information indicating the one or more network credentials.