Connecting mobile devices, internet-connected vehicles, and cloud services

• US 9,032,493 B2
• Filed: 03/31/2011
• Issued: 05/12/2015
• Est. Priority Date: 03/31/2011
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Lortz, Victor B., Rangarajan, Anand P., Rathi, Somya, Kesavan, Vijay Sarathi
• Primary Examiner(s): Mehedi, Morshed
• Assistant Examiner(s): LYNCH, SHARON S
• Application Number:
  US13/065,840
• Publication Number:
  US 20120254960A1
• Time in Patent Office: 1,503 Days
• Field of Search: 726/7, 340/426, 701/1, 379/212
• US Class Current: 726/7
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 Access security

Abstract

A three-way trust relationship is established between a mobile device, Internet-connected vehicle system, and a cloud-based service. Access rights are granted to the mobile device from the vehicle system, such that the mobile device can securely connect to, and obtain status information and/or control the Internet-connected vehicle system, through the cloud-based service.

Claims

1. A method performed by a mobile device, of establishing a trust relationship between the mobile device, a vehicle system, and a cloud-based service comprising:

performing an out of band exchange of data between the mobile device and the vehicle system to exchange data used to establish a first trust relationship;

determining access rights of the mobile device to the cloud-based service that supports the vehicle system by accessing a database storing information defining the role of the mobile device as guest or owner and data specific to the vehicle system; and

establishing a second trust relationship between the mobile device and cloud-based service based on data provided by the vehicle system received by the mobile device during the performing of the out of band exchange including the vehicle system sending a symmetric key and mobile device identifier to the mobile device and to the cloud-based service, wherein a pre-existing trust relationship between the vehicle system and the cloud-based service includes a digital certificate for the vehicle system and another digital certificate for the cloud-based service, wherein the digital certificates for the vehicle system is built-in during a vehicle manufacturing process.

2. The method of claim 1 wherein the digital certificate for the cloud-based service identifies the cloud-based service as trusted by the vehicle.

3. The method of claim 1 wherein the performing out of band exchange of data is performed using one or more of the following:

NFC touch, infrared, 2-D barcode, accelerometer bump, time-limited push-button configuration, and/or PIN number entry.

4. The method of claim 1 wherein the data includes an authenticated and encrypted payload.

5. The method of claim 1 wherein the accessing rights includes determining vehicle ownership status of a user.

6. The method of claim 5 wherein the determining vehicle ownership status includes using biometric information to determine if the user is an owner.

7. The method of claim 5 wherein the accessing rights is defined by the following roles:

owner or guest.

8. The method of claim 5 wherein if the determining vehicle ownership status is not determined, setting access rights to a predetermined default level.

9. The method of claim 1 wherein the accessing rights includes providing a role of the mobile device for the vehicle to the cloud-based service.

10. The method of claim 1 wherein establishing the second trust relationship between the mobile device and the cloud-based service based on the data provided by the vehicle system includes an exchange of signed certificates between the mobile device and the cloud-based service.

11. A mobile device comprising:

one or more processors;

memory configured to the one or more processors, having instructions to;

perform an initial startup to connect to a vehicle system;

perform an out of band exchange of data between the mobile device and the vehicle system including the vehicle system sending a symmetric key and mobile device identifier to the mobile device and to a cloud-based service to establish a trust relationship with the vehicle system and the mobile device;

determine access rights as to the mobile device to the cloud-based service that supports the vehicle system by accessing a database storing information defining the role of the mobile device as guest or owner and data specific to the vehicle system, wherein the vehicle system and the cloud-based service have a pre-existing trust relationship that includes digital certificates that are built-in during a vehicle manufacturing process, wherein the digital certificates include a separate digital certificate for the vehicle system and the cloud-based service; and

establish a second trust relationship between the mobile device and the cloud-based service using data that was exchanged during the out of band exchange of data.

12. The mobile device of claim 11 wherein the memory includes an application to perform the initial startup.

13. The mobile device of claim 11 wherein the memory stores secured data used to establish the trust relationship between the vehicle system and the mobile device and the second trust relationship between the mobile device and the cloud-based service.

14. The mobile device of claim 11 wherein the access rights are determined from biometric information obtained by the vehicle system as to ownership of the vehicle system.

15. The mobile device of claim 11 further comprising a first wireless interface local connection configured to the one or more processors and memory to perform the out of band exchange of data, and a second wireless interface to exchange other data with the vehicle system.

16. The mobile device of claim 11 further comprising a cellular wireless interface to connect the mobile device with the cloud-based system.

17. One or more non-transitory computer-readable media having stored thereon computer executable instructions that, when executed, perform a method comprising:

starting an initial exchange with a vehicle system;

performing an out of band exchange of data between a mobile device and the vehicle system including the vehicle system sending a symmetric key and mobile device identifier to the mobile device and to a cloud-based service in order to establish a trust relationship between the mobile device and the vehicle system;

receiving access rights at the mobile device to the cloud-based service that controls the vehicle system upon accessing, at the cloud-based service, a database storing information defining the role of the mobile device as guest or owner and data specific to the vehicle system, wherein a pre-existing trust relationship between the vehicle system and the cloud-based service includes a digital certificate for the vehicle system and another digital certificate for the cloud-based service, wherein the digital certificates for the vehicle system is built-in during a vehicle manufacturing process;

and establishing a second trust relationship with the mobile device and the cloud-based service based on data received during the out of band exchange of data.

18. The computer-readable media of claim 17 wherein the performing the out of band exchange comprises part of a local pairing of the mobile device and the vehicle system.

19. The computer-readable media of claim 17 further comprising sending and receiving certificates used to establish the trust relationship between the vehicle system and the mobile device and the second trust relationship between the mobile device and the cloud-based service.

20. The computer-readable media of claim 17 further comprising sending and receiving a symmetric key used to establish the trust relationship between the vehicle system and the mobile device and the second trust relationship between the mobile device and the cloud-based service.

21. The computer-readable media of claim 17 further comprising providing a role of the mobile device to the cloud-based service.