Multimodal vehicle approach safety

Abstract

A computing device may be programmed to authorize a user device to control a vehicle upon determining that the location of the vehicle is within a set of boundaries associated with a wireless network and the user device is authenticated to the wireless network. The computing device may also be programmed to authorize the user device to control the vehicle upon determining that the vehicle is not within the boundaries based on transmitting authentication credentials to a server and receiving an authorization certificate.

Description

Technical Field

[0001] The present invention relates to a system and method for implementing multi-mode vehicle approach safety through computer programming. Background Art

[0002] The vehicle may be equipped to operate in an autonomous driving mode and an occupant driving mode. The vehicle may be equipped with computing devices, networks, sensors, and controllers to obtain information about the vehicle environment and drive the vehicle based on the information. Safe and comfortable vehicle driving may depend on obtaining accurate and timely information about the vehicle environment. Computing devices, networks, sensors, and controllers may be equipped to analyze their performance, detect when information is not obtained in an accurate and timely manner, and take corrective measures including notifying the occupants of the vehicle, giving up autonomous control, or parking the vehicle. The computing device may also determine whether the occupant is authorized to use or drive the vehicle by obtaining authentication information. Summary of the invention

[0003] According to the present invention, there is provided a computer programmed to:

[0004] upon determining that the location of the vehicle is within a set of boundaries associated with the wireless network and the user device is authenticated to the wireless network, authorizing the user device to control the vehicle; and

[0005] Upon determining that the location of the vehicle is outside of a set of boundaries, the user device is authorized to control the vehicle based on requesting and receiving the authorization certificate.

[0006] According to one embodiment of the invention, the wireless network is a Wi-Fi network operable to communicate within a second set of boundaries including the set of boundaries.

[0007] According to one embodiment of the present invention, the position of the vehicle is determined by latitude, longitude and altitude.

[0008] According to one embodiment of the invention, the computer is further programmed to compare the location of the vehicle to geo-fence boundaries defined by a set of boundaries to determine whether the location of the vehicle is within the set of boundaries.

[0009] According to one embodiment of the invention, the user device is authorized to control the vehicle for at most a predetermined time period.

[0010] According to one embodiment of the present invention, the computer is further programmed to, upon determining that the location of the vehicle is not within a set of boundaries, deauthorize the user device to control the vehicle.

[0011] According to one embodiment of the present invention, the authorization certificate is received from and transmitted to the server via a wide area network operable to communicate outside a set of boundaries.

[0012] According to one embodiment of the present invention, the wide area network is a cellular network, a satellite network or a mesh network.

[0013] According to one embodiment of the present invention, the authentication credentials include a user identification and a password.

[0014] According to one embodiment of the invention, controlling the vehicle includes actuating one or more vehicle components including a steering device, a powertrain system, and a braking device.

[0015] According to the present invention, there is provided an apparatus comprising a service controller for a vehicle, programmed to:

[0016] upon determining that the location of the vehicle is within a set of boundaries associated with the first wireless network, transmitting the first authentication credential to the first authentication server via the first wireless network;

[0017] Upon determining that the location of the vehicle is outside of the set of boundaries, transmitting second authentication credentials to a second authentication server via a second wireless network; and

[0018] Upon receiving authentication from one of the first and second authentication servers, actuation of one or more vehicle components is permitted.

[0019] According to one embodiment of the present invention, the first authentication credential includes a user identification and a password.

[0020] According to one embodiment of the invention, the device is further programmed to allow actuation of one or more vehicle components including steering, drivetrain and braking.

[0021] According to one embodiment of the invention, the device is further programmed to allow actuation of one or more vehicle components by the service controller upon receipt of authentication from the second authentication server.

[0022] According to one embodiment of the invention, the position of the vehicle is received from a computer in the vehicle.

[0023] According to one embodiment of the invention, the device is further programmed to allow actuation of one or more vehicle components for up to a predetermined time period upon receipt of authentication from the second authentication server.

[0024] According to the present invention, there is provided a system, comprising:

[0025] a user device programmed to control the vehicle;

[0026] a first computer programmed to authorize the user device to control the vehicle via the first network upon determining that the vehicle's location is within a set of boundaries; and

[0027] A server is programmed to authorize the user device to control the vehicle via the second network upon determining that the vehicle location is not within a set of boundaries.

[0028] According to one embodiment of the invention, the first network is a Wi-Fi network operable to communicate with the vehicle within a set of boundaries.

[0029] According to one embodiment of the present invention, the second network is a wide area network operable to communicate outside a set of boundaries.

[0030] According to one embodiment of the invention, controlling the vehicle includes actuating one or more vehicle components including a steering device, a powertrain system, and a braking device. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 is a block diagram of an exemplary vehicle;

[0032] Figure 2 is a diagram of an exemplary service controller;

[0033] Figure 3 is a diagram of an exemplary service controller in communication with a computing device in a vehicle via a wide area network;

[0034] Figure 4 is a diagram of an exemplary vehicle in a set of boundary positions;

[0035] Figure 5 is a diagram of an exemplary service controller communicating with a computing device in a vehicle via a local area network;

[0036] Figure 6 is a flow chart of an exemplary process of an authorization service controller;

[0037] Figure 7 is a flow chart of an exemplary process for an authorization service controller. DETAILED DESCRIPTION

[0038] A method is disclosed herein, including, when it is determined that the location of the vehicle is within a set of boundaries associated with a wireless network and the user device is authenticated to the wireless network, authorizing a user device to control the vehicle, and when it is determined that the location of the vehicle is outside the set of boundaries, authorizing the user device to control the vehicle based on requesting and receiving an authorization certificate. The wireless network can be a Wi-Fi (Wireless Fidelity) network operable to communicate within a second set of boundaries including the set of boundaries. The location of the vehicle is determined by latitude, longitude, and altitude. The location of the vehicle can be compared to a geo-fence boundary defined by a set of boundaries to determine whether the location of the vehicle is within the set of boundaries. The user device can be authorized to control the vehicle for up to a predetermined time period, wherein the time period can be between half an hour and 8 hours.

[0039] Upon determining that the location of the vehicle is not within a set of boundaries, the user device may be deauthorized to control the vehicle. The user device may control the vehicle based on requesting and receiving an authorization credential prior to deauthorizing the user device, wherein the authorization credential is received from and transmitted to a server via a wide area network operable to communicate outside the set of boundaries, wherein the wide area network is a cellular network, a satellite network, or a mesh network and wherein the authentication credential includes a user identification and a password. Controlling the vehicle includes actuating one or more vehicle components including a steering device, a powertrain, and a brake device. The authentication credential may be compared to an authentication credential received by a service controller, wherein the authentication credential is encrypted.

[0040] A computer-readable medium storing program instructions for performing some or all of the above method steps is also disclosed. A computer programmed to perform some or all of the above method steps is also disclosed, the computer including a computer device programmed to authorize a user device to control the vehicle when it is determined that the location of the vehicle is within a set of boundaries associated with a wireless network and the user device is authenticated to the wireless network, and to authorize the user device to control the vehicle based on requesting and receiving an authorization certificate when it is determined that the location of the vehicle is outside a set of boundaries. The wireless network can be a Wi-Fi network operable to communicate within a second set of boundaries including a set of boundaries. The location of the vehicle is determined by latitude, longitude, and altitude. The computer can also be programmed to compare the location of the vehicle with a geo-fence boundary defined by a set of boundaries to determine whether the location of the vehicle is within a set of boundaries. The user device can be authorized to control the vehicle for up to a predetermined time period, wherein the time period can be between half an hour and 8 hours.

[0041] The computer may also be programmed to, upon determining that the location of the vehicle is not within a set of boundaries, deauthorize the user device to control the vehicle. The computer may also be programmed to authorize the user device to control the vehicle based on requesting and receiving an authorization certificate before deauthorizing the user device, wherein the authorization certificate is received from a server via a wide area network and transmitted to the server, the wide area network being operable to communicate outside a set of boundaries, wherein the wide area network is a cellular network, a satellite network, or a mesh network and wherein the authentication credential includes a user identification and a password. Controlling the vehicle includes actuating one or more vehicle components including a steering device, a powertrain, and a brake device. The authentication credential may be compared with an authentication credential received by a service controller, wherein the authentication credential is encrypted.

[0042] The vehicle may be equipped to operate in both autonomous and occupant-driven modes. By semi-autonomous or fully autonomous mode, we mean an operating mode in which the vehicle may be driven by a computing device that is part of a vehicle information system having sensors and controllers. The vehicle may be occupied or unoccupied, but in either case the vehicle may be driven without assistance from an occupant. For purposes of this invention, autonomous mode is defined as a mode in which each of vehicle propulsion (e.g., via a powertrain including an internal combustion engine and / or an electric motor), braking, and steering is controlled by one or more vehicle computers; in semi-autonomous mode, the vehicle computer controls one or both of vehicle propulsion, braking, and steering.

[0043] Figure 1 1 is a diagram of a vehicle information system 100 according to a disclosed embodiment that includes a vehicle 110 that can operate in both autonomous (in this disclosure, "autonomous" itself means "fully autonomous") and occupant-driven (also referred to as non-autonomous) modes. The vehicle 110 also includes one or more computing devices 115 for performing calculations for driving the vehicle 110 during autonomous operation. The computing devices 115 can receive information about the vehicle's operation from sensors 116.

[0044] The computing device 115 includes a processor and memory such as are known. Moreover, the memory includes one or more forms of computer-readable media and stores instructions executable by the processor for performing various operations including those disclosed herein. For example, the computing device 115 may include programming to perform the following operations: operate one or more of vehicle braking, propulsion (e.g., controlling acceleration in the vehicle 110 by controlling one or more of an internal combustion engine, an electric motor, a hybrid engine, etc.), steering, climate control, interior and / or exterior lighting, etc., and determine whether and when the computing device 115, rather than a human operator, controls such operations.

[0045] The computing device 115 may include or be communicatively coupled to (e.g., via a vehicle communication bus as further described below) more than one computing device (e.g., controllers included in the vehicle 110, etc.) to monitor and / or control various vehicle components (e.g., powertrain controller 112, brake controller 113, steering controller 114, etc.). The computing device 115 is typically arranged to communicate over a vehicle communication network (e.g., a bus in the vehicle 110, such as a controller area network (CAN), etc.); the vehicle 110 network may include, for example, known wired or wireless communication mechanisms (e.g., Ethernet or other communication protocols).

[0046] The computing device 115 may transmit messages to various devices in the vehicle and / or receive messages from various devices (e.g., controllers, actuators, sensors, etc.) including the sensor 116 via the vehicle network. Alternatively or additionally, in the case where the computing device 115 actually includes multiple devices, the vehicle communication network may be used for communication between the devices represented as the computing device 115 in the present invention. Moreover, as described below, various controllers or sensing elements may provide data to the computing device 115 via the vehicle communication network.

[0047] In addition, the computing device 115 can be configured to communicate with a remote server computer 120 (e.g., a cloud server) via a network 130 through a vehicle-to-infrastructure (V to I) interface 111, which can use various wired and / or wireless network technologies as described below, such as cellular, Bluetooth, and wired and / or wireless packet networks. The computing device 115 can be configured to communicate with other vehicles 110 through a V to I interface 111 using a vehicle-to-vehicle (V to V) network formed on an ad hoc basis between nearby vehicles 110 or formed through an infrastructure-based network. The computing device 115 also includes a non-volatile memory such as known. The computing device 115 can record information by storing the information in a non-volatile memory so that it can be retrieved and transmitted to a server computer 120 or a user mobile device 160 later via a vehicle communication network and a vehicle-to-infrastructure (V to I) interface 111.

[0048] As already mentioned, typically included in the instructions stored in the memory and executed by the processor of the computing device 115 is programming for operating one or more vehicle 110 components (e.g., braking, steering, propulsion, etc.) without operator intervention. Using data received in the computing device 115 (e.g., sensor data from sensors 116, server computer 120, etc.), the computing device 115 can make various decisions and / or control various vehicle 110 components and / or operations without the driver operating the vehicle 110. For example, the computing device 115 may include programming to adjust the operating behavior of the vehicle 110 (such as speed, acceleration, deceleration, steering, etc.) and tactical behaviors such as the distance between vehicles and / or the amount of time between vehicles, lane changes, minimum gaps between vehicles, left turn path minimums, time to reach a specific location, and intersection (without signal) minimum time to arrive to cross the intersection.

[0049] As the term is used herein, a controller includes a computing device that is generally programmed to control a particular vehicle subsystem. Examples include a powertrain controller 112, a brake controller 113, and a steering controller 114. The controller may be an electronic control unit (ECU), such as is known, which may include additional programming as described herein. The controller may be communicatively connected to a computing device 115 and receive instructions from the computing device 115 to actuate the subsystems in accordance with the instructions. For example, a brake controller 113 may receive instructions from the computing device 115 to operate the brakes of the vehicle 110.

[0050] One or more controllers 112, 113, 114 for the vehicle 110 may include a known electronic control unit (ECU) or the like, and as a non-limiting example, the ECU includes one or more powertrain controllers 112, one or more brake controllers 113, and one or more steering controllers 114. Each of the controllers 112, 113, 114 may include a corresponding processor and memory and one or more actuators. The controllers 112, 113, 114 may be programmed and connected to a vehicle 110 communication bus (such as a controller area network (CAN) bus or a local interconnect network (LIN) bus) to receive instructions from a computing device 115 and control the actuators based on the instructions.

[0051] Sensors 116 may include various devices known to provide data via a vehicle communication bus. For example, a radar fixed to a front bumper (not shown) of vehicle 110 may provide the distance from vehicle 110 to the next vehicle in front of vehicle 110, or a global positioning system (GPS) sensor disposed in vehicle 110 may provide the geographic coordinates of vehicle 110. The distances provided by radar and / or other sensors 116 and / or the geographic coordinates provided by a GPS sensor may be used by computing device 115 to operate vehicle 110 autonomously or semi-autonomously.

[0052] The vehicle 110 is typically a land-based autonomous vehicle 110 having three or more wheels, such as a passenger car, a light truck, etc. The vehicle 110 includes one or more sensors 116 , a V to I interface 111 , a computing device 115 , and one or more controllers 112 , 113 , 114 .

[0053] The sensors 116 may be programmed to collect data related to the vehicle 110 and the environment in which the vehicle 110 is operating. As non-limiting examples, the sensors 116 may include, for example, altimeters, cameras, lidars, radars, ultrasonic sensors, infrared sensors, pressure sensors, accelerometers, gyroscopes, temperature sensors, pressure sensors, Hall sensors, optical sensors, voltage sensors, current sensors, mechanical sensors such as switches, etc. The sensors 116 may be used to sense the environment in which the vehicle 110 is operating, such as weather conditions, road grade, road location, or locations adjacent to the vehicle 110. The sensors 116 may also be used to collect data including dynamic vehicle 110 data related to the operation of the vehicle 110, such as speed, yaw rate, steering angle, engine speed, brake pressure, oil pressure, power levels applied to controllers 112, 113, 114 in the vehicle 110, connectivity between components, and electrical and logical health of the vehicle 110.

[0054] The vehicle 110 capable of autonomous operation may have conventional controls for operation by a human, such as a steering wheel, brake pedal, accelerator pedal, and on / off key switch, buttons, etc. In other cases, the vehicle 110 capable of autonomous operation may be configured without conventional controls because, in these cases, occupant control of the vehicle 110 is not desired or permitted. The vehicle 110 may be programmed to travel a fixed route like a shuttle bus, or to receive a destination from a third party (e.g., an occupant) and proceed to the destination, for example, without further input from the occupant. No control input from the occupant is required, and conventional controls may therefore represent an unnecessary expense and an opportunity for undesirable occupant control of the vehicle 110. For example, a vehicle 110 without conventional controls may represent a deterrent to theft of the vehicle 110.

[0055] In a vehicle 110 without conventional controls, it is advantageous to allow a user to control the vehicle 110 by actuating a steering device, a powertrain, and a brake device by inputting instructions to move the vehicle 110 via a service controller. For example, a vehicle 110 may be typically grouped with other vehicles 110 for a period of time during which it may be advantageous to move one or more of the vehicles 110. Examples include parked vehicles 110, service vehicles 110, and transport vehicles 110. Parking a vehicle 110 may include moving the vehicle 110 from a current location to a parked location and moving the vehicle from a parked location to a current location. For example, the parked location may be in a parking lot or parking structure. The current location may be outside of a parking lot or parking structure or inside a parking lot or parking structure.

[0056] For example, servicing a vehicle 110 may include, for example, performing refueling, charging, diagnosing, testing, repairing, upgrading, and cleaning of the vehicle 110. Servicing a vehicle 110 may include moving the vehicle 110 from a parked location to one or more service locations, servicing the vehicle 110 at each service location, and then moving the vehicle 110 back to the parked location. A transport vehicle 110 may include moving a vehicle from a parked location to a transport vehicle 110, being operable to transport the vehicle 110, and moving the vehicle 110 from the transport vehicle 110 to a parked location. Examples include vehicle transport trucks / trailers and tractors.

[0057] Directing the vehicle 110 to autonomously complete these parking, servicing, and transportation moves may require accurate, timely, and detailed location and information about the location of the vehicle 110, the parking location, the service location, and the transportation location to plot a path for safely moving the vehicle 110 between the locations. Since multiple moving vehicles 110 may be involved, the path information may change at any time, including due to the presence of other vehicles. Moving the vehicle 110 for parking, servicing, or transportation may be advantageously accomplished by equipping the user with a service controller to control the steering, powertrain, and brakes of the vehicle 110 to allow the user to select a path.

[0058] Figure 2 2 is a diagram of a service controller 200. The service controller 200 may be configured to communicate with the service controller 200 via a communication interface such as that described above. Figure 1 Bluetooth in question TM The service controller 200 may be a handheld computing device that directly communicates with the vehicle 110 (e.g., with the computer 115) via a short-range network. The service controller 200 may communicate with the vehicle 110 via the short-range network to transmit instructions about the vehicle 110 steering device, powertrain, and brake device, and receive information about the status and operation of the vehicle 110. The service controller 200 may thus allow the user to drive the vehicle 110 as if the vehicle 110 were equipped with conventional controls. In addition to the autonomous driving mode of the vehicle 110, the service controller 200 may also allow the user to actuate the vehicle 110 steering device, powertrain, and brake device.

[0059] The exemplary service controller 200 may be configured with a touch screen display 202 that may display icons 212 representing conventional controls, such as an accelerator pedal icon 204, a brake pedal icon 206, an on / off switch icon 208, and a steering wheel icon 210. The manipulation icons 212 may simulate the operation of conventional controls by receiving input via the touch screen display 202 and transmitting data representing the input to a computing device 115 in the vehicle 110. The service controller 200 may update the touch screen display 202 to provide visual feedback to the user. For example, touching the steering wheel icon 210 may cause the service controller 200 to transmit steering data to the computing device 115 via a short-range network that may instruct the steering controller 114 to move the wheels of the vehicle 110 in proportion to the input from the touch screen display 202. The steering wheel icon 210 may then be updated to display, for example, the direction of the wheels of the vehicle 110. In other examples, the service controller 200 may be configured with physical devices representing conventional vehicle controls, such as buttons, switches, rotary potentiometers, and joysticks, in addition to or in lieu of icons 212, for example, on the touch screen display 202. In other examples, the service controller 200 may be built into a display or control included in the vehicle 110 and executed, for example, on a computing device 115 operating in a service mode.

[0060] Figure 3 314 is a diagram of a service controller 200 and a computing device 115 in a vehicle 110 both communicating with an authentication server 312 via a wide area network (WAN) 314. Since the service controller 200 may control the vehicle 110, the service controller 200 may be configured to require authentication in a manner similar to the authentication required for occupants transported by the vehicle 110 to provide security and accountability. Without the authentication server 312 over the wide area network 314 to implement a security system, the service controller 200 could be used, for example, to illegally move a vehicle. The service controller 200 and the computing device 115 in the vehicle 110 may communicate with the server 312 via the wide area network 314 to confirm authorization for the service controller 200 to control the vehicle 110. The service controller 200 may first communicate with the server 312 as described above with respect to Figure 2 The short-range network in question establishes a short-range network connection 318 with the computing device 115 in the vehicle 110 . The short-range network connection 318 allows the service controller 200 to transmit safety and control information to the computing device 115 and to receive status and operating information from the computing device 115 .

[0061] In order to control the vehicle 110, the service controller 200 may first input user authentication data 302 from the user. The user authentication data 302 may include, for example, a user identification (user ID) and password, an electronic identifier like a key card, or a biometric identifier like a retinal scan or facial or fingerprint recognition. The service controller 200 may transmit a request for credentials 304 to an authentication server 312 via a WAN 314 along with the service controller authentication data 306. The request for credentials 304 may identify the service controller 200 as the authentication server 312, for example, to establish responsibility. The WAN 314 may be based on a network with a large coverage area (such as a cellular network, a satellite network, or a mesh network). The WAN 314 is defined as a network that covers a dispersed geographic area (i.e., by definition, a larger geographic area than the area covered by WiFi or other local networks, for example, more than 500 feet (or possibly more using repeaters)) and covers more than a single possible user location (e.g., a single place (premises) such as a vehicle storage facility). WAN 314 may require large-area network coverage because authentication requests can come from anywhere that vehicle 110 can reasonably be expected to operate. Cellular telephone networks can be used to provide WAN 314 and can operate anywhere that cellular networks operate (such as cellular phones). Satellite networks operate almost worldwide, but may require additional transmission and receiving equipment including antennas that are operable to communicate with satellites. A mesh network is a network in which individual network computing devices are configured as nodes that store and forward network messages, forming peer-to-peer network connections that can be aggregated to operate as a larger network. Mesh networks can operate in areas without cellular service and do not require additional antennas such as satellite networks because they can be implemented using ground networks such as Wi-Fi, for example. Mesh networks can use fixed locations or movable locations, such as vehicles 110, aerial drones, or balloons.

[0062] The request for credentials 304 may include data identifying the service controller 200 as the authentication server 312 to allow the authentication server 312 to correctly identify the service controller 200. This may prevent an unauthorized (e.g., stolen) service controller from being used, for example, to control the vehicle 110. The service controller 200 may also transmit service controller authentication data 306 including an entered user ID and password to the authentication server 312. The authentication server 312 may receive the request for credentials 304 and service controller authentication data 306 and determine that a valid user entered valid authentication data 302 into a known service controller 200 and return the authorization certificate 310 to the service controller 200 via the WAN 314.

[0063] The authorization certificate 310 is digital data that can be transmitted between computing devices such as the authentication server 312 and the computing device 115 and the service controller 200 via a network such as the WAN 314 for purposes including transmitting secure information. The authorization certificate may include, for example, encryption to allow the receiving computing device to securely verify the identity of the sender and determine that the authorization certificate is valid. Receiving a valid authorization certificate from a verified sender allows the computing device 115 and the service controller 200 to determine that they are properly authorized to control the vehicle 110 by the service controller 200 through the valid authentication server 312. The authentication server 312 may also transmit the authentication certificate 316 to the computing device 115 in the vehicle 110 to allow the computing device 115 to confirm that the service controller 200 is properly authorized and that the vehicle 110 can be controlled via the short-range network 318 by comparing the authorization certificates 310, 316 and achieving a match. In other examples, the short-range network 318 may be replaced with an electronic cable, thereby requiring a physical connection between the service controller 200 and the vehicle 110. In other examples, the service controller 200 may be included in the vehicle 110.

[0064] An example of a service controller 200 for controlling a vehicle 110 in this manner may be a situation where the vehicle 110 encounters a problem while operating. For example, if the computing device 115 finds that the sensor 116 is operating to report a correct result with a probability of less than 99.99%, the computing device 115 may direct the vehicle 110 to park at the nearest safe location and report the problem via the WAN 314 to alert the server 312 where assistance is needed. A service vehicle 110 including a tractor may be dispatched to the location, for example, along with the service controller. At the location, a user may apply for and receive an authentication certificate 310 for the service controller 200 and the computing device 115 in the vehicle 110 to allow the user to drive the vehicle 110 to a service or parking location or to a tractor for transportation. Since this can occur anywhere that the vehicle 110 can operate, a WAN 314 is needed to handle the communication. As described above, the service requires strong security. This may provide sufficiently strong security, but it may also mean a lot of waiting time for authorization because a large number of security routines are performed on a large database.

[0065] Figure 44 is a diagram of a geo-fenced vehicle yard 400. Geofencing is a technique for establishing boundaries based on geographic location. In geo-fencing, boundary locations 406, 408, 410, 412 are defined based on geographic location (e.g., latitude and longitude coordinates). A list of boundary locations 406, 408, 410, 412 can be connected to form a geo-fence boundary 414, which defines an inner area 416 and an outer area 418. The geo-fenced vehicle yard 400 can include a Wi-Fi interface 402, which can be an interface to a local area network (LAN). The Wi-Fi interface 402 can provide communication between a yard server computing device and a computing device 115 in a vehicle 110 having a Wi-Fi interface 420. The Wi-Fi interface 402 can form a local area network such as a Wi-Fi network 404, within which the Wi-Fi interface 402 is operable to communicate with the computing device 115 in the vehicle 110 via the Wi-Fi interface 420. The Wi-Fi network 404 may include boundary locations 406, 408, 410, 412, and therefore a geo-fence boundary 414. By transmitting the boundary locations 406, 408, 410, 412 to the computing device 115 in the vehicle 110, the computing device 115 may determine whether the vehicle 110 is located in an inner area 416 or an outer area 418 of the geo-fence boundary 414. The network 404 is described herein as a WiFi network but generally refers to a local area network, i.e., a network with a limited geographic range, e.g., a radius that does not exceed the transmission range of a wireless router (possibly with a repeater), e.g., 500 feet, a designated place, etc.

[0066] Figure 5 4 is a diagram of a service controller 200, a computing device 115 in a vehicle 110, both communicating with a service server 510 via a Wi-Fi network 404. In this example, the vehicle 110 is within an interior area 416 of a geo-fence boundary 414. Figure 4As discussed, the computing device 115 may determine that the vehicle 110 is within the interior area 416 and therefore within the geo-fence boundary 414. Once the service controller 200 receives information that the vehicle 110 is within the geo-fence boundary 414 via the short-range network 318, for example, the user may be permitted to enter a user ID and password 502 into the service controller 200 to be transmitted as user authentication data 504 to the service server 510 via the Wi-Fi network 404. Once authenticated by the service server 510, the service server 510 may transmit a Wi-Fi verification 508. The service controller 510 may also transmit a Wi-Fi verification 512 to the computing device 115 in the vehicle 110. Once the computing devices 115 each receive matching Wi-Fi verifications 508, 512, the service controller 200 may receive permission to transmit vehicle control data to the computing device 115 and receive status and operational data, thereby allowing the service controller 200 to control the vehicle 110.

[0067] Receiving Wi-Fi authorization 508, 512 via the Wi-Fi network 404 may occur more quickly and represent, for example, Figure 3 The discussed lower security level of receiving authentication credentials 310, 316 via the WAN. By "security level", the present invention means the level of assurance provided by the security mechanism, and a lower security level is equivalent to less assurance, i.e., a higher level of concern about the possibility of security breaches. The lower security level is acceptable because the Wi-Fi authorization 508, 512 relies on being inside the geo-fence boundary 414. In some examples, the Wi-Fi authorization 508, 512 can be granted to the service controller 200 and the vehicle 110 for a predetermined time period, which means that the service controller 200 can remove from the vehicle 110, receive the Wi-Fi authorization 508 to control the second vehicle 110, and return to control the first vehicle 110, without retransmitting the user authentication data 504 and receiving the Wi-Fi authorization 508, 512 as long as the time period has not expired. The predetermined time period can range from about half an hour to a full workday (8 hours), for example. This can allow a user to effectively control multiple vehicles inside the geo-fence boundary 414 using a single service controller 200.

[0068] In an example where the vehicle 110 is controlled by the service controller 200 based on the Wi-Fi authorization 508, 512 and the vehicle travels from the inner area 416 of the geo-fence boundary 414 to the outer area 418 of the geo-fence boundary 414, the computing device 115 may require that the Wi-Fi authorization 508, 512 be replaced by the authorization certificate 310, 316 received from the authentication server 312 via the WAN 314. In this example, the computing device 115 may detect that the vehicle 110 has exited the geo-fence boundary 414 and automatically release the Wi-Fi authorization 508, 512, thereby preventing the controller 220 from controlling the vehicle 110. In this case, the computing device 115 may direct the vehicle 110 to park safely at the earliest opportunity. To transition from Wi-Fi authorization 508, 516 to authorization based on authorization certificates 310, 316 when the vehicle 110 travels from inside the geo-fence boundary 414 to outside the geo-fence boundary, the computing device 115 may send a message to the service controller 200 to instruct the service controller 200 to transmit a request for credentials 304 and service controller authentication data 306 to the authentication server 312 via the WAN 314. By requesting WAN 314-based authorization before the service server 510 automatically releases the Wi-Fi authorization, the service controller 200 may continue to control the vehicle 110 with minimal interruption while maintaining uninterrupted security when driving from inside the geo-fence boundary 414 to outside the geo-fence boundary 414.

[0069] Figure 6 is a process 600 for authorizing the service controller 200 to control the vehicle 110 Figure 1-5 Flowchart of description. Process 600 may be implemented, for example, by a processor of computing device 115, obtaining input information from sensor 116 and executing instructions and sending control signals via controllers 112, 113, 114. Process 600 includes multiple steps taken in the order disclosed. Process 600 also includes implementations that include fewer steps, or may include steps taken in a different order.

[0070] Process 600 begins at step 602, where computing device 115 in vehicle 110 may determine whether the location of vehicle 110 is within the range described above with respect to FIG. Figure 4 and Figure 5within the geo-fence boundary in question. The vehicle 110 may use sensors 116 (including GPS and V to I interface 111, including, for example, cell-based geolocation) to determine the location of the vehicle 110. The location of the vehicle 110 may be expressed as latitude, longitude, and altitude, where latitude and longitude specify the geographic coordinates of the location of a point on the earth in degrees, minutes, and seconds, and altitude specifies the altitude of the point in meters relative to a predetermined circumference of the earth at that point. By specifying values ​​for latitude, longitude, and altitude, the location of the point may be uniquely determined relative to the earth. The computing device 115 in the vehicle 110 may access GPS data and 3D accelerometer data via sensors 116, for example, coupled with mapping data from the V to I interface 111, to determine the latitude, longitude, and altitude relative to the geo-fence boundary 414. Once the computing device 115 determines the latitude, longitude, and altitude, these values ​​may be compared to the boundary locations 406, 408, 410, 412 associated with the geofence boundary 414 to determine whether the vehicle 110 is within the geofence boundary 414, for example, as is known through 3D geometry techniques.

[0071] When the vehicle 110 is within the boundary location 406, 408, 410, 412, the process 600 branches to step 604, where the computing device 115 can notify the service controller 200 that the vehicle 110 is within the boundary location 406, 408, 410, 412. The service controller 200 can transmit the authentication data 504 to the service server 510 via the Wi-Fi network 404 with network coverage, which is operable to communicate with the service controller 200 and the vehicle 110 when the service controller 200 and the vehicle 110 are within the geo-fence boundary 414 formed by the boundary location 406, 408, 410, 412. At step 606, the service controller 200 can receive the Wi-Fi authorization 508 from the service server 510 via the Wi-Fi network 404. The service server 510 can also transmit the Wi-Fi authorization 512 to the computing device 115.

[0072] At step 608, the service controller 200 may compare the received Wi-Fi authorization 508 with the Wi-Fi authorization 512 received by the computing device 115 to determine whether the service controller 200 is authorized for the vehicle 110, for example, by communicating with the computing device 115 via short-range communication 318. The computing device 115 may compare the received Wi-Fi authorization 512 with the Wi-Fi authorization 508 received by the service controller 200 to determine the proper authorization. At step 610, if the Wi-Fi authorizations match, the process 600 branches to step 612, where the service controller 200 is allowed to control the vehicle 110. At step 610, if the Wi-Fi authorizations do not match, the service controller 200 is not allowed to control the vehicle 110 and the process 600 ends.

[0073] Returning to step 602, if the service controller 200 determines that the vehicle 110 is not within the geo-fence boundary 414, the service controller 200 may request an authorization credential from the authentication server 312 via the WAN 314. This represents an additional level of security over and above the security represented by steps 604, 606, 608, and 610, since the service controller 200 has already determined that the vehicle 110 is not within the geo-fence boundary 414. This level of security to securely identify the service controller 200 and the vehicle 110 is not required when the vehicle 110 is known to be within the geo-fence boundary 414.

[0074] After step 614, at step 616, the service controller 200 may transmit the user ID and password to the authentication server 312 via the WAN 314 to, for example, identify the user. Assuming that the authentication server 312 determines that the service controller 200, the vehicle 110, and the user are known to the authentication server 312 and that the service controller 200 determines that it is appropriate for the user to control the vehicle 110, then at step 618, the service controller may receive the authorization certificate 310 from the authentication server 312 via the WAN 314. At step 620, the service controller 200 may compare the authorization certificate 310 with the authorization certificate 316 received by the computing device 115 in the vehicle 110. The authorization certificates 310, 316 may also be compared by the computing device 115. At step 622, if the authorization certificates 310, 316 match, then the process 600 branches to step 623, where the authentication server 312 is authenticated as described above with respect to the authentication server 312. Figure 2 The service controller 200 in question may control the vehicle 110. At step 622, if the authorization credentials 310, 316 do not match, the service controller 200 is not allowed to control the vehicle 110 and the process 600 ends.

[0075] Figure 7 is a process 700 for authorizing the service controller 200 to control the vehicle 110 Figure 1-6The process 700 may be implemented, for example, by a processor of the computing device 115, obtaining input information from the sensor 116, and executing instructions and sending control signals via the controllers 112, 113, 114. The process 700 includes a plurality of steps taken in the order disclosed. The process 700 also includes implementations that include fewer steps, or may include steps taken in a different order.

[0076] Process 700 begins at step 702, where service controller 200 may determine whether vehicle 110 is within boundary locations 406, 408, 410, 412, and therefore within the boundaries described above. Figure 4-6 414. When the service controller 200 determines that the vehicle 110 is within the geo-fence boundary 414, the process 700 branches to step 704, where the service controller 200 can be authorized by the service server 510 via the Wi-Fi network 404 according to steps 604, 606, 608, and 610 of the process 600. If the service controller is authorized at step 704, the process 700 branches to step 706, where the service controller 200 is authorized to control the vehicle 110. At step 704, when the service controller fails to be authorized by the service server 510 via the Wi-Fi network 404, the process 700 ends. After step 706, when the service controller 200 is controlling the vehicle 110, at step 708, the service controller rechecks the location of the vehicle 110 to determine whether the vehicle 110 remains within the geo-fence boundary 414. This is because the vehicle 110 is being driven by the user having the service controller 200 and can therefore be driven to travel outside the geo-fence boundary 414.

[0077] At step 708, when the service controller determines that the vehicle 110 is within the geofence boundary 414, the process 700 returns to step 706, where the service controller 200 may continue to control the vehicle 110. At step 708, when the service controller determines that the vehicle 110 is no longer within the geofence boundary 414, the process 700 proceeds to step 710, where the service controller 200 releases the Wi-Fi authorization and the service controller 200 is no longer allowed to control the vehicle 110. After step 710, at step 712, the service controller 200 may obtain authorization to control the vehicle 110 by receiving the authorization certificate 310 from the authentication server 312 via the WAN 314 and comparing the authorization certificate 310 to the authorization certificate 316 received by the computing device 115 in the vehicle 110 as described with respect to steps 614, 616, 618, 620, and 622 of process 600. If the service controller 200 receives authorization at step 712, then at step 714, the service controller 200 may, as described with respect to steps 614, 616, 618, 620, and 622 of process 600, obtain authorization to control the vehicle 110. Figure 2Controlling vehicle 110 as described. If service controller 200 does not receive authorization to control vehicle 110 at step 712, process 700 ends.

[0078] Computing devices such as those discussed herein typically each include instructions executable by one or more computing devices such as those identified above, as well as blocks or steps for performing the processes described above.For example, the process blocks discussed above may be embodied as computer-executable instructions.

[0079] Computer executable instructions may be compiled or interpreted from a computer program created using a variety of programming languages ​​and / or techniques including, but not limited to, Java, either alone or in combination. TM , C, C++, VisualBasic, Java Script, Perl, HTML, etc. Typically, a processor (e.g., a microprocessor) receives instructions from a memory, a computer-readable medium, etc. and executes these instructions to perform one or more processes including one or more processes described herein. Such instructions and other data may be stored in a document and transmitted using various computer-readable media. Files in a computing device are typically a collection of data stored on a computer-readable medium such as a storage medium, a random access memory, etc.

[0080] Computer readable media include media that participate in providing data (e.g., instructions) that can be read by a computer. Such media can take many forms, including but not limited to non-volatile media, volatile media, etc. Non-volatile media include, for example, optical disks or disks and other persistent memories. Volatile media include dynamic random access memory (DRAM) that usually constitutes main memory. Common forms of computer readable media include, for example, floppy disks, flexible disks, hard disks, magnetic tapes, any other magnetic media, CD-ROMs, digital video disks (DVDs), any other optical media, punch cards, paper tapes, any other physical media with hole patterns, random access memory (RAM), programmable read-only memory (PROM), electrically programmable read-only memory (EPROM), flash electrically erasable programmable read-only memory (FLASH-EEPROM), any other memory chips or boxes or any other media that can be read by a computer.

[0081] All terms used in the claims are intended to be given their plain and ordinary meanings as understood by those skilled in the art unless an explicit indication to the contrary is given herein. In particular, use of the singular forms "a," "an," "the," and "said" should be read to recite one or more indicated elements unless a claim recites an explicit limitation to the contrary.

[0082] The term "exemplary" is used herein to mean an example; for example, reference to an "exemplary widget" should be read as simply referring to an example of a widget.

[0083] The value or result modified by the adverb "approximately" means that the shape, structure, measurement result, value, determination result, calculation result, etc. may deviate from the precisely described geometry, distance, measurement result, value, determination result, calculation result, etc. due to defects in materials, processing, manufacturing, sensor measurement, calculation, processing time, communication time, etc.

[0084] In the accompanying drawings, the same reference numerals represent the same elements. Moreover, some or all of these elements may be changed. With regard to the media, processes, systems, methods, etc. described herein, it should be understood that, although the steps of these processes, etc. have been described as occurring according to a certain ordered sequence, these processes can be implemented with the described steps performed in an order other than the order described herein. It should also be understood that certain steps may be performed simultaneously, other steps may be added, or certain steps described herein may be omitted. In other words, for the purpose of illustrating certain embodiments, a description of the process herein is provided, and should never be interpreted as limiting the claimed invention.

Claims

1. A method for a vehicle, comprising: upon determining that the location of the vehicle is within a set of boundaries associated with a wireless local area network and the user device is authenticated by the wireless local area network, authorizing the user device to control the vehicle; as well as Upon determining that the location of the vehicle moves outside of the set of boundaries, the user device is authorized to control the vehicle based on an authorization credential requested and received over a wide area network. 2 . The method of claim 1 , wherein the wireless local area network is a Wi-Fi network operable to communicate within a second set of boundaries that includes the set of boundaries. The method of claim 1 , wherein the location of the vehicle is determined by latitude, longitude, and altitude.

4. The method of claim 3 further programmed to compare the location of the vehicle to geo-fence boundaries defined by the set of boundaries to determine whether the location of the vehicle is within the set of boundaries. The method of claim 1 , wherein the user device is authorized to control the vehicle for at most a predetermined time period.

6. The method of claim 5, wherein the time period is between half an hour and 8 hours.

7. The method of claim 1 further programmed to, upon determining that the location of the vehicle is not within the set of boundaries, deauthorize the user device to control the vehicle.

8. The method of claim 7, further programmed to authorize the user device to control the vehicle based on an authorization certificate requested and received over a wide area network before deauthorizing the user device.

9. The method of claim 1, wherein the authorization certificate is received from and transmitted to a server via the wide area network, the wide area network being operable to communicate outside the set of boundaries.

10. The method of claim 9, wherein the wide area network is a cellular network, a satellite network, or a mesh network.

11. The method of claim 1, wherein the authorization credentials include a user identification and a password.

12. The method of claim 1, wherein controlling the vehicle comprises actuating one or more vehicle components, the vehicle components comprising steering, a powertrain, and braking.

13. The method of claim 1, wherein the authorization certificate is compared to an authorization certificate received by a service controller. The method of claim 1 , wherein the authorization certificate is encrypted.

15. A system for a vehicle, comprising a computer programmed to perform the method of any one of claims 1-14.

16. A computer programmed to: upon determining that the location of the vehicle is within a set of boundaries associated with a wireless local area network and the user device is authenticated by the wireless local area network, authorizing the user device to control the vehicle; and Upon determining that the location of the vehicle moves outside of the set of boundaries, the user device is authorized to control the vehicle based on an authorization credential requested and received over a wide area network.

17. An apparatus for a vehicle, comprising a service controller for the vehicle, the apparatus being programmed to: transmitting, via the wireless local area network, a first authentication credential to a first authentication server upon determining that the location of the vehicle is within a set of boundaries associated with a wireless local area network, wherein within the set of boundaries, authentication of control of the vehicle by the service controller via the wireless local area network is permitted; upon determining that the position of the vehicle moves outside the set of boundaries, transmitting a second authentication credential requesting authentication of control of the vehicle located outside the set of boundaries to a second authentication server via a wide area network; as well as Upon receiving authentication from one of the first authentication server and the second authentication server, actuation of one or more vehicle components is permitted by the service controller.

18. A system for a vehicle, comprising: a user device programmed to control a vehicle; a first computer programmed to authorize the user device to control the vehicle via the wireless local area network upon determining that the vehicle location is within a set of boundaries associated with the wireless local area network and the user device is authenticated by the wireless local area network; as well as A server is programmed to authorize the user device to control the vehicle via a wide area network upon determining that the vehicle moves outside the set of boundaries.

Images