Method and system for controlling access to sensor data

Abstract

A method of controlling access to sensor data, comprising: generating sensor data, and protecting the sensor data to generate protected sensor data; transmitting the protected sensor data to a device for storage; the sensor receiving: access control data defining one or more operations that the device is permitted to perform on the protected sensor data; the sensor determining, based on the access control data, the operations that the device is permitted to perform on the protected sensor data; enabling the device to perform the permitted operations on the protected sensor data. A method of accessing protected sensor data by a device having stored thereon access control data defining one or more operations that the device is permitted to perform on the protected sensor data, the method comprising the steps of: receiving protected sensor data from a sensor; storing the received protected sensor data; sending the access control data to the sensor; receiving a signal from the sensor, the signal enabling the device to perform the permitted operations on the protected sensor data.

Description

Technical Field

[0001] This invention relates to controlling access to sensor data. More specifically, this invention relates to methods and systems that rely on encryption based on a local key at the sensor and the use of authorization tokens to ensure that a device can only access the data it is permitted to access. Various aspects of the invention relate to different parts of a system and methods performed by these different parts. Background Technology

[0002] Sensors are ubiquitous in daily life, essential for the operation and maintenance of almost all devices we see and use. It is necessary to ensure that data acquired by a given sensor cannot be accessed or modified by any other device. For example, it might be desirable that data collected by sensors detecting wear in industrial machinery can only be accessed by devices belonging to the engineers responsible for maintaining these machines. Similarly, it is important to ensure that sensor data cannot be manipulated (unless by an authorized party). Traditionally, device access permissions are controlled by a secure platform. However, with the advent of edge computing (where data processing occurs on devices at network nodes, rather than being centrally executed), edge devices may be significantly isolated from the secure platform through what is known as an "air gap." In these cases, there may be no secure connection or secure network between the edge device and the secure platform. Therefore, there is a need for a system that can securely control device access to sensor data even when devices and sensors are far from the secure platform controlling access permissions. This need is addressed by the invention addressed in this application. Summary of the Invention

[0003] In summary, the present invention provides a system in which access control data is deployed on a device, such as an edge device. This access control data is included, for example, on an authorization token that can be generated by a remote security platform. The access control data on the authorization token defines the sensor data that the device is authorized to access, and the operations that the device is allowed to perform on that sensor data. A sensor generates sensor data, protects the sensor data, and then transmits the sensor data to the device for storage. Therefore, even though the sensor data is stored on the device, the device may not be able to utilize the sensor data because it is protected. If the device wishes to access the sensor data, it can send a request to the sensor, along with, for example, the access control data on the authorization token. The sensor then enables the device to perform only certain permitted operations, for example, by returning a key that can only be used to perform the permitted operations. By deploying the authorization token on the device, the device does not need a physical connection to the security platform. Furthermore, since the data stored on the device is protected and can only be accessed with the correct permissions, data security is not compromised. It should be noted that the invention has many parts, each contributing to achieving technical advantages. Therefore, the invention has many aspects.

[0004] One aspect of the present invention provides a method for controlling access to sensor data, the method comprising the steps of: generating sensor data and protecting the sensor data to generate protected sensor data; transmitting the protected sensor data to a device for storage; the sensor receiving access control data, the access control data defining one or more operations permitted by the device to be performed on the protected sensor data; the sensor determining, based on the access control data, the operations permitted by the device to be performed on the protected sensor data; and enabling the device to perform the permitted operations on the protected sensor data. Hereinafter, a secret key (e.g., an encryption key) may be used to protect the sensor data. Furthermore, as described above, the sensor may receive an authorization token including the access control data. Enabling the device to perform permitted operations can be achieved by providing data to the device, such as one or more keys that the device can use to perform permitted operations on the protected sensor data. Specifically, enabling the device to perform permitted operations may include sending a signal to the device including one or more keys or data encoding one or more keys that the device can use to perform permitted operations on the protected sensor data. Another aspect of the present invention provides a sensor for performing the method of the preceding aspect of the present invention. Two important methods can be used to control access to sensor data: first, different keys can be provided to the device depending on the permitted operations. Alternatively or additionally, sensor data may include multiple subsets of sensor data (the subsets may be different), each of which is individually protected. In this case, the sensor may only provide the device with a key that can be used to access the permitted subset of sensor data.

[0005] Another complementary aspect of the invention is a method performed by a device rather than a sensor, specifically a method for a device to access protected sensor data, wherein the device stores access control data that defines one or more operations permitted by the device to perform on the protected sensor data. The method includes the steps of: receiving the protected sensor data from the sensor; storing the received protected sensor data; sending the access control data to the sensor; and receiving a signal from the sensor that enables the device to perform permitted operations on the protected sensor data. In some cases, the device may store an authorization token including the access control data. Furthermore, in some cases, receiving the signal that enables the device to perform permitted operations on the protected sensor data may include receiving one or more keys that can be used by the device to perform permitted operations on the protected sensor data. Another aspect of the invention provides a device for performing the method of the preceding aspect of the invention.

[0006] Another aspect of the present invention provides a system including the above-described sensor and the above-described device.

[0007] Various embodiments of the present invention enable more processing and computation to be performed at the "edge" while reducing the risk of interference by malicious actors. Therefore, the present invention can be advantageously applied to a variety of use cases, such as smart vehicles and smart buildings. In the context of the present invention, the term "smart" can generally be used to refer to the technical field of sensors distributed throughout, for example, vehicles or buildings, collecting data, and using that data to inform control processes related to the vehicle or building. With the emergence of the so-called "Internet of Things," the computational and processing load of the sensors themselves is also increasing. According to another aspect of the invention, a building is provided comprising a plurality of sensors interconnected via a network, wherein at least one of the plurality of sensors is a sensor according to a prior aspect of the invention. Preferably, each of the plurality of sensors is a sensor according to a prior aspect of the invention. An equivalent aspect of the invention provides a vehicle instead of a building.

[0008] Sensors according to all aspects of the present invention may include any or all of the following: cameras, proximity sensors, CO2 sensors, smoke sensors, pressure sensors, humidity sensors, accelerometers, position sensors, motion sensors, LiDAR-based sensors, temperature sensors, force sensors, vibration sensors, piezoelectric sensors, fluid property sensors, photoelectric sensors, and light intensity sensors. However, it should be understood that this is a non-exhaustive list, and the present invention is by no means limited to these types of sensors.

[0009] In the context of a vehicle, the "sensor" of this invention can be used to sense specific conditions within the vehicle. The data can then be protected to ensure that only authorized maintenance personnel can access the sensor data to inform maintenance decisions. Specific types of sensor data or other information obtainable in the context of intelligent vehicles or more generally vehicles include the following: - Information about the vehicle's identity (this information can be encoded in or obtained from a code such as a QR code or other identifier, where a sensor can be a device used to obtain the identity information from the code or other identifier). This can be applied, for example, to an automatic license plate recognition system. Similarly, information about the identity of the vehicle's passengers or driver can also exist, which can be obtained, for example, from an image sensor or by scanning a code (e.g., a code used for vehicle identification). Information that can be used for navigation includes the vehicle's location, vectors indicating the vehicle's movement, and vector changes indicating changes in direction, acceleration, or deceleration. This can be sensed by a GPS tracker (or other satellite navigation system) located in the car. In this case, protecting the sensor data may be particularly important for the owner's privacy. Since this type of information is frequently used by insurance companies and law enforcement, it is also crucial to prevent or detect any attempts to tamper with the obtained data. Similarly, sensor data may include vehicle mileage or the time the vehicle has been used. Sensors can be used to detect when various vehicle components require maintenance or are damaged. This information is particularly relevant to maintenance personnel. Similarly, sensors can detect the consumption of substances such as oil, fuel, and battery energy within the vehicle. Battery power detection is especially important in electric vehicles. - The vehicle may contain the environmental sensors listed above.

[0010] Commercial environments where such information obtained by sensors may be particularly useful include: insurance, fleet management, business / transactions, vehicle health / maintenance, vehicle-to-vehicle communication, autonomous vehicles, smart parking, and traffic management.

[0011] Similar considerations apply to buildings that include sensors: it is important to ensure that sensor data can only be accessed by authorized maintenance personnel.

[0012] The present invention includes combinations of the described aspects and preferred features, unless such combinations are clearly not permitted or explicitly conflicting. Attached Figure Description

[0013] Embodiments of the present invention will now be described with reference to the following accompanying drawings, in which:

[0014] Figure 1 A system including sensor 10 and device 20 is shown.

[0015] Figure 2 An example of a method that can be performed by sensor 10 is shown.

[0016] Figure 3 An example of a method that can be performed by device 20 is shown.

[0017] Figure 4 An alternative example of sensor 100 is shown.

[0018] Figure 5 An alternative example of device 200 is shown.

[0019] Figure 6 This demonstrates how to divide sensor data into subsets.

[0020] Figure 7The process for recovering or generating an encryption key for a given set of data is illustrated.

[0021] Figure 8A and Figure 8B The layout of two example encryption key data tables is shown.

[0022] Figure 9 The method for generating encryption keys is shown.

[0023] Figure 10 The authentication method is shown.

[0024] Figure 11 The system shown includes sensors, devices, and operating components. Detailed Implementation

[0025] Various aspects and embodiments of the invention will now be discussed with reference to the accompanying drawings. Other aspects and embodiments will be apparent to those skilled in the art. All documents mentioned herein are incorporated by reference.

[0026] This invention relates to various methods and apparatuses. Specifically, it relates to methods performed by sensors, methods performed by devices such as edge devices or servers, and methods performed by systems including the sensor and the device. The invention also relates to sensors, devices, and systems themselves. Figure 1 System 1, including sensor 10 and device 20, is shown. Figure 2 and Figure 3 Specific examples of methods according to the present invention that can be performed by sensor 10 and device 20 are shown respectively.

[0027] As discussed, Figure 1 System 1 includes a sensor 10 and a device 20. The sensor 10 and device 20 are connected via a connection C. Connection C can be any form of connection capable of transmitting data and / or information between the sensor 10 and device 20. Preferably, connection C is an electrical connection and can be a wired or wireless connection, such as a connection via a wireless network (e.g., Wi-Fi or a cellular network). Alternatively, the wireless connection can be in the form of a Bluetooth connection or a near-field communication connection. It should be understood that connection C can take many different forms, which need not be explicitly listed herein.

[0028] Sensor 10 includes processor 11, which includes encryption module 12 and access determination module 13. (Reference) Figure 1 As with the remainder of this application, it should be noted that the term "module" refers to any functional unit used to perform a given function. Modules may be implemented in dedicated, adapted, or modified hardware, or alternatively, in the form of software modules, such as code segments.

[0029] Sensor 10 also includes a transmitter 14 and a receiver 15. In this document, the term "transmitter" is used broadly to encompass any component capable of transmitting data or influencing data transmission. For example, transmitter 14 may be used to generate and transmit wireless signals that encode data. Alternatively, transmitter 14 may be used to enable data transmission via a wired connection (e.g., connection C). Similarly, the term "receiver" should be broadly considered as any component capable of receiving data. For example, receiver 15 may be used to receive wireless signals or may be used to receive data via a wired connection (e.g., connection C). The functions of sensor 10, processor 11, encryption module 12, access determination module 13, transmitter 14, and receiver 15 will be referenced below in this application. Figure 2 and Figure 3 To provide a more detailed description.

[0030] Device 20 includes a receiver 21, a memory 22, a processor 25, and a transmitter 26. The terms "transmitter" and "receiver" should be interpreted as defined in the preceding paragraph. The memory 22 of device 20 includes or stores an authorization token 23 and encrypted sensor data 24. The nature of these components will be described below.

[0031] Before describing specific embodiments of the invention, optional features of the first and second aspects of the invention are first outlined. Although reference numerals are used in the following disclosure, it should be noted that different reference numerals are explicitly contemplated. Figure 1 The system shown implements this method.

[0032] As previously described, a first aspect of the present invention provides a method for controlling access to sensor data, the method comprising the steps of: generating sensor data and protecting the sensor data using one or more keys to generate protected sensor data 24; transmitting the protected sensor data 24 to a device 20 for storage; the sensor 10 receiving an authorization token 23 including access control data, the access control data defining one or more operations permitted by the device 20 to perform on the protected sensor data 24; the sensor 10 determining, based on the access control data, the operations permitted by the device 20 to perform on the protected sensor data 24; and providing the device 20 with one or more keys that the device 20 can use to perform the permitted operations on the protected sensor data 24. Preferably, to reduce the storage requirements of the sensor 10 (specifically, its memory), the method may further include a step of deleting the sensor data after the step of transmitting the sensor data to the device 20. The core idea of ​​the present invention is that the sensor 10 will, based on the access control data in the authorization token 23, only provide the device 20 with one or more keys that the device 20 can use to perform the operations it is permitted to perform. The permitted operations and the nature of the associated keys will be discussed in more detail below, but before that, a general case is described in which various keys can be applied during the generation of protected sensor data, and combinations of these keys can be used to perform various operations on the protected sensor data. It should be noted that the various keys can be applied one after another in a “stacked” manner.

[0033] In some cases, protecting sensor data includes applying a first secret key to the sensor data to generate first protected sensor data. Then, if the access control data definition allows the device to perform a first operation on the first protected sensor data, the providing step may include providing the device with a first complementary key that the device can use to perform the first operation. Hereinafter, the first operation may be complementary to applying the first secret key to the sensor data, such as encryption / decryption (specific examples will be discussed in detail below in this application). Hereinafter, the term "complementary" should be understood to mean that the key can perform a complementary action to the secret key. For example, if the secret key is an encryption key, the complementary key may be a corresponding decryption key. If the secret key is used to generate an authentication code, the complementary key may be the same as the secret key, thereby enabling the device to generate the same authentication code to authenticate the protected sensor data. It should be noted that the complementary key may be the same as the secret key.

[0034] In a preferred embodiment, the first secret key is an encryption key, and the first protected sensor data is encrypted sensor data. The first operation can then be a decryption operation or a read operation. In this case, the above-described providing steps may include providing the device with a complementary key in the form of a decryption key. In some embodiments, the encryption key may be a symmetric encryption key, in which case the encryption key and the decryption key may be the same. In this example, the sensor encrypts the sensor data, and the device can only receive the key to decrypt the sensor data when access control data specifies permission.

[0035] In other cases, protecting sensor data may involve applying a second secret key to the first protected sensor data to generate a second protected sensor data. This leads to two possible outcomes: 1. If the access control data definition allows the device to perform a second action on the second protected sensor data, the above-described providing steps may include providing the device with a second complementary key, which the device may use to perform the second operation on the second protected sensor data. Hereinafter, as described above, the second operation may be complementary to applying a second secret key to the first protected sensor data. 2. If the access control data definition allows the device to perform a first operation and a second operation, or to perform a third operation (optionally, the third operation may be a combination of the first and second operations, or both the first and second operations must be performed to perform the third operation), then the above-described providing step may include: providing the device with a first complementary key and a second complementary key, the first and second complementary keys being combinable for performing the third operation on the second protected sensor data. Alternatively, the above-described providing step may include: providing the device with a first complementary key and a second complementary key, the second complementary key being usable by the device for performing a second operation on the second protected sensor data to recover the first protected sensor data, and then the first complementary key being usable by the device for performing a first operation on the first protected sensor data.

[0036] The following describes two example scenarios where two keys can be used.

[0037] In the first scenario, the sensor data is first processed using an authentication key to generate an authentication code. Then, an encryption key is applied to the combination of the sensor data and the authentication code to generate encrypted sensor data. In this case, the first secret key is the authentication key; the first protected sensor data is the combination of the sensor data and the authentication code; the second secret key is the encryption key; and the second protected sensor data is the encrypted sensor data. Now, consider scenarios 1 and 2 above: 1. The second operation can be decryption. In other words, if the access control data definition allows the device to decrypt encrypted sensor data, the above-described providing steps can include providing the device with a decryption key (complementary to the encryption key) that the device can use to decrypt the encrypted sensor data. When using a symmetric encryption key, the encryption key and decryption key can be the same. 2. The first operation can be authentication, and the second operation can (still) be decryption. In other words, the third operation can include, for example, modifying sensor data, particularly modifying sensor data in a way that can be authenticated. For a device to modify sensor data, it must first be able to decrypt the sensor data, at which point it can modify the sensor data. If an unauthorized device does this, it will be detected because such a device (without an authentication key) cannot generate an authentication code corresponding to the modified sensor data. Therefore, an authorized device needs to be able to decrypt the sensor data (i.e., read the sensor data) and, after modifying the sensor data, be able to re-authenticate the sensor data so that the modified sensor data can be verified. Therefore, if the access control data definition allows devices to decrypt and re-authenticate encrypted sensor data, or modify sensor data, the above-provided steps can include: a. Provide the device with a first authentication key and a decryption key, the combination of which can be used to modify sensor data; or b. Provide the device with a first authentication key and a decryption key. The decryption key can be used by the device to decrypt encrypted sensor data to recover the combination of sensor data and authentication code, thereby enabling the device to modify the sensor data to generate modified sensor data. The first authentication key can also be used by the device with the modified sensor data to generate a second authentication code. In some cases, as described above, the encryption key is symmetric, and therefore the encryption key is the same as the decryption key. In this case, the device can use the key to re-encrypt the modified sensor data and the combination of the second authentication code to generate modified encrypted sensor data for storage, for example, in the device's memory.

[0038] In the second example, the first secret key can be an encryption key, and the first protected sensor data can be encrypted sensor data. Then, the second secret key can be a second authentication key (unrelated to the first authentication key that forms part of the previous example), and the second protected sensor data can take the form of an authentication code, or preferably, a combination of encrypted sensor data and an authentication code. The first operation can be a decryption operation, and the second operation can be an authentication operation. Note that this is the opposite of the previous example.

[0039] but: 1. The second operation can be authentication. In this case, if the access control data definition allows the device to authenticate encrypted sensor data, the above-described providing steps can include providing the device with an authentication key that the device can use to authenticate the encrypted sensor data. The authentication steps described herein can include using the authentication key on the encrypted sensor data to generate an authentication code, and comparing the generated authentication code with an authentication code included in the second protected sensor data. If the two authentication codes match, it can be concluded that the encrypted sensor data has not been tampered with. If the two authentication codes do not match, the encrypted sensor data may have been tampered with in an unauthorized manner. 2. The first operation can be encryption. In this case, if the access control data definition allows the device to decrypt encrypted sensor data, a step is taken to provide the device with a decryption key that the device can use to decrypt the encrypted sensor data, thereby recovering the sensor data. It should be noted that in this case, the above decryption can be performed without authentication. However, it is beneficial to first verify that the encrypted sensor data is authentic. Therefore, if the access control data definition allows the device to authenticate and decrypt the encrypted sensor data, it is preferable that the device performs the authentication step before the decryption step.

[0040] The example above only requires the explicit application of the first and second secret keys. However, it should be understood that this method can be generalized to the application of multiple secret keys in general. In this case, protecting sensor data may include applying multiple secret keys to the sensor data to generate protected sensor data. Then, the above-described providing step may include providing the device with multiple complementary keys, each complementary key being complementary to a corresponding secret key among the multiple secret keys, and the combination of the multiple complementary keys can be used by the device to perform permitted operations.

[0041] As an extension of the specific example above, three keys are used: 1. The first secret key is the first authentication key. 2. The second secret key is the encryption key. 3. The third secret key is the second authentication key.

[0042] In this case, protecting sensor data includes the following steps: applying a first authentication key to generate first protected sensor data including sensor data and a first authentication code; applying an encryption key to the first protected sensor data to generate second protected sensor data in the form of encrypted sensor data (the second protected sensor data is an encryption of the sensor data and the first authentication code); and applying a second authentication key to the second protected sensor data to generate third protected sensor data including the encrypted sensor data and the second authentication code.

[0043] This example effectively combines the two examples listed above. In this case: 1. The first step is to authenticate the sensor data. 2. The second operation is the decryption operation. 3. The third step is to authenticate the encrypted sensor data.

[0044] If the access control data definition allows the device to authenticate encrypted sensor data, the above-described providing steps may include: providing the device with a second authentication key that the device can use to authenticate the encrypted sensor data.

[0045] If the access control data definition allows the device to decrypt encrypted sensor data, the above-described providing steps may include providing the device with a decryption key (complementary to the encryption key) that the device can use to decrypt the encrypted sensor data. When using a symmetric encryption key, the encryption key and decryption key can be the same. If the access control data definition allows the device to authenticate and decrypt encrypted sensor data, two keys can be provided to enable the device to perform two operations.

[0046] If the access control data definition allows the device to decrypt and re-authenticate encrypted sensor data, or modify the sensor data, the above-described providing steps may include: providing the device with a first authentication key and a decryption key, the combination of which can be used to modify the sensor data; or providing the device with a first authentication key and a decryption key, the decryption key of which can be used by the device to decrypt the encrypted sensor data to recover the combination of the sensor data and the first authentication code, thereby enabling the device to modify the sensor data to generate modified sensor data, and the first authentication key can be used by the device to generate a third authentication code from the modified sensor data. In some cases, as described above, the encryption key is symmetric, and therefore the encryption key is the same as the decryption key. In this case, the device can then use the key to re-encrypt the combination of the modified sensor data and the third authentication code to generate modified encrypted sensor data for storage, for example, in the device's memory.

[0047] Where possible, the order of applying the plurality of secret keys is important, and accordingly, the order of applying the plurality of complementary keys is also important. In these cases, which may or may not form a subset of the aforementioned preceding cases, protecting sensor data may comprise: sequentially applying N secret keys to the sensor data to generate Nth protected sensor data, wherein applying a first secret key to the sensor data generates first protected sensor data, and for k>1, applying a kth key to (k-1)th protected sensor data generates kth protected sensor data, wherein 1<k≤N. Then, if the access control data defines that the device is permitted to perform an Mth operation on the Nth protected sensor data, wherein 1≤M≤N, the foregoing providing step comprises providing the device with (N+1−M) complementary keys complementary to a key subset of the plurality of keys, wherein M≤k≤N, from the Nth complementary key sequentially to the Mth complementary key, such that M keys are available to perform or facilitate performance of the Mth operation. Specifically, the device can then sequentially apply the plurality of complementary keys from N to M onto the Nth protected sensor, wherein applying the kth complementary key to the kth protected sensor data recovers the (k−1)th protected sensor data (k>1), and wherein applying the first complementary key to the first protected sensor data recovers the sensor data.

[0048] According to some implementations, the method may further comprise the step of generating a secret key for each individual piece of data generated by the sensor. Generation and storage of secret keys in this manner will be explained in more detail hereinafter in the context of encryption keys in the present application. It should be noted, however, that the present disclosure applies equally to the case of a generic key for protecting sensor data.

[0049] In some cases, devices may be permitted to perform different operations on different subsets of data. For example, a given device may be able to modify and re-authenticate one subset of data, but only decrypt another subset. Such permission is preferably defined in access control data comprised in an authorization token. Specifically, the sensor data may comprise a first subset of sensor data and a second subset of sensor data. Accordingly, generating protected sensor data may comprise: protecting the first subset of sensor data to generate a first subset of protected sensor data, and protecting the second subset of sensor data to generate a second subset of protected sensor data. The manner in which sensor data may be divided into subsets is set out in detail hereinafter in the present application. As mentioned above, generating the first subset of protected sensor data may comprise applying a first secret key to the first subset of sensor data, and generating the second subset of protected sensor data may comprise applying a second secret key to the second subset of sensor data.

[0050] In these cases, access control data can be defined as: allowing the device to perform a first operation on a first subset of the protected sensor data; and / or allowing the device to perform a second operation on a second subset of the protected sensor data.

[0051] The determining step may then include determining, based on access control data: a first operation permitted for the device to perform on a first subset of the protected sensor data; and / or a second operation permitted for the device to perform on a second subset of the protected sensor data. The device may not be permitted to perform operations on the first and second subsets. Therefore, the providing step described above may include: providing one or more keys that the device can use to perform the first operation on the first subset of the protected sensor data, only when it is determined that the device is permitted to perform the first operation; and providing one or more keys that the device can use to perform the second operation on the second subset of the protected sensor data, only when it is determined that the device is permitted to perform the second operation. In other words, the first and second operations cannot be performed unless access control data indicates that the device is permitted to do so.

[0052] In a more general case, sensor data may include multiple subsets of sensor data. The step of encrypting the sensor data may then include protecting each subset of the multiple subsets of sensor data with a corresponding key to generate corresponding protected subsets of sensor data. Therefore, access control data may define one or more operations permitted by the device to perform on the corresponding subsets of the protected sensor data. For example, operations may be defined for each data subset, only for one subset, or some subsets. The determination step described above may then include determining one or more operations permitted by the device to perform on the corresponding subsets of the protected sensor data. After determination, the method may include providing one or more keys to the device, each key which the device may use to perform permitted operations on the corresponding subsets of the protected sensor data.

[0053] In the example above, only the authorization token is specified to be received by the sensor. It should be understood that the determination step described above occurs in response to the receipt of the authorization token. In this case, it should be understood that, in response to the determination step, the sensor provides the device with one or more keys based on access control data, which the device can use to perform all permitted operations. However, in some cases, the device may not wish to perform all possible operations. In this case, the method may further include the step of receiving an access request from the device specifying: performing a first operation on a first subset of protected sensor data and / or performing a second operation on a second subset of protected sensor data. The determination step above can then include: determining whether the device is permitted to perform the first operation on the first subset of protected sensor data; and / or determining whether the device is permitted to perform the second operation on the second subset of protected sensor data. Then, as already discussed, the relevant keys are only provided if a positive determination has been made.

[0054] Several implementations have been listed above, in which multiple operations can be performed on protected sensor data depending on the permissions of a given device. Implementations in which the device can perform different operations on different subsets of the sensor data have also been described. It should be noted that the invention also includes implementations in which each subset of the multiple subsets of the protected sensor data is protected by multiple secret keys, and access control data defines individual operations that can be performed on each subset of the protected sensor data. Such implementations can be obtained by combining the optional features described above and should be considered as explicitly disclosed in this application.

[0055] When sensor 10 receives authorization token 23, it can perform the authentication steps for authorization token 23. For example, when authorization token 23 is generated, it may have already been signed using, for example, an elliptic curve digital signature algorithm and a private key. The private key may be stored in a PKI, and thus signed by a certification authority (CA) in the form of a certificate. The root CA's public key may be hardcoded into sensor 10 (e.g., the sensor security element of sensor 10) and then used to authenticate authorization token 23. When device 20 requests access to data, a secure channel can be established between sensor 10 and device 20. In this case, sensor 10 and / or device 20 may use, for example, a pre-shared symmetric key or an asymmetric PKI to perform a mutual authentication process.

[0056] In a preferred embodiment of the invention, the above method is used to protect sensor data at least by generating encrypted sensor data through encryption of the sensor data. In this case, the method includes the following steps: generating sensor data and encrypting the sensor data using an encryption key to generate encrypted sensor data 24; transmitting the encrypted sensor data 24 to a device 20 for storage; the sensor 10 receiving an authorization token 23 including access control data, the access control data defining one or more operations permitted for the device 20 to perform on the encrypted sensor data 24; the sensor 10 determining, based on the access control data, the operations permitted for the device 20 to perform on the protected sensor data 24; and providing the device 20 with one or more keys available to the device 20 to perform the permitted operations on the encrypted sensor data 24. Additional optional features of the invention are described below. It should be noted that the features listed below may represent restatesment of the above examples. Where compatible, any optional features of the invention disclosed herein may be combined with any other features without departing from the intended scope of this disclosure. In particular, it should be noted that any optional features listed below related to encryption or encryption keys may be equally applicable to general protection or secret keys themselves and their complements.

[0057] A key objective of this invention is to ensure that sensor data remains secure and can only be read and / or modified by a specific, designated party. Therefore, operations may include decrypting encrypted sensor data 24, as well as modifying and re-authenticating the sensor data. In the latter case, it should be understood that encrypted sensor data 24 must first be decrypted before the corresponding (i.e., unencrypted) sensor data can be modified.

[0058] First, consider the case where the access control data defines a scenario that allows device 20 to decrypt encrypted sensor data 24. In this case, the method may include providing device 20 with a decryption key that device 20 can use to decrypt the encrypted sensor data. In other words, because the access control data defines a scenario that allows the device to decrypt encrypted sensor data 24, the scenario that allows the device to decrypt encrypted sensor data 24 will be determined (based on this). In some cases, the encryption key may be a symmetric key, in which case the decryption key may be the same as the initial encryption key used to encrypt the sensor data.

[0059] In other cases, device 20 may be allowed to operate further and modify the sensor data. It will be noted that either party possessing the decryption key can decrypt and modify the data. However, it is important that unauthorized modifications to the data be identified so that they can be ignored. To ensure this, the encryption step may include applying a first authentication key to the data before using the encryption key. Thus, if an unauthorized party wants to modify the sensor data and then re-encrypt the sensor data, but without the first authentication key, the unauthorized party will not be able to authenticate the data, and unauthorized tampering will be detected directly. Now consider the case where device 20 is allowed to modify the data. If the access control data definition allows device 20 to modify the sensor data, the method may include: providing device 20 with a decryption key that can be used to decrypt the encrypted sensor data, thereby outputting the sensor data; and providing device 20 with a first authentication key that device 20 can use to re-authenticate the modified sensor data. Therefore, device 20 can be used to decrypt the data, modify the data, and reapply the authentication key to authenticate the modified sensor data. Device 20 can then re-encrypt the data.

[0060] In some other cases, the operation may include authenticating only the encrypted sensor data. In other words, in some situations, device 20 may want to verify that the encrypted sensor data 24 has not been tampered with during its generation, transmission to the device, and storage within the device. To achieve this, the encryption step may include applying a second authentication key to the encrypted sensor data 24. The aforementioned provisioning step may then include providing the second authentication key to device 20, which device 20 may use to authenticate the encrypted sensor data. It should be noted that the second authentication key may also be provided to device 20 where, as described above, device 20 is permitted to decrypt and / or modify the sensor data.

[0061] It should be noted that, in the context of this application, the authentication key is a key that can be applied to some (encrypted or unencrypted) data, outputting a message authentication code (MAC). The MAC can then be associated with the original data (i.e., the "message"). Specifically, applying the authentication key to data can include applying a key-based algorithm to the data, the output of which depends on the input data and the key. In other words, the same result can only be obtained when the input data and the key are identical. Different keys will produce different results. In a preferred example, applying the authentication key to sensor data (or encrypted sensor data) can include generating an HMAC on the sensor data (or encrypted sensor data) using a keyed hash algorithm involving the authentication key or an HMAC scheme. Other key authentication schemes are also envisioned.

[0062] It should be noted that any actions described in this application concerning the encryption keys (especially those related to the generation and / or recovery of these keys) can also be performed on the first authentication key and / or the second authentication key.

[0063] In some cases, different operations may be permitted for different subsets of sensor data. For example, sensor 10 may acquire two different types of data, and may allow a given device 20 to read only one type of data while modifying the other. Alternatively, device 20 may be allowed to view only the data recorded within a specific time frame. Some embodiments of the present invention enable different rules to be applied to different subsets of sensor data. Specifically, sensor data may include a first subset and a second subset. Of course, sensor data can generally be divided into multiple subsets. In this document, the division into a first subset and a second subset is for illustrative purposes. The general case will be described below.

[0064] There are many methods to partition sensor data into subsets. For example, such methods may include generating a header and appending it to each generated piece of sensor data. The header includes metadata containing information about the sensor data, including one or more of the following: a timestamp indicating the time and / or date the sensor data was collected / generated; a sensor ID identifying the sensor that collected the data; a data type indicating the type of data; and one or more device IDs identifying the device 20 allowed to access the data. In this case, the subset to which each piece of sensor data belongs is based on the metadata in the header of that sensor data.

[0065] The encryption steps may include encrypting a first subset of sensor data with a first encryption key to generate an encrypted first subset 24 of sensor data; and encrypting a second subset of sensor data with a second encryption key different from the first encryption key to generate an encrypted second subset 24 of sensor data. In this case, access control data may define a first operation permitted by device 20 to perform on the first subset of encrypted sensor data 24; and / or a second operation permitted by device 20 to perform on the second subset of encrypted sensor data 24. Therefore, the above-described determining step may include determining, based on the access control data: the first operation permitted by device 20 to perform on the first subset of encrypted sensor data 24; and / or the second operation permitted by device 20 to perform on the second subset of encrypted sensor data 24. Device 20 may be denied operation on both the first and second subsets. Therefore, the above-described providing step may include providing one or more keys that device 20 can use to perform the first operation on the first subset of encrypted sensor data 24 only when it is determined that device 20 is permitted to perform the first operation; and providing one or more keys that device 20 can use to perform the second operation on the second subset of encrypted sensor data 24 only when it is determined that device 20 is permitted to perform the second operation. In other words, it cannot be performed unless the access control data indicates that the device 20 is allowed to perform the first and second operations.

[0066] In a more general case, sensor data may include multiple subsets of sensor data. The step of encrypting sensor data 24 may then include encrypting each subset of the multiple subsets of sensor data with a corresponding key to generate corresponding multiple subsets of encrypted sensor data 24. Therefore, access control data may define one or more operations permitted by device 20 to perform on the corresponding subsets of encrypted sensor data 24. For example, operations may be defined for each data subset, only for one subset, or some of the subsets. The determination step described above may then include determining one or more operations permitted by device 20 to perform on the corresponding subsets of encrypted sensor data 24. Once the above determination occurs, the method may include the step of providing device 20 with one or more keys, each key which device 20 may use to perform permitted operations on the corresponding subsets of encrypted sensor data 24.

[0067] In the example above, only authorization token 23 is specified to be received by sensor 10. It should be understood that the determination step described above occurs in response to the receipt of authorization token 23. In this case, it should be understood that, in response to the determination step, sensor 10 provides device 20 with one or more keys based on access control data, which device 20 can use to perform all permitted operations. However, in some cases, device 20 may not wish to perform all possible operations. In this case, the method may further include the step of receiving an access request from device 20 specifying: a first operation to be performed on a first subset of encrypted sensor data 24 and / or a second operation to be performed on a second subset of encrypted sensor data 24. The determination step above can then include: determining whether device 20 is permitted to perform the first operation on the first subset of encrypted sensor data 24; and / or determining whether device 20 is permitted to perform the second operation on the second subset of encrypted sensor data 24. Then, as already discussed, the relevant keys are only provided if a positive determination occurs.

[0068] As previously stated, this can be extended to situations where multiple subsets of sensor data exist. In this case, the access request can specify one or more operations to be performed on the corresponding subset of the sensor data, and the determination step described above includes determining whether to allow device 20 to perform the corresponding specified operation on each specified subset of the encrypted sensor data 24.

[0069] The optional features presented above primarily relate to the first aspect of the invention, namely the method performed by sensor 10. However, it should be understood that, where compatible, these features are equally applicable to the second aspect of the invention, namely the method performed by device 20. Below, some additional optional features that may be applied to the second aspect of the invention are outlined. The second aspect of the invention provides a method for accessing protected sensor data via device 20, which stores an authorization token 23 including access control data that defines one or more operations permitted by device 20 to perform on encrypted sensor data 24. The method includes the steps of: receiving encrypted sensor data 24 from a sensor, the encrypted sensor data being encrypted using an encryption key; storing the received sensor data; sending the authorization token 23 to the sensor; and receiving a key that can be used by device 20 to perform permitted operations on the encrypted sensor data 24. As previously described, the operations may include decrypting the encrypted sensor data 24; modifying and re-authenticating the sensor data.

[0070] As described above, when the invention is defined broadly, device 20 only sends authorization token 23 to sensor 10. In these cases, device 20 can receive a key that can be used to perform all operations permitted by the access control data of authorization token 23. However, in some cases where this is not desired, device 20 can send an access request to sensor 10 specifying the requested operation to be performed on encrypted sensor data 24.

[0071] As described above with reference to the first aspect of the invention, sensor data may include a first subset and a second subset, and device 20 may be allowed to perform different operations on different subsets. As previously stated, encrypted sensor data 24 may include a first subset and a second subset of encrypted sensor data 24. Access control data may then define a first operation allowed by the device on the first subset of encrypted sensor data 24, and / or a second operation allowed by the device on the second subset of encrypted sensor data 24. In this case, as a result of the determining step occurring at sensor 10, the receiving step may include: receiving one or more keys that can be used by device 20 to perform the first operation on the first subset of encrypted sensor data 24 only if the access control data defines that the device is allowed to perform the first operation; and receiving one or more keys that can be used by device 20 to perform the second operation on the second subset of encrypted sensor data 24 only if the access control data defines that the device is allowed to perform the second operation. Of course, sensor data may include more than just a first subset and a second subset. The optional features described in this paragraph can be extended to a general plurality of subsets of sensor data. Specifically, device 20 may receive multiple subsets of encrypted sensor data 24, and access control data may define one or more operations permitted by device 20 to perform on the corresponding subsets of encrypted sensor data 24. For example, operations may be defined for each data subset, for only one subset, or for some subsets. The method then includes the step of receiving one or more keys from sensor 10, each key which device 20 may use to perform permitted operations on the corresponding subsets of encrypted sensor data 24.

[0072] When device 20 sends an access request, the access request may specify one or more of the following: a first operation to be performed on a first subset of encrypted sensor data 24, and a second operation to be performed on a second subset of encrypted sensor data 24.

[0073] To enhance security, sensor 10 can encrypt the key before providing it to the device. In a preferred embodiment, sensor 10 may pre-load a public key, device 20 may pre-load a private key, and the method may include the step of encrypting one or more keys using the public key. Because only device 20, which receives the key, possesses the private key capable of decrypting the encrypted key, access to the key by other external parties is prevented, and consequently, access to sensor data by other external parties is also prevented. The method of the second aspect of the invention may include (preferably using the private key) the corresponding step of decrypting one or more keys.

[0074] The method of the second aspect of the invention may further include the step of using one or more keys received from the sensor to perform a permitted operation (e.g., a first operation and / or a second operation).

[0075] Figure 2 and Figure 3 It can be made by Figure 1 The system 1 executes a series of steps S1 to S12, illustrating a specific example of the method of the first and second aspects of the invention. Although those skilled in the art will understand that the order of some steps can be changed, in a preferred embodiment, steps S1 to S12 are performed sequentially. Figure 2 The steps performed by sensor 10 are shown. Figure 3 The steps performed by device 20 are shown.

[0076] In step S1, sensor 10 generates sensor data. At this point, it is worthwhile to elaborate on some contemplated uses of the invention. For example, device 20 could be an edge gateway or control unit managing several sensors, for which device 20 requires different and specific access. One example could be a tracking control unit connected to a container, which uses the generated accelerometer data to guide specific operations (e.g., aircraft landing detection) and also stores encrypted data generated by temperature sensors or door status sensors for reporting to the cloud, thereby ensuring transport quality and tamper-proofing. The integrity and privacy of temperature and door status tracking data are end-to-end protected between the sensors and the system. In another example: a vehicle (e.g., a car, ship, train, etc.) has multiple sensors connected to a local network, where different control units exist, requiring different and specific access to the data generated by the sensors. A sensor can provide different types of data to different control units, all of which are managed and authorized by a system set up as required during production, maintenance, or field connection.

[0077] Once sensor 10 has generated sensor data, in step S2, the sensor data is encrypted by encryption module 12 of processor 11. Then, in step S3, transmitter 14 sends the encrypted sensor data 24 to device 20. Figure 3 In step S4, the data is received by receiver 21 of device 20. In a preferred embodiment, the method further includes a step of deleting the sensor data after it has been transmitted to device 20 for storage in memory 22. Alternatively, sensor 10 can be used to delete sensor data after it has been transmitted to device 20 for storage in memory 22.

[0078] Then, in step S5, the encrypted sensor data 24 is stored in the memory 22 of device 20. At this point, when a user of device 20 wishes to access some or all of the encrypted sensor data 24, in step S6, the processor 25 of device 20 can generate an access request, which may optionally specify a subset of the encrypted sensor data 24 that the user of device 20 wishes to access. The access request is a request from device 20 to perform some operation on the encrypted sensor data, and will be discussed in detail below. In step S7, the transmitter 26 of device 20 sends the request along with an authorization token 23 or a copy thereof to sensor 10. It should be noted that in some cases, transmitter 26 may only send the authorization token 23. In this case, sensor 10 may send a key to device 20 that enables the execution of all permitted actions.

[0079] The authorization token 23 includes access control data that defines the sensor data 24 that the device 20 is allowed to access. For example, the access control data may define one or more subsets of the sensor data 24 that the device 20 is allowed to access. Furthermore, the access control data may define the operations that the device 20 can perform on the encrypted sensor data.

[0080] The features of authorization token 23 will be described in more detail below in this application. Return Figure 2 In step S8, the receiver 15 of sensor 10 receives an access request and an authorization token 23 from the transmitter 26 of device 20. Then, in step S9, the access determination module 13 of the processor 11 of sensor 10 determines, based on the access control data in the authorization token 23, whether device 20 is allowed to access encrypted sensor data 24. In some cases, the access determination module 13 determines which encrypted sensor data 24 is allowed to be accessed by device 20, or which operations are allowed to be performed by device 20. This access determination process is the core of the invention and will be described in more detail below. In step S10, sensor 10 (specifically its transmitter 14) sends one or more access keys to device 20, which can be used to perform the permitted operations. Finally, returning to... Figure 3In step S11, the receiver 21 of device 20 receives the access key, and the processor 25 of device 20 uses one or more access keys to perform permitted operations on the encrypted sensor data 24.

[0081] Figure 4 An alternative example of the sensor module 100 is shown, which may form part of the system of the present invention or may perform the methods of the present invention (e.g., as shown in the diagram). Figure 2 The steps S1, S2, S3, S8, S9, and S10 are shown. Figure 4 The basic structure of the sensor module 100 is similar to Figure 1 The structure of sensor 10 is shown, but many optional features are illustrated.

[0082] although Figure 4 The optional features are shown in a single graph, but it should be emphasized that, due to their optional nature, it is not necessary to be exactly as shown in the graph. Figure 4 All these features are present in combination as shown. For illustrative purposes, these optional features are shown in a single sensor 100, and it should be understood that... Figure 4 Any, some, or all of the features shown in the alternative sensor 100 can be excluded from the example, and the resulting arrangement does not fall outside the scope of this disclosure.

[0083] and Figure 1 Similarly, the structure of sensor 100 will be described first, followed by an explanation of the functions of various optional modules. Sensor 100 includes a sensor secure environment (SSE) 101, which can be defined as a subsystem of sensor 100, enabling controlled storage and use of sensor data. One purpose of the secure environment, such as SSE 101, is to protect secure / confidential data in the event of data loss. SSE 101 can use encryption methods such as hashing as a means of protecting information. Figure 4 In this configuration, SSE 101 includes a processor 102, a memory 104, a data acquisition module 103, and a device interface module 106. Preferably, the processor 102 and memory 104 are located within SSE 101; however, the device interface module 106 may be located within sensor 100 but outside of SSE 101. Device interface module 106 acts as an interface between external signals and devices (e.g., device 20 or device 200) and sensor 100. Figure 4 The device interface module 106 includes a transmitter 124 and a receiver 126. Alternatively, in other cases, the device interface module 106 may simply act as an interface for transmitting signals to the transmitter 124 and receiving signals from the receiver 126; such examples are still within the scope of the invention.

[0084] Figure 4 The processor 102 may include one or more of an encryption module 108, an access determination module 110, and an authorization module 112. Similarly, the memory 104 may include persistent memory 114 and a buffer 116. The buffer capacity may be from 100KB to 10MB. In this document, the term "persistent memory" should be understood as long-term or permanent storage. Only data that requires long-term storage (such as metadata 118 and encryption key data 120 in this example) should be stored on persistent memory 114. The nature of this data will be described in more detail below. Buffer 116 is short-term storage and can be used to store sensor data 122 after it has been generated and before it has been transmitted by, for example, transmitter 124 to a device (e.g., 20 or 200).

[0085] Now will be Figure 2 and Figure 3 A more detailed description within the context of advanced methods. Figure 4 The components shown have functionality, and any other optional features are listed.

[0086] The data collection module 103 is a module of the sensor 100. The data collection module 103 itself performs sensing, and therefore may include a sensing element 105 for sensing, detecting, and / or measuring some external parameters. The sensing element 105 may include one or more of the following: a temperature sensor, a light sensor, a sound sensor, a humidity sensor, a CO2 sensor, a smoke sensor, a pressure sensor, a proximity detector, or a camera. The data collection module 103 may also include one or more devices for measuring one or more of the following: voltage, current, resistance, magnetic field strength, magnetic flux density, capacitance, inductance, frequency, and wavelength. The sensing element 105 may also include an accelerometer. It should be understood that the sensing element 105 may include devices for sensing, detecting, or measuring any form of external physical or environmental stimulus. In addition to detecting physical or environmental stimuli, the sensing element 105 may be implemented as a software module for detecting the occurrence of a predetermined process in a computer device (e.g., a computer, tablet, or smartphone). For example, the sensing element 105 may be used to detect a predetermined data processing operation or a specific result of a data processing operation. Sensing element 105 may include a counter for counting the number of times a specific event occurs. Data collection module 103 may optionally include its own processor for converting the raw data collected by sensing device 105 into a form that can be processed by processor 102. Alternatively, the raw data may be sent directly to processor 102, where it is then converted into a more suitable form. It should be understood that sensor 100 may include more than one data collection module 103. Each data collection module 103 may also include one or more sensing elements 105 of the type described in this paragraph.

[0087] exist Figure 2 In step S2, the sensor data is encrypted. Before discussing the encryption process, it is helpful to describe in more detail the possible properties of the obtained sensor data and the optional processes that can be performed on the sensor data before encryption.

[0088] When sensor data is first collected, processor 102 can generate a header and attach it to the data. Between data collection and header attachment, the sensor data can be stored in buffer 116 of the sensor 100's memory 104 for processing. Buffer 116 is suitable for this type of storage because it is only short-term storage. The header preferably contains metadata containing information about the sensor data. The metadata preferably includes one or more of the following: a timestamp indicating the time and / or date of data collection; a sensor ID indicating the identity of the sensor 100 or sensing element 105 that collected the data; a data type indicating the type of data (e.g., the physical parameter to which the data belongs or the type of activity detected); a nonce material; key generation data that can be used to generate the required key; and sensor information such as hardware and firmware numbers (e.g., ID and version). These are referred to as the "type of metadata". Sensor data can be divided into multiple subsets. These subsets can be exclusive subsets, meaning each sensor data belongs to only one subset. Alternatively, each sensor data can belong to one or more subsets. A subset can include only a single sensor data.

[0089] Sensor data can be further subdivided into subsets based on the first type of metadata. In other words, sensor data can be divided into multiple subsets, each recorded within a different time frame, or each subset being a different type of data, or each subset being recorded by a different sensor. Sensor data can be further subdivided into multiple subsets based on the second type of metadata.

[0090] In this document, the term "segmentation" does not necessarily mean that sensor data is divided or that different subsets are stored separately from each other, although this can be an optional case. However, preferably, multiple subsets can be allocated based on metadata, but these subsets are not separate from each other (at least at this point). At this point, multiple data subsets have been established, each optionally including a header containing metadata that provides information about the data, and the subset is based on the metadata. Data with additional headers can then be temporarily stored in buffer 116 of the memory 104 of sensor 100.

[0091] Then, the encryption module 108 of the processor 102 is used to encrypt the sensor data to generate encrypted sensor data. The encryption module 108 can be used to encrypt both the sensor data and the header, but preferably only the sensor data. Specifically, the encryption module 108 is used to encrypt each subset of multiple data subsets with different corresponding encryption keys. This is straightforward when each sensor data belongs to a single subset of multiple subsets.

[0092] However, the situation is more complex when a piece of data may belong to or be assigned to more than one subset (e.g., a subset based on the time of recording the data, and a subset based on the sensing element 105 of the recorded data), and can be handled in any of the following ways: (i) The encryption module 108 can be used to encrypt each sensor data with a different corresponding key to generate a single encrypted sensor dataset, each encrypted sensor data corresponding to a corresponding (raw, unencrypted) sensor data. The processor 102 (optionally, its encryption module 108) can then append a header to each encrypted sensor data, the header including metadata identifying one or more subsets of data to which the encrypted sensor data belongs (or more specifically, one or more subsets to which the corresponding unencrypted sensor data belongs). This is in Figure 6 As shown, keys K1 through K4 are used for sensor data A through D, respectively. In this paper, one set of sensor data is generated each time, and two subsets are identified in each header. (ii) Encryption module 108 can be used to encrypt each piece of data in each corresponding subset with the same encryption key to generate multiple encrypted data corresponding to subsets of the original, unencrypted sensor data. Encryption module 108 can be used to do this for all subsets of data (note that these subsets can overlap). In the case of overlapping subsets of sensor data (i.e., where each piece of sensor data belongs to more than one subset), for a given unencrypted sensor data, multiple encrypted sensor data can be generated, each encrypted sensor data being encrypted with a different corresponding encryption key, each encryption key being associated with a corresponding subset of the subset to which the unencrypted sensor data belongs or is assigned. Similarly, processor 102 (optionally, its encryption module 108) can append a header to each encrypted sensor data, the header including metadata identifying the subset of data to which the encrypted sensor data belongs (or more specifically, one or more subsets to which the corresponding unencrypted sensor data belongs). This is in Figure 6 As shown, each sensor data is encrypted twice: once using a key corresponding to its "time subset" and once using a key corresponding to its "data type" subset. K1 is used for data in subset T1, K2 for data in the temperature subset, K3 for data in the current subset, and K4 for data in subset T2. It can be seen that, depending on case (ii), more than twice the amount of encrypted data is generated.

[0093] Now let's discuss how encryption is performed. In a simple case, encryption module 108 can be used to encrypt given sensor data (in this application, unless otherwise stated, the term "sensor data" can be understood as unencrypted sensor data) using an encryption key to generate corresponding encrypted sensor data. The encryption key can be a symmetric key or an asymmetric key. Each of these types of keys has its own advantages depending on the system's priority. For example, generating a symmetric key is much simpler, so if the encryption key is a symmetric key, the processing requirements of processor 102 are reduced, allowing the sensor 100 to be simpler, smaller, and less expensive to manufacture. On the other hand, asymmetric keys are more secure but require more processing power to generate and apply.

[0094] In order to identify and transmit the appropriate access key to device 20 or device 200 in response to a request and a determination of permitted access, sensor 100 needs to be able to store a key associated with metadata or encrypted data identifying sensor data in memory 104. Alternatively, to reduce the storage requirements of sensor 104's memory 104, the processor 102 of sensor 100 may be able to reliably regenerate the access key based on some input. Both possibilities are described below.

[0095] Figure 7 The method for the first case is shown. Figure 7The processing performed on a single sensor data point is illustrated. In step S108A, the encryption module 108 receives sensor data, which includes metadata identifying the subset to which the sensor data belongs. Then, in step S108B, the encryption module 108 (or optionally, the processor 102) performs a lookup in the encryption key data table 120 to determine if an encryption key corresponding to the subset exists. Optionally, before performing this step, the encryption module 108 or the processor 102 may remove a header from the sensor data and extract metadata (not shown) containing a subset ID or indicating a subset ID from the sensor data. If an encryption key exists, in step S108C, the key is recovered from the encryption key data table 120, and the sensor data is encrypted using the key in step S108E. Even if it is determined that no key corresponding to the subset exists, in step S108D, a new key is generated, for example by the key generation module 109, and this new key is stored in the encryption key data table 120 before being used to encrypt the sensor data in step S108E. The method can stop here, but optionally, it can continue to step S108F, where it is determined whether the sensor data belongs to any other subset. If it does not belong to any other subset, the processing of the data is complete, and the method can optionally return to step S108A to receive another set of sensor data. Otherwise, if it is determined that the sensor data does indeed belong to another subset of sensor data, the method returns to step S108B. Using this method, as more sensor data is received, the encryption key data table 120 grows larger. Figures 8A to 8B Two examples of sample layouts for encryption key data tables are shown below. Figure 8A In this context, the encryption key is stored in association with a subset ID representing a specific subset, while... Figure 8B In this context, encryption keys are stored in association with specific metadata corresponding to subsets and subset IDs. In slightly different cases, subset IDs may not be included in the encryption key data table 120.

[0096] It should be noted that when the encryption module 108 uses an asymmetric key to encrypt sensor data, in step S108D, an encryption key and a complementary decryption key are generated, and both the encryption key and the decryption key are then stored in the encryption key data table 120. Alternatively, once the encryption key is generated and used, it can be deleted, and only the decryption key is stored.

[0097] In the example given above, the encryption key data table 120 is generated and grows larger as more sensor data is received. This can be undesirable in some situations, such as when the capacity of memory 104 is limited. Therefore, in an alternative example, the key generation module 109 can be used to generate encryption keys based on metadata or a subset of IDs and one or more of local key generation data 118, which is unique and secret to sensor 100. This way, once the encryption key has been generated, it does not need to be stored in the sensor 100's memory or elsewhere, as the encryption key can be reliably regenerated based on the metadata associated with the sensor data it protects. Only the local key generation data 118 needs to be stored in memory. Figure 9 An example of the method is shown. In step S109A, the encryption module receives sensor data. Then, in step S109B, the key generation module 109 can generate an encryption key based on the metadata in the header of the sensor data and local key generation data 118. It is important to use local key generation data 118 and keep it secret; otherwise, any other actor could potentially regenerate the key using only known metadata, which poses a significant and non-negligible security risk. In step S109C, the generated encryption key is used to encrypt the sensor data. The generated encryption key can then be deleted in step S109D. Alternatively, the generated encryption key can be stored in buffer 116 and in temporary key data table 123. In this way, when encountering another set of sensor data from the same subset, the encryption module 108 can perform a lookup in the temporary key data table 123 to determine if an encryption key corresponding to that subset has already been generated. In this case, the encryption key is recovered from the temporary key data table 123 and used to encrypt subsequent sensor data. This can be particularly useful when the subset is based on the time of data collection, thus allowing the same encryption key to encrypt a range of sensor data, all collected within a predetermined timeframe. Therefore, the generated encryption keys stored in the temporary key data table 123 can have an associated lifespan or expiration time, after which these encryption keys are removed from table 123. After encrypting the sensor data in step S109C and removing the sensor data fragment in step S109D, the method returns to step S109A, where new sensor data arrives. In the case of generating an asymmetric key, in step S109B, the key generation module 109 generates an encryption key and a complementary decryption key. Then, in step S109C, the encryption key (preferably a private key) is used to encrypt the sensor data. The decryption key is preferably a public key.

[0098] Encrypting the data using a generated or recovered encryption key ensures that the data is effectively scrambled into an unidentifiable form, thereby ensuring its confidentiality—that is, ensuring that a user intercepting the data transmission cannot derive any meaning from it. In addition to encrypting the sensor data, it is equally important that sensor 100 and device 20 or device 200 can ensure that the data they receive is received from the entity they believe to be receiving it—this is called "authentication." Many schemes can be used for this process, such as encrypt-then-MAC, MAC-then-encrypt, and encrypt-and-MAC. Preferably, the encrypt-then-MAC process is used in this invention. This will be explained with reference to the first sensor data, but it will be understood that the method can be applied to every input sensor data.

[0099] Figure 10 An example of this is illustrated. First, in step S108M, the sensor data can be encrypted as described in the preceding paragraphs to generate encrypted sensor data. Then, in step S108N, the encryption module 108 can be used to apply an authentication key to the encrypted sensor data to generate a message authentication code (referred to herein as "MAC"). It should be emphasized that the encrypted sensor data is not deleted; the MAC is generated together with the encrypted sensor data. Then, in step S108O, the encrypted sensor data and the MAC can be concatenated to generate a message. This arrangement of information will be discussed below. In some cases, the authentication key can be applied to the sensor data before encrypting it with the encryption key. This is described elsewhere in this application.

[0100] At this time, Figure 2 In step S3, the encrypted sensor data is transmitted by transmitter 124 to device 20 or device 200. Specifically, encrypted sensor data or messages generated as described in the previous paragraph can be transmitted. In some cases, encryption module 108 may transmit the encrypted sensor data to buffer 116 for temporary storage instead of sending it immediately after the encrypted sensor data is generated. Then, when the amount of encrypted sensor data in buffer 116 exceeds a predetermined threshold, transmitter 124 may send all the encrypted sensor data. Alternatively, transmitter 124 may be used to send all the encrypted sensor data in buffer 116 at regular time intervals. Before discussing the steps performed by device 20 or device 200 in more detail, it is helpful to consider the structure of the devices in more detail.

[0101] Therefore, it is very similar to Figure 4 , Figure 5An alternative example of device 200 is shown, which may form part of the system of the present invention or may perform the methods of the present invention (e.g., steps S4, S5, S6, S7, S11, and S12). Figure 5 The basic structure of device 200 is similar to Figure 1 The structure of device 20 is shown, but many optional features are illustrated. Although Figure 5 The optional features are shown in a single graph, but it should be emphasized that, due to their optional nature, it is not necessary to be exactly as shown in the graph. Figure 5 All these features are present in combination as shown. For illustrative purposes, these optional features are shown in a single device 200, and it should be understood that... Figure 5 Any, some, or all of the features shown in the alternative device 200 may be excluded from the examples, and the resulting arrangement does not fall outside the scope of this disclosure.

[0102] Before discussing the components that make up device 200, it is important to consider what device 200 actually is. In a preferred embodiment, device 200 is an edge device. In the context of this invention, the term "edge device" should be understood as a device that provides an entry point into a network of devices, possessing some processing capabilities to allow decentralized processing, thereby improving the efficiency of the entire network. In some cases, the device may be a server. The device may also be an electronic control unit of a vehicle or other system, or a basic embedded system with a multipoint control unit (MCU) that uses one or more types of sensor data as input.

[0103] Figure 5 Device 200 is connected to security platform 300 via connection C2. Security platform 300 includes an authorization token generation module 302, the function of which will be described below. For example, like sensor 100, device 200 includes a secure environment, in this case a device secure environment (DSE) 201. Figure 5 In the example shown, DSE 201 includes a processor 202 and a memory 204. Furthermore, DSE 201 may also include a user interface module 206, a sensor interface module 208, and a security platform interface module 209. Although the above five components... Figure 5 While shown as part of DSE 201, it should be understood that one or more of these components may be located outside of DSE 201. Processor 202 may include one or more of a decryption module 210, an access request generation module 212, and an authorization module 214. Memory 204 may include persistent memory 216 (with...) Figure 4 (with the same meaning in the text), it can itself store authorization token 216 and encrypted sensor data 220. User interface module 206 may include display 222 and user input receiver 224. Sensor interface module 208 may include transmitter 226 and receiver 228. Finally, security platform interface module 209 may also include transmitter 230 and receiver 232 (optionally, transmitter 230 and receiver 232 may be the same as transmitter 226 and receiver 228, respectively). Now in Figure 3 The method is described in the context of the method shown. Figure 5 It describes the operation of various components and exposes optional features.

[0104] In step S4, the receiver 228 of the sensor interface module 206 receives encrypted sensor data transmitted by the transmitter 124 of the sensor 100. Then, in step S5, the received encrypted sensor data 220 is stored in the persistent memory 216.

[0105] At this point, the user of device 200 may need to access a subset of the data collected by the sensing element 105 of the data collection device 103 of sensor 100. The user is typically a maintenance user who needs access to the subsystem's data (i.e., the sensor data stored in device 20). The user can connect to the device using, for example, a smartphone, USB drive, maintenance device, or device UI, and provide their credentials to obtain an authorization token, thereby requesting a key to process the sensor data.

[0106] Therefore, in step S6, the access request generation module 212 generates an access request. Data that allows user access is managed by the authorization token 218; therefore, before discussing the generation of the request by the access request generation module 212, the nature of the authorization token 218 will be described.

[0107] In a broader sense, authorization token 218 is an electronic token deployed in permanent memory 216 of memory 204 of device 200. Authorization token 218 includes access control data that defines one or more subsets of sensor data that device 200 is allowed to access. For example... Figure 5 As shown, the authorization token 218 can be generated by the authorization token generation module 302 of the security platform 300.

[0108] The authorization token 218 can define a subset using, for example, a subset ID (or preferably, metadata associated with the subset). Specifically, the authorization token 218 can define one or more of the following: - The types of data that device 200 is allowed to access. For example, the authorization can specify that only device 200 is allowed to access temperature data. - The timestamps or timestamp ranges of data that device 200 is allowed to access. For example, authorization token 218 can specify that device 200 is only allowed to access data recorded in October 2020. - In a system with more than one sensor 100, the authorization token can specify that only device 200 is allowed to access data from a specific sensor 100. Optionally, in a system 100 that includes multiple sensing elements 105, the authorization token 218 can specify that only device 200 is allowed to access data collected by a specific sensing element 115.

[0109] In addition to specifying metadata related to the collected sensor data, the authorization token 218 may also include other constraints. For example, in some cases, the authorization token 218 may define one or more validity conditions. In this document, a "validity condition" refers to a rule that defines when the authorization token 218 can be valid, usable, or effective. If a validity condition is not met, the authorization token 218 is considered invalid. Validity conditions may include one or more of the following: - Restrictions on the validity period of authorization token 218. For example, authorization token 218 may be valid only on the first day of each month, or it may be valid only within a year (this should not be confused with restrictions on the time period for recording sensor data. The validity condition is a regional attribute of the authorization token itself, which applies regardless of the nature of the sensor data in question). After this period, authorization token 218 may expire. - A limit on the number of times the authorization token 218 can be used. The authorization token 218 may include a usage counter that increments by 1 each time it is used, and the authorization token 218 may expire after the usage counter reaches a predetermined value. - Restrictions on the user of authorization token 218. For this purpose, authorization token 218 may specify its valid user credentials or set of user credentials. In this case, the processor 102 of sensor 100 or the processor 202 of device 200 may be used to compare the user credentials in authorization token 218 with, for example, user credentials included in a request or user credentials received at user input interface 206 of device 200. If the user credentials do not match, authorization token 218 may then be considered invalid. In a system comprising multiple devices 200, the authorization token 218 may also specify the specific device 200 (or multiple devices) authorized to access the requested sensor data. If the request originates from a different device, the authorization token 218 may be deemed invalid, and the request may be rejected.

[0110] Authorization token 218 can specify a specific type of data access: - Authorization token 218 can specify that only device 200 is allowed to decrypt and read the associated encrypted sensor data 220. In other words, device 200 will not be able to modify the data. - Authorization token 218 can specify that device 200 is allowed to decrypt and authenticate related encrypted sensor data 220. - Authorization token 218 can specify that only the device 200 is allowed to authenticate encrypted sensor data 220 in encrypted form, that is, the encrypted sensor data 220 is not decrypted.

[0111] Now refer to Figure 5 The optional features of this process are described. In step S6, an access request is generated. In some examples of this method, the access request includes an indication of one or more subsets of encrypted sensor data. However, in other cases, the request does not include such an indication. In the latter case, step S7 only includes transmitting a request for access to some data and an authorization token 218 to sensor 100.

[0112] However, ideally, the request includes some indication of encrypted sensor data 220 stored in the device's memory 204 (which the device 200 wishes to access (i.e., decrypt)). Before generating the access request, the user input receiver 224 of the user interface module 206 may receive user input from the user. The user input may be in the form of a request for access to a specific subset of the data acquired by the sensor 100. This request may include information identifying the subset of sensor data the user wishes to access; for example, the request may include the type of data, the time range in which the data was collected, and / or the specific sensor or sensing element that collected the data. As mentioned above, when the data is first collected, a header containing metadata may be appended to the data, including information about that specific sensor data. In some cases, the request from the user may include the same form of metadata.

[0113] After receiving a data request via the user interface module 208, the access request generation module 212 generates a request based on the content received from the user. This can happen in many ways, with largely similar results. In general, these cases can be categorized into two types: (i) the request identifies a subset ID, and (ii) the request does not identify a subset ID. (i) In some cases, a request received by the user input receiver 224 may include metadata in a form compatible with or equivalent to the metadata stored in memory, and the request may then be directly forwarded to the access request generation module 212. The access request generation module 212 can then be used to perform a lookup in the encrypted sensor data 220 to determine one or more subsets of data corresponding to the relevant metadata. For example, using... Figure 6The data in the intermediate table serves as an example; if the access request is for all temperature data, then a subset of "temperature" data will be returned. As will be apparent from the rest of this application, the subset can have an associated subset ID (e.g., a numeric or alphanumeric ID). The access request generation module 212 then generates a request containing subset IDs corresponding to all metadata received via the user interface. Optionally, the request may also include metadata. In a slightly modified version of the method, if the request received by the user input receiver 224 includes data in a format unsuitable for processing by the access request generation module 212, the method may include additional steps to convert the request received by the user interface 206 into metadata in a format suitable for processing by the access request generation module 212. Therefore, the processor 202 may also include, as... Figure 5 The metadata conversion module 211 shown. (ii) Optionally, once a request is received at the user interface 206, the access request generation module 212 can be used to generate a request that includes metadata without looking up and identifying the subset ID.

[0114] At this point, the access request generation module 212 has generated a request, which optionally includes an indication of a subset of the encrypted sensor data 220 that it wishes to decrypt. The indication of the subset may be in the form of metadata related to the data or in the form of a subset ID.

[0115] Then, in step S8, the transmitter 226 of the sensor interface module 208 sends a request and authorization token 218 to the sensor 100. At this point, the process returns... Figure 2 In step S8, the receiver 126 of the device interface module 106 receives the request and authorization token 218.

[0116] Before the access determination module 110 determines which sensor data the device 200 is allowed to access, if the authorization token 218 includes validity conditions, the processor 102, sensor 100, or access determination module 110 may optionally first determine whether the validity conditions are met.

[0117] Then, in step S9, processor 102 (specifically, its access determination module 110) uses authorization token 218 to determine whether to allow device 200 to access its requested sensor data. Several cases exist herein: the request does not include an indication of the requested data, the request includes metadata but not the subset ID, and the request includes the subset ID. These cases will be discussed below. (i) If the request does not include an indication of the requested data, the only information that sensor 100 (specifically its access determination module 110) needs to continue processing is the information stored in authorization token 218, which is received along with the data request. In effect, this is a request for the decryption key for all encrypted sensor data that device 200 is authorized to access. As previously described, the authorization token may include metadata identifying a subset of data that device 200 can access, or the authorization token may include a specific subset ID. In either case, access determination module 110 can then perform a lookup of the metadata and / or subset IDs in encryption key data table 120 and recover the decryption key associated with each metadata or subset ID. It should be understood that, in the case where the encryption key is symmetric, the decryption key is the same as the encryption key. (ii) When requesting metadata that device 200 wishes to access, it is first necessary to verify whether device 200 is allowed to access the data. Therefore, the access determination module 110 verifies the metadata or subset ID in the request based on the access control data of the authorization token 218. Specifically, the access determination module compares the metadata or subset ID in the request with the metadata or subset ID listed in the access control data. Several possible results may occur: If it is determined that device 200 is permitted to access all requested metadata or subset IDs, then access determination module 110 can look up all requested metadata or subset IDs in encryption key data table 120 and recover the decryption key associated with each metadata or subset ID. It should be understood that, in the case of a symmetric encryption key, the decryption key is the same as the encryption key. - If it is determined that only certain metadata or a subset of IDs requested in the device 200 access request are allowed, then: a. The request will be considered invalid, and the method will terminate, or b. The access determination module 110 will determine which metadata or subset IDs in the access request are allowed to the device 200, and will only look up those metadata or subset IDs in the encryption key data table 120, and recover the decryption key associated with each of those metadata or subset IDs. It should be understood that, in the case that the encryption key is symmetric, the decryption key is the same as the encryption key. If it is determined that device 200 is not allowed to access any requested metadata or subset ID, the request will be considered invalid and the method will terminate.

[0118] Optionally, there may be an additional step in which the processor 102 performs a lookup to identify a subset ID corresponding to metadata in the request or metadata that the device 200 can access, and then uses the identified subset ID as input to perform a lookup in the encryption key data table 120.

[0119] The above pertains to a scenario where the encryption / decryption keys are stored in the encryption key data table 120. However, the possibility of generating encryption and / or decryption keys based on metadata and / or subset IDs, as well as locally stored key generation data 118, is also discussed. In these cases, if no data is specified or indicated in the request, the access determination module 110 may forward all metadata and / or subset IDs defined in the access control data of the authorization token 218 to the encryption module 108, the key generation module 109, or any other suitable module (not shown) of the processor 102. Here, the method may include the step of generating a decryption key for each encrypted sensor data corresponding to the metadata and / or subset IDs defined by the access control data. As discussed earlier in this application, the decryption key is determined in the same manner as the encryption key.

[0120] The process is similar for requests that include indications of requested metadata / subset IDs. First, it's necessary to verify whether device 200 is permitted to access the data. Therefore, the access determination module 110 verifies the metadata or subset ID in the request based on the access control data of the authorization token 218. Specifically, the access determination module compares the metadata or subset ID in the request with the metadata or subset ID listed in the access control data. Then, as described above: If it is determined that device 200 is permitted to access all requested metadata or subset IDs, the access determination module 110 may forward all metadata and / or subset IDs defined in the request to encryption module 108, key generation module 109, or any other suitable module of processor 102 (not shown). Here, the method may include the step of generating a decryption key for each encrypted sensor data corresponding to the metadata and / or subset IDs defined by access control data. As discussed earlier in this application, the decryption key is generated deterministically in the same manner as the encryption key. - If it is determined that only certain metadata or a subset of IDs requested in the device 200 access request are allowed, then: a. The request will be considered invalid, and the method will terminate, or b. Access determination module 110 will identify the metadata or subset IDs in the request that allow device 200 to access. Access determination module 110 may then forward all identified metadata and / or subset IDs defined in the access control data of authorization token 218 to encryption module 108, key generation module 109, or any other suitable module of processor 102 (not shown). Here, the method may include the step of generating a decryption key for each encrypted sensor data corresponding to the metadata and / or subset IDs defined by the access control data. As discussed earlier in this application, the decryption key is determined in the same manner as the encryption key. If it is determined that device 200 is not allowed to access any requested metadata or subset ID, the request will be considered invalid and the method will terminate.

[0121] At this point, a decryption key corresponding to the encrypted sensor data 220 defined by metadata or subset ID has been generated or recovered on sensor 100, for example, by key generation module 109, access determination module 110, or any other appropriate module on processor 102. In some cases, a decryption key corresponding to all encrypted sensor data 220 allowed to be accessed by device 200, as defined by metadata or subset ID (such as access control data in an authorization token), has been recovered or generated. In other cases, a decryption key corresponding to all encrypted sensor data 220 defined by metadata or subset ID included in the request has been recovered or generated. And, in still other cases, a decryption key corresponding to all encrypted sensor data 220 defined by metadata or subset ID allowed to be accessed by device 200, as included in the request and as defined by access control data in an authorization token. Then, in step S10, transmitter 124 of device interface module 106 of sensor 100 transmits these decryption keys to device 200.

[0122] return Figure 3 The receiver 228 of the sensor interface module 208 of device 200 receives the transmitted key, and then the decryption module 210 of processor 202 can use the received decryption key to decrypt the required data for further processing, thereby completing the method.

[0123] Figure 11 A system 1000 comprising various components is illustrated. As will be understood from the following description, system 1000 represents an environment in which the present invention can be deployed. Specific use cases are also described below with particular reference to relevant sensor types and operating parameters. The methods of the present invention have been described in detail in the foregoing description, and various options are not repeated herein; however, it should be understood that any feature previously described may be combined with any of the following features where compatible.

[0124] System 1000 includes multiple sensors 1002a, 1002b, 1002c, 1002d, and 1002e (although it should be understood that the container may include any number of sensors (including only a single sensor 1002)). Each sensor 1002 can be used to perform the method of the first aspect of the invention. Each sensor 1002 may include a buffer memory in which sensor data is temporarily stored, such as a protection key generated and stored on the corresponding sensor 1002. Optionally, as previously described, the sensor 1002 may generate a key on a specific basis, and the key may be used only to protect the generated sensor data and not stored on the sensor 1002. The sensor 1002 may be as previously described in this application.

[0125] System 1000 also includes multiple devices 1006a, 1006b, and 1006c. Figure 11 In the example shown, each device 1006 may correspond to a corresponding sensor 1002. However, this is not mandatory. For example, imagine that each sensor 1002 can send its generated protected sensor data to a single device 1006. Alternatively, a single sensor 1002 can send different types of protected sensor data to different devices 1002. In this example, device 1006 may be in the form of a monitoring station on or near system 1000, or device 1006 may be a terminal device (accessible by a user) or a control unit. For illustrative purposes, an example of each of these components is provided below. Figure 11 As shown in the image.

[0126] Each device 1006 may include memories 1008a, 1008b, 1008c (where protected sensor data may be stored) and corresponding processors 1010a, 1010b, 1010c. One use of device 1006 is to allow users to access permitted data, such as for system maintenance, control, or quality control purposes. Several examples are as follows (reiterating that although these examples are disclosed herein in conjunction with specific examples of system 1000, these examples can be generally applied to any implementation of the invention): Device 1006a may be a terminal having a display 1012a. The memory of terminal 1008a may include an authorization token, authorizing... The authorization token includes access control data. In this case, when a user wants to access protected sensor data, they can activate the terminal and enter a command, causing terminal 1006a to send an access request and / or authorization token to sensor 1002a. Therefore, according to one embodiment of the present invention, sensor 1002a can send a relevant access key to terminal 1006a. Allows users to perform related access, such as viewing data on the display, or modifying and re-encrypting data. Device 1006b can also be a terminal with a display 1012b. In this example, terminal 1006b differs from terminal 1006a in that terminal 1006b does not have an authorization token. In this case, a user who wants to access protected sensor data can have their own portable device 1014b (e.g., a laptop, tablet, smartphone, etc.) with an authorization token deployed on it. Device 1006b includes an interface 1016b (which can be a physical or wireless interface) through which the user can connect to portable device 1014b. Portable device 1014b can then deploy the authorization token to device 1006b. At this point, the authorization token can be considered to be deployed on device 1006b. Alternatively, the authorization token can remain on portable device 1014b. In this case, the combination of device 1006b and portable device 1014b can be considered to represent "a device on which an authorization token is deployed" or an equivalent. The steps described above can then be performed. Data access can be achieved via the display 1012b or the display 1018b of the portable device 1014b. • Device 1006c may be a control unit, which is used to control one or more components 1020 in system 1000. Operating parameters. The control unit 1006c of system 1000 can be used to adjust one or more operating parameters based on sensor data. To obtain the sensor data, the control unit 1006c needs to access protected sensor data stored in its memory 1008c. An authorization token is stored on the control unit 1006c, although the authorization token can be deployed via a portable device. Then, according to one embodiment, the control unit 1006c can receive an appropriate key to access the desired data. The control unit 1006c can then be used to change, select, or otherwise determine the value of one or more operating parameters based on the sensor data. By protecting data according to the invention, it can be ensured that unauthorized devices cannot control the operating parameters.

[0127] The following describes some specific use cases.

[0128] In one scenario, system 1000 may be in the form of a container for transporting goods (e.g., a transport container). For example, the container may be used for long-distance transport of food. In this case, the container may include a refrigeration unit, which may include a temperature sensor, and the operating parameter may be the temperature of the storage area of ​​the refrigeration unit.

[0129] In this way, system 100 can safely monitor the temperature of the refrigeration unit and adjust the temperature based on the received temperature data. In the container example, other sensors that can be included are other types of environmental sensors, such as temperature sensors, humidity sensors, pressure sensors, door status sensors, motion sensors, etc. Therefore, users such as maintenance personnel or engineers can monitor the conditions inside the container, and because only authorized personnel can access the data, there is no risk of sensor data tampering, and any tampering can be ensured to be detectable.

[0130] In another scenario, system 1000 can be in the form of a vehicle, such as a car, train, airplane, bus, helicopter, or any other means of transportation. In a preferred embodiment, system 1000 can be in the form of an "intelligent" vehicle. The invention is particularly advantageous in both cases involving vehicles or intelligent vehicles (having various types of sensors, such as radar sensors, laser sensors (including 3D LiDAR sensors), or ultrasonic sensors): • Monitoring. In this case, the sensors may include wear sensors, each used to monitor the phase of the vehicle. The sensor may be used to measure parameters indicating the "health" or "wear" of vehicle components, depending on wear and tear. In particularly advantageous cases, the sensor or device may generate an alarm when it detects that the value of a measured parameter meets or exceeds a predetermined threshold. The alarm can notify the vehicle's user or owner that the vehicle should be taken for repair. Registered engineers may also have access to sensor data (or different subsets of sensor data) to assist in repair work. This ensures that only registered or authorized engineers can repair vehicles with problems. • Control. This invention can be used to enable advanced driver assistance systems (ADAS) or autonomous functions in vehicles. In this document, the term "autopilot" should be understood to refer to any automatic control of a vehicle, not necessarily just an aircraft. This function can be implemented analogously to the refrigeration control discussed with regard to containers. Sensors can be used to detect various parameters related to the control of the vehicle, such as proximity to other vehicles or obstacles, position (e.g., the position of a car on a map, the position of an aircraft relative to a runway, the position of a ship relative to a seabed feature), altitude, depth, speed / rate, and vehicle orientation. Based on these parameters, the control unit can then be used to determine or change the values ​​of one or more operating parameters. For example, this function can be used for the automatic landing of an aircraft, the stopping of a car or train, or the mooring of a ship. This invention is advantageous in this case because it ensures that unauthorized devices cannot access sensor data (unauthorized access to sensor data would obviously have disastrous consequences).

[0131] Similar to the use cases of intelligent vehicles, this invention can also be applied to industrial control systems within the aforementioned monitoring and control context. In other words, System 1000 can be an industrial control system. In a monitoring environment, the system's operation may be very similar to that of an intelligent vehicle. In the case of industrial control, the parameters measured by the sensors may differ. For example, sensors may be used to measure environmental conditions such as temperature, pressure, humidity / moisture levels, pH values, concentrations or partial pressures of certain substances. Additional conditions may include various electrical characteristics (e.g., current, voltage, power, electric field strength / magnetic flux density, magnetic field strength / magnetic flux density, charge, resistance, inductance, capacitance, conductivity / conductivity, resistivity / resistivity), thermal conductivity, and any other parameters that can provide indications of the progress of an industrial process. Furthermore, the use of "wear" sensors is envisioned for monitoring the health of industrial components. As previously mentioned, the control unit can be used to change one or more operating parameters based on sensor data.

[0132] Another application of this invention is in hospitals.

[0133] The features disclosed in the foregoing description, claims, or drawings, expressed in their particular form or according to the means for performing the disclosed functions or the methods or processes for obtaining the disclosed results, can be used alone to implement different forms of the invention or in any combination of these features to implement different forms of the invention.

[0134] Although the present invention has been described in conjunction with the exemplary embodiments described above, many equivalent modifications and variations will be apparent to those skilled in the art upon presentation of this disclosure. Therefore, the exemplary embodiments of the present invention described above are to be considered illustrative rather than restrictive. Various changes may be made to the described embodiments without departing from the spirit and scope of the invention.

[0135] To avoid any ambiguity, any theoretical explanations provided herein are intended to enhance the reader's understanding. The inventor does not wish to be bound by any of these theoretical explanations.

[0136] Any section headings used herein are for organizational purposes only and should not be construed as limiting the subject matter described.

[0137] Throughout this specification, including the preceding claims, unless the context otherwise requires, the word “comprising” and variations such as “including” shall be understood to imply inclusion of the said integer or step size or a set of integers or steps, but not to exclude any other integer or step size or a set of integers or steps.

[0138] It should be noted that, unless the context explicitly specifies otherwise, the singular forms “a,” “an,” and “the” as used in the specification and appended claims include plural references. A range herein may be expressed as from “about” one particular value and / or to “about” another particular value. When such a range is expressed, another embodiment includes from one particular value and / or to another particular value. Similarly, when a value is expressed as an approximation, the particular value can be understood to form another embodiment by using the antecedent “about.” The term “about” in relation to numerical values ​​is optional, for example, indicating + / - 10%.

Claims

1. A method for controlling access to sensor data, the method comprising the following steps: Generate sensor data and protect the sensor data to generate protected sensor data; as well as The protected sensor data is transmitted to the device for storage; The sensor receives an authorization token, which includes access control data that defines one or more operations that the device is allowed to perform on the protected sensor data. The sensor determines, based on the access control data, the operations that the device is permitted to perform on the protected sensor data; Provide the device with one or more keys that the device can use to perform permitted operations on the protected sensor data.

2. The method according to claim 1, wherein: Protecting sensor data includes using a secret key to protect the sensor data.

3. The method according to claim 1 or 2, wherein: The method further includes deleting the sensor data and / or the protected sensor data after the step of transmitting the protected sensor data to the device.

4. The method according to claim 1 or 2, wherein: The protection of the sensor data includes: Apply the first secret key to the sensor data to generate first protected sensor data; and If the access control data definition allows the device to perform a first operation on the first protected sensor data, then the providing step includes: providing the device with a first complementary key that can be used by the device to perform the first operation, the first complementary key being a complement to the first secret key.

5. The method according to claim 4, wherein: The first secret key is an encryption key; The first protected sensor data is encrypted sensor data; The first operation is either a decryption operation or a read operation; The providing steps include: Provide the device with a complementary key in the form of a decryption key.

6. The method according to claim 5, wherein: The protection of the sensor data includes: Applying a second secret key to the first protected sensor data to generate second protected sensor data; and (i) If the access control data definition allows the device to perform a second operation on the second protected sensor data, then the providing step includes: Provide the device with a second complementary key, which the device can use to perform the second operation on the second protected sensor data; or (ii) If the access control data definition allows the device to perform the first operation and the second operation, then the providing step includes: The device is provided with a first complementary key and a second complementary key, the second complementary key being usable by the device to perform the second operation on the second protected sensor data to recover the first protected sensor data, and the first complementary key being usable by the device to perform the first operation on the first protected sensor data; (iii) If the access control data definition allows the device to perform a third operation on the second protected data, then the providing step includes: The device is provided with a first complementary key and a second complementary key, the combination of which can be used to perform the third operation on the second protected sensor data.

7. The method according to claim 6, wherein: The first secret key is the first authentication key; The second secret key is the encryption key; The steps for protecting the sensor data include: The first authentication key is applied to the sensor data to generate an authentication code, wherein the first protected sensor data is a combination of the sensor data and the authentication code; The encryption key is applied to the first protected sensor data to generate encrypted sensor data.

8. The method according to claim 7, wherein: If the access control data definition allows the device to decrypt the encrypted sensor data, then the providing step includes providing the device with a decryption key that the device can use to decrypt the encrypted sensor data; as well as If the access control data definition allows the device to decrypt and re-authenticate the encrypted sensor data, or modify the sensor data, then the providing step includes: The device is provided with the first authentication key and the decryption key, and the combination of the first authentication key and the decryption key can be used to modify the sensor data; or The device is provided with a first authentication key and a decryption key, the decryption key being used by the device to decrypt the encrypted sensor data to recover the combination of the sensor data and the authentication code, thereby enabling the device to modify the sensor data to generate modified sensor data, and the first authentication key being used by the device with the modified sensor data to generate a second authentication code.

9. The method according to claim 1 or 2, wherein: The sensor data includes a first subset of sensor data and a second subset of sensor data; The steps for protecting the sensor data include: Protect a first subset of the sensor data to generate a first subset of protected sensor data; and Protect a second subset of the sensor data to generate a second subset of protected sensor data; The access control data is defined as follows: A first operation is permitted for the device to perform on a first subset of the protected sensor data; and / or A second operation is permitted for the device to perform on a second subset of the protected sensor data; The determination step includes determining based on the access control data: The first operation that allows the device to perform on a first subset of the protected sensor data; and / or The second operation that allows the device to perform on a second subset of the protected sensor data; and The providing steps include: Only when it is determined that the device is permitted to perform the first operation, provide one or more keys that can be used by the device to perform the first operation on a first subset of the protected sensor data; and Only when it is determined that the device is permitted to perform the second operation, one or more keys are provided that can be used by the device to perform the second operation on a second subset of the protected sensor data.

10. A method for accessing protected sensor data via a device, the device storing an authorization token including access control data that defines one or more operations permitted by the device to be performed on the protected sensor data, the method comprising the steps of: Receive protected sensor data from the sensor; Store the received protected sensor data; Send the authorization token to the sensor; as well as The device receives one or more keys from the sensor, which can be used by the device to perform permitted operations on the protected sensor data.

11. The method of claim 10, further comprising: Send an access request to the sensor, the access request specifying the requested operation to be performed on the protected sensor data.

12. The method according to claim 10 or 11, wherein: The protected sensor data includes a first subset of protected sensor data and a second subset of protected sensor data; The access control data is defined as follows: A first operation is permitted for the device to perform on a first subset of the protected sensor data; and / or A second operation is permitted for the device to perform on a second subset of the protected sensor data; The receipt of one or more keys includes: Only when the access control data defines that the device is allowed to perform the first operation, receive one or more keys that the device can use to perform the first operation on a first subset of the protected sensor data; as well as Only when the access control data defines that the device is allowed to perform the second operation, one or more keys that can be used by the device to perform the second operation on a second subset of the protected sensor data are received.

13. The method of claim 12, comprising: Send an access request to the sensor, the access request specifying one or more of the following: The first operation to be performed on a first subset of the protected sensor data, and The second operation to be performed on a second subset of the protected sensor data.

14. The method according to claim 10 or 11, wherein: The authorization token defines one or more validity conditions, which are conditions that must be met for the authorization token to be valid. The validity conditions include one or more of the following: Limitation on one or more time periods during which the authorization token is valid; A limit on the number of times the authorization token can be used; Restrictions on user credentials or sets of user credentials that can be associated with the authorization token; and Restrictions on the device that sends the authorization token.

15. A sensor for generating sensor data and for controlling access to said sensor data, said sensor for performing the method according to any one of claims 1 to 9.

16. An apparatus for processing protected sensor data, the apparatus being used to perform the method according to any one of claims 10 to 14.

Images