Secure storage system including loading processor

Abstract

The present disclosure provides a storage system in which a set of encryption keys is used to control the operation (one or more) of loading processing devices in an automated storage and retrieval system. One of the encryption keys may be permanently stored in a non-volatile data memory loading the processing device and used to authenticate another key from the group of keys to enable operations to be performed, such as connecting to a control system, introducing into a storage and retrieval system, and the like.

Description

Technical Field

[0001] The present disclosure relates to a method and system for controlling a load handling device, and more particularly to a method and system for use with a robot in a storage system. Background Art

[0002] Grid-based automated storage and retrieval systems are well known in the art. In such a system, a plurality of robotic load handling devices operate on a horizontal grid structure, beneath which are received a plurality of containers arranged in a plurality of stacks. The containers are used to store products, and the load handlers are adapted to retrieve a container from one of the plurality of stacks and place the container in one of the stacks. The load handlers may travel along a route on the grid in an autonomous (or semi-autonomous) manner, but require a wireless communication system to convey instructions to the load handlers and to enable each load handler to communicate with a management system. The claimed apparatus, method, system, and computer program are directed to improvements in the communication system used in an automated retrieval and storage system using swarms of robotic load handlers. Summary of the Invention

[0003] According to a first aspect of the present disclosure, there is provided a method of operating a load handling device in a storage system, the method comprising the steps of: generating a set of encryption keys associated with the load handling device; storing a first encryption key of the set of encryption keys in the load handling device; using a second encryption key of the set of encryption keys to authenticate the first encryption key stored in the load handling device such that software can only be installed on the load handling device when the authentication is successful.

[0004] The first encryption key may be permanently stored in the load handling device. The first encryption key may be permanently burned into a non-volatile data storage unit, and the non-volatile data storage unit may then be installed in the load handling device.

[0005] The method may further comprise the step of: using a third encryption key of the set of encryption keys to authenticate the first encryption key stored in the load handling device such that the load handling device is only introduced into the storage system when the authentication is successful. Introducing the load handling device into the storage system may include establishing a connection between the load handling device and the storage system via a wireless communication system. Alternatively, the method may further comprise the step of: using a fourth encryption key of the set of encryption keys to authenticate the first encryption key stored in the load handling device such that the load handling device can only be connected to the storage system via the wireless communication system when the authentication is successful.

[0006] The method may further include the step of: the loading processing device generates one or more local encryption keys for use in the loading processing device. The one or more local encryption keys may be generated based on a first encryption key stored in the loading processing device.

[0007] According to a second aspect of the present disclosure, there is provided a loading processing device for use in a storage system. The loading processing device includes a non-volatile data memory, a volatile data memory, one or more processors, and a first communication interface for communicating with a wireless communication network of the storage system. Wherein, in use, a first encryption key from a set of encryption keys associated with the loading processing device is stored in the non-volatile data memory of the loading processing device; and software can only be installed on the loading processing device when a second encryption key from the set of encryption keys successfully authenticates the first encryption key.

[0008] The first encryption key may be permanently stored in the non-volatile data memory of the loading processing device. The non-volatile data memory of the loading processing device may include a one-time programmable storage device.

[0009] The loading processing device may further include an encryption processor. The encryption processor may be configured to generate one or more additional encryption keys. The encryption processor may be configured to generate one or more additional encryption keys based on the first encryption key stored in the non-volatile data memory of the loading processing device.

[0010] The loading processing device may only be introduced into the storage system when a third encryption key from the set of encryption keys successfully authenticates the first encryption key. Introducing the loading processing device into the storage system may include establishing a connection between the loading processing device and the storage system through a wireless communication system. Alternatively, the loading processing device may only be connected to the storage system through the first communication interface when a fourth encryption key from the set of encryption keys successfully authenticates the first encryption key.

[0011] According to a third aspect, there is provided a storage system comprising: a first set of parallel tracks extending in the X direction and a second set of parallel tracks extending in the Y direction, the second set of parallel tracks being transverse to the first set in a substantially horizontal plane to form a grid pattern including a plurality of grid spaces; a stack of a plurality of storage containers, the stack of a plurality of storage containers being located below the tracks and arranged such that each stack is within the coverage area of a single grid space; at least one transport device as described above, the at least one transport device being arranged to selectively move on the tracks above the stacks in the X direction and / or the Y direction and being arranged to transport storage containers; and a picking station, the picking station being arranged to receive the storage containers transported by the at least one transport device and to convey items from the storage containers into a delivery container. The at least one transport device may have a coverage area that occupies only a single grid space in the storage system, such that a transport device occupying one grid space does not impede a transport device occupying or passing through an adjacent grid space in the X direction and / or the Y direction.

[0012] According to a further aspect, there is provided a data carrier device comprising computer-executable code for performing the above method. Description of the Drawings

[0013] The communication system will now be described in detail with reference to embodiments, in which: FIG. 1 schematically shows a storage structure and containers; FIG. 2 schematically shows tracks on top of the storage structure shown in FIG. 1; FIG. 3 schematically shows a loading handling device on top of the storage structure shown in FIG. 1; FIG. 4 schematically shows a single loading handling device with a container lifting tool in a lowered configuration; FIG. 5 schematically shows a cross-sectional view of a single loading handling device with a container lifting tool in a raised configuration and a lowered configuration; Figure 6 A schematic depiction of a communication system enabling a plurality of robots to communicate with a central computing device is shown; Figure 7 A schematic depiction of a system capable of deploying software to robots in an automated storage and retrieval system is shown; Figure 8 A schematic depiction of Figure 6 and Figure 7 a further embodiment of the communication system of Figure 9 A schematic depiction of a robot PC is shown; Figure 10 A schematic depiction of a method by which an encryption key can be transmitted is shown; Figure 11A schematic depiction showing an embodiment of bootloader code; and Figure 12 A schematic depiction of a computer device 1000 used in an implementation of a communication system is shown. Detailed implementation

[0014] The following embodiments represent the applicant's preferred embodiments of how to implement a communication system for use with robots in a warehouse, but they are not necessarily the only embodiments for achieving this purpose.

[0015] FIG. 1 shows a storage structure 1 including upright members 3 and horizontal members 5, 7 supported by the upright members 3. The horizontal members 5 are parallel to each other and extend parallel to the shown x-axis. The horizontal members 7 are parallel to each other and extend parallel to the shown y-axis and extend transversely to the horizontal members 5. The upright members 3 are parallel to each other and extend parallel to the shown z-axis and extend transversely to the horizontal members 5, 7. The horizontal members 5, 7 form a grid pattern defining a plurality of grid cells. In the shown embodiment, containers 9 are arranged in stacks 11 below the grid cells defined by the grid pattern, with each grid cell having one stack 11 of containers 9.

[0016] FIG. 2 shows a large-scale plan view of a section of the track structure 13 that forms part of the storage structure 1 shown in FIG. 1 and is located on top of the horizontal members 5, 7 of the storage structure 1 shown in FIG. 1. The track structure 13 can be provided by the horizontal members 5, 7 themselves (e.g., formed in or on the surfaces of the horizontal members 5, 7) or by one or more additional components mounted on top of the horizontal members 5, 7. The shown track structure 13 includes x-direction tracks 17 and y-direction tracks 19, i.e., a first set of tracks 17 extending in the x-direction, and a second set of tracks 19 extending in the y-direction and transversely to the first set of tracks 17. The tracks 17, 19 define holes 15 at the centers of the grid cells. The size of the holes 15 is designed to allow the containers 9 located below the grid cells to be lifted and lowered through the holes 15. The x-direction tracks 17 are separated by channels 21 and are arranged in pairs, and the y-direction tracks 19 are separated by channels 23 and are arranged in pairs. Other arrangements of the track structure are also possible.

[0017] FIG. 3 shows a plurality of load handling devices 31 moving on top of the storage structure 1 shown in FIG. 1. The load handling devices 31 (also referred to as automated handling devices 31 or robots 31) are provided with wheel sets to engage with the corresponding x- or y-direction tracks 17, 19 so that the robot 31 can travel on the track structure 13 and reach a specific grid cell. The shown pairs of tracks 17, 19 separated by the channels 21, 23 enable the robot 31 to occupy (or pass by each other) adjacent grid cells without colliding with each other.

[0018] As shown in detail in FIG. 4, the robot 31 includes a main body 33, and one or more components enabling the robot 31 to perform its intended functions are installed in or on the main body 33. These functions may include moving across the storage structure 1 on the track structure 13 and raising or lowering the container 9 (e.g., from or to the stack 11), such that the robot 31 can retrieve or deposit the container 9 at specific positions defined by the grid pattern.

[0019] The illustrated robot 31 includes a first set of wheels and a second set of wheels 35, 37, and the first and second sets of wheels 35, 37 are mounted on the main body 33 of the robot 31 and enable the robot 31 to move along the tracks 17 and 19 in the x and y directions, respectively. Specifically, two wheels 35 are visibly provided on the shorter side of the robot 31 in FIG. 4, while the other two wheels 35 are provided on the opposite shorter side of the robot 31 (this side and the other two wheels 35 are not visible in FIG. 4). The wheels 35 engage with the track 17 and are rotatably mounted on the main body 33 of the robot 31 to allow the robot 31 to move along the track 17. Similarly, two wheels 37 are visibly provided on the longer side of the robot 31 in FIG. 4, while the other two wheels 37 are provided on the opposite longer side of the robot 31 (this side and the other two wheels 37 are not visible in FIG. 4). The wheels 37 engage with the track 19 and are rotatably mounted on the main body 33 of the robot 31 to allow the robot 31 to move along the track 19.

[0020] The robot 31 further includes a container lifting tool 39 configured to raise and lower the container 9. The illustrated container lifting tool 39 includes four straps or reels 41 connected to a container engagement assembly 43 at its lower end. The container engagement assembly 43 includes an engagement tool configured to engage with features of the container 9 (e.g., the engagement tool may be provided at the corners of the assembly 43, near the straps 41). For example, the container 9 may be provided with one or more holes on its upper side, and the engagement tool can engage with one or more holes. Alternatively or additionally, the engagement tool may be configured to hook under the edge or lip of the container 9, and / or clamp or grip the container 9. The straps 41 can be wound up or down as needed to raise or lower the container engagement assembly. One or more motors or other tools may be provided to effect or control the up or down winding of the straps 41.

[0021] As seen in FIG. 5, the main body 33 of the illustrated robot 31 has an upper portion 45 and a lower portion 47. The upper portion 45 is configured to receive one or more operating components (not shown). The lower portion 47 is disposed below the upper portion 45. The lower portion 47 includes a container receiving space or cavity for receiving at least a portion of the container 9 that has been lifted by the container lifting tool 39. The size of the container receiving space is designed such that the container 9 can be fully inserted into the interior of the cavity, enabling the robot 31 to move on the track structure 13 at the top of the storage structure 1 without the lower side of the container 9 getting caught on the track structure 13 or another part of the storage structure 1. When the robot 31 reaches its intended destination, the container lifting tool 39 controls the belt 41 to lower the container gripping assembly 43 and the corresponding container 9 from the cavity of the lower portion 47 to the intended position. The intended position may be the stack 11 of containers 9 or the exit point of the storage structure 1 (or, if the robot 31 has moved to collect the container 9 for storage in the storage structure 1, the entry point of the storage structure 1). Although in the illustrated embodiment, the upper and lower portions 45, 47 are separated by a physical separator, the upper and lower portions 45, 47 may not be physically separated by a specific component or part of the main body 33 of the robot 31.

[0022] To enable the robot 31 to move on different wheels 35, 37 in the first and second directions, the robot 31 includes a wheel positioning mechanism for selectively engaging the first set of wheels 35 with the first set of tracks 17 or engaging the second set of wheels 37 with the second set of tracks 19. The wheel positioning mechanism is configured to raise and lower the first set of wheels 35 and / or the second set of wheels 37 relative to the main body 33, thereby enabling the load handling device 31 to selectively move in the first direction or the second direction on the tracks 17, 19 of the storage structure 1.

[0023] The wheel positioning mechanism may include one or more linear actuators, rotating components, or other tools for raising and lowering at least one set of wheels 35, 37 relative to the main body 33 of the robot 31 to bring at least one set of wheels 35, 37 into contact with and out of contact with the tracks 17, 19. In some embodiments, only one set of wheels is configured to be raised and lowered, and the act of lowering one set of wheels can effectively lift the other set of wheels off the corresponding track, while the act of raising one set of wheels can effectively lower the other set of wheels into contact with the corresponding track. In other embodiments, both sets of wheels can be raised and lowered, which advantageously means that the main body 33 of the robot 31 remains substantially at the same height, so the weight of the main body 33 and the components mounted on the main body 33 do not need to be lifted and lowered by the wheel positioning mechanism.

[0024] To remove the container 9 from the top of the stack 11, the robot 31 moves in the X and Y directions as required so that the container gripping assembly 43 is positioned above the stack 11. The container gripping assembly 43 is then vertically lowered in the Z direction to engage the container 9 at the top of the stack 11. The container gripping assembly 43 grips the container 9 and is then pulled upward along with the attached container 9 by the belt 41. At the top of its vertical travel, the container 9 is received within the vehicle body and placed above the level of the track. In this way, the loading handling device 30 can be moved to different positions in the X-Y plane, transport the container 9 along with it, and transport the container 9 to another location. The belt 41 is long enough to allow the loading handling device 30 to retrieve and place the container from any level of the stack 11, including the ground level. The weight of the vehicle can be partially constituted by the battery used to power the drive mechanisms for the wheels 35, 37.

[0025] As shown in FIG. 3, a plurality of loading handling devices 31 are provided so that each robot 31 can operate simultaneously to increase the throughput of the system. The system shown in FIG. 3 can include specific locations (referred to as ports) where the container 9 can be transported into or out of the system. An additional conveyor system (not shown) is associated with each port so that the container 9 transported to the port by the robot 31 can be transported to another location by the conveyor system, such as to a picking station (not shown). Similarly, the container 9 can be moved from an external location to the port by the conveyor system, such as to a container filling station (not shown), and transported by the robot 31 to the stack 11 to replenish the inventory in the system.

[0026] Each robot 31 can lift and move one container 9 at a time. If it is necessary to retrieve a container ("target container") that is not at the top of the stack 11, the containers stacked above it ("non-target containers") must first be moved to allow access to the target container. This is achieved in an operation hereinafter referred to as "digging". During the digging operation, one of the robots 31 sequentially lifts each non-target container 9a from the stack 11 containing the target container 9b and places it in an empty position within another stack 11. The target container 9b can then be accessed by the robot 31 and moved to the port for further transportation.

[0027] Each robot 31 is controlled by a grid controller. Each individual container 9 in the tracking system is tracked so that the appropriate container 9 can be retrieved, transported, and replaced as required. For example, during the digging operation, the position of each non-target container is recorded so that the non-target containers can be tracked.

[0028] The system described with reference to FIGS. 1 to 5 has many advantages and is suitable for a wide range of storage and retrieval operations. Specifically, it allows products to be stored very densely and provides a very economical way to store a large number of different goods in the containers 9, while allowing all the containers 9 to be accessed reasonably economically when picking is required.

[0029] It should be understood that messages need to be sent to the robots. These messages can be short messages, such as an instruction to move a container from a first position to a second position, or the messages can be larger messages, such as an update of computer code used to operate the robot or components of the robot. Similarly, the robots may also need to send messages to the central management system, such as reporting operating parameter values, operating status reports, etc. Embodiments of a communication system that can be used are disclosed in the applicant's international patent application WO 2015 / 185726.

[0030] Figure 6 A schematic depiction of a communication system 100 enabling a plurality of robots 31 to communicate with a central computing device 400 is shown. The central computing device executes a number of different computer programs in order to be able to send instructions to each of the plurality of robots and receive messages returned from each of the plurality of robots. Messages sent by the central computing device to the robots can instruct the robots to: move to a specific grid location; place the container it is carrying at the current location; retrieve the topmost container from the current location; move to a charging point for battery charging; etc. Messages returned by the robots to the central computing device can include: confirmation that the message from the central computing device has been received and action is being taken; a request for the robot to move to a charging point for battery charging; a request for the robot to return for maintenance activities, etc. The central computing device controls the operation of the storage and retrieval system so as to (but not limited to): store the received products for subsequent retrieval; retrieve the stored products so that customer orders can be picked, packed and dispatched in a timely manner; the products stored in the storage and retrieval system are arranged and rearranged to support the efficient operation of the system.

[0031] The communication system 100 includes base stations 200A and 200B. Each robot 31 includes a radio antenna so that it can communicate with one of the base stations. The communication system may further include a base station controller (BSC) 300 that controls the operation of the base stations (e.g., when a robot is handed over from a first base station to a second base station). The BSC communicates with a computing device and is configured to route messages from the computing device to the robots via the appropriate base station and vice versa. Known wireless communication systems for use with such an automated storage and retrieval system are disclosed in WO 2015 / 185726, WO 2018 / 127437, and WO2018 / 177788. In an alternative, for example, if the communication system is designed to cover a large warehouse or fulfillment center, the communication system may include more than two base stations. In a further alternative, for example, if the communication system is designed to cover a smaller warehouse or fulfillment center, the communication system may include only a single base station. In such a case, a base station controller is not required in the communication system.

[0032] Figure 7 A schematic depiction of a system that can securely deploy software code to a robot 31 is shown, where the robot 31 operates as part of an automated storage and retrieval system. The system includes one or more than one base station 200 (only one base station is shown for clarity, Figure 7 ), a base station controller (BSC) 300, a central computing device 400, an encryption server 500, and a plurality of robots 31 (again, only one of the plurality of robots is shown for clarity, Figure 7 ). Based on the foregoing discussion with respect to FIGS. 3 to 5, each of the plurality of robots 31 further includes a communication interface 34 and a robot PC 40. The communication interface 34 enables communication between the robot and the base station 200 and may include a suitable modem device, such as a 4G modem, a WiFi modem, etc. The communication interface 34 is connected to the robot PC 40 such that signals received from the base station can be routed to the robot PC and vice versa. The structure of the robot PC 40 will be described below with reference to Figure 9 for illustration.

[0033] Thus, messages can be communicated between the central computing device and the robot's robot PC such that control messages transmitted by the central computing device can be received by the robot PC and then processed for the robot to take action: for example, the robot can: activate one of the robot's drive mechanisms to move the robot in its current direction; activate a container lifting tool to lower or raise the container; activate a wheel positioning mechanism to change the direction of the robot's movement, etc. Similarly, messages from the robot PC can be routed back to the central computing device so that: for example, if data generated in the robot (e.g., a sensor) indicates an impending fault condition, the central computing device can instruct the robot to return to the maintenance area so that preventive action can be taken, or alternatively, the robot can be remotely controlled back to the maintenance area.

[0034] Each fulfillment center will include such a communication system, and it should be understood that a single enterprise will likely include a plurality of such fulfillment centers. The components forming each of these systems can be considered to form separate security zones 600. Each of these security zones can be connected to the enterprise security zone 700. The enterprise security zone 700 can include an enterprise encryption server 710.

[0035] In use, encryption operations can be used in the operation of the robot PC and extended to the operation of the robot. For each robot operating within a fulfillment center, a set of encryption keys is generated such that each set of encryption keys includes one or more encryption keys. For example, the enterprise encryption server 710 can be used to generate a set of encryption keys for each of the plurality of robots operating in each fulfillment center, where the fulfillment center is operated by the enterprise operating the enterprise encryption server 710. The set of keys can then be transmitted to their respective robots and then used in the operation of the robots. The keys can be distributed to their respective robots through the encryption server 500 for the fulfillment center in which the robot operates. Alternatively, the encryption server 500 can generate the required multiple sets of keys for use by the plurality of robots active in this fulfillment center. The creation of the set of keys by the encryption server can be initiated or otherwise controlled by the enterprise encryption server.

[0036] The enterprise encryption server and the encryption server 500 or each encryption server 500 perform the functions of a certification authority within the public key infrastructure and the functions of other entities in order to be able to create, manage, and revoke digital certificates and encryption keys as needed, thereby assisting in the operation of the robots within the fulfillment center and other operations of the fulfillment center in a secure manner.

[0037] In some cases, a fulfillment center may not have an encryption server deployed therein. In such a case, the required encryption functionality may be provided by an enterprise encryption server. In an alternative arrangement, an encryption server in one fulfillment center may provide the required encryption functionality for one or more other fulfillment centers. In a further variation, the enterprise encryption server may provide the required encryption functionality for all fulfillment centers.

[0038] As can be seen from the following discussion, it may be necessary to supply one or more sets of encryption keys to different entities. For example, a company that operates an automated storage and retrieval system to deliver products to customers is unlikely to manufacture the robots that operate within the storage and retrieval system. In such a case, it will be necessary to transfer the key (or keys) for each robot to be manufactured. The manufacturer will need to operate an additional encryption server capable of receiving and managing the received keys. A secure communication channel will need to be provided to ensure the secure transfer of keys between different entities.

[0039] Figure 8 Illustrated above with reference to Figure 6 and Figure 7 is a schematic depiction of a further embodiment of the communication system 100 described above. In this embodiment, the communication system 100 further includes a second wireless communication network. In one embodiment, the second wireless communication network is a peer-to-peer wireless communication network and includes one or more peer-to-peer wireless transceivers. The transceiver or each transceiver 450 of the second wireless communication network is connected to a central computing device 400, for example, via a fixed Ethernet communication link. More specifically, the second wireless communication network is a peer-to-peer optical free space communication network. It should be understood that although the encryption server 500 and the base station(s) 300 are not shown in Figure 8 for clarity, they are still present in the Figure 8 communication system.

[0040] Each of a plurality of robots may further include a second network interface 36 connected to the robot PC 40. The second network interface is also configured to enable the robot PC to communicate with the central computing device via the second wireless communication network. The central computing device may include a software library 410 that includes an operating system and one or more applications required to control the operation of the robots (see the description below regarding Figure 9 ). If the software of the robot needs to be updated, the required files can be transferred from the software library to the robot via the second wireless communication network and subsequently installed on the robot PC.

[0041] It should be understood that, in an alternative, the software library can be stored elsewhere, such as on a server or a cloud computing platform communicatively connected to the central computing device, and the software can be transmitted from the server or the cloud computing platform to the robot.

[0042] The second wireless communication network can include a plurality of transceivers configured such that they can communicate with a robot located at a predetermined grid cell location. In one embodiment, if the robot needs to upgrade one or more elements of the software operating the robot PC, the robot can navigate to one of the predetermined grid cell locations so that the second network interface 36 of the robot can communicate with one of the plurality of transceivers of the second wireless communication network. In a further embodiment, the transceivers of the second wireless communication network can be configured such that they can communicate with a robot located at a charging location, which can be located at the periphery of the grid. Thus, when the robot moves to the charging location to recharge the battery (or batteries) powering the robot, the robot can be connected to the central computer device via the second wireless communication network. If one or more elements of the software operating the robot PC need to be updated, then these elements can be transmitted from the software library to the robot via the second wireless communication network and subsequently installed on the robot PC.

[0043] Figure 9A schematic depiction of the robotic PC 40 is shown, which includes a central processing unit (CPU) 4010, a random access memory (RAM) 4020, a read-only memory (ROM) 4030, a non-volatile data storage unit 4040, an encryption processor 4050, and a one-time programmable memory (OTPM) 4060. The non-volatile data storage unit 4040 includes a bootloader 4042, an operating system 4044, and one or more application programs 4046. The robotic PC is configured such that the CPU is communicatively connected to each of the RAM, ROM, non-volatile data storage unit, and OTPM, such that the CPU can: access data stored in one or more of these entities; process the accessed data; or, write data to the RAM and / or non-volatile data storage unit. In combination with the above, it will be understood that the CPU is also communicatively coupled to the communication interface 34, such that data received from the communication system 100 can be transmitted to the CPU for processing, and similarly, data generated by the CPU can be routed through the communication interface 34 and the communication system to the central computing device 400. The robotic PC is further configured such that each of the bootloader 4042, operating system 4044, and one or more application programs 4046 can communicate with the encryption processor 4050. In one embodiment, the operating system and one or more application programs can be integrated into a single software package that can control the operation of the robot, communicate with the communication system, etc. In a further embodiment, the operating system can include a variant of Linux, and one or more application programs can include a single computer program. The operating system and one or more application programs can include firmware.

[0044] In use, encryption operations can be used in the operation of the robotic PC and can be extended to the operation of the robot. For each robot operating within a fulfillment center, a set of encryption keys is generated such that each set of encryption keys includes one or more encryption keys. As described above, each set of encryption keys can be generated by an enterprise encryption server or by the encryption server 500.

[0045] Figure 10A schematic depiction of a method is shown by which an encryption key can be transmitted. At S1010, a key set is generated for one of a plurality of robots. One or more keys in the key set are then transmitted to their respective robots (S1020). So that the received keys are then stored by the robots (S1030). Subsequently, a robot can make a request (S1040), for example, a request to connect to the communication system 100 via one of the base stations 200. It will be understood from the discussion below that a robot can make different types of requests. One of the keys held by the robot can be presented and, if a cryptographic challenge is passed, the robot request is permitted (S1070). For example, a private encryption key held in an encryption server can be used to decode a request that has been encoded with a public encryption key held by the robot. If the cryptographic challenge fails, the robot request is rejected (S1060).

[0046] In one embodiment, at step S1020, one or more private keys and / or one or more public keys are transmitted to the robots such that one or more additional private keys remain in the encryption server. One or more public keys can also remain in the encryption server. The key(s) received by the robot(s) can be stored in a non-volatile data storage unit of the robot PC. In one embodiment, the key can be permanently written into an one-time programmable memory (OTPM) 4060 such that the key is permanently associated with its respective robot. Thus, if this key needs to be updated or replaced with a new key, the OTPM needs to be removed from the robot PC, replaced with a new OTPM module and then the new key is permanently written into the new OTPM. The permanently stored key can be a public key or a private key. One or more keys can be permanently stored in the OTPM.

[0047] The public key stored in the robot can be used to encrypt a message that can be sent to the encryption server. The encryption server can then decrypt the message using one of the private keys held in the encryption server, the private key being selected from the same set of encryption keys as the public key stored in the robot. Subsequently, a response to the message can be sent to the robot. For example, a robot can request to connect to a base station 200 of the communication network 100. If the request is encrypted with the correct key, the robot is permitted to connect to the communication network. In the case where one or more keys are transmitted to the robot via the encryption server and the keys are permanently written into the OTPM, it can be seen that the control of accessing the communication network can reach a more secure level than relying on credentials such as robot ID and password.

[0048] The robot PC includes an encryption processor, which can be, for example, a Trusted Platform Module (TPM). The encryption processor can generate one or more additional keys, which can subsequently be used by the robot, either for operations within the robot or for operations involving external entities of the robot. This one or more additional keys can be generated based on one or more of the keys (one or more) received from the encryption server. For example, the encryption processor can be used to generate a symmetric key, which can be used to encrypt the content of the non-volatile data storage unit. Alternatively, one or more symmetric keys can be generated and used to encrypt the content of one or more of the bootloader, the operating system, and one or more applications. Alternatively or additionally, an asymmetric key can be generated, which can subsequently be used to create a device identity that can be used by the robot communicating with the central communication device 400.

[0049] As described above, the robot can access the software for the robot from the software library 410, which can be stored within the central computing device. To control the software deployed to the robot, an encryption key generated by the encryption server can be used to sign the software package. Additionally, the keys held by the robot can be used to authenticate the software packages or each software package that the robot needs to download. Alternatively or additionally, the robot can access the software library only when it can present the appropriate keys to the central computing device.

[0050] The following Table 1 gives an example of a set of keys that can be stored and used by the robot.

[0051] Table 1: Exemplary Group Keys Held by the Robot As can be seen from Table 1, using such an exemplary set of keys can utilize the encryption key to ensure that: only authorized robots can connect to the communication network; only encrypted-signed firmware can be downloaded and installed on the robot; the wireless communication between the robot and the central computing device is encrypted; the data stored in the robot is encrypted; and, the central computing device can securely remotely log in to the robot, for example, for maintenance purposes.

[0052] It is understandable that in some deployments of the robot, not all of these keys will be used because some of them may not be required. For example, a security audit can determine that if the security risk is below a predetermined level, no mitigation measures need to be taken for it. Alternatively, additional keys may be required to protect other aspects of the robot operation. For example, it may be necessary to provide two separate device identity keys. One of the keys can be used to register the robot to the network, while the second key can be used for continuous communication with the base station of the communication network. It is understandable that if necessary, keys with higher strength can be used.

[0053] Figure 11 illustrates a schematic depiction of an embodiment of the code content written to the bootloader 4042 of the robot (see Figure 9 ). The boot image 1100 includes a boot image header 1110, a secure boot descriptor 1120, peripheral configuration code 1130, and stage 2 code 1140. The secure boot 1120 descriptor includes certificate 1 1121, certificate 2 1122, certificate 3 1123, certificate 4 1124, a certificate revocation list (CRL) 1125, a peripheral configuration code signature 1126, and a stage 2 code signature 1127.

[0054] The boot up header 1110 defines the locations of the different elements of the boot image 1100 in the bootloader. Once started, the secure boot descriptor 1120 is loaded into the memory. The four certificates (certificate 1, certificate 2, certificate 3, and certificate 4) are referred to as the certificate block 1128. The hash value of the certificate block can be permanently written to the OTPM. Therefore, once started, the content of the certificate block can be hashed and compared with the value stored in the OTPM. If the values do not match, the startup will abort because the certificate values have been changed. If they match, the startup process can continue.

[0055] The peripheral code signature code can be compared with the peripheral code stored in the bootloader. Similarly, if they match, the startup program can continue, but if they do not match, the startup aborts. The next step is to compare the stage 2 code signature with the stage 2 code. If the signature and the code match, the startup continues. Executing the stage 2 code will cause the operating system to be executed, and subsequently one or more applications will be executed. If they do not match, the startup process aborts. It is very likely that the robot startup fails because of file corruption or incorrect keys used to generate the certificates or signatures. Such errors must be fixed in order to be able to use the robot subsequently.

[0056] The CRL includes a list of certificates that have been revoked, for example, by an enterprise encryption server and are no longer recognized. In one embodiment, four certificates (Certificate 1, Certificate 2, Certificate 3, and Certificate 4) are from Keys 1 to 4 listed in Table 1 above.

[0057] By way of example, Figure 12 A schematic depiction of a computer device 1200 used in an embodiment of the communication system of the present disclosure is shown. The computer device 1200 may include a central processing unit (“CPU”) 1202 connected to a storage unit 1214 and a random access memory 1206. The CPU 1202 may process an operating system 1201, application programs 1203, and data 1223. The operating system 1201, application programs 1203, and data 1223 may be stored in the storage unit 1214 and loaded into the memory 1206 as needed. The computer device 1200 may further include a graphics processing unit (GPU) 1222 operatively connected to the CPU 1202 and the memory 1206 to share the intensive image processing computations of the CPU 1202 and run these computations in parallel with the CPU 1202.

[0058] An operator 1207 may interact with the computer device 1200 using a video display 1208 connected through a video interface 1205 and various input / output devices (such as a keyboard 1215, a mouse 1212, and a disk drive or solid state drive 1214) connected through an I / O interface 1204. In a known manner, the mouse 1212 may be configured to control the movement of a cursor in the video display 1208 and operate various graphical user interface (GUI) controls appearing in the video display 1208 with mouse buttons. The disk drive or solid state drive 1214 may be configured to accept a computer-readable medium 1216. The computer device 1200 may form part of a network through a network interface 1211 to allow the computer device 1200 to communicate with other suitably configured data processing systems (not shown). One or more different types of sensors 1235 may be used to receive inputs from various sources.

[0059] It should be understood that the control of the storage system can be performed by a suitably configured industrial computing device. However, the functionality of the computing device can be implemented using almost any form of computer device, including desktop computers, laptops, tablets, wireless handheld devices, or cloud computing platforms. The computing device or multiple computing devices can execute one or more software instances, such as virtual machines and / or containers. The present system and method can also be implemented as a computer-readable / usable medium including computer program code to enable one or more computer devices to implement each of the various process steps in the method according to the present disclosure. In the case where multiple computer devices perform the entire operation, the computer devices can be networked to distribute the various steps of the operation.

[0060] It should be understood that the term computer-readable medium or computer-usable medium includes one or more in a physical implementation of any type of program code. Specifically, the computer-readable / usable medium can include program code incorporated on one or more portable storage articles (such as optical discs, magnetic disks, magnetic tapes, etc.), on one or more data memories (such as memories associated with a computer and / or a storage system) that are part of a computing device. In a further aspect, the present disclosure provides a system, device, method, and computer programming product for implementing such a method and achieving the foregoing functionality, including a non-transitory machine-readable instruction set.

[0061] In an alternative arrangement, the size of the storage and retrieval system can be such that a single base station is sufficient to provide radio coverage over the entire grid surface. In such a case, the BSC can be retained as a separate entity, or the functionality of the BSC can be integrated into the base station.

[0062] It is contemplated that any one or more of the variations described in the foregoing clauses can be implemented in the same embodiment of the communication system.

[0063] As used herein, the term "movement in the n direction" (and related expressions) is intended to express movement substantially along or parallel to the n-axis in any direction (i.e., towards the positive end or towards the negative end of the n-axis), where n is one of x, y, and z. As used herein, the words "connected" and its derivatives are intended to include the possibility of direct connection and indirect connection. For example, "x is connected to y" is intended to include the possibility that x is directly connected to y without an intermediate component and the possibility that x is indirectly connected to y with one or more intermediate components. When it is intended to express direct connection, the expressions "is directly connected", "directly connected", or similar expressions will be used. Similarly, the words "supports" and its derivatives are intended to include the possibility of direct contact and indirect contact. For example, "x supports y" is intended to include the possibility that x directly supports and is in direct contact with y without an intermediate component and the possibility that x indirectly supports y with one or more intermediate components that contact x and / or y. The words "mounted" and its derivatives are intended to include the possibility of direct mounting and indirect mounting. For example, "x is mounted on y" is intended to include the possibility that x is directly mounted on y without an intermediate component and the possibility that x is indirectly mounted on y with one or more intermediate components.

[0064] As used herein, the words "comprises" and its derivatives are intended to have an open-ended meaning rather than a closed meaning. For example, "x comprises y" is intended to include the possibility that x comprises one and only one y, a plurality of y, or one or more y and one or more other elements. When it is intended to express a closed meaning, "x consists of y" will be used, indicating that x includes only y and no other. As used herein, "controller" is intended to include any hardware suitable for controlling (e.g., providing instructions to) one or more other components. For example, a processor equipped with one or more memories and appropriate software to process data related to the component or components and send appropriate instructions to the component or components to enable the component or components to perform their intended functions.

[0065] In one aspect, the present disclosure provides a system for managing encryption keys for use by robots in an automated storage and retrieval system. By assigning a set of encryption keys to each robot, various robot functions can be achieved only when the appropriate encryption key is presented.

Claims

1. A method of operating a loading processing device in a storage system, the method comprises the following steps: generating a set of encryption keys associated with the loading processing device; storing a first encryption key of the set of encryption keys in the loading processing device; using a second encryption key of the set of encryption keys to authenticate the first encryption key stored in the loading processing device, such that software can only be installed on the loading processing device when the authentication is successful.

2. The method according to claim 1, wherein, the first encryption key is permanently stored in the loading processing device.

3. The method according to claim 2, wherein, the first encryption key is permanently burned into a non-volatile data storage unit, and the non-volatile data storage unit is subsequently installed into the loading processing device.

4. The method according to any of the preceding claims, wherein, the method further comprises the step of using a third encryption key of the set of encryption keys to authenticate the first encryption key stored in the loading processing device, such that the loading processing device is only introduced into the storage system when the authentication is successful.

5. The method according to claim 4, wherein, introducing the loading processing device into the storage system includes establishing a connection between the loading processing device and the storage system through a wireless communication system.

6. The method according to claim 4, wherein, the method further comprises the step of using a fourth encryption key of the set of encryption keys to authenticate the first encryption key stored in the loading processing device, such that the loading processing device can only be connected to the storage system through the wireless communication system when the authentication is successful.

7. The method according to any of the preceding claims, wherein, the method further comprises the step of the loading processing device generating one or more local encryption keys used in the loading processing device.

8. The method according to claim 7, wherein, the one or more local encryption keys are generated based on the first encryption key stored in the loading processing device.

9. A loading processing device used in a storage system, the loading processing device includes a non-volatile data memory, a volatile data memory, one or more processors, and a first communication interface for communicating with a wireless communication network of the storage system, wherein, in use, a first encryption key from a set of encryption keys associated with the loading processing device is stored in the non-volatile data memory of the loading processing device; and software can only be installed on the loading processing device when a second encryption key from the set of encryption keys successfully authenticates the first encryption key.

10. The loading processing device according to claim 9, wherein, the first encryption key is permanently stored in the non-volatile data memory of the loading processing device.

11. The loading processing device according to claim 9, wherein, The non-volatile data memory of the loading processing device includes a one-time programmable storage device.

12. The loading processing device according to any one of claims 9 to 11, wherein, the loading processing device further includes an encryption processor.

13. The loading processing device according to claim 12, wherein, the encryption processor is configured to generate one or more additional encryption keys in use.

14. The loading processing device according to claim 13, wherein, the encryption processor is configured to generate one or more additional encryption keys in use based on the first encryption key stored in the non-volatile data memory of the loading processing device.

15. The loading processing device according to any one of claims 9 to 14, wherein, in use, the loading processing device is introduced into the storage system only when a third encryption key from the set of encryption keys successfully authenticates the first encryption key.

16. The loading processing device according to claim 15, wherein, introducing the loading processing device into the storage system includes establishing a connection between the loading processing device and the storage system through a wireless communication system.

17. The loading processing device according to claim 15, wherein, in use, the loading processing device is connected to the storage system through the first communication interface only when a fourth encryption key from the set of encryption keys successfully authenticates the first encryption key.

18. The loading processing device according to any one of claims 9 to 17, the loading processor is configured to lift and move containers stacked in a stack of a storage structure, the storage structure includes a first set of tracks extending in a first direction above the stack of containers and a second set of tracks extending in a second direction transverse to the first direction, the loading processing device is configured to move on the tracks above the stack, the loading processing device further includes: a main body configured to accommodate one or more operating components; a container receiving space configured to accommodate at least a portion of a container; a first set of wheels and a second set of wheels, the first set of wheels being configured to engage with the first set of tracks to guide the movement of the loading processing device in the first direction, the second set of wheels being configured to engage with the second set of tracks to guide the movement of the loading processing device in the second direction; a wheel positioning mechanism configured to selectively engage the first set of wheels with the first set of tracks or engage the second set of wheels with the second set of tracks, the wheel positioning mechanism being configured to raise or lower the first set of wheels and / or the second set of wheels relative to the main body, so that the loading processing device can selectively move in the first direction or the second direction on the tracks of the storage structure; and A container lifting mechanism, the container lifting mechanism including a container engaging assembly configured to releasably engage a container, and a lifting and lowering assembly configured to raise and lower the container engaging assembly.

19. A storage system, the storage system comprising: a first set of parallel tracks extending in the X direction, and a second set of parallel tracks extending in the Y direction, the second set of parallel tracks being transverse to the first set in a substantially horizontal plane to form a grid pattern including a plurality of grid spaces; a stack of a plurality of storage containers, the stack of the plurality of storage containers being located below the tracks and arranged such that each stack is within the coverage area of a single grid space; at least one loading handling device according to any one of claims 9 to 18, the at least one loading handling device being arranged to selectively move in the X direction and / or the Y direction above the stack on the tracks and being arranged to transport storage containers; and a picking station arranged to receive storage containers transported by the at least one transport device and to transfer items from the storage containers into a delivery container.

20. The storage system according to claim 18, wherein the at least one transport device has a coverage area that occupies only a single grid space in the storage system, such that a transport device occupying one grid space does not impede a transport device occupying or passing through an adjacent grid space in the X direction and / or the Y direction.

21. A data carrier device, the data carrier device including computer-executable code for performing the method according to any one of claims 1 to 18.

Images