Environmental validation to control access to data

Abstract

A system for controlling access to data based on environmental validation includes a physical environment authenticator that receives data characterizing environmental parameters of a node within an environment from a set of environmental sensors. The physical environment authenticator compares a plurality of correlated environmental parameters to one another and / or to a threshold. The plurality of correlated environmental parameters are based at least in part on data from the set of environmental sensors, and access to the data is permitted if the plurality of correlated environmental parameters indicate that the node is operating in an authorized environment, and access to the data is prevented if the plurality of correlated environmental parameters indicate that the node is not operating in an authorized environment.

Description

[Technical field]

[0001] FIELD OF THE DISCLOSURE The present disclosure relates to data access, and more particularly, to a system and method for controlling access to data using environmental validation. [Background technology]

[0002] A secure computing platform (also called a secure cryptoprocessor) is a dedicated computer-on-chip or microprocessor for performing cryptographic operations, embedded in packaging with multiple physical security measures that give the secure computing platform a degree of tamper resistance. The Trusted Platform Module (TPM) is an international standard for secure computing platforms. A TPM can be implemented as a dedicated microcontroller designed to secure the hardware with an integrated cryptographic key.

[0003] The secure computing platform includes generation, storage, and management of on-board secure cryptographic keys. In addition, the secure computing platform can use such keys to perform decryption and encryption of content. In this manner, the secure computing platform can use a private key (e.g., an asymmetric key of an asymmetric key pair, or a symmetric key) to encrypt and / or decrypt data without revealing the private key to an external source. Summary of the Invention

[0004] One example relates to a system for controlling access to data based on environmental validation. The system may include a non-transitory memory having machine-executable instructions and a processing unit for accessing the machine-readable instructions. The machine-readable instructions may include a physical environment authenticator that receives data characterizing environmental parameters of a node in an environment from a set of environmental sensors. The physical environment authenticator may compare the plurality of correlated environmental parameters to one another and / or to a threshold. The plurality of correlated environmental parameters are based at least in part on data from the set of environmental sensors, and access to the data is permitted if the plurality of correlated environmental parameters indicate the node is operating in an authorized environment, and access to the data is prevented if the plurality of correlated environmental parameters indicate the node is not operating in an authorized environment.

[0005] Another example relates to a non-transitory machine-readable medium having machine-executable instructions. The machine-executable instructions may include a physical environment authenticator that receives a request for access to data from a node and, in response to the request, captures data characterizing a plurality of environmental parameters of the node from a set of environmental sensors. The physical environment authenticator may also compare the plurality of correlated environmental parameters to one another and / or to a threshold. At least a portion of the plurality of correlated environmental parameters are based on data from the set of environmental sensors, and if the plurality of correlated environmental parameters from each of the plurality of environmental sensors indicate that the node is operating in an authorized environment, access to the data is permitted, and if at least one of the plurality of correlated environmental parameters indicates that the node is not operating in an authorized environment, access to the data is denied.

[0006] Yet another example relates to a method of controlling access to data based on environmental validation. The method may include a physical environment authenticator executing on a secure computing platform receiving a request for access to data from a node. The method may also include the physical environment authenticator capturing data characterizing a plurality of environmental parameters of the node from a set of environmental sensors in response to the request. The method may further include the physical environment authenticator comparing the plurality of correlated environmental parameters to each other and / or to a threshold value. At least a portion of the plurality of correlated environmental parameters are based on data from the set of environmental sensors. The physical environment authenticator allows access to the data if the plurality of correlated environmental parameters of each of the set of environmental sensors indicate that the node is operating in an authorized environment and denies access to the data if at least one of the plurality of correlated environmental parameters indicates that the node is not operating in an authorized environment. [Brief description of the drawings]

[0007] [Figure 1] FIG. 1 illustrates an example of a system that uses environmental validation to control access to data. [Diagram 2] FIG. 2 illustrates an example of the system of FIG. 1 including a Global Navigation Satellite System (GNSS) receiver and an Inertial Measurement Unit (IMU). [Diagram 3] FIG. 2 illustrates an example of the system of FIG. 1 including an accelerometer and a flow meter. [Figure 4] FIG. 2 illustrates an example of the system of FIG. 1 including a three-axis accelerometer. [Diagram 5] FIG. 2 illustrates an example of the system of FIG. 1 including a deformation meter and an accelerometer. [Figure 6] FIG. 2 illustrates an example of the system of FIG. 1 including an acoustic sensor. [Figure 7] FIG. 2 illustrates an example of the system of FIG. 1 including a temperature sensor and a pressure sensor. [Figure 8] FIG. 2 illustrates an example of the system of FIG. 1 including an orientation sensor and an accelerometer. [Figure 9] FIG. 2 illustrates an example of the system of FIG. 1 including a magnetometer. [Figure 10] FIG. 2 illustrates an example of the system of FIG. 1 including an orientation sensor, an accelerometer, and a magnetometer. [Figure 11] FIG. 2 illustrates an example of the system of FIG. 1 including a temperature sensor and a shear sensor. [Figure 12] FIG. 1 illustrates an example of a node that includes a feature that uses environmental validation to control access to data. [Figure 13] FIG. 1 illustrates a flowchart of an example method for controlling access to data using environment validation. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0008] The present application relates to a system and method for controlling access to data using an environmental validation process. More specifically, the present application relates to a system for validating unique and characteristic physical environmental conditions that are difficult (or infeasible) to fake and are therefore used as a basis for controlling access to data. Such a system may be employed to reliably validate a complex set of correlated environmental parameters to allow (or deny) access to a private key required to decrypt an encrypted form of the data. By robustly validating current and previously observed actual operating environmental conditions, the system and method described herein improves the cybersecurity performance of systems required to restrict access to data when operating in front of or outside of an authorized environment.

[0009] More generally, the system can analyze and compare multiple correlated environmental parameters provided by a set of environmental sensors to determine whether access to a private key (that can be used to decrypt the data) is authorized. The set of environmental parameters can be any environmental parameters in which two or more parameters are correlated such that measurements taken across the multiple parameters are resistant to environmental spoofing such that measurements reflect the actual environment in which the multiple parameters are being observed.

[0010] As an example of an embodiment, the system may use an environmental validation process to control the release of encrypted data so that such data is only decrypted after the system has verified that it is currently operating in, or has previously observed, an authorized environment characterized by multiple correlated environmental parameters. In some examples, the multiple environmental parameters may be compared directly. In other examples, the system may correlate through application of physical laws to make it infeasible to spoof an authorized environment, thus reliably validating the environment.

[0011] Some systems (e.g., satellites) are intended to perform certain functions or access certain data only after reaching a certain authorized environment (e.g., a particular operating physical environment such as in orbit or suborbit around a celestial body), and upon reaching the authorized environment, such systems require access to the encrypted data. Furthermore, in some instances, such systems have previously spent time in other, different physical environments while tracing their path to the authorized environment. With conventional approaches, in these situations, an unauthorized party (e.g., an intruder or adversary) who has gained physical access to such a system is typically unable to replicate the authorized environment, thereby impeding and / or thwarting attempts to uncover the data in unencrypted form.

[0012] 1 illustrates an example of a system 100 that uses environmental validation to control access to data. The data may be stored in a file, and in some examples, the data may be secure data. As used herein, the term "file" may correspond to a single digital file or multiple digital files. Additionally, a file may be nearly any consumable file format, including a data file, an executable file, a text file, etc.

[0013] The system 100 may include a secure computing platform 104 that may interact with the node 108. The secure computing platform 104 may be implemented as a computing device such as a single board computer. In some examples, the secure computing platform 104 may be physically embedded in the node 108. In other examples, the secure computing platform 104 may be external to the node 108, including situations where the secure computing platform 104 is mounted on the outside of the node 108, or where the secure computing platform 104 is remote from the node 108 and communicates with the node 108 via wireless communication. In some examples, the node 108 may be implemented as a hardware device for deployment in a particular environment. In some examples, the node 108 may be embodied as a vehicle (ground vehicle or aircraft), rocket, weapon (e.g., missile), etc. In some examples, theft of the node 108 may represent a national security risk.

[0014] The secure computing platform 104 may include a cryptographic processor 112. The cryptographic processor 112 may represent a collection of IC chips and / or other electrical components working in concert, or the cryptographic processor 112 may be implemented in a single IC chip. The secure computing platform may include a memory 116. In some examples, the memory 116 may be a non-transitory machine-readable secure memory embedded in the cryptographic processor 112. Additionally, in some examples, a partition of the memory 116 may be external to the cryptographic processor 112. The memory 116 may store data and machine-readable instructions. The cryptographic processor 112 may access the memory 116 to execute the machine-readable instructions. The cryptographic processor 112 may be a general-purpose processor dedicated to encrypting and decrypting data. The memory 116 may store a private key 120. The private key 120 may be a symmetric or asymmetric key. In either situation, the private key 120 is not disclosed to external entities. Instead, the secure computing platform 104 includes a physical environment authenticator 124 and a cryptographic engine 128 that can be utilized to decrypt data and / or encrypt data using the private key 120 .

[0015] More specifically, the system 100 includes encrypted data 132 that is decryptable only with the private key 120. The encrypted data 132 may be data in an encrypted form. In some examples, the private key 120 (or a copy of the private key 120) may be the one used to encrypt the encrypted data 132. In other examples, the complement of the private key 120 (e.g., an asymmetric key of an asymmetric key pair) may be used to encrypt the encrypted data 132 and / or the private key 120 may be used to encrypt data that is decryptable only by the complement of the private key 120. In such a situation, the encrypted data 132 is unknown without access to the private key 120. In some examples, the encrypted data 132 may be stored in a file store 136. In some examples, the file store 136 may be embedded in the secure computing platform 104 for the node 108. In other examples, the file store 136 may be external to the secure computing platform 104 and the node 108. For example, in one example, the file store 136 may communicate wirelessly with the secure computing platform 104 and the encrypted data 132 (in encrypted form) may be provided to the secure computing platform 104 .

[0016] The cryptographic processor 122 may include a root trusted server 140. The root trusted server 140 may represent hardware (e.g., a field programmable gate array (FPGA), an application specific integrated circuit (ASIC) chip, etc.), software (e.g., machine executable instructions stored in the memory 116), or a combination thereof. The root trusted server 140 may monitor the operation of the secure computing platform 104. The root trusted server 140 may be used to implement a trusted boot on the secure computing platform 104. In some examples, the root trusted server 140 includes digitally signed (e.g., a digital signature certificate) machine readable instructions (e.g., signed by a trusted authority) that can ensure that the secure computing platform 104 only performs trusted operations. In some examples of this situation, the physical environment authenticator 124 and the cryptographic engine 128 may also be digitally signed, and the root trusted server 140 may verify that the physical environment authenticator 124 and the cryptographic engine 128 have not been modified prior to execution by the cryptographic processor 112. In other examples, the cryptographic engine 128 may be implemented as a hardware device (e.g., an FPGA or ASIC) such that the cryptographic engine 128 does not need to be digitally signed. In any such situation, the root trusted server 140 may ensure that the secure computing platform 104 only performs authorized operations.

[0017] The physical environment authenticator 124 may include an access portal 144. The access portal 144 may receive a request to decrypt the encrypted data 132 from a client 148 executing at the node 108. The client 148 may execute on a computing platform 152 of the node 108. The computing platform 152 of the node 108 may include, for example, a memory for storing data and machine-readable instructions, and a processing unit (e.g., one or more processor cores) for accessing the memory and executing the machine-readable instructions. For ease of explanation, some features of the computing platform 152 have been omitted.

[0018] In some examples, the client 148 may generate a request for decryption of the encrypted data 132 in response to a request from a data consuming module 153 (e.g., application software) executing on the computing platform 152. In other examples, the client 148 may generate the request without interaction with the data consuming module 153 and / or the client 148 may be integrated with the data consuming module 153. In response to receiving the request to decrypt the encrypted data 132, the physical environment authenticator 124 may perform an environment verification process. The environment verification process verifies whether the node 108 is located within the expected environment when the request to decrypt the encrypted data 132 is received.

[0019] To perform the environmental verification process, the physical environment authenticator 124 compares data characterizing the environment of the implementation for the node 108 from two separate sources. Thus, the system 100 may include K environmental sensors 160, where K is an integer equal to or greater than 1. That is, the K environmental sensors 160 provide a set of environmental sensors 160. Each of the K environmental sensors 160 measures a distinct type of environmental parameter and provides the data to the physical environment authenticator 124. As an example, one environmental sensor 160 may be a temperature sensor, a pressure sensor, or a flow meter, and another environmental sensor 160 may be an accelerometer. As another example, one environmental sensor 160 may be an inertial measurement unit (IMU), and another environmental sensor 160 may be a global navigation satellite system (GNSS) receiver (or other position sensor). As yet another example, one environmental sensor 160 may be an orientation sensor (e.g., a 3-axis gyroscope, or a Micro-Electro-Mechanical Systems (MEMS) gyroscope) and another environmental sensor 160 may be an accelerometer or speedometer. In yet another example, one environmental sensor 160 may be a deformation meter and another environmental sensor may be an accelerometer. This list is not meant to be exhaustive. In various examples, including those described herein, any two environmental sensors that measure correlated environmental parameters may be used.

[0020] Each of the K environmental sensors 160 (or a portion thereof) may be integrated into the node 108 or may be external to the node 108 (physically separated from the node 108). In an example where the given environmental sensor 160 is external to the node 108, the physical environmental authenticator 124 may receive data (directly or indirectly) from the given environmental sensor 160 wirelessly over a secure communication channel. For example, in a situation where the given environmental sensor 160 is a speedometer (e.g., an infrared speedometer), an external entity (e.g., a drone) may have the given environmental sensor 160 mounted thereon and provide data characterizing the speed of the node 108 to the physical environmental authenticator 124. In another example, each of the K environmental sensors 160 (or a portion thereof) may be formed on an integrated circuit (IC) chip, such as an application specific integrated circuit (ASIC) chip.

[0021] Each of the K environmental sensors 160 provides data characterizing parameters of the environment in which the node 108 is implemented at or near the time the request to decrypt the data to be decrypted is provided to the physical environment authenticator 124, and these parameters are referred to as environmental parameters. During the environmental verification process, the physical environment authenticator 124 may capture data characterizing distinct but correlated environmental parameters and compare them with each other and / or with corresponding thresholds (or a single threshold) to determine whether the node 108 is operating in an authorized environment. In some examples, such as situations in which the system 100 includes only one environmental sensor 160, the environmental sensor 160 may be configured to measure two or more distinct environmental parameters and provide data of the two or more distinct environmental parameters to the physical environment authenticator 124. In other examples, there are multiple environmental sensors 160, each operating independently. Furthermore, in some examples, a particular environmental parameter, such as time, may originate not from one of the K environmental sensors 160, but from another component of the system 100, such as a clock within the secure computing platform 104 or a clock at the node 108.

[0022] As described above, the data of the two separate environmental parameters are correlated. In some examples, the physical environment authenticator 124 may format, convert, and / or fuse one or more of the two separate environmental parameters to form a common environmental parameter. For example, if one environmental sensor 160 is an accelerometer and another environmental sensor 160 is a position sensor, the physical environment authenticator 124 may integrate data from the accelerometer and derive data from the position sensor to determine a velocity (the same environmental parameter) based on data from both such environmental sensors 160. That is, the physical environment authenticator 124 may use an equation to apply the laws of physics to change the units of a particular physical parameter and / or combine multiple physical parameters (e.g., position and time) to convert multiple physical parameters into another physical parameter (e.g., velocity).

[0023] In some examples, if the data characterizing the multiple correlated environmental parameters is within an acceptable range (based on a comparison between the environmental parameters and / or based on a comparison with corresponding thresholds), the physical environment authenticator 124 retrieves the encrypted data 132 and provides the encrypted data to the crypto engine 128, which provides a notification to the crypto engine 128 that the node 108 is authorized to decrypt the encrypted data 132. In response, the crypto engine 128 accesses the private key 120 and decrypts the encrypted data 132 using the private key 120, and the crypto engine 128 returns the decrypted data 154 to the physical environment authenticator 124. The physical environment authenticator 124 may provide the decrypted data 154 to the client 148 in response to a request to decrypt the encrypted data 132. In this manner, the decrypted data 154 may be consumed by the node 108, such as by a data consumption module 153 on the computing platform 152.

[0024] Conversely, in situations where a comparison of the data characterizing the environmental parameters provided by the K environmental sensors 160 indicates that the node 108 is not located within an authorized environment, the physical environment authenticator 124 does not grant access to the private key 120. In some situations, the physical environment authenticator 124 may provide a notification to the client 148 that access to the data (corresponding to the encrypted data 132 in unencrypted form) is not authorized. In other examples, if the physical environment authenticator 124 cannot confirm that the node 108 is located within an authorized environment, the physical environment authenticator 124 may not respond to a request for data.

[0025] Additionally or alternatively, in some examples, the physical environment authenticator 124 can score (e.g., assign scores to) the environmental parameters to determine whether access to the private key 120 (and thus the data) is authorized. For example, in such a situation, the physical authenticator 124 can apply a weighted score to each environmental parameter and compare each such score to a corresponding threshold. The scoring can be based, for example, on the predicted accuracy (e.g., due to noise) of each parameter. As an example, if M scores for the environmental parameters meet or exceed the corresponding threshold, but N scores for the environmental parameters do not meet the corresponding threshold, the physical environment authenticator 124 can grant access to the private key 120 and the data. In this situation, M is a selected integer equal to or greater than 2, N is a selected integer greater than 1, and M is greater than N. Continuing with this situation, if there are fewer than M scores that exceed the corresponding threshold score, access to the private key 120 and the data (in unencrypted form) is denied. In this way, access to the private key 120 and data may be permitted even in certain situations where one or more environmental parameters are uncorrelated with other environmental parameters (eg, due to noise).

[0026] The system 100 can prevent unauthorized parties (e.g., an intruder or adversary) who may have physical possession of the node 108 from accessing the private key 120 and the encrypted data 132 in an unencrypted form. As a given example (hereinafter, "Given Example"), consider a situation where the node 108 is implemented as a rocket, where shear force is measured by a shear sensor (e.g., the first environmental sensor 160) and skin temperature is measured by a temperature sensor (e.g., the second environmental sensor 160), and these environmental parameters are correlated. That is, in such a situation, the higher the shear force measured by the shear sensor, the higher the skin temperature (e.g., due to heat transfer from the combustion chamber coupled with atmospheric friction). Thus, continuing with the given example, assume that the first environmental sensor 160 provides the shear force to the physical environmental authenticator 124. The physical environmental authenticator 124 can calculate the expected skin temperature relative to the shear force. Thus, in a situation where the surface temperature provided by the second environmental sensor 160 differs from the expected surface temperature by more than an acceptable margin, the physical environment authenticator 124 may determine that the node 108 is not in an approved environment. For instance, in the given example, if an unauthorized person in possession of the node 108 were to mount the node 108 in a wind tunnel to simulate the operation of a rocket, the surface temperature would not match the shear forces, and thus the physical environment authenticator 124 would prevent the unauthorized person from accessing the private key 120, and thus preventing the unauthorized person from decrypting the encrypted data 132, thereby preventing the unauthorized person from possessing the data corresponding to the encrypted data 132.

[0027] 2-11 illustrate examples of distinct types of environmental sensors (e.g., K environmental sensors 160 of FIG. 1) that can be used to provide environmental parameters of node 108 to physical environmental authenticator 124 of system 100 of FIG. 1 for use during the environmental validation process. For ease of explanation, some details have been omitted from FIG. 2-11.

[0028] More specifically, FIG. 2 illustrates an example of a system 100 including a Global Navigation Satellite System (GNSS) receiver 200 that provides data characterizing the location of the node 108 of FIG. 1, and an Inertial Measurement Unit (IMU) 210 that provides data characterizing the node's location (using dead reckoning) and the velocity of the node 108. In some examples, the physical environment authenticator 124 may determine the node's 108 location as a function of time (e.g., time may be an environmental parameter) to confirm or disprove that the node 108 is currently either inside or outside a boundary (geolocation) of the authorized environment during the environmental validation process. In other examples, the physical environment authenticator 124 may monitor the node's 108 location as a function of time relative to a previous location of the node 108 to determine whether the node 108 has moved into the authorized environment during the environmental validation process.

[0029] The use of the GNSS receiver 200 can generate time-correlated position measurements. Such measurements can then be differentiated to estimate velocity, which can be differentiated to estimate acceleration, thus effectively monitoring position versus time to estimate velocity and acceleration values. The use of the IMU 210 provides an estimate of the node 108's current position, represented by integrating acceleration to provide an estimate of the node 108's velocity, and integrating the node 108's velocity to obtain the node 108's position, so that the physical environment authenticator 124 can effectively monitor acceleration versus time to estimate position and generate time-correlated position, velocity, and acceleration values.

[0030] In other examples, the location measurements from the GNSS receiver 200 and / or IMU 210 may be correlated with other measurements such as pressure, temperature, magnetic environment, etc. by the physical environment authenticator 124. Indeed, the location of the node 108 may be correlated with any other environmental parameters that may be shown to be dependent or related to location during the environmental validation process.

[0031] Similarly, in other examples, the velocity of the node 108 may be sensed (measured) by multiple mechanisms including such as stagnation pressure (e.g., via a pitot tube, etc.), or as a by-product from the IMU 210, the GNSS receiver 200, or by a separate type of environmental sensor (e.g., another environmental sensor 160 of FIG. 1). Thus, in some examples, during the authentication process, the physical environmental authenticator 124 may correlate velocity, acceleration, and position as described above. Additionally or alternatively, the velocity of the node 108 may also be correlated with pressure, temperature, mass flow rate, etc. of fuel consumed by the engine of the node 108. Indeed, the velocity of the node 108 may be correlated with any other environmental parameter that may be shown to be dependent or related to speed.

[0032] 3 illustrates an example of a system 100 that includes an accelerometer 220 that provides the physical environment authenticator 124 with environmental parameters that characterize the acceleration of the node 108, and a flow meter 230 that provides the physical environment authenticator 124 with environmental parameters that characterize the fuel consumed by the node 108 (e.g., by an engine combustion chamber of the node 108). In such a situation, the physical environment authenticator 124 can correlate the acceleration with the flow rate of the fuel by calculating the expected fuel consumption for the reported acceleration. In a situation where the flow meter 230 provides data that indicates that fuel is being consumed at an expected rate, the physical environment authenticator 124 can authenticate the environment of the node 108.

[0033] In alternative situations, instead of including an accelerometer 220 that directly measures the acceleration of the node 108, in other examples, the acceleration of the node 108 may be derived from a position versus time measurement (e.g., by the GNSS receiver 200 or IMU 210 of FIG. 2). Additionally, in some examples, instead of (or in addition to) the flow meter 230, a temperature sensor and / or a pressure sensor may be included to provide data characterizing the temperature and / or pressure (e.g., stagnation pressure) of the system 100 that may be correlated with the expected speed of the node 108. In any of these situations, the physical environment authenticator 124 may be configured / programmed to correlate the acceleration with data corresponding to the expected fuel consumption to authenticate the environment of the node 108. Indeed, the acceleration may be correlated with any other environmental parameter that may be shown by the physical environment authenticator 124 to be dependent and / or related to the acceleration.

[0034] Additionally, in examples where the node 108 uses an engine that consumes fuel, the physical environment authenticator 124 may be configured / programmed to correlate position, velocity, and acceleration to mass flow rate of fuel, which may also be correlated to things like temperature and pressure inside the node 108 (e.g., a combustion chamber) or at the boundary between the node 108 and the external environment.

[0035] 4 illustrates an example of a system 100 including a three-axis accelerometer 240 that provides data characterizing the acceleration of the node 108 in three axes. The example system 100 of FIG. 4 may be used, for example, in a situation where the node 108 is implemented as a satellite and the approved environment is an orbital or suborbital ballistic trajectory around a celestial body while outside the Earth's atmosphere. In this situation, during an environment validation process, the physical environment authenticator 124 may compare the acceleration in the three axes to determine whether the node 108 is located in microgravity.

[0036] When the node 108 is in orbit or suborbit of a celestial body and experiencing microgravity, all three axes provide acceleration less than 0.25g (corresponding to microgravity) for a duration greater than a predetermined amount of time (e.g., greater than one minute). Thus, during the environmental validation process, the physical environmental authenticator 124 may be configured / programmed to determine to authenticate the environment of the node 108 if the data from the three-axis accelerometer 240 indicates that all three axes provide acceleration less than 0.25g (e.g., microgravity) for a duration greater than or equal to one minute (e.g., a predetermined amount of time). The inclusion of the duration prevents an authorized person from simulating the effect of being in an orbit or suborbit in a parabolic arc orbit, because being in such an orbit is limited to a duration of about 30 seconds or less. Thus, in the example shown in FIG. 4, a single instance of an environmental sensor, i.e., the three-axis accelerometer 240, can be used to provide multiple environmental parameters required in the environmental validation process.

[0037] Additionally, in some examples, the physical environment authenticator 124 may use the three-axis accelerometer 240 to measure the impact of the node 108. An impact is a transient physical effect that typically results from a collision or other sudden acceleration (e.g., an explosion, etc.). Like acceleration, an impact is also a vector with the same type of unit (rate of change of velocity). In some examples, the physical environment authenticator 124 includes logic to convert the acceleration in three axes of the acceleration reported from the three-axis accelerometer 240 to derive an impact pulse for the node 108. The impact pulse may be characterized by peak acceleration, duration, and pulse shape (triangle, trapezoid, etc.). Additionally, in such a situation, during an environment validation process, the physical environment authenticator 124 may correlate the impact of the node 108 with the acceleration measured directly by the three-axis accelerometer 240 to determine whether the node 108 is operating in an approved environment.

[0038] Further, in some examples, the physical environment authenticator 124 may derive the measured vibration of the node 108 using the three-axis accelerometer 240. Vibration is a situation in which the node 108 experiences vibrations in acceleration around a balance point. Such vibrations may be periodic or random. In some examples, the physical environment authenticator 124 includes logic to convert the acceleration in three axes of the acceleration reported from the three-axis accelerometer 240 to derive the vibration of the node 108. Furthermore, in such a situation, during the environment verification process, the physical environment authenticator 124 may correlate the vibration of the node 108 with the acceleration measured directly by the three-axis accelerometer 240 to determine whether the node 108 is operating in an approved environment.

[0039] 5 illustrates an example of a system 100 including a deformation meter 250 that provides the physical environment authenticator 124 with environmental parameters characterizing the deformation of an element (e.g., a surface or part) of the node 108, and an accelerometer 260 that provides the physical environment authenticator 124 with environmental parameters characterizing the acceleration of the node 108. In such a situation, the physical environment authenticator 124 can associate the acceleration due to the deformation of the element of the node 108 with a stress of the node 108 that is calculated based on the acceleration of the node 108.

[0040] More generally, a stress corresponding to a force applied across a given cross-sectional area can cause an elastic deformation of the element of the node 108, which can be characterized by the deformation meter 250. This stress can be measured over time and correlated to the force applied to the node 108, which can be calculated based on the acceleration provided by the accelerometer 260. Normal stress is a stress resulting from a force normal (or perpendicular) to the material cross-section on which the stress acts. Similarly, shear stress is a stress resulting from a force parallel to the cross-section of the element of the node 108. Shear stress results from shear forces, which are a pair of equal and opposite forces acting on opposite sides of an object. In some examples, a nodal fluid (including both liquids and gases) moving along a solid boundary will experience shear stress at the boundary, and thus the shear stress can be correlated to the velocity (derived from acceleration) of the node 108 in such a flow. Additionally, in some examples, the physical environment authenticator 124 can correlate shear stress to atmospheric dynamic pressure and, over time, to temperature generated due to frictional heating. In these situations, pressure and / or temperature sensors can be used instead of (or in addition to) the accelerometer 260.

[0041] In another example, the deformation meter 250 can be used to calculate the strain on the elements of the node 108. The strain on the elements corresponds to the permanent deformation of the elements. The physical environment authenticator 124 can measure the strain over time, and the strain can be correlated with the acceleration (corresponding to the force) applied to the node 108. In most examples, the strain occurs for materials that are under stress for a period of time where the applied force exceeds the elastic deformation range, resulting in permanent deformation of the material in the elements of the node 108. Thus, in these situations, the amount of strain can be correlated with the acceleration by the physical environment authenticator during the environmental validation process. In another example, the strain can be correlated with other environmental parameters such as temperature, material strength, etc.

[0042] FIG. 6 illustrates an example of a system 100 including a first sonic sensor 270 and a second sonic sensor 280, each of which provides environmental parameters characterizing the sonic waves measured at the node 108 to the physical environment authenticator 124. Sound waves manifest as mechanical waves traveling through various media, such as gases, liquids, and solids, and are generated, propagated, and received at the node 108. The first sonic sensor 270 and the second sonic sensor 280 detect mechanical stresses as the sound waves propagate through the surface material of the node 108. More specifically, the first sonic sensor 270 and the second sonic sensor 280 measure the amplitude and frequency characteristics of the sound waves by observing the propagation path and speed at the node 108.

[0043] The characteristic changes in frequency and amplitude (or volume) of the sound waves detected by the first sonic sensor 270 and the second sonic sensor 280 at the node 108 over a particular time interval can be used to verify that the node 108 is operating in an authorized environment. Additionally, the first sonic sensor 270 and the second sonic sensor 280 can be tuned to separate frequency ranges at physically separate locations within the node 108 to provide directionality of the sound waves. In some examples, the physical environment authenticator 124 can correlate the detected sound waves with other environmental parameters measured by other environmental sensors (e.g., accelerometers), such as shock, vibration, acceleration, velocity, pressure, etc., to perform an environmental verification process.

[0044] 7 illustrates an example of a system 100 including a pressure sensor 285 that provides an environmental parameter characterizing the pressure of fuel consumed by the node 108, and a temperature sensor 290 that provides the temperature of the node 108 to the physical environment authenticator 124. In such a situation, the physical environment authenticator 124 may calculate an expected amount of fuel based on the reported pressure of the fuel. In this example, the physical environment authenticator 124 may calculate an expected temperature of the system based on the calculated amount of fuel, and the physical environment authenticator 124 may compare the expected temperature of the node 108 to the temperature measured by the temperature sensor 290 to perform an environmental verification process.

[0045] In such a situation, the physical environment authenticator 124 may calculate an expected amount of fuel based on the reported pressure of the fuel. In this example, the physical environment authenticator 124 may calculate an expected temperature of the system based on the calculated amount of fuel, and the physical environment authenticator 124 may compare the expected temperature of the node 108 to the temperature measured by the temperature sensor 290 to perform an environmental verification process. In other examples, additional or alternative environmental sensors, such as an accelerometer, may provide environmental parameters that can be correlated with the measured pressure and / or temperature of the node 108.

[0046] Additionally, in some examples, as node 108 moves through the atmosphere, the pressure reported by pressure sensor 285 may be used to calculate the stagnation pressure of node 108, and the temperature reported by temperature sensor 290 may be used to calculate the stagnation temperature of node 108. In this situation, the stagnation pressure and stagnation temperature may be correlated and used during the environmental validation process.

[0047] 8 illustrates an example of a system 100 including an orientation sensor 300 that provides the orientation and / or angular velocity of the node 108 to the physical environment authenticator 124, and an accelerometer 310 that provides the acceleration of the node 108 to the physical environment authenticator 124. The orientation sensor 300 may be implemented as a microelectromechanical system (MEMS) gyroscope, a solid-state ring laser gyroscope, a fiber optic gyroscope, a quantum gyroscope, or the like. In some examples, the orientation sensor 300 may be implemented as an air data probe. In other examples, the orientation sensor 300 may be integrated with an IMU.

[0048] As an example, the physical environment authenticator 124 may correlate the acceleration of the node 108 with the orientation of the node 108 to perform an environment validation process. For example, if the node 108 is mounted on a rocket, high acceleration may be detected, but still correlated with a relatively constant orientation if the node 108 is operating in an authorized environment. Conversely, if an unauthorized party were to attempt to provide a fake environment using a centrifuge to simulate acceleration, the orientation sensor 300 would report a constantly changing orientation, and the physical environment authenticator 124 would not authenticate the fake environment.

[0049] In other examples, the orientation of the node 108 may be correlated with other environmental parameters, such as a flow stream around the body of the node 108. For example, if the node 108 is implemented as an aircraft and the system 100 includes a flow meter (e.g., flow meter 230 of FIG. 3), the physical environment authenticator 124 may determine the angle of attack of the node 108. The angle of attack may be correlated with the expected airflow over the body of the node 108 to authenticate the environment.

[0050] FIG. 9 shows an example of the system 100 including a magnetometer 320 that provides the strength (magnitude) of the measured magnetic field of the node 108 to the physical environment authenticator 124. This magnitude of the magnetic field can be measured in three orthogonal dimensions so that the physical environment authenticator 124 can calculate the resulting measured magnetic field vector for the node 108. In examples where the node 108 is moving (when operating in an authorized environment), this magnetic field vector can be expected to change over time. In these situations, the physical environment authenticator 124 can correlate the magnetic field vector to other environmental parameters such as the position and orientation (rotation) of the system. In fact, to perform the environmental verification process, the magnetic field strength and orientation can be correlated with any other environmental parameters that depend on or are related to either the strength or orientation of the magnetic field.

[0051] Figure 10 shows an example of a system 100 including the orientation sensor 300 and accelerometer 310 of Figure 8 and the magnetometer 320 of Figure 9. The orientation sensor 300 provides the orientation and / or angular velocity of the node 108 to the physical environment authenticator 124, and the accelerometer 310 provides the acceleration of the node 108 to the physical environment authenticator 124. The magnetometer 320 provides the strength (magnitude) of the measured magnetic field of the node 108 to the physical environment authenticator 124. This magnitude of the magnetic field may be measured in three orthogonal dimensions such that the physical environment authenticator 124 can calculate a resulting measured magnetic field vector for the node 108.

[0052] In instances where the node 108 is in motion (operating in an authorized environment), the magnetic field vector measured by the magnetometer 320 may be expected to change over time. In these situations, the physical environment authenticator 124 may correlate the magnetic field vector to the orientation measured by the orientation sensor 300 and the acceleration measured by the accelerometer 310. Thus, if the node 108 is mounted on a rocket, a changing magnetic field and high acceleration may be detected, but still correlated to a relatively constant orientation when the node 108 is operating in an authorized environment. Conversely, if an unauthorized party were to attempt to provide a spoofed environment using a centrifuge to simulate acceleration, the magnetometer 320 would report a changing magnetic field, but the orientation sensor 300 would report a constantly changing orientation, and the physical environment authenticator 124 would not authenticate the spoofed environment. Thus, in this situation, the physical environment can be authenticated by comparing three independent, but correlated, environmental conditions measured by three separate sensors.

[0053] 11 illustrates an example of a system 100 that includes a temperature sensor 330 that provides the physical environment authenticator 124 with an environmental parameter characterizing a surface temperature of the node 108, and a shear sensor 334 that provides the physical environment authenticator 124 with an environmental parameter characterizing a shear force applied to an element (e.g., a surface or part) of the node 108. In such a situation, the physical environment authenticator 124 may correlate the surface temperature with the shear force on the element of the node 108. The node 108 may represent a rocket, and the authorized environment may be the node 108 moving through the air.

[0054] In an example where node 108 represents a rocket (or other projectile), sustained high velocity airflow (e.g., hypersonic flow corresponding to airflow of greater than Mach 5) results in aerodynamic heating that can be measured by temperature sensor 330. Additionally, sustained high velocity airflow induces relatively constant shear forces on elements of node 108 that can be measured by shear sensor 334. Thus, physical authenticator 124 can correlate an expected surface temperature of node 108 with the expected relatively constant shear forces on elements of node 108.

[0055] Further, in an attempt to spoof the node 108's approved environment (a rocket moving through the air), an unauthorized individual may use a wind tunnel to simulate airflow above the node 108. However, airflow through such a wind tunnel is not constant for a period long enough to raise the surface temperature of the node 108. In addition, a pulse of airflow (e.g., an unsustained airflow) causes a corresponding pulse of shear force on elements of the node 108 that can be measured by the shear sensor 334. Thus, the physical environment authenticator 124 may determine that the environmental parameters do not correlate with the approved environment.

[0056] The examples provided in Figures 2-11 are not meant to be exhaustive. Indeed, any measurable physical environmental parameter that is characteristic during some or all of the operation of node 108 prior to granting access to private key 120 may be included in the set of authenticated environmental conditions. While some of the possible environmental parameters may be relatively easy to spoof individually (e.g., temperature), in combination with other environmental parameters, it may be infeasible for an unauthorized party to reliably spoof all correlated physical parameters unless node 108 is operating within an approved environment.

[0057] Additionally, the example environmental sensors shown in Figures 2-9 may be combined in many different ways. As explained, by increasing the number of correlated physical parameters, the difficulty of faking an authorized environment increases, improving security. The number and type of correlated physical parameters may be selected based on, for example, the sensitivity of the encrypted data 132 of Figure 1.

[0058] FIG. 12 illustrates an example of a node 400 that includes components of the system 100 of FIG. 1. As some examples, the node 400 may be implemented as a vehicle (ground vehicle or aircraft), a rocket, a satellite, a weapon (e.g., a missile), and the like. In some examples, theft of the node 400 may represent a national security risk. The node 400 includes features for controlling access to secure content based on environmental validation. The node 400 may include a secure computing platform 404 that may be employed to implement the secure computing platform 104 of FIG. 1. For ease of explanation, some details of the secure computing platform 404 have been omitted. The secure computing platform 404 includes a physical environment authenticator 408 that executes on the secure computing platform 404.

[0059] The physical environment authenticator 408 may perform an environment verification process to verify that the node 108 is operating in an authorized environment. The secure computing platform 404 includes a private key 412 stored on the secure computing platform 404. During the environment verification process, if the physical environment authenticator 408 confirms that the node 400 is operating in an authorized environment, the physical environment authenticator 408 is configured to be granted access (directly or indirectly) to the private key 412. Conversely, if the physical environment authenticator 408 cannot confirm that the node 400 is operating in an authorized environment, access to the private key 412 is denied. The private key 412 may be a symmetric key or an asymmetric key of an asymmetric key pair. In either situation, the private key 412 is not exposed to external entities. Instead, the private key 412 may be used to decrypt data on the secure computing platform 404.

[0060] The node 400 may include a computing platform 420 that may be employed to implement the computing platform 152 of FIG. 1 . That is, the computing platform 420 may include a non-transitory memory that stores data and machine-readable instructions, as well as a processing unit (one or more processor cores) for accessing the memory of the computing platform 420 and executing the machine-readable instructions. In some examples, the computing platform may include a data consumption module 424 (e.g., application software) that requires access to the data for the node 400 to operate properly. The data may be stored in an encrypted form as encrypted data 428. The encrypted data 428 may be stored in a file store 432, which may be included on the node 400 in the illustrated example. The encrypted data 428 may only be decrypted by the private key 412. Thus, unless access to the private key 412 is granted, the encrypted data is unknown.

[0061] The physical environment authenticator 408 receives the request for data. In response, the physical environment authenticator 408 performs an environment verification process to verify whether the node 400 is operating in an authorized environment. The environment verification process verifies whether the node 108 is located within the expected environment when the request to decrypt the encrypted data 132 is received.

[0062] To perform the environmental validation process, the physical environmental authenticator 408 captures and compares data characterizing at least two environmental parameters of the environment of the implementation for the node 400. Thus, the node 400 may include K environmental sensors 434. Each of the K environmental sensors 434 measures a distinct type of environmental parameter, and the K environmental sensors 434 may be used to implement the environmental sensor 160 of FIG. 1. Each of the K environmental sensors 434 may be implemented in a manner similar to the examples provided in FIGS. 2-9. As some examples, the K environmental sensors 434 may include, but are not limited to, an accelerometer, an IMU, a GNSS (or other position sensor), an orientation sensor, a temperature sensor, a pressure sensor, a flow sensor, a speed sensor, a sonic sensor, and the like. This list is not meant to be exhaustive. In various examples, including those described herein, any two environmental sensors measuring correlated environmental parameters may be used. In the illustrated example, each of the K environmental sensors 434 is integrated with the node 400, while in other examples, each of the K environmental sensors 434, or portions thereof, are external to the node 400. In such situations, the environmental sensors 434 are distributed throughout the node 400. Additionally, while FIG. 12 illustrates the K environmental sensors 434 as communicating with the secure computing platform 404, in some examples, the K environmental sensors 434 may further communicate with the computing platform 420 and / or other components of the node 400.

[0063] Each of the K environmental sensors 434 provides data characterizing a parameter of the environment in which the node 400 is implemented at or near the time a request to decrypt the data to be decrypted is provided to the physical environment authenticator 408. During the environmental verification process, the physical environment authenticator 408 may compare data characterizing two correlated environmental parameters to determine whether the node 108 is operating in an authorized environment. In some examples, such as situations in which the node 400 includes only one environmental sensor 434, the environmental sensor 434 may be configured to measure two separate environmental parameters and provide data of the two separate environmental parameters to the physical environment authenticator 408. In other examples, there are multiple environmental sensors 434, each operating independently.

[0064] As described above, the data of the two separate environmental parameters are correlated. In some examples, the physical environment authenticator 408 may convert one or more of the two separate environmental parameters to form a common environmental parameter. If the multiple correlated environmental parameters are different but the correlated environmental parameters are within an acceptable range, the physical environment authenticator 408 retrieves the encrypted data 428 and requests that the encrypted data 428 be decrypted by a cryptographic engine (not shown) using the private key 412. In response, the physical environment authenticator 408 receives the decrypted data 440, which is provided to the data consumption module 424. In this manner, the decrypted data 440 may be consumed by the data consumption module 424 or other modules (e.g., application software) in the node 400.

[0065] Conversely, in situations where a comparison of the data characterizing the environmental parameters provided by the K environmental sensors 434 indicates that the node 400 is not located within an authorized environment, the physical environment authenticator 408 does not authorize access to the private key 412. In some situations, the physical environment authenticator 408 may provide a notification that access to the encrypted data 428 (in unencrypted form) is not authorized in response to a request for the data. In other examples, the physical environment authenticator 408 may not respond to a request to decrypt the encrypted data 428 if the physical environment authenticator cannot confirm that the node 400 is located within an authorized environment.

[0066] The node 400 can prevent an unauthorized party (e.g., an intruder or adversary) who may have physical possession of the node 400 from accessing the private key 412 and the encrypted data 428 in unencrypted form. Furthermore, by using multiple environmental parameters as described in the examples shown in Figures 2-9, it can be made infeasible to fake an authorized environment. Furthermore, the number and type of environmental parameters correlated in the environmental validation process can be commensurate with the sensitivity of the data (decrypted data 440).

[0067] In view of the structural and functional features described above, the exemplary method will be better understood with reference to FIG. 13. For ease of explanation, the exemplary method of FIG. 13 is shown and described as being performed sequentially, however, it should be understood and appreciated that the example is not limited by the illustrated order, as some operations in other examples may be performed multiple times and / or simultaneously in a different order than shown and described herein. Moreover, not all described operations need to be performed to implement the method. The exemplary method of FIG. 13 may be implemented as instructions stored on a non-transitory machine-readable medium. The instructions may be accessed by a processing resource (e.g., one or more processor cores) and executed to perform the methods disclosed herein.

[0068] Figure 13 illustrates one example of a method 500 for controlling access to data. Method 500 may be implemented, for example, by secure computing platform 104 of system 100 of Figure 1 and / or computing platform 404 of node 400 of Figure 12. In such a situation, secure computing platform 104 may include a physical environment authenticator (e.g., physical environment authenticator 124 of Figure 1 and / or physical environment authenticator 408 of Figure 10) executing on secure computing platform 104.

[0069] At 510, an access portal of a physical environment authenticator (e.g., access portal 144 of FIG. 1 ) receives a request for data from a computing platform (e.g., computing platform 152 of FIG. 1 ). At 515, in response to the request, the physical environment authenticator captures data characterizing at least two environmental parameters from a set of environmental sensors (e.g., K environmental sensors 160 of FIG. 1 and / or K environmental sensors 434 of FIG. 12 ). At 520, the physical environment authenticator converts and / or formats the data to form correlated environmental parameters. Formatting and / or conversion may include, for example, application of mathematical formulas (e.g., changing units of measurement) to apply physical laws to the separate environmental parameters.

[0070] At 525, the physical environment authenticator may compare the correlated parameters. The comparison of the correlated parameters may be a direct comparison or a comparison of expected values. At 530, based on the comparison, the physical environment authenticator may determine whether the node is operating in an authorized environment. If the determination at 530 is negative (e.g., no), the method 500 proceeds to 535. If the determination at 530 is positive (e.g., yes), the method 500 proceeds to 537. At 535, the physical environment authenticator denies access to the data.

[0071] At 537, access to the data is granted. At 540, the crypto engine (e.g., crypto engine 128 of FIG. 1) uses the private key (e.g., private key 120 of FIG. 1) to decrypt the encrypted data (e.g., encrypted data 132 of FIG. 1) that can only be decrypted with the private key, and publishes decrypted data corresponding to the data. The private key is securely stored in the secure computing platform. At 545, the physical environment authenticator returns the decrypted data (corresponding to the data) to the node's computing platform so that a module (e.g., application software) on the node can consume the decrypted data.

[0072] The above description is an example. Of course, it is not possible to describe every conceivable combination of components or methods, but one of ordinary skill in the art will recognize that many more combinations and permutations are possible. Accordingly, this disclosure is intended to embrace all such changes, modifications, and variations that are within the scope of this application, including the appended claims. As used herein, the term "comprises" means including, without limitation. The term "based on" means based at least in part on. Furthermore, when a disclosure or claim recites "a," "first," or "another" element, or the equivalent thereof, it should be construed as including one or more such elements, and does not require or exclude two or more such elements. The technical ideas that can be understood from the above-described embodiment will be described below as supplementary notes. [Appendix 1] 1. A system for controlling access to data based on environmental validation, comprising: a non-transitory memory having machine-executable instructions; a processing unit for accessing machine-readable instructions, the machine-readable instructions including a physical environment authenticator; The physical environment authenticator includes: receiving data from a set of environmental sensors characterizing a plurality of environmental parameters of nodes within the environment; a plurality of correlated environmental parameters are compared to each other and / or to thresholds, where at least a portion of the plurality of correlated environmental parameters are based on the data from the set of environmental sensors, and where the plurality of correlated environmental parameters allow access to data if the plurality of correlated environmental parameters indicate that the node is operating in an authorized environment and where the plurality of correlated environmental parameters block access to data if the node is not operating in the authorized environment. [Appendix 2] 2. The system of claim 1, further comprising a root of trust server that performs a trusted boot to verify that the physical environment authenticator has not been modified. [Appendix 3] 2. The system of claim 1, wherein the physical environment authenticator receives decrypted data from a cryptographic engine and provides the decrypted data to the node. [Appendix 4] 2. The system of claim 1, wherein the set of environmental sensors is integrated on an application specific integrated circuit (ASIC) chip. [Appendix 5] 2. The system of claim 1, wherein the physical environmental authenticator converts and / or formats a first environmental parameter provided from a first environmental sensor of the set of environmental sensors into a unit of measurement used to characterize a second environmental parameter provided from a second environmental sensor of the set of environmental sensors to form the plurality of correlated environmental parameters. [Appendix 6] 2. The system of claim 1, wherein a first environmental sensor of the set of environmental sensors measures a first environmental parameter and a second environmental sensor of the set of environmental sensors measures a second environmental parameter separate from the first environmental parameter. [Appendix 7] 7. The system of claim 6, wherein the first environmental parameter is a shear force applied to the node and the second environmental parameter is a temperature of the node. [Appendix 8] 7. The system of claim 6, wherein the first environmental parameter is an acceleration of the node and the second environmental parameter is an amount of fuel consumed by the node. [Appendix 9] 7. The system of claim 6, wherein the first environmental sensor is a Global Navigation Satellite System (GNSS) receiver and the second environmental sensor is an Inertial Measurement Unit (IMU). [Appendix 10] 7. The system of claim 6, wherein the first environmental sensor is a Global Navigation Satellite System (GNSS) receiver and the second environmental sensor is an accelerometer. [Appendix 11] 7. The system of claim 6, wherein the first environmental sensor is an accelerometer that measures acceleration of the node, and the second environmental sensor is one of a mass flow meter, a temperature sensor, and a pressure sensor. [Appendix 12] 7. The system of claim 6, wherein the first environmental sensor is an accelerometer that measures acceleration of the node, and the second environmental sensor is a deformation meter that measures deformation of a surface of the node. [Appendix 13] 7. The system of claim 6, wherein the first environmental parameter characterizes a shock or vibration of the node and the second environmental parameter characterizes an acceleration of the node. [Appendix 14] 7. The system of claim 6, wherein the first environmental parameter characterizes a stress or strain of the node and the second environmental parameter characterizes an acceleration of the node. [Appendix 15] 7. The system of claim 6, wherein the first environmental parameter characterizes a first acoustic wave propagating through the node at a first frequency, and the second environmental parameter characterizes one of an impact, vibration, acceleration, velocity, and pressure of the node. [Appendix 16] 7. The system of claim 6, wherein the first environmental parameter characterizes an amount of fuel at the node and the second environmental parameter characterizes an acceleration of the node. [Appendix 17] 7. The system of claim 6, wherein the first environmental parameter characterizes an angle of attack of a body of the node and the second environmental parameter characterizes a velocity of a flow stream around the body of the node. [Appendix 18] 7. The system of claim 6, wherein the first environmental parameter characterizes a stagnation temperature of a fluid relative to the node, and the second environmental parameter characterizes a stagnation pressure of the fluid relative to the node. [Appendix 19] 7. The system of claim 6, wherein the first environmental parameter characterizes a mass flow rate of the fuel relative to the node, and the second environmental parameter characterizes at least one of a position, a velocity, and an acceleration of the fuel relative to the node. [Appendix 20] 7. The system of claim 6, wherein the first environmental parameter characterizes an orientation of a magnetic field of the node and the second environmental parameter characterizes a position or orientation of the node. [Appendix 21] 7. The system of claim 6, wherein the first environmental parameter characterizes an orientation of a magnetic field of the node, the second environmental parameter characterizes a position or orientation of the node, and a third environmental sensor in the set of environmental sensors measures a third environmental parameter that characterizes time. [Appendix 22] 2. The system of claim 1, wherein the set of environmental parameters includes a three-axis accelerometer, the plurality of correlated environmental parameters includes an acceleration of the node in three separate axes, and the physical environment authenticator allows access to data if the acceleration of the node in the three separate axes corresponds to microgravity for a predetermined duration. [Appendix 23] 2. The system of claim 1, wherein a given environmental sensor of the set of environmental sensors is physically separated from the node, and data from the given environmental sensor is wirelessly transmitted to the physical environmental authenticator. [Appendix 24] 2. The system of claim 1, wherein each environmental sensor of the set of environmental sensors measures the same environmental parameter. [Appendix 25] The system of claim 1, wherein the physical environment authenticator further scores each of the plurality of correlated environmental parameters, and the physical environment authenticator allows access to data if the scores for M (M is an integer greater than or equal to 2) correlated environmental parameters satisfy a corresponding threshold score and if the scores for N (N is an integer greater than or equal to 1) correlated environmental parameters are less than a corresponding threshold score. [Appendix 26] 2. The system of claim 1, wherein the physical environment authenticator grants access to a private key usable to decrypt data in encrypted form in response to the plurality of correlated environmental parameters indicating the node is operating in the authorized environment. [Appendix 27] A non-transitory machine-readable medium having machine-executable instructions, the machine-executable instructions including a physical environment authenticator; The physical environment authenticator includes: receiving a request from a node to access the data; In response to the request, capturing data from a set of environmental sensors characterizing a plurality of environmental parameters of the node; A non-transitory machine-readable medium that compares a plurality of correlated environmental parameters with each other and / or to a threshold, where at least a portion of the plurality of correlated environmental parameters are based on the data from the set of environmental sensors, and grants access to data if the plurality of correlated environmental parameters from each of the set of environmental sensors indicates that the node is operating in an authorized environment, and denies access to data if at least one of the plurality of correlated environmental parameters indicates that the node is not operating in the authorized environment. [Appendix 28] 28. The non-transitory machine-readable medium of claim 27, further comprising a root of trust server that performs a trusted boot to verify that the physical environment authenticator has not been modified. [Appendix 29] 28. The non-transitory machine-readable medium of claim 27, wherein the physical environment authenticator provides decrypted data to a computing platform on the node. [Appendix 30] 28. The non-transitory machine-readable medium of claim 27, wherein a first environmental sensor of the set of environmental sensors measures a first environmental parameter and a second environmental sensor of the set of environmental sensors measures a second environmental parameter separate from the first environmental parameter. [Appendix 31] 28. The non-transitory machine-readable medium of claim 27, wherein a given sensor of the set of environmental sensors is physically separate from the node, and data from the given environmental sensor is wirelessly transmitted to the physical environmental authenticator. [Appendix 32] 28. The non-transitory machine-readable medium of claim 27, wherein at least two of the set of environmental sensors measure the same environmental parameter. [Appendix 33] 28. The non-transitory machine-readable medium of claim 27, wherein a first environmental sensor of the set of environmental sensors measures a first environmental parameter and a second environmental sensor of the set of environmental sensors measures a second environmental parameter separate from the first environmental parameter. [Appendix 34] 28. The non-transitory machine-readable medium of claim 27, wherein the physical environment authenticator converts, formats, and / or fuses one or more of the plurality of environmental parameters such that each of the plurality of environmental parameters is correlated. [Appendix 35] 28. The non-transitory machine-readable medium of claim 27, wherein in response to the physical environment authenticator granting access to the data, the cryptographic engine decrypts the encrypted data using a private key. [Appendix 36] 1. A method for controlling access to data based on environmental validation, comprising: receiving a request for access to data from a node, the request being received by a physical environment authenticator executing on the secure computing platform; said physical environment authenticator responding to said request to capture data from a set of environmental sensors characterizing a plurality of environmental parameters of said node; the physical environment authenticator comparing a plurality of correlated environmental parameters with each other and / or with thresholds, where at least a portion of the plurality of correlated environmental parameters are based on data from the set of environmental sensors, and allowing access to data if the plurality of correlated environmental parameters from each of the set of environmental sensors indicates that the node is operating in an authorized environment and denying access to data if at least one of the plurality of correlated environmental parameters indicates that the node is not operating in the authorized environment. [Appendix 37] 37. The method of claim 36, further comprising converting and / or formatting data provided from one or more of the set of environmental sensors to form the plurality of correlated environmental parameters. [Appendix 38] 37. The method of claim 36, wherein a first environmental sensor in the set of environmental sensors measures a first environmental parameter and a second environmental sensor in the set of environmental sensors measures a second environmental parameter separate from the first environmental parameter. [Appendix 39] 37. The method of claim 36, further comprising the step of the cryptographic engine of the secure computing platform decrypting the data in encrypted form using a private key in response to access to the data being granted.

Claims

1. 1. A system for controlling access to data based on environmental validation, comprising: a non-transitory memory storing machine-executable instructions; a processing unit for accessing machine-readable instructions stored in the non-transitory memory, the machine-readable instructions including a physical environment authenticator; The physical environment authenticator causes the processing unit to execute a process when the processing unit is executed, the process comprising: receiving data characterizing a plurality of environmental parameters of a node within the environment from a set of environmental sensors; comparing a plurality of correlated environmental parameters to one another or to a threshold, where the plurality of correlated environmental parameters are based at least in part on the data from the set of environmental sensors, allowing access to data if the plurality of correlated environmental parameters indicate that the node is operating in an authorized environment, and preventing access to data if the plurality of correlated environmental parameters indicate that the node is not operating in the authorized environment.

2. The system of claim 1, wherein the machine-readable instructions further comprise a trust server root, which, when executed by the processing unit, causes the processing unit to perform a process including performing a trusted boot to verify that the physical environment authenticator has not been modified.

3. 2. The system of claim 1, wherein the processing that the physical environment authenticator causes the processing unit to perform includes receiving decrypted data from a cryptographic engine and providing the decrypted data to the node.

4. The system of claim 1 , wherein the set of environmental sensors is integrated on an application specific integrated circuit (ASIC) chip.

5. 2. The system of claim 1, wherein the processing that the physical environmental authenticator causes the processing unit to perform includes converting and / or formatting a first environmental parameter provided from a first environmental sensor of the set of environmental sensors into a unit of measurement used to characterize a second environmental parameter provided from a second environmental sensor of the set of environmental sensors to form the plurality of correlated environmental parameters.

6. 2. The system of claim 1, wherein a first environmental sensor of the set of environmental sensors measures a first environmental parameter and a second environmental sensor of the set of environmental sensors measures a second environmental parameter separate from the first environmental parameter.

7. The system of claim 6 , wherein the first environmental parameter is a shear force applied to the node and the second environmental parameter is a temperature of the node.

8. The system of claim 6 , wherein the first environmental parameter is an acceleration of the node and the second environmental parameter is an amount of fuel consumed by the node.

9. The system of claim 6 , wherein the first environmental sensor is a Global Navigation Satellite System (GNSS) receiver and the second environmental sensor is an Inertial Measurement Unit (IMU).

10. The system of claim 6 , wherein the first environmental sensor is an accelerometer that measures an acceleration of the node, and the second environmental sensor is one of a mass flow meter, a temperature sensor, and a pressure sensor.

11. 7. The system of claim 6, wherein the first environmental parameter characterizes an orientation of a magnetic field of the node, the second environmental parameter characterizes a position or orientation of the node, and a third environmental sensor in the set of environmental sensors measures a third environmental parameter that characterizes time.

12. 2. The system of claim 1, wherein the set of environmental parameters includes a three-axis accelerometer, and the plurality of correlated environmental parameters includes an acceleration of the node in three separate axes, and the processing that the physical environment authenticator causes the processing unit to perform includes allowing access to data if the acceleration of the node in the three separate axes corresponds to microgravity for a predetermined duration.

13. 1. A method for controlling access to data based on environmental validation, comprising: receiving a request for access to data from a node, the request being received by a physical environment authenticator executing on the secure computing platform; said physical environment authenticator responding to said request to capture data from a set of environmental sensors characterizing a plurality of environmental parameters of said node; the physical environment authenticator comparing a plurality of correlated environmental parameters to each other or to a threshold, where at least a portion of the plurality of correlated environmental parameters are based on data from the set of environmental sensors, and allowing access to data if the plurality of correlated environmental parameters from each of the set of environmental sensors indicates that the node is operating in an authorized environment and denying access to data if at least one of the plurality of correlated environmental parameters indicates that the node is not operating in the authorized environment.

14. The method of claim 13 , further comprising converting and / or formatting data provided by one or more of the set of environmental sensors to form the plurality of correlated environmental parameters.

15. 14. The method of claim 13, further comprising the step of a cryptographic engine of the secure computing platform, in response to access being granted to the data, decrypting the data in encrypted form using a private key.

Images