System and Method for Protecting Train Event Data

Patent metadata

Field	Value
Publication number	US-2016014111-A1
Application number	US-201414767418-A
Country	US
Kind code	A1
Filing date	Feb 24, 2014
Priority date	Mar 4, 2013
Publication date	Jan 14, 2016
Grant date	—

Abstract

Systems and methods for protecting and preventing unauthorized transfer or downloading of recorded train event data for use in a train event recording system of a train. A train event recording system and an authenticated data storage device are also disclosed. According to one preferred and non-limiting embodiment, provided is a system for protecting recorded train event data, the system including at least one external memory device having encrypted authentication data stored thereon, the encrypted authentication data including authentication data encrypted with at least one first key.

First claim

What is claimed is:

1 . A system for protecting recorded train event data, comprising:
at least one external memory device comprising encrypted authentication data, the encrypted authentication data comprising authentication data encrypted with at least one first key; and a train event recording system on a train and in communication with a train management computer, the train event recording system configured to:
record train event data for the train from the train management computer;
determine if the at least one external memory device comprises the encrypted authentication data when the at least one external memory device is in communication with the train event recording system;
decrypt the encrypted authentication data based at least partially on at least one second key;
determine if the authentication data is valid; and
facilitate a transfer or cause the transfer of at least a portion of the event data to the at least one external memory device if the authentication data is determined to be valid.

2 . The system of claim 1 , wherein the at least one first key and the at least one second key are different, and wherein the authentication data is encrypted with an asymmetrical encryption algorithm.

3 . The system of claim 2 , wherein the at least one first key comprises at least one private key and the at least one second key comprises at least one public key.

4 . The system of claim 1 , wherein the authentication data comprises at least one of the following: railroad data, user data, a device serial number, an expiration date, or any combination thereof.

5 . The system of claim 1 , wherein the train event recording system is further configured to detect when the at least one external memory device is in communication with the train event recording system.

6 . The system of claim 1 , further comprising a computer-readable medium including program instructions which, when executed by at least one processor of a computer, cause the computer to:
receive user input; generate the authentication data based at least in part on the user input; and encrypt at least a portion of the authentication data.

7 . The system of claim 1 , further comprising at least one authentication token stored on the at least one external memory device, the at least one authentication token including at least a portion of the encrypted authentication data.

8 . The system of claim 1 , further comprising a verification server configured to receive at least a portion of the decrypted authentication data, and transmit an indication to the train event recording system that the at least one external storage device is valid or invalid.

9 . A method of preventing unauthorized transfer of train event data from a train event recording system, comprising:
providing a plurality of memory devices, wherein each memory device comprises authentication data encrypted with at least one first key; storing at least one second key on a computer-readable medium in communication with the train event recording system; determining, with the train event recording system or a train management computer, if the encrypted authentication data is on at least one memory device of the plurality of memory devices; decrypting, with the train event recording system or the train management computer, the encrypted authentication data based at least partially on the at least one second key; determining if the at least one memory device is valid based at least partially on the authentication data; and preventing at least a portion of the event data from being transferred to the at least one memory device if the at least one memory device is not determined to be valid.

10 . The method of claim 9 , wherein the at least one first key and the at least one second key are different, and wherein the authentication data is encrypted with an asymmetrical encryption algorithm.

11 . The method of claim 9 , wherein the at least one first key comprises at least one public key and the at least one second key comprises at least one private key.

12 . The method of claim 9 , wherein the authentication data comprises at least one of the following: railroad data, user data, a memory device serial number, an expiration date, or any combination thereof.

13 . The method of claim 9 , further comprising detecting a connection of the at least one memory device to the train event recording system.

14 . The method of claim 9 , wherein, before the providing step, the method further comprises:
receiving user input at a management computer; generating the authentication data based at least in part on the user input; and encrypting at least a portion of the authentication data with the at least one first key.

15 . A method of preventing unauthorized download of event data from a train event recording system, comprising:
generating at least one authentication token for at least one storage device; storing the at least one authentication token on the at least one storage device; and providing an event recording system on a train, wherein the event recording system is configured to selectively facilitate access to at least a portion of recorded event data based at least partially on the at least one authentication token.

16 . The method of claim 15 , wherein the at least one authentication token is generated by encrypting authentication data with at least one encryption key.

17 . The method of claim 16 , wherein the event recording system is further configured to decrypt the authentication token with at least one decryption key.

18 . The method of claim 17 , wherein the at least one encryption key is different than the at least one decryption key, and wherein the authentication data is encrypted based at least partially on an asymmetrical encryption algorithm.

19 . The method of claim 15 , wherein the authentication data comprises at least one of the following: railroad data, user data, a device serial number, an expiration date, or any combination thereof.

20 . The method of claim 15 , further comprising detecting a connection of the at least one storage device to the event recording system.

21 . The method of claim 15 , further comprising:
receiving user input at a management computer; generating authentication data based at least in part on the user input; and encrypting at least a portion of the authentication data.

22 . A train event recording system comprising at least one processor, the train event recording system configured to:
record train event data; detect an external storage device communicating with the train event recording system; determine if the external storage device is valid based at least partially on encrypted authentication information stored on the external storage device and at least one decryption key; and prevent transfer of at least a portion of the train event data to the external storage device if the external storage device is not valid.

23 . The train event recording system of claim 22 , wherein the encrypted authentication information is encrypted with at least one encryption key, and wherein the at least one encryption key is different than the at least one decryption key.

24 . The train event recording system of claim 23 , wherein the at least one encryption key comprises at least one private key and the at least one decryption key comprises at least one public key.

25 . The train event recordin

Assignees

• Wabtec Holding Corp

Inventors

• Kurz Brian E

Classifications

• H04L63/0807 Primary

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title

• B61L15/0072

  On-board train data handling · CPC title

• H04L9/3234

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• G06F21/44

  Program or device authentication · CPC title