Patent Publication Number: US-11664993-B2

Title: Communicating with a vehicle tracking device via short message service (SMS) secured by single-use credentials

Description:
RELATED APPLICATIONS 
     This application claims priority to U.S. provisional patent application Ser. No. 62/808,051, filed Feb. 20, 2019, titled One-Time Personal Identification Number (PIN) for Secured Short Message Service (SMS) Communications, the entire contents of which are incorporated herein by reference. 
    
    
     FIELD 
     This invention relates to the field of vehicle tracking devices. More particularly, this invention relates to a system for communicating with a vehicle tracking device using a secured Short Message Service communication protocol. 
     BACKGROUND 
     Typical automotive tracking devices include a GPS receiver and a cellular modem module. Communications with such tracking devices can be through a backend server via a data connection or via a Short Message Service (SMS) message. SMS is a text messaging service that uses standardized communication protocols to allow mobile devices to exchange relatively short (no more than 160 characters) alphanumeric text messages. 
     When a wireless data connection is used for communicating with a tracking device, standard and well known methods of authenticating the data can be used. However, there are some remote locations in which wireless data connections are not available, but SMS is available. SMS is often used to command a tracking device to perform a critical action when a wireless data connection is not available, such as setting up cellular connections and commanding a firmware update. 
     Currently, the only secure aspect of an SMS communication is the requirement of knowledge of the unique phone number of the cellular modem in the tracking device. However, if that phone number is known to a hacker, a message can be sent to a tracking device via a phone or a computer to command the device to perform some unwanted action. This is a significant security vulnerability. 
     What is needed, therefore, is a system for securely communicating with a vehicle tracking device using the SMS protocol. 
     SUMMARY 
     To resolve security vulnerabilities, embodiments described herein provide a single-use credential value for authenticating an SMS communication link before it can be used to command a vehicle tracking device. The single-use credential value is also referred to herein as a One-Time Personal Identification Number (OTPIN). The OTPIN is preferably time-based so that it can be used only once, similar to techniques described in the Request for Comments (RFC) 6238 promulgated by the Internet Engineering Task Force (IETF). In a preferred embodiment, a shared key “K” is set up in the tracking device and the backend server before the tracking device is put into service. When the backend server wishes to contact the tracking device, it must use the OTPIN to authenticate itself. This can be done in one of several ways, as described hereinafter. 
     A first embodiment described herein is directed to a method for providing secure communications between a backend server and a vehicle tracking device. This first embodiment includes steps of:
         (a) generating a command message including a command to be executed by the vehicle tracking device;   (b) generating a single-use credential value based at least in part on a shared key value and a first time value, wherein the single-use credential value is valid only during a first time window having a duration of X seconds, and wherein the first time value falls within the first time window;   (c) attaching the single-use credential value to the command message;   (d) sending the command message from the backend server to the vehicle tracking device via a wireless communication network;   (e) receiving the command message at the vehicle tracking device;   (f) a processor of the vehicle tracking device generating a first expected credential value based at least in part on the shared key value and a second time value;   (g) the processor of the vehicle tracking device comparing the first expected credential value to the single-use credential value attached to the command message; and   (h) the vehicle tracking device executing the command included in the command message only if the first expected credential value matches the single-use credential value attached to the command message.       

     In some embodiments, the first expected credential value matches the single-use credential value only if the second time value falls within the first time window. 
     In some embodiments, if the first expected credential value does not match the single-use credential value, the method further comprises:
         (f1) the processor of the vehicle tracking device generating a second expected credential value based at least in part on the shared key value and a time value that falls within a preceding time window that immediately precedes a time window into which the second time value falls;   (g1) the processor of the vehicle tracking device comparing the second expected credential value to the single-use credential value attached to the command message; and   (h1) the vehicle tracking device executing the command included in the command message only if the second expected credential value matches the single-use credential value attached to the command message.       

     In some embodiments, the preceding time window corresponds to the first time window. 
     In some embodiments, the second time value corresponds to a time at which the command message is received at the vehicle tracking device. 
     In some embodiments, the time at which the command message is received at the vehicle tracking device is determined based on reference to timing signals from Global Positioning System (GPS) satellites. 
     A second embodiment described herein includes steps of:
         (a) generating a command message including a command to be executed by the vehicle tracking device;   (b) generating a single-use credential value based at least in part on a shared key value and a first time value, wherein the single-use credential value is valid only during a first time window having a duration of X seconds, and wherein the first time value falls within the first time window;   (c) attaching the single-use credential value to the command message;   (d) attaching a timestamp value to the command message, wherein the timestamp value corresponds to the first time value;   (e) sending the command message from the backend server to the vehicle tracking device via a wireless communication network;   (f) receiving the command message at the vehicle tracking device;   (g) a processor of the vehicle tracking device generating an expected credential value based at least in part on the shared key value and the timestamp value attached to the command message;   (h) the processor of the vehicle tracking device comparing the expected credential value to the single-use credential value attached to the command message; and   (i) the vehicle tracking device executing the command included in the command message only if the expected credential value matches the single-use credential value attached to the command message.       

     A third embodiment described herein includes steps of:
         (a) generating a command message including a command to be executed by the vehicle tracking device;   (b) generating a single-use credential value based at least in part on a shared key value and a first time value, wherein the single-use credential value is valid only during a first time window having a duration of X seconds, and wherein the first time value falls within the first time window;   (c) encrypting the command message using the single-use credential value as an encryption key;   (d) sending the command message from the backend server to the vehicle tracking device via a wireless communication network;   (e) receiving the command message at the vehicle tracking device;   (f) a processor of the vehicle tracking device generating an expected credential value based at least in part on the shared key value and a second time value;   (g) the processor of the vehicle tracking device decrypting the command message using the expected credential value as a decryption key; and   (h) the vehicle tracking device executing the command included in the command message.       

     In some embodiments, the processor of the vehicle tracking device is able to decrypt the command message only if the expected credential value matches the single-use credential value attached to the command message. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       Other embodiments of the invention will become apparent by reference to the detailed description in conjunction with the figures, wherein elements are not to scale so as to more clearly show the details, wherein like reference numbers indicate like elements throughout the several views, and wherein: 
         FIG.  1    depicts a vehicle tracking device in communication with a backend server according to an embodiment of the invention; 
         FIG.  2    depicts a method for communicating messages to the vehicle tracking device from the backend server according to an embodiment of the invention; 
         FIG.  3    depicts a method for communicating messages to the vehicle tracking device from the backend server according to an alternative embodiment of the invention; 
         FIG.  4    depicts a method for communicating messages to the vehicle tracking device from the backend server according to an alternative embodiment of the invention; and 
         FIG.  5    depicts a method for communicating messages to the vehicle tracking device from the backend server according to an alternative embodiment of the invention. 
     
    
    
     DETAILED DESCRIPTION 
     As shown in  FIG.  1   , a communication system  10  includes a vehicle tracking device  12 , which may be installed in a vehicle. The vehicle tracking device  12  communicates with a service provider&#39;s backend server  26  via a wireless communication network  28 , such as a cellular network or Wi-Fi network, and a wide area communication network  32 , such as the Internet. The backend server  26  is also operable to communicate with a customer device  30  via the network  32  or the network  28 . The customer device  30  may be a computer, a tablet, or a smartphone through which a customer entity receives communications from the service provider. The customer entity may be a subscriber to asset tracking and monitoring services provided by the service provider. 
     A preferred embodiment of the vehicle tracking device  12  includes a Global Positioning System (GPS) module  16 , a central processing unit (CPU)  18 , a wireless modem  20 , and a power supply  24 . The GPS module  16  determines location coordinates of the vehicle tracking device  12  based on timing signals received from GPS satellites. These location coordinates may be communicated to the CPU  18  for storage in associated memory or to the wireless modem  20  to be transmitted to the backend server  26  of the monitoring service provider. In some embodiments, the location of the vehicle tracking device  12  may be determined based on the presence of a given Wi-Fi network or a particular cellular tower detected by the wireless modem  20 . 
     The CPU  18  of the vehicle tracking device  12  executes instructions to make decisions and direct communications between the vehicle tracking device  12  and the backend server  26 . In preferred embodiments, memory associated with the CPU  18  stores a unique identification/serial number (such as cellular telephone number) assigned to the vehicle tracking device  12 . 
     The wireless modem  20  of the vehicle tracking device  12  comprises a wireless RF transceiver, such as cellular modem, a satellite modem and/or a Wi-Fi modem, for providing two-way wireless communications between the vehicle tracking device  12  and the backend server  26 . 
     The vehicle tracking device  12  includes a power supply  24  that may receive and condition power from the vehicle power supply when the device  12  is connected to the vehicle&#39;s OBD bus. The power supply  24  may include a backup battery for providing power to the vehicle tracking device  12  when no power is being provided by the vehicle power supply. 
       FIG.  2    depicts steps of one preferred method  100  for communicating an SMS message from the backend server  26  to the vehicle tracking device  12 . Prior to any wireless command communications between the backend server  26  and the vehicle tracking device  12 , a provisioning process is performed in which at least two values are stored in the memory of the CPU  18  of the tracking device  12  to be used in the One-Time Personal Identification Number (OTPIN) authentication process (step  102 ). These values, which are discussed in more detail hereinafter, include a shared key K and a time window value X. The provisioning process is typically performed before the vehicle tracking device  12  is installed in a vehicle, and may be accomplished via a secure Wi-Fi or wired network connection. 
     After the vehicle tracking device  12  has been installed in a vehicle, the backend server  26  generates an SMS message that includes a command to be executed by the vehicle tracking device  12  (step  104 ), such as a command to acquire and transmit its current GPS coordinates. Using the shared key and a first time value corresponding to the current time, the backend server  26  also generates the OTPIN (step  106 ). In a preferred embodiment, the first time value identifies a specific time window referenced to standard UNIX time, also referred to herein as the first time window. Preferably, the OTPIN is valid only during this first time window after its generation. For example, the width of the first time window may be specified by the value X, which in a preferred embodiment is 30 seconds. The first time window has a begin time TO that is preferably referenced to the current UNIX time. The backend server  26  prepends the OTPIN to the SMS message (step  108 ), and transmits the SMS message via the communication networks  32  and  28  to the vehicle tracking device  12  (step  112 ). 
     Upon receipt of the SMS message (step  114 ), the CPU  18  of the vehicle tracking device  12  calculates an expected value of the OTPIN based on the shared key and a second time value corresponding to a second time window during which the vehicle tracking device  12  received the SMS message (step  116 ). The CPU  18  compares the expected value of the OTPIN to the OTPIN appended to the SMS message (step  118 ). If the expected value of the OTPIN matches the OTPIN appended to the SMS message, the vehicle tracking device  12  executes the command included in the SMS message (step  120 ). 
     An alternative embodiment implements the process depicted in  FIG.  3   . Steps  202  through  206  of this embodiment are generally the same as steps  102  through  106  of the embodiment of  FIG.  2   . However, in the process of  FIG.  3   , instead of prepending the OTPIN to the SMS message, the backend server  26  encrypts the SMS message using the OTPIN as the encryption key (step  208 ). The backend server  26  then transmits the encrypted SMS message via the communication networks  32  and  28  to the vehicle tracking device  12  (step  210 ). Upon receipt of the SMS message (step  212 ), the CPU  18  of the vehicle tracking device  12  calculates an expected value of the OTPIN based on the shared key and the second time value corresponding to the time window during which the vehicle tracking device  12  received the SMS message (step  214 ). The CPU  18  can decrypt the encrypted SMS message using the expected OTPIN only if the expected OTPIN matches the OTPIN that was used by the backend server  26  to encrypt the SMS message (step  216 ). If the SMS message is successfully decrypted, then the vehicle tracking device  12  executes the decrypted command (step  218 ). While providing the advantage of an encrypted message, this embodiment also requires no messaging overhead. Given the 140-byte limit of legacy SMS messages, this embodiment provides a significant advantage. 
     It should be noted that the OTPIN prepended to the SMS message is valid only for the duration of the first time window defined by the value X (such as 30 seconds) that began at the time TO at which the OTPIN was generated. Due to latency issues, by the time the SMS message is received at the vehicle tracking device  12 , the first time window during which the OTPIN is valid may have expired. Timing errors can also occur due to clock drift in the GPS module  16  of the vehicle tracking device  12  if it is unable to acquire GPS timing signals due to loss of communication with the GPS satellites. In such situations, the expected value of the OTPIN may have been calculated by the CPU  18  during a time window subsequent to the first time window in which the OTPIN prepended to the SMS message was calculated, and the expected OTPIN will therefore not match the received OTPIN. 
     As depicted in  FIG.  4   , some embodiments address the latency issue by also prepending a timestamp to the SMS message (step  110 ). The timestamp corresponds to the time TO at which the prepended OTPIN value was calculated at the backend server  26 . The CPU  18  of the vehicle tracking device  12  then uses the timestamp value in calculating the expected OTPIN instead of using the time value corresponding to the time at which the SMS message was received by the vehicle tracking device  12  (step  115 ). 
     It should be noted that the embodiment of  FIG.  4    differs from time-based one-time password (TOTP) techniques described in RFC6238. In contrast to the embodiment of  FIG.  4   , TOTP uses a Unix timestamp as one of several seed values for an encryption hash, but the timestamp is not transmitted openly in the message. In the embodiment of  FIG.  4   , the timestamp is transmitted openly in the message. 
     As depicted in  FIG.  5   , other embodiments address the latency issue by effectively lengthening the time period during which the prepended OTPIN value is valid. In these embodiments, if the expected OTPIN calculated as described above does not match the OTPIN value prepended to the SMS message (step  119 ), the CPU  18  calculates the expected value of the OTPIN based on the shared key and a time value corresponding to a 30-second-wide time window that preceded the window in which the vehicle tracking device  12  received the SMS message (step  117 ). The number of time windows included in this “looking back” process may be programmed to no more than one or two windows (such as 60 or 90 seconds), as providing validity to older OTPIN values may significantly impact security vulnerabilities. In other words, lengthening the time that an OTPIN value is valid gives hackers more time to access and use an old value OTPIN to cause the vehicle tracking device  12  to act on an unwanted command. It will be appreciated that the time windows may have widths other than 30 seconds, as specified by the provisioned value X. 
     Some embodiments may be implemented using a separate library in the vehicle tracking device  12 , allowing for integration into third party systems without revealing the method by which the SMS message is encrypted. A library may be created which has the functions of:
         EncryptedMessage=EncryptMessage(SMSClearTextMessageToSend)   DecryptedMessage=DecryptMessage(SMSEncryptedMessageReceived)   StoreSharedKey(SharedKey)       

     The foregoing description of preferred embodiments for this invention have been presented for purposes of illustration and description. They are not intended to be exhaustive or to limit the invention to the precise form disclosed. Obvious modifications or variations are possible in light of the above teachings. The embodiments are chosen and described in an effort to provide the best illustrations of the principles of the invention and its practical application, and to thereby enable one of ordinary skill in the art to utilize the invention in various embodiments and with various modifications as are suited to the particular use contemplated. All such modifications and variations are within the scope of the invention as determined by the appended claims when interpreted in accordance with the breadth to which they are fairly, legally, and equitably entitled.