Patent Description:
The present disclosure relates to devices, systems, and methods for communicating between devices in an aircraft system, and more specifically, to methods and systems for starting secure communication in systems with high availability.

Aircraft and other systems often include distributed control systems with embedded devices. Secure communication between the embedded components is important for security and other reasons. In addition, establishing secure communication protocols between embedded products in a distributed control system may be needed.

US patent application <CIT> is background art.

The present disclosure generally relates to devices, systems, and methods for establishing secure communication protocols between embedded devices in a distributed control system, such as an aircraft system with distributed architecture. The devices, systems, and methods described herein ensure that communication is only between devices within the distributed control system. This ensures integrity and confidentially of the data transmitted between devices. When combined with a secure boot, this ensures that the distributed control system has not been tampered with, thereby ensuring a secure system.

One method of ensuring secure communication between devices is to use a session key. In particular, a session key may be used by a device to encrypt messages to be sent to another device and/or to decrypt messages received from the other device. As such, devices can communicate with each other in a secure fashion.

However, in order for communication using a session key to be secure, the session key itself must be negotiated between two devices in a secure manner. A variety of methods may be utilized to securely negotiate a session. For example, a Diffie-Hellman key exchange uses modular arithmetic involving public-private key pairs made up of large prime numbers (typically hundreds of bits long) to establish a symmetric session key that can be used to encrypt communications between devices. This method is highly secure if the prime numbers used are large enough. However, establishing a secure communication protocol using a system such as Diffie-Hellman key exchange may require many transmissions and significant traffic between devices and may take several seconds to complete, depending on processor loading. Other methods may also be used to negotiate a session key, but other such methods are also likely to take some time to complete.

Accordingly, if two devices need to quickly establish communication with each other before a secure session key can be negotiated between the two devices, an alternative communication protocol may be desired. This may be important to ensure quick communication between devices upon system startup or after a system reset to ensure safe engine operation.

As such, in embodiments disclosed herein, in order to quickly establish communication between devices, if a session key exists that was created during a previous communication session between the devices, the devices may use the previously negotiated session key to begin encrypted communication with each other. If there is no session key created during a previous communication session (e.g., during the first time that two devices communicate with each other), then the devices may begin communicating using unencrypted communication. Once communication begins, either unencrypted or using a previously negotiated session key, a new session key may be negotiated, while communication is ongoing. After the new session key is negotiated, the devices may begin using the new session key to transmit encrypted communication and the devices may store the new session key for a future communication session. Accordingly, embodiments disclosed herein have a technical effect of quickly establishing secure communications between devices in a distributed control system.

It should be understood that, while the embodiments described herein relate particularly to a distributed control system that is used to control components of an aircraft, the present disclosure is not limited to such. That is, similar systems and methods may be used for other applications without departing from the scope of the present disclosure. For example, the systems and methods described herein could be used for other distributed systems, such as chemical plants, power plants, water management systems, pharmaceutical manufacturing systems, and the like.

These and other features, and characteristics of the present technology, as well as the methods of operation and functions of the related elements of structure and the combination of parts and economies of manufacture, will become more apparent upon consideration of the following description and the appended claims with reference to the accompanying drawings, all of which form a part of this specification, wherein like reference numerals designate corresponding parts in the various figures. It is to be expressly understood, however, that the drawings are for the purpose of illustration and description only and are not intended as a definition of the limits of the disclosure. As used in the specification and in the claims, the singular form of 'a', 'an', and 'the' include plural referents unless the context clearly dictates otherwise.

<FIG> depicts an illustrative distributed control system <NUM>, which is used to control various components of an aircraft <NUM> according to various embodiments. The aircraft <NUM> generally includes a fuselage <NUM>, wing assemblies <NUM>, and one or more engines <NUM>. While <FIG> depicts the aircraft <NUM> as being a fixed-wing craft having two wing assemblies <NUM> with one engine <NUM> mounted on each wing assembly <NUM> (two engines <NUM> total), other configurations are contemplated. For example, other configurations may include more than two wing assemblies <NUM>, more than two engines <NUM> (e.g., trijets, quadjets, etc.), engines <NUM> that are not mounted to a wing assembly <NUM> (e.g., mounted to the fuselage <NUM>, mounted to the tail, mounted to the nose, etc.), non-fixed wings (e.g., rotary wing aircraft), and/or the like.

As illustrated in <FIG>, the aircraft <NUM> may include the engines <NUM> coupled to the wing assemblies <NUM> and/or the fuselage <NUM>, a cockpit <NUM> positioned in the fuselage <NUM>, and the wing assemblies <NUM> extending outward from the fuselage <NUM>. A control mechanism <NUM> for controlling the aircraft <NUM> is included in the cockpit <NUM> and may be operated by a pilot located therein. It should be understood that the term "control mechanism" as used herein is a general term used to encompass all aircraft control components, particularly those typically found in the cockpit <NUM>.

A plurality of additional aircraft systems <NUM> that enable proper operation of the aircraft <NUM> may also be included in the aircraft <NUM> as well as an engine controller <NUM>, and a communication system having the aircraft wireless communications link <NUM>. The additional aircraft systems <NUM> may generally be any systems that effect control of one or more components of the aircraft <NUM>, such as, for example, cabin pressure controls, elevator controls, rudder controls, flap controls, spoiler controls, landing gear controls, heat exchanger controls, and/or the like. In some embodiments, the avionics of the aircraft <NUM> may be encompassed by one or more of the additional aircraft systems <NUM>. The aircraft wireless communications link <NUM> may generally be any air-to-ground communication system now known or later developed. Illustrative examples of the aircraft wireless communications link <NUM> include, but are not limited to, a transponder, a very high frequency (VHF) communication system, an aircraft communications addressing and reporting system (ACARS), a controller-pilot data link communications (CPDLC) system, a future air navigation system (FANS), and/or the like. The engine controller <NUM> may be operably coupled to the plurality of aircraft systems <NUM> and the engines <NUM>. While the embodiment depicted in <FIG> specifically refers to the engine controller <NUM>, it should be understood that other controllers may also be included within the aircraft <NUM> to control various other aircraft systems <NUM> that do not specifically relate to the engines <NUM>.

In some embodiments, the engine controller <NUM> is mounted on the one or more engines <NUM>. However, the engine controller <NUM> may be mounted to or integrated with other aircraft components in other embodiments. For example, the engine controller <NUM> may be mounted within the aircraft <NUM> (e.g., not on the one or more engines <NUM>) in some embodiments, including the embodiment of <FIG>. The engine controller <NUM> may also be communicatively coupled to other controllers of the aircraft <NUM>. In embodiments, the engine controller <NUM> may include a processor <NUM> and/or memory <NUM>, including non-transitory memory. In some embodiments, the memory <NUM> may include random access memory (RAM), read-only memory (ROM), flash memory, or one or more different types of portable electronic memory, such as discs, DVDs, CD-ROMs, or the like, or any suitable combination of these types of memory. The processor <NUM> may carry out one or more programming instructions stored on the memory <NUM>, thereby causing operation of the engine controller <NUM>. That is, the processor <NUM> and the memory <NUM> within the engine controller <NUM> may be operable to carry out the various processes described herein with respect to the engine controller <NUM>, including operating various components of the aircraft <NUM> (such as the engine <NUM> and/or components thereof), monitoring the health of various components of the aircraft <NUM> (e.g., the engine <NUM> and/or components thereof), monitoring operation of the aircraft <NUM> and/or components thereof.

In some embodiments, the engine controller <NUM> may be a full authority digital engine control (FADEC) system. The FADEC system includes an electronic engine controller (EEC) <NUM> or engine control unit (ECU) or electronic control unit and a distributed control module (DCM) <NUM>, as shown in <FIG>, and described in further detail below. Returning to <FIG>, the FADEC system may also contain one or more additional components that are configured to control various aspects of performance of the engines <NUM>. The FADEC system generally has full authority over operating parameters of the engines <NUM> and cannot be manually overridden. A FADEC system generally functions by receiving a plurality of input variables of a current flight condition, including, but not limited to, air density, throttle lever position, engine temperature, engine pressure, and/or the like. The inputs are received, analyzed, and used to determine operating parameters such as, but not limited to, fuel flow, stator vane position, bleed valve position, and/or the like. The FADEC system may also control a start or a restart of the engines <NUM>. The operating parameters of the FADEC can be modified by installing and/or updating software. As such, the FADEC can be programmatically controlled to determine engine limitations, receive engine health reports, and receive engine maintenance reports and/or the like to undertake certain measures and/or actions in certain conditions.

In some embodiments, the engine controller <NUM> may include one or more programming instructions for diagnosing and/or predicting one or more engine system faults in the aircraft <NUM>. Diagnosed and/or predicted faults may include, but are not limited to, improper operation of components, failure of components, indicators of future failure of components, and/or the like. As used herein, the term diagnosing refers to a determination after the fault has occurred and contrasts with prediction, which refers to a forward looking determination that makes the fault known in advance of when the fault occurs. Along with diagnosing, the engine controller <NUM> may detect the fault.

The program run by the engine controller <NUM> (e.g., executed by the processor <NUM> and stored within the memory <NUM>) may include a computer program product that includes machine-readable media for carrying or having machine-executable instructions or data structures. Such machine-readable media may be any available media, which can be accessed by a general purpose or special purpose computer or other machine with a processor. Generally, such a computer program may include routines, programs, objects, components, data structures, algorithms, and/or the like that have the technical effect of performing particular tasks or implementing particular abstract data types. Machine-executable instructions, associated data structures, and programs represent examples of program code for executing the exchange of information as disclosed herein. Machine-executable instructions may include, for example, instructions and data, which cause a general purpose computer, special purpose computer, or special purpose processing machine to perform a certain function or group of functions. In some embodiments, the computer program product may be provided by a component external to the engine controller <NUM> and installed for use by the engine controller <NUM>.

In embodiments, each of the engines <NUM> may include a fan <NUM> and one or more sensors <NUM> for sensing various characteristics of the fan <NUM> during operation of the engines <NUM>. Illustrative examples of the one or more sensors <NUM> include, but are not limited to, a fan speed sensor <NUM>, a temperature sensor <NUM>, and a pressure sensor <NUM>. The fan speed sensor <NUM> is generally a sensor that measures a rotational speed of the fan <NUM> within the engine <NUM>. The temperature sensor <NUM> may be a sensor that measures a fluid temperature within the engine <NUM> (e.g., an engine air temperature), a temperature of fluid (e.g., air) at an engine intake location, a temperature of fluid (e.g., air) within a compressor, a temperature of fluid (e.g., air) within a turbine, a temperature of fluid (e.g., air) within a combustion chamber, a temperature of fluid (e.g., air) at an engine exhaust location, a temperature of cooling fluids and/or heating fluids used in heat exchangers in or around an engine, and/or the like. The pressure sensor <NUM> may be a sensor that measures a fluid pressure (e.g., air pressure) in various locations in and/or around the engine <NUM>, such as, for example, a fluid pressure (e.g., air pressure) at an engine intake, a fluid pressure (e.g., air pressure) within a compressor, a fluid pressure (e.g., air pressure) within a turbine, a fluid pressure (e.g., air pressure) within a combustion chamber, a fluid pressure (e.g., air pressure) at an engine exhaust location, and/or the like.

In some embodiments, each of the engines <NUM> may have a plurality of sensors <NUM> associated therewith (including one or more fan speed sensors <NUM>, one or more temperature sensors <NUM>, and/or one or more pressure sensors <NUM>). That is, more than one of the same type of sensor <NUM> may be used to sense characteristics of an engine <NUM> (e.g., a sensor <NUM> for each of the different areas of the same engine <NUM>). In some embodiments, one or more of the sensors <NUM> may be utilized to sense characteristics of more than one of the engines <NUM> (e.g., a single sensor <NUM> may be used to sense characteristics of two engines <NUM>). The engines <NUM> may further include additional components not specifically described herein, and may include one or more additional sensors <NUM> incorporated with or configured to sense such additional components in some embodiments.

In embodiments, each of the sensors <NUM> (including, but not limited to, the fan speed sensors <NUM>, the temperature sensors <NUM>, and the pressure sensors <NUM>) may be communicatively coupled to one or more components of the aircraft <NUM> such that signals and/or data pertaining to one or more sensed characteristics are transmitted from the sensors <NUM> for the purposes of determining, detecting, and/or predicting a fault, as well as completing one or more other actions in accordance with software programming that requires sensor information. As indicated by the dashed lines extending between the various sensors <NUM> (e.g., the fan speed sensors <NUM>, the temperature sensors <NUM>, and the pressure sensors <NUM>) and the aircraft systems <NUM> and the engine controller <NUM> in the embodiment depicted in <FIG>, the various sensors <NUM> may be communicatively coupled to the aircraft systems <NUM> and/or the engine controller <NUM> in some embodiments. As such, the various sensors <NUM> may be communicatively coupled via wires or wirelessly to the aircraft systems <NUM> and/or the engine controller <NUM> to transmit signals and/or data to the aircraft systems <NUM> and/or the engine controller <NUM>.

It should be understood that the aircraft <NUM> merely represents one illustrative embodiment that may be configured to implement embodiments or portions of embodiments of the devices, systems, and methods described herein. During operation, the aircraft <NUM> (such as the engine controller <NUM> and/or another component) may diagnose or predict a system fault in one or more of the various aircraft systems <NUM>. By way of non-limiting example, while the aircraft <NUM> is being operated, the control mechanism <NUM> may be utilized to operate one or more of the aircraft systems <NUM>. Various sensors <NUM>, including, but not limited to, the fan speed sensors <NUM>, the temperature sensors <NUM>, and/or the pressure sensors <NUM> may output data relevant to various characteristics of the engine <NUM> and/or the other aircraft systems <NUM>. The engine controller <NUM> may utilize inputs from the control mechanism <NUM>, the fan speed sensors <NUM>, the temperature sensors <NUM>, the pressure sensors <NUM>, the various aircraft systems <NUM>, one or more database, and/or information from airline control, flight operations, or the like to diagnose, detect, and/or predict faults that airline maintenance crew may be unaware of. Among other things, the engine controller <NUM> may analyze the data output by the various sensors <NUM> (e.g., the fan speed sensors <NUM>, the temperature sensors <NUM>, the pressure sensors <NUM>, etc.), over a period of time to determine drifts, trends, steps, or spikes in the operation of the engines <NUM> and/or the various other aircraft systems <NUM>. The engine controller <NUM> may also analyze the system data to determine historic pressures, historic temperatures, pressure differences between the plurality of engines <NUM> on the aircraft <NUM>, temperature differences between the plurality of engines <NUM> on the aircraft <NUM>, and/or the like, and to diagnose, detect, and/or predict faults in the engines <NUM> and/or the various other aircraft systems <NUM> based thereon. Once a fault has been diagnosed, detected, and/or predicted, an indication may be provided on the aircraft <NUM> and/or at the ground system <NUM>. It is contemplated that the diagnosis, detection, and/or prediction of faults may be completed during pre-flight checks, may be completed during flight, may be completed post flight, or may be completed after a plurality of flights has occurred. The aircraft wireless communications link <NUM> and the ground wireless communications link <NUM> may transmit data such that data and/or information pertaining to the fault may be transmitted off the aircraft <NUM>.

It should be appreciated that, although a particular aerial vehicle has been illustrated and described in <FIG>, other configurations and/or aerial vehicles, such as high speed compound rotary-wing aircraft with supplemental translational thrust systems, dual contra-rotating, coaxial rotor system aircraft, turboprops, tilt-rotors, tilt-wing aircraft, conventional take-off and landing aircraft and other turbine driven machines will also benefit from the present disclosure.

While the embodiment of <FIG> specifically relates to components within an aircraft <NUM>, the present disclosure is not limited to such. That is, the various components depicted with respect to the aircraft <NUM> may be incorporated within various other types of craft and may function in a similar manner to perform the operations described herein. For example, the various components described herein with respect to the aircraft <NUM> may be present in watercraft, spacecraft, and/or the like without departing from the scope of the present disclosure.

Still referring to <FIG>, the ground system <NUM> is generally a transmission system located on the ground that is capable of transmitting and/or receiving signals to/from the aircraft <NUM>. That is, the ground system <NUM> may include a ground wireless communications link <NUM> that is communicatively coupled to the aircraft wireless communications link <NUM> wirelessly to transmit and/or receive signals and/or data. In some embodiments, the ground system <NUM> may be an air traffic control (ATC) tower and/or one or more components or systems thereof. Accordingly, the ground wireless communications link <NUM> may be a VHF communication system, an ACARS unit, a CPDLC system, FANS, and/or the like. Using the ground system <NUM> and the ground wireless communications link <NUM>, the various non-aircraft components depicted in the embodiment of <FIG> may be communicatively coupled to the aircraft <NUM>, even in instances where the aircraft <NUM> is airborne and in flight. However, it should be understood that the embodiment depicted in <FIG> is merely illustrative. In other embodiments, the aircraft <NUM> may be communicatively coupled to the various other components of the distributed control system <NUM> when on the ground.

Turning to <FIG>, a schematic diagram of various components of the distributed control system <NUM> are depicted. Particularly, <FIG> depicts a schematic diagram of the engine controller <NUM>. As explained above, in some embodiments, the engine controller <NUM> comprises FADEC system. As also explained above, the engine controller <NUM> comprises an electronic engine control (EEC) <NUM> and a distributed control module (DCM) <NUM>. The EEC <NUM> is coupled to the DCM <NUM> through a data bus <NUM>. In some embodiments, the data bus <NUM> comprises an Engine Area Distributed Interconnect Network (EADIN). Under the EADIN data bus protocol, the EEC <NUM> and the DCM <NUM> operate in a master/slave structure, where the EEC <NUM> is the master and the DCM <NUM> is the slave. Thus, the EEC <NUM> controls the operation of various components of the aircraft <NUM> through the DCM <NUM>. In some examples, the engine controller <NUM> may be replaced with a component in an avionics system, a power distribution system, a propeller control system, or another device in the distributed control system <NUM>.

The DCM <NUM> is coupled to a plurality of sensor nodes 206a, 206b, 206c and a plurality of actuator nodes 208a, 208b, 208c. In the illustration of <FIG>, three sensor nodes and three actuator nodes are shown for purposes of illustration. However, it should be understood that the distributed control system <NUM> may include any number of sensor nodes and/or actuator nodes without departing from the scope of the present disclosure. The sensor nodes 206a, 206b, 206c send and receive data from a variety of sensors, such as the sensors <NUM> of <FIG>. The actuator nodes 208a, 208b, 208c can control actuation devices such as the aircraft systems <NUM> of <FIG>. In some embodiments, the nodes are all located on the aircraft <NUM>. In other embodiments, some of the nodes may be located off the aircraft <NUM>. In some embodiments, the engine controller <NUM> may include multiple distributed control modules <NUM> coupled to the EEC <NUM> through the data bus <NUM>. In these embodiments, each DCM <NUM> may be coupled to a plurality of different nodes. In some examples, one or more of the actuator nodes 208a, 208b, 208c or the sensor nodes 206a, 206b, 206c may be a line-replaceable unit (LRU).

Military and/or civilian applications may include authentication and encryption along with the data bus <NUM> to prevent tampering. Furthermore, it is important that data from sensors on the aircraft and commands sent to actuators on the aircraft be processed quickly in order to maintain control of the engine <NUM> and support operation of the aircraft <NUM>. In addition, high availability is desired to ensure safe engine operation. Thus, distributed engine control has tight real time constraints.

As discussed above, a Diffie-Hellman key exchange, or other methods of negotiating a secure, symmetric session key that may be used to encrypt data transmitted between devices may take up to several seconds to complete. As such, disclosed herein is a method of quickly establishing secure communication between devices before a new session key can be established.

In embodiments disclosed herein, when the EEC <NUM> and the DCM <NUM> begin a communication session, they may check whether a previously negotiated session key has been stored. If so, the stored session key may be used to encrypt and/or decrypt communication between the EEC <NUM> and the DCM <NUM>. A new session key may then be negotiated while this communication is ongoing using a Diffie-Hellman key exchange or another method. Once the new session key is negotiated, the EEC <NUM> and the DCM <NUM> may either start using the new session key to encrypt and/or decrypt communication, or simply store the newly negotiated session key for a future communication session.

Alternatively, if a previously negotiated session key has not been stored (e.g., this is the first time the EEC <NUM> and the DCM <NUM> are communicating with each other) or previously stored session keys don't match and encrypted communication fails (e.g., either the EEC <NUM> or the DCM <NUM> has previously communicated with a different endpoint and as such, the EEC <NUM> and the DCM <NUM> have each stored different session keys), then the EEC <NUM> and the DCM <NUM> may begin unencrypted communication with each other (e.g., without using a session key). Then, while unencrypted communication is ongoing, a new session key may be securely negotiated. Once the new session key is negotiated, the EEC <NUM> and the DCM <NUM> may start using the new session to encrypt and/or decrypt communication. The new session key may also be stored for a future communication session. A similar communication protocol may be used for communication between the DCM <NUM> and the nodes 206a, 206b, 206c, 208a, 208b, or 208c in the example of <FIG>, or between other components of the aircraft system <NUM>.

Turning to <FIG>, a schematic diagram of the EEC <NUM> is shown. The EEC <NUM> includes a non-volatile memory <NUM>, one or more processors <NUM>, a transceiver <NUM>, and one or more memory modules <NUM>. The one or more processors <NUM> may be a controller, an integrated circuit, a microchip, a computer, or any other computing device. The one or more memory modules <NUM> may include RAM, ROM, flash memories, hard drives, or any device capable of storing machine readable and executable instructions such that the machine readable and executable instructions can be accessed by the one or more processors <NUM>.

The one or more memory modules <NUM> may include a session key retrieval module <NUM>, an encryption module <NUM>, a decryption module <NUM>, and a session key negotiation module <NUM>. Each of the session key retrieval module <NUM>, the encryption module <NUM>, the decryption module <NUM>, and the session key negotiation module <NUM> may be a program module in the form of operating systems, application program modules, and other program modules stored in the one or more memory modules <NUM>. The one or more memory modules <NUM> may include, but are not limited to, routines, subroutines, programs, objects, components, data structures and the like for performing specific tasks or executing specific data types as will be described below.

The non-volatile memory <NUM> may store session keys negotiated by the session key negotiation module <NUM>, as explained in further detail below. Once a session key is stored in the non-volatile memory <NUM>, it may be used to encrypt communication in a future communication session, as explained in further detail below.

The transceiver <NUM> may send and receive messages to and from the data bus <NUM>, where the messages can be directed to the DCM <NUM> or to other components of the aircraft system <NUM>. In some examples, the transceiver <NUM> may transmit messages encrypted by the encryption module <NUM>, as disclosed herein. In other examples, the transceiver <NUM> may transmit messages without encryption, as disclosed herein.

The session key retrieval module <NUM> may determine whether a previously negotiated session key is stored in the non-volatile memory <NUM>. If a previously negotiated session key is stored in the non-volatile memory <NUM>, the session key retrieval module <NUM> may retrieve the previously negotiated session key from the non-volatile memory <NUM>. The retrieved session key may then be use for secure communications, as disclosed in further detail below.

In one example, multiple previously negotiated session keys may be stored in the non-volatile memory <NUM>. For example, multiple session keys used to communicate with different devices (e.g., different nodes of the aircraft system <NUM>) may be stored in the non-volatile memory <NUM>. In this example, the session key retrieval module <NUM> may retrieve the appropriate session key associated with which communication is to begin. This ensures that both devices to communicate with each other will use the same session key.

In another example, multiple session keys negotiated with the same device on previous occasions may be stored in the non-volatile memory <NUM>. For example, a new session may be negotiated and stored in the non-volatile memory <NUM> during each communication session between two devices. In this example, each time a session key is stored in the non-volatile memory <NUM>, a timestamp may also be stored indicating a time that the session key is stored. Then, when the session key retrieval module <NUM> retrieves a previously negotiated session key from the non-volatile memory, the session key retrieval module <NUM> may retrieve the most recently stored session key. The other device to be communicated with may do the same thing, thereby ensuring that the two devices use the same session key.

The encryption module <NUM> may use the session key retrieved by the session key retrieval module <NUM> to encrypt messages. A message encrypted with the session key can only be decrypted by another holder of the session key, which ensures that the message cannot be decrypted if it is intercepted. Thus, the encryption module <NUM> may encrypt messages to send securely to the DCM <NUM>.

In some examples, the encryption module <NUM> may utilize the session key to authenticate and/or verify a message without encrypting the message. For example, the encryption module <NUM> may utilize the session key to calculate a Message Authentication Code (MAC) of some sort, which may be transmitted along with the message by the transceiver <NUM>. This may allow for verification of the transmitted message without utilizing the time and resources needed to perform encryption.

The decryption module <NUM> may use the session key retrieved by the session key retrieval module <NUM> to decrypt messages received by the transceiver <NUM>. In particular, messages received from the DCM <NUM> that have been encrypted using the session key may be decrypted using the session key. Thus, the decryption module <NUM> may allow for secure communication between devices. In some examples, the transceiver <NUM> may receive a MAC along with a message and the decryption module <NUM> may utilize the session key to verify the MAC in order to ensure that the received message is authentic.

The session key negotiation module <NUM> may securely negotiate a session key with the DCM <NUM>. As discussed above, negotiating a secure session key takes time to complete. Thus, communication between the EEC <NUM> and the DCM <NUM> may begin using either a previously negotiated session key or using unencrypted communication. While this communication is ongoing, the session key negotiation module <NUM> may negotiate a new session key in the background. In some examples, the session key negotiation module <NUM> may negotiate a session key using Diffie-Hellman key exchange. In other examples, any other method may be used to negotiate a session key.

In some examples, once the session key negotiation module <NUM> negotiates a new session key, the encryption module <NUM> and the decryption module <NUM> may use the new session key to encrypt and decrypt messages, respectively. In these examples, the newly negotiated session key may replace the previously negotiated session key to ensure secure communications. In other examples, the encryption module <NUM> and the decryption module <NUM> may continue to use the previously negotiated session key to encrypt and decrypt messages, respectively, even after the new session key is negotiated. In either case, after the session key negotiation module <NUM> negotiates a session key, the newly negotiated session key is stored in the non-volatile memory <NUM>. This allows the newly negotiated session key to be used in a future communication session.

Turning now to <FIG>, a schematic diagram of the DCM <NUM> is shown. The DCM <NUM> includes a non-volatile memory <NUM>, one or more processors <NUM>, a transceiver <NUM>, and one or memory modules <NUM>. The one or more memory modules <NUM> may be capable of storing machine readable and executable instructions such that the machine readable and executable instructions can be accessed by the one or more processors <NUM>. The one or more memory modules <NUM> may include a session key retrieval module <NUM>, an encryption module <NUM>, a decryption module <NUM>, and a session key negotiation module <NUM>.

The components of the DCM <NUM> are similar to the components of the electronic engine control <NUM> and will not be described in detail. The non-volatile memory <NUM> may store previously negotiated session keys. The one or more processors <NUM> may execute the one or more memory modules <NUM>. The transceiver <NUM> may transmit and receive data to and from the EEC <NUM> or other components of the aircraft system <NUM>. The session key retrieval module <NUM> may retrieve a previously negotiated session key from the non-volatile memory <NUM>. The encryption module <NUM> may use a session key to encrypt data to be transmitted by the transceiver <NUM> key. The decryption module <NUM> may use a session key to decrypt messages received by the transceiver <NUM>. The session key negotiation module <NUM> may negotiate a new session key with the EEC <NUM> while communication is ongoing using a previously negotiated session key, or in some circumstances, without encryption.

Accordingly, in operation, the first time the EEC <NUM> and the DCM <NUM> communicate with each other, no previously used session keys are stored on either device. Thus, the devices begin unencrypted communication with each other. Then, while unencrypted communication is ongoing, the session key negotiation modules <NUM> and <NUM> may negotiate a session key (e.g., using Diffie-Hellman key exchange). Once the session key is negotiated, the EEC <NUM> and the DCM <NUM> may stop communicating in an unsecure manner and may begin communicating securely using the negotiated session key. Accordingly, unencrypted communication between the devices can begin quickly. Then, once a session key is negotiated, communication can switch to using the session key, thereby minimizing the amount of time that unencrypted communication takes place. The newly negotiated session key can be stored in the non-volatile memories <NUM>, <NUM> of the EEC <NUM> and the DCM <NUM>, respectively, for future use.

The next time that the EEC <NUM> and the DCM <NUM> communicate with each other, the previously negotiated session key that is stored on the devices may be used to immediately begin secure communication. The session key negotiation modules <NUM>, <NUM> may then negotiate a new session key. Once the new session key is negotiated, the devices may store the new session key for use in a future communication session.

<FIG> depicts a flow diagram of an illustrative method of starting secure communication between devices such as between the EEC <NUM> and the DCM <NUM> of <FIG>. The example of <FIG> illustrates a method performed by the EEC <NUM> to communicate with another device. However, a similar method may be performed by the DCM <NUM> or other devices of the aircraft system <NUM>.

At block <NUM>, the session key retrieval module <NUM> determines whether a previously negotiated session key is stored in the non-volatile memory <NUM>. If the session key retrieval module <NUM> determines that a previously negotiated session key is stored in the non-volatile memory <NUM> ("YES" at block <NUM>), then control passes to block <NUM>.

At block <NUM>, the session key retrieval module <NUM> retrieves the previously negotiated session key and the electronic engine control <NUM> begins encrypted communications with another device using the retrieved, previously negotiated session key. Specifically, the encryption module <NUM> uses the previously negotiated session key to encrypt messages to be transmitted by the transceiver <NUM> and the decryption module <NUM> uses the previously negotiated session key to encrypt messages received by the transceiver <NUM>.

At block <NUM>, the session key negotiation module <NUM> negotiates a new session key with the device with which the electronic engine control <NUM> is communicating. The session key negotiation module <NUM> negotiates the new session key while the electronic engine control <NUM> communicates with the other device using the previously negotiated session key. In one example, the session key negotiation module <NUM> negotiates a new session key using a Diffie-Hellman key exchange. In other examples, the session key negotiation module <NUM> may use any other method to negotiate a new session key.

At block <NUM>, after the session key negotiation module <NUM> negotiates a new session key, it stores the new session key in the non-volatile memory <NUM>. The new session key may be used to perform secure communication during a future communication session.

If the session key retrieval module <NUM> determines that a previously negotiated session key is not stored in the non-volatile memory <NUM> ("NO" at block <NUM>), then control passes to block <NUM>. This may occur the first time that the electronic engine control <NUM> communicates with a particular device. In some examples, if encrypted communication with the other device fails in block <NUM> (e.g., the previously negotiated session key stored in the non-volatile memory <NUM> does not match a previously negotiated session key stored by the other device), control may also pass to block <NUM>.

At block <NUM>, the electronic engine control <NUM> begins unencrypted communications with the other device. At block <NUM>, the session key negotiation module <NUM> negotiates a new session key with the other device. At block <NUM>, after the session key negotiation module <NUM> negotiates the new session key, the session key negotiation module <NUM> stores the new session key in the non-volatile memory <NUM>.

At block <NUM>, the electronic engine control <NUM> ceases performing unencrypted communicating with the other device and begins encrypted communication with the device using the new session key. In particular, the encryption module <NUM> uses the new session key to encrypt messages to be transmitted by the transceiver <NUM> and the decryption module <NUM> uses the new session key to decrypt messages received by the transceiver <NUM>.

<FIG> depicts a flow diagram of another illustrative method of starting secure communication between devices such as between the EEC <NUM> and the DCM <NUM> of <FIG>. The example of <FIG> illustrates a method performed by the EEC <NUM> to communicate with another device. However, a similar method may be performed by the DCM <NUM> or other devices of the aircraft system <NUM>.

At block <NUM>, the session key retrieval module <NUM> retrieves the previously negotiated session key and the electronic engine control <NUM> begins encrypted communications with another device using the retrieved, previously negotiated session key. If the session key retrieval module <NUM> determines that a previously negotiated session key is not stored in the non-volatile memory <NUM> ("NO" at block <NUM>), then at block <NUM>, the electronic engine control <NUM> begins unencrypted communication with the device. In some examples, if encrypted communication with the other device fails in block <NUM> (e.g., the previously negotiated session key stored in the non-volatile memory <NUM> does not match a previously negotiated session key stored by the other device), then control may pass to block <NUM> and the electronic engine control <NUM> may begin unecrypted communication with the device.

At block <NUM>, the session key negotiation module <NUM> negotiates a new session key with the device with which the electronic engine control <NUM> is communicating. The session key negotiation module <NUM> may negotiate the new session key using a Diffie-Hellman key exchange, or another method.

At block <NUM>, after the session key negotiation module <NUM> negotiates the new session key, it stores the new session key in the non-volatile memory <NUM>. At block <NUM>, the electronic engine control <NUM> ceases communicating with the other device either using the previously negotiated session key or in an unencrypted manner and begins encrypted communication with the device using the new session key.

It should now be understood that that the devices, systems, and methods described herein utilize devices, systems, and methods for starting secure communication in in system with high availability. When a device begins communicating with another device, the device may determine whether a previously negotiated session key is stored on the device. If so, the device may begin encrypted communication using the previously negotiated session key. If not, the device may begin unencrypted communication. The device may then negotiate a new session key. After the new session key is negotiated, communication may continue using the new session key and the new session key may be stored on the device to be used during future communication sessions. For example, an electronic engine control of an aircraft system may utilize the disclosed techniques to establish secure communications with a distributed device of the aircraft system.

Claim 1:
A distributed control system comprising:
an electronic control unit (<NUM>); and
one or more distributed control modules (<NUM>),
wherein the electronic control unit (<NUM>) is configured to establish secure communication with a distributed control module (<NUM>) of the one or more distributed control modules by:
upon determination that a previously negotiated session key is stored on the electronic control unit:
transmitting encrypted communications between the electronic control unit and the distributed control module using the previously negotiated session key;
negotiating a new session key with the distributed control module; and
storing the new session key; and
upon determination that the previously negotiated session key is not stored on the electronic control unit:
transmitting unencrypted communications between the electronic control unit and the distributed control module;
negotiating the new session key with the distributed control module; and
after negotiating the new session key with the distributed control module:
ceasing transmission of unencrypted communications between the electronic control unit and the distributed control module;
transmitting encrypted communications between the electronic control unit and the distributed control module using the new session key; and
storing the new session key.