Patent Description:
With events like <NUM>/<NUM>, security in the cockpit has become extremely important. Having an unauthorized user in the cockpit can cause extreme harm not just to those on the aircraft, but to the greater society in general. Alarm systems are disclosed in <CIT>. lt would be advantageous to provide a device, system, and method that cures the shortcomings described above.

A system is provided as defined by claim <NUM>.

Embodiments of the present disclosure are directed to a system and method to detect an authorized user. The system may include non-intrusive detection devices (e.g., cameras, fingerprint scanners, keypads, or the like) to detect a user and uniquely identify them. If an un-authorized user is present, the system may be configured to lock down and prevent access. In addition, a ground system of the system may be configured to unlock the cockpit in an emergency situation where a user becomes incapacitated.

Referring generally to <FIG> a system <NUM> to detect an authorized user, in accordance with one or more embodiments of the disclosure. The system <NUM> may include one or more of an aircraft <NUM> and a ground dispatch <NUM>. The aircraft <NUM> may include an aircraft flight deck <NUM>. The aircraft flight deck <NUM> may be configured for a user <NUM> (e.g., an aircraft operator or other user) to interact with avionics systems <NUM> of an airborne platform. In embodiments, the aircraft flight deck <NUM> includes a user authentication system <NUM>. The user authentication system <NUM> may be configured to detect an authorized/unauthorized user within the aircraft flight deck <NUM>. The user authentication system <NUM> may be further configured to enable/disable control of the aircraft when an authorized/unauthorized user is detected. For example, the user authentication system <NUM> may adjust a mode of the aircraft <NUM> (e.g., by the avionics <NUM>).

The system <NUM> may be further integrated with ground dispatch <NUM>. The ground dispatch <NUM> may be communicatively coupled to the aircraft flight deck <NUM>, and vice versa. The ground dispatch <NUM> may include a user authorization monitoring sub-system <NUM>. For example, the user authorization monitoring sub-system <NUM> may be communicatively coupled to the user authorization sub-system <NUM>. In one instance, the user authorization sub-system <NUM> may be configured to provide one or more signals to the user authorization monitoring sub-system <NUM>, where the one or more signals include authorization data to indicate whether or not the user <NUM> is authorized/unauthorized. In this regard, when an unauthorized user is detected, the monitoring sub-system <NUM> may be configured to disable the avionics <NUM> and when an authorized user is detected, the monitoring sub-system <NUM> may be configure to enable to avionics <NUM>. In another instance, the user monitoring sub-system <NUM> may be configured to provide one or more signals to the user authorization sub-system <NUM> to authorize a user <NUM>. In this regard, the ground dispatch <NUM> may be configured to authorize a user <NUM> without the use of the one or more detection devices <NUM> (e.g., when a user is not in a database <NUM>, when an emergency situation occurs, or the like). Although the system <NUM> is described as including the ground dispatch <NUM>, this is not intended to be limiting. In embodiments, the user authorization system <NUM> is configured to authorize the user <NUM> without communicating with the ground dispatch <NUM>.

Referring now to <FIG>, one or more components of the flight deck <NUM> are further described.

The avionics <NUM> may include one or more flight displays <NUM> and one or more user interface ("UI") elements <NUM>. It is noted that the avionics <NUM> may include any type of display <NUM> known in the art including, but not limited to, cathode ray tube (CRT) display, liquid crystal display (LCD), organic light-emitting diode (OLED), dot matrix display, and the like.

The flight displays <NUM> may be configured to provide information to the user <NUM> to increase visual range and enhance decision-making abilities. For example, one or more of the flight displays <NUM> may be configured to function as a primary flight display (PFD) used to display altitude, airspeed, vertical speed, and navigation and traffic collision avoidance system (TCAS) advisories. By way of another example, one or more of the flight displays <NUM> may also be configured to function as a multi-function display used to display navigation maps, weather radar, electronic charts, TCAS traffic, aircraft maintenance data and electronic checklists, manuals, and procedures. By way of another example, one or more of the flight displays <NUM> may also be configured to function as an engine indicating and crew-alerting system (EICAS) display used to display critical engine and system status data.

The user interface elements <NUM> may include, but are not limited to, a keyboard, a joystick, a mouse, a touchscreen display, a button, a switch, or the like. The user interface elements <NUM> may be used for controlling aircraft <NUM>, such as, but not limited to, rudder pedals, throttle control, trim, and the like. Other types and functions of the user interface elements <NUM> are contemplated and will be apparent to those skilled in the art. In some instances, the user interface elements <NUM> provide fly-by-wire commands to various control surfaces (e.g., elevators, flaps, aileron, etc.) of the aircraft <NUM>. In embodiments, the system <NUM> is used to provide commands to adjust a mode of the aircraft <NUM>, thereby limiting or preventing the ability of the user interface elements <NUM> to transmit control signals to the control surfaces.

The user authorization sub-system <NUM> may include one or more detection devices <NUM>. The detection devices <NUM> may also be referred to herein as input devices. The detection devices <NUM> may receive various input from the user <NUM> within the flight deck <NUM>. The input is then provided to the processors <NUM> for detection whether the user <NUM> is authorized or unauthorized and controlling the avionics <NUM> appropriately. The one or more detection devices <NUM> may provide various inputs of detection data to the processor <NUM>. The processor <NUM> may then compare detection data with a database <NUM> stored in the memory <NUM>. By comparing the detection data to the database <NUM>, the processor may determine whether the user <NUM> is an unauthorized user or an authorized user. For example, if the detection data is not found in the database <NUM> then the user may be deemed an unauthorized user. By way of another example, if the detection data is found in the database <NUM> then the user may be deemed an authorized user. The detection device includes a camera <NUM>, and may include, but is not limited to, a touchscreen <NUM>, a fingerprint scanner <NUM>, a microphone, a badge reader, and the like.

The one or more detection devices <NUM> includes a camera <NUM> configured to capture a stream of images. The stream of images may then be provided to the processor <NUM> for detecting a face and comparing the face with a list of authorized faces of authorized users to determine whether the user <NUM> is authorized or unauthorized. The processors <NUM> is thus be configured with facial recognition capabilities or facial detection by which the processors detect a detected face in an image. It is noted that the camera <NUM> and/or processors <NUM> may use any type of facial detection algorithms known in the art.

By way of another example, the one or more detection devices <NUM> may further include a touchscreen <NUM>. The user <NUM> may input one or more of a password, a pin code, and the like by the touchscreen. The password or pin code may be provided to the processors <NUM>. The processors <NUM> may then compare the input prestored passwords and pin codes. The prestored passwords and pin codes may be associated with authorized users and/or duress signals. For instance, the pin code may be a unique, predetermined unlock code. It is noted that the predetermined unlock code may be any length alphanumeric code or non-alphanumeric code. By way of another instance, the pin code may be a duress signal which adjusts a mode of the aircraft to prevent unauthorized users from using the user interface element <NUM> (e.g., input a <NUM> code). Although the touchscreen <NUM> is depicted as being one of the input devices <NUM> of the system <NUM>, this is not intended as a limitation. The touchscreen <NUM> may also be one of the user interface elements <NUM> of the avionics <NUM>. For example, the touchscreen <NUM> may include, but is not limited to, a primary flight display or a multi-function display of the aircraft <NUM>, which may also be considered part of the display <NUM> of the avionics <NUM>.

By way of another example, the one or more detection devices <NUM> may further include a fingerprint scanner <NUM>. The fingerprint scanner <NUM> may capture a fingerprint of the user <NUM> and provide the captured fingerprint to the processors <NUM>. The processors <NUM> may then compare the captured fingerprint to a database of fingerprints of authorized users. If the fingerprint is a match, the processors <NUM> may authorize the user <NUM>.

By way of another example, the one or more detection devices <NUM> may further include a microphone <NUM>. The microphone <NUM> may capture an audio recording of a voice of the user <NUM>. The audio recording may then be provided to the processors <NUM>. In embodiments, the processors <NUM> are configured to perform voice recognition or speaker recognition on the audio recording to identify who is speaking and determine whether the voice is associated with one or more authorized users stored in a database. In embodiments, the processors <NUM> are configured to perform speech recognition on the audio recording to identify words or phrases spoken by the user <NUM> and compare the words or phrases with various words or phrases stored in memory. For instance, the memory may include a word or phrase associated with an authorized user which is used to authorize the user <NUM>. By way of another instance, the memory may include a word or phrase associated with a duress which is used to indicate the user <NUM> is in duress and further limits the users <NUM> ability to control the aircraft <NUM>. In embodiments, the speech recognition may be imprinted when on ground when getting ready to take-off, thereby allowing the system to recognize user as authorized user. In some instances, the camera <NUM> and the microphone <NUM> may be housed in common housing.

It is noted that the one or more detection devices <NUM> may be located anywhere within the aircraft cabin (e.g., cockpit, outside of the cockpit, or the like). Further, it is noted that the one or more detection devices <NUM> may be located anywhere outside of the aircraft cabin. Therefore, the above description should not be construed as limiting the scope of the present disclosure.

The database <NUM> may contains biometric information and nonbiometric information associated with authorized users which is used to authorize the user <NUM> and unlock the aircraft <NUM>. The information may provide two types of the authentication. For example, the biometric information may include facial features, eyes, fingerprints, voice recognition, and the like. By way of another example, the nonbiometric information may include badge identification, passphrase, pin code, speech utterance, and the like. The database may also contain information associated with duress. For example, the duress inputs may include a pin code, a speech utterance, and the like.

In embodiments, the database <NUM> may be stored in a remote database. For example, the remote database <NUM> may include one or more images of one or more authorized users. In this regard, if the image captured by the camera matches an image within the database <NUM>, then the user may be deemed an authorized user. However, if the image captured by the camera does not match an image within the database <NUM>, then the user may be deemed an unauthorized user. By way of another example, the remote database <NUM> may include one or more fingerprint scans of one or more authorized users. In this regard, if the fingerprint scan captured by the fingerprint scanner matches a fingerprint within the database <NUM>, then the user may be deemed an authorized user. However, if the fingerprint scan captured by the fingerprint scanner does not match a fingerprint within the database <NUM>, then the user may be deemed an unauthorized user. By way of another example, the remote database <NUM> may store the predetermined unlock code for the keypad. In this regard, if the entered code matches the stored unlock code, then the user may be deemed an authorized user. However, if the entered code does not match the stored unlock code, then the user may be deemed an unauthorized user.

The database <NUM> may be formed using any data collection method. For example, information from aircrew employee badges may be stored in the database <NUM>. For instance, the aircrew employee's ID badge image may be stored in the database <NUM>. In this regard, the aircrew employee may scan their ID badge at the gate and when in the cockpit, the user may be authorized by performing facial recognition using the camera, where the camera compares the ID badge image and the captured image from the camera. By way of another example, the database <NUM> may be formed by pre-loading authorization data onto the database <NUM> (e.g., loading images of authorized users, loading fingerprints of authorized uses, loading predetermined unlock codes, or the like).

The system <NUM> may further include one or more processors <NUM>. The processors <NUM> may include any processing unit known in the art. For example, the processing unit may include a multi-core processor, a single-core processor, a reconfigurable logic device (e.g., FPGAs), a digital signal processor (DSP), a special purpose logic device (e.g., ASICs)), or other integrated formats. Those skilled in the art will recognize that aspects of the embodiments disclosed herein, in whole or in part, can be equivalently implemented in integrated circuits, as one or more computer programs running on one or more computers (e.g., as one or more programs running on one or more computer systems), as one or more programs running on one or more processors (e.g., as one or more programs running on one or more microprocessors), as firmware, or as virtually any combination thereof, and that designing the circuitry and/or writing the code for the software/and or firmware would be well within the skill of one skilled in the art in light of this disclosure. Such hardware, software, and/or firmware implementation may be a design choice based on various cost, efficiency, or other metrics. In this sense, the processor(s) may include any microprocessor-type device configured to execute software algorithms and/or instructions. In general, the term "processor" may be broadly defined to encompass any device having one or more processing elements, which execute program instructions from a memory, from firmware, or by hardware implemented functions. It should be recognized that the steps described throughout the present disclosure, such as, but not limited to, the method described herein, may be carried out by the processors <NUM>.

The system <NUM> may include a memory <NUM>. The memory <NUM> may include any storage medium known in the art. For example, the storage medium may include a non-transitory memory medium. For instance, the non-transitory memory medium may include, but is not limited to, a read-only memory (ROM), a random-access memory (RAM), a magnetic or optical memory device (e.g., disk), a solid-state drive and the like. It is further noted that memory may be housed in a common controller housing with the one or more processor(s). For example, the memory and the processor may be housed in an integrated modular avionics (IMA) controller, or the like. In an alternative embodiment, the memory <NUM> may be located remotely with respect to the physical location of the processor <NUM>. In another embodiment, the memory maintains program instructions for causing the processor(s) to carry out the various steps described through the present disclosure. The memory <NUM> may also maintain a database <NUM> for authorizing the user <NUM> and/or for changing a mode of the aircraft <NUM>.

Referring now in particular to <FIG>, an exemplary embodiment of the flight deck <NUM> is described. The number and arrangement of the various elements within the flight deck <NUM> may be based on the type of the aircraft <NUM>. Thus, the configuration of <FIG> is not intended to be limiting but is merely provided for exemplary purposes.

The flight deck <NUM> may include one or more the displays <NUM>. The displays <NUM> may be implemented using any of a variety of display technologies, including CRT, LCD, organic LED, dot matrix display, and others. The displays <NUM> may be configured to function to display various information known in the art. The displays <NUM> may be configured to function as one or more of a primary flight display (PFD) or a multifunction display (MFD). Such PFD and MFDs may be mounted in front of both a pilot and a copilot. The MFD may be mounted between the PFD of the pilot and the PFD of the copilot. Thus, the displays <NUM> may provide instrumentation for the operation of an aircraft. Other types and functions of the displays <NUM> are contemplated and will be apparent to those skilled in the art.

The flight deck <NUM> may also include one or more aircraft instruments <NUM>. The aircraft instruments <NUM> may include, but are not limited to, left, center, right, overhead, second officer, or other aircraft instruments. The aircraft instruments <NUM> may be implemented using any of a variety of technologies, including CRT, LCD, organic LED, dot matrix display, and others. The aircraft instruments <NUM> may indicate information associated with various flight instruments of the aircraft, such as, but not limited to, attitude, heading, vertical speed, air speed, altimeter, or turn. Other types and functions of the aircraft instruments <NUM> are contemplated and will be apparent to those skilled in the art.

The flight deck <NUM> may also include one or more of the user interface elements <NUM>. As depicted, the user interface elements <NUM> may be control yoke. A user sitting in the seat may utilize the control yoke to control the attitude, pitch, or roll of the aircraft <NUM>.

<FIG> illustrates a flowchart depicting a method <NUM> or process for detecting an authorized user, in accordance with one or more embodiments of the present disclosure. The embodiments and the enabling technology described previously herein in the context of the system <NUM> should be interpreted to extend to the method <NUM>. It is further contemplated that the method <NUM> is not limited to the system <NUM>.

In a step <NUM>, the user authenticates with the user authorization sub-system. For example, the user <NUM> may authenticate with the user authorization sub-system <NUM> using one of the one or more detection devices <NUM>. In one instance, the user <NUM> may authenticate using facial recognition via the camera. In this regard, the user authorization sub-system <NUM> may be configured to compare the user's face with the database <NUM> and determine whether the user is authorized (e.g., the user's face is an authorized user within the database <NUM>). In another instance, the user <NUM> may authenticate using fingerprint scanning via a fingerprint scanner. In this regard, the user authorization sub-system <NUM> may be configured to compare the user's fingerprint with the database <NUM> and determine whether the user is authorized (e.g., the user's fingerprint is an authorized user within the database <NUM>). In another instance, the user <NUM> may authenticate using a predetermined code via the keypad device. In this regard, the user authorization sub-system <NUM> may be configured to compare the entered code and the predetermined code and determine whether the user is authorized (e.g., whether the codes match).

By way of another example, the user <NUM> may authenticate with the user authorization sub-system <NUM> when the user monitoring sub-system <NUM> provides the authorization sub-system <NUM> with an authorization signal. In this regard, the ground dispatch <NUM> may be configured to authorize the user <NUM> remotely.

In a step <NUM>, the ground dispatch is alerted of the authentication. For example, the ground dispatch <NUM> may be configured to receive one or more signals from the user authentication sub-system <NUM> to alert the ground dispatch <NUM> of the authentication.

In an optional step <NUM>, the ground dispatch may authorize/enable use of the aircraft. For example, the ground dispatch <NUM> may provide one or more signals to the aircraft flight deck <NUM> to authorize/enable use of the aircraft. In this regard, the ground dispatch <NUM> may control the use of the aircraft (e.g., avionics) and when a user <NUM> wants to access the avionics, the user <NUM> may request control from the ground dispatch <NUM>. It is noted that this allows the ground dispatch <NUM> to have tighter control as to who uses the aircraft and when they are able to use it. For example, maintenance personnel could only access the avionics during their shift.

In a step <NUM>, a signal is received from the user authorization sub-system to enable avionics interface for the user. For example, the user authorization sub-system <NUM> may provide one or more signals to the avionics <NUM> to enable the interface for the user <NUM>. In this regard, the information on the displays is visible and user inputs may be accepted from the system. However, if the system is "locked", then no user input would be accepted by the system. For example, the flight plan could not be changed. By way of another example, the flight controls would not respond to inputs.

In a step <NUM>, the user authorization sub-system determines whether the user is authorized or unauthorized. For example, the user authorization sub-system <NUM> may determine whether the user is authorized or unauthorized using one of the one or more detection devices <NUM>. The user <NUM> may authenticate with the user authorization sub-system <NUM> using one of the one or more detection devices <NUM>. The user <NUM> may authenticate using facial recognition via the camera. In this regard, the user authorization sub-system <NUM> is configured to compare the user's face with the database <NUM> and determine whether the user is authorized (e.g., the user's face is an authorized user within the database <NUM>). By way of another example, the user <NUM> may further authenticate using fingerprint scanning via a fingerprint scanner. In this regard, the user authorization sub-system <NUM> may be configured to compare the user's fingerprint with the database <NUM> and determine whether the user is authorized (e.g., the user's fingerprint is an authorized user within the database <NUM>). By way of another example, the user <NUM> may further authenticate using a predetermined code via the keypad device. In this regard, the user authorization sub-system <NUM> may be configured to compare the entered code and the predetermined code and determine whether the user is authorized (e.g., whether the codes match).

In examples not presently being claimed, in a step <NUM>, if the user is unauthorized, the system locks avionics and continues current flight plan. For example, the information on the displays is visible and user inputs may be rejected by the system. For instance, the flight plan may not be changed. By way of another example, the flight controls may not respond to inputs.

In a step <NUM>, if the user is unauthorized, the ground dispatch may be alerted of the unauthorized user. For example, the user authorization sub-system <NUM> may be configured to provide one or more signals to the ground dispatch <NUM> via the monitoring sub-system <NUM>, where the signals indicate that the user <NUM> is unauthorized.

In an optional step <NUM>, if the user is unauthorized, the ground dispatch may authorize/enable use of the aircraft to unrecognized user. For example, the user <NUM> may authenticate with the user authorization sub-system <NUM> when the user monitoring sub-system <NUM> provides the authorization sub-system <NUM> with an authorization signal. In this regard, the ground dispatch <NUM> may be configured to authorize the user <NUM> remotely.

In an optional step <NUM>, if the user is unauthorized, the avionics may be disabled for the unauthorized user. For example, the authorized sub-system <NUM> may provide one or more signals to the avionics <NUM> to disable the interface for the unauthorized user to prevent the unauthorized user from controlling the aircraft.

If the user is authorized, steps <NUM>-<NUM> may be followed.

In an optional step <NUM>, the ground dispatch may authorize/enable use of the aircraft. For example, the ground dispatch <NUM> may provide one or more signals to the aircraft flight deck <NUM> to authorize/enable use of the aircraft.

In a step <NUM>, a signal is received from the user authorization sub-system to enable avionics interface for user. For example, the user authorization sub-system <NUM> may provide one or more signals to the avionics <NUM> to enable the interface for the user <NUM>.

Referring now to <FIG>, a flow diagram for one or more modes of the aircraft <NUM> are described, in accordance with one or more embodiments of the present disclosure. In embodiments, the system <NUM> is configured to adjust a mode of the aircraft <NUM> between one or more of a full authority mode <NUM>, a reduced authority mode <NUM>, and a no authority mode <NUM>.

The full authority mode <NUM> may include allowing the user <NUM> to control the user interface elements <NUM> of the flight deck <NUM> with full authority. For example, the user <NUM> may control the user interface elements <NUM> of the flight deck <NUM> thereby adjusting the flight envelope <NUM> (e.g., pitch, yaw, thrust, etc.). In some instances, the user <NUM> may even adjust the flight envelope <NUM> beyond what would normally be considered an acceptable range by an autopilot system. The ability to control the flight envelope <NUM> outside of the normally acceptable ranges may be essential during non-standard flight scenarios, which may be difficult or impossible to prepare an autopilot maneuver a priori.

The reduced authority mode <NUM> may include increasing the flight rules or otherwise reducing an authority of the user <NUM> to control the user interface elements <NUM> of the flight deck <NUM>. In the reduced authority mode <NUM> not all authority is taken away from the user <NUM>. However, the reduced authority mode <NUM> may include placing one or more thresholds <NUM> on the user interface elements <NUM>. In this regard, the threshold may limit a rate-of-climb, a rate-of-descent, a pitch angle, a roll angle, a yaw angle, a thrust, attitude, bank angle, and the like. The ability to not take away all authority but limit the climb/descent, control exclusion zones, and control the flight path may improve a safety of the aircraft. Thus, the reduced authority mode <NUM> does not totally lock the user from controlling the flight surfaces, but rather restrict or limits the ability to control the aircraft.

The reduced authority mode <NUM> may also include geofencing <NUM> the aircraft <NUM>. The geofencing may include engaging an aircraft autopilot to ensure that the aircraft <NUM> remains within a prescribed geographic boundary or outside of a prescribed geographic boundary (e.g., an exclusion zone). For example, the aircraft <NUM> may be caused to follow a flight path and remain within a prescribed geographic boundary around the flight plan. In this regard, the user may be prevented from moving the aircraft outside of the preset flight path in the reduced authority mode. By way of another example, the aircraft <NUM> may be caused to remain outside of a no-fly zone such as near a populous city, or the like.

The no authority mode <NUM> may include engaging any number of safety systems of the aircraft <NUM> for preventing a crash event. In the no authority mode <NUM> users of the aircraft may be locked out from sending commands to the control surfaces. In a first instance, the no authority mode <NUM> includes engaging an autopilot and preventing the user <NUM> from the input commands from the user interface elements <NUM> to control the control surfaces of the aircraft <NUM>. One or more flight control systems of the aircraft are thus disengaged in the no authority mode to lock out and prevent the unauthorized user from controlling the aircraft.

The no authority mode <NUM> may include engaging an auto-land function <NUM>. The auto-land function <NUM> may determine a nearest airport and engage the control surfaces to path towards and land at the nearest airport. The auto-land function <NUM> may thus put the aircraft <NUM> on a path or trajectory which brings into land in a nearest airport. The trajectory may further govern how much the user is authorized to bank. The auto-land function may also be referred to as an emergency descent and landing system. After an unauthorized user is detected and/or a duress phrase is uttered, the emergency descent and landing system may compute how to bring an aircraft into safe landing.

The no authority mode <NUM> may also include an auto-taxi function <NUM>. For example, the aircraft <NUM> may be disposed on the ground. The auto-taxi function <NUM> may be engaged to automatically taxi the aircraft back to a nearest gate.

The no authority mode <NUM> may also include an alerting function <NUM>. The alerting function <NUM> may signal to one or more authorities that the user <NUM> is in duress. For example, the alerting function <NUM> may provide the signal to an air marshal onboard the aircraft <NUM>. By way of another example, the alerting function <NUM> may provide the signal to the ground dispatch <NUM>. In some instances, an alert may be provided on the display within the flight deck in response to the no authority mode or the reduced authority mode.

In a step <NUM> the aircraft may be in full authority mode <NUM>. The system <NUM> may detect an unauthorized user is in the flight deck <NUM>. The system <NUM> may detect the authorized user is in the flight deck <NUM> by any of the techniques described previously herein, such as, but not limited to, facial detection. The processors may then be configured to reduce the mode of the aircraft from the full authority mode <NUM> to the reduced authority mode. In this regard, the pilot may still have some authority to issue flight commands, and may not even notice the limited authority. However, the reduced authority mode <NUM> may be beneficial in preventing the authorized user from overpowering the pilot and issuing flight commands outside of the threshold <NUM> or geofence <NUM>. For example, the aircraft <NUM> may be mid-flight in any of various phases of flight. The ability to reduce the mode during flight may be advantageous for ensuring safety of the aircraft <NUM>. By way of another example, the aircraft <NUM> may be in on the ground, such as at a gate or during taxi. Reducing the authority may be beneficial in preventing an unauthorized user from taking off while on the ground.

In a step <NUM>, the aircraft may be in one of the full authority mode <NUM> or the reduced authority mode <NUM>. The system <NUM> may detect a duress input. The system <NUM> may detect the duress input by any of the techniques described previously herein, such as, but not limited to, a facial detection, a duress phrase, a pin code, a button, a switch (e.g., a gated switch with a cover), and the like. In response to receiving the duress input, the processors may change the mode to the no authority mode <NUM>. The user may then be prevented from controlling the flight control surfaces. For example, the aircraft may be in flight when a phrase is input and detected. The system <NUM> may recognize the input phrase and compare the input phrase with one or more duress phrases. In response to detection the input phrase as being a duress, the system <NUM> may lock out the controls, contact ground dispatch, and contact the air marshal. By way of another example, the aircraft may be on the ground and taxiing when the duress phrase is detected. The system <NUM> may recognize the duress phrase, lock out the controls, auto-taxi the aircraft back to the gate, and inform the ground dispatch.

In a step <NUM>, the aircraft may be in one of the no authority mode <NUM> or the reduced authority mode <NUM>. The system <NUM> may detect a duress input. The system <NUM> may detect the duress input by any of the techniques described previously herein, such as, but not limited to, biometric inputs, non-biometric inputs, speech recognition, nominal phrase, pin code, fingerprint, and the like. For example, the user may use speech recognition to input a phrase and compare the phrase with an unlock phrase to unlock the controls and change to full authority mode. The system may thus allow the user to change unlock the flight controls, even when in the no authority mode <NUM> or the reduced authority mode <NUM>. At reduced and no authority states, if an authorized user on the flight deck has resolved, the authorized user thus has the ability to reclaim full authority by uttering a nominal phrase a code, or the like.

In embodiments, the processors receive an at-gate input. The at-gate input may indicate the aircraft is at a gate of an airport. The processors may receive the at-gate input from the pilot, the ground dispatch, or the like. In response to receiving, the at gate input, the processors may be configured to place the aircraft into the no authority mode. In this regard, the controls may be prevented from taxing or taking of the aircraft until the aircraft is placed into full authority mode by the authorized user. The pilot may leave the cockpit while at gate. Putting the aircraft into the no authority mode while at the gate may be beneficial in reducing vulnerabilities while the pilot is away from the flight deck. In further embodiments, the processors may be configured to receive an image from the camera, detect a face within the image, and determine the detected face is authorized. Such determination may indicate the authorized user is disposed within the flight deck (e.g., determine the pilot has returned to the flight deck). In response to determining the detected face within the image is authorized, the processors may change the mode of the aircraft from the no authority mode to the full authority mode.

In embodiments, the system <NUM> requires one or more of a biometric and/or a nonbiometric authentication before unlocking the controls. For example, the system <NUM> may require at least two forms of biometric authentication and at least one form of nonbiometric authentication prior to allowing access to flight control, although this is not intended to be limiting.

In the event the authentication of the user fails, the user may be flagged as an unauthorized user. The system <NUM> may be configured to perform various function in the event of flagging the user, which may be based on the phase of the aircraft <NUM>. For example, if the aircraft <NUM> is at the gate, the controls may be locked out and the alert may be provided to the dispatch. By way of another example, if the aircraft is in taxi and the authentication does not pass, the auto-taxi function may be engaged, the alert may be provided, and the controls may be locked-out. By way of another example, if the aircraft is in flight and the authentication does not pass, an alert may be provided to the air marshal and the emergency descent and landing system may be engaged.

Referring generally again to <FIG>.

Claim 1:
A system comprising:
a camera (<NUM>) configured to capture an image within a flight deck of an aircraft;
a non-transitory memory (<NUM>) maintaining program instructions and one or more authorized faces; and
one or more processors (<NUM>) configured to execute the program instructions maintained on the memory, the program instructions causing the one or more processors to:
receive the image from the camera;
determine a detected face within the image is unauthorized, thereby indicating an unauthorized user is disposed within the flight deck; wherein the one or more processors detects the detected face by a facial detection algorithm; wherein the one or more processors determines the detected face within the image is unauthorized by comparing the detected face with the one or more authorized faces; and
by controlling avionics systems (<NUM>) of the aircraft, change a mode of the aircraft from a full authority mode to a reduced authority mode in response to determining the detected face within the image is unauthorized; wherein the unauthorized user has full authority to control one or more user interface elements of the aircraft in the full authority mode; wherein the unauthorized user has reduced authority to control the one or more user interface elements of the aircraft in the reduced authority mode;
wherein a limit is placed on a rate-of-climb, a rate-of-descent, a pitch angle, a roll angle, a yaw angle, and a thrust in the reduced authority mode; and
wherein the unauthorized user is prevented from moving the aircraft outside of a preset flight path in the reduced authority mode; and characterized in that:
in the reduced authority mode, not all authority is taken away from the user to control one or more flight surfaces.