Patent ID: 12250328

DETAILED DESCRIPTION

Embodiments described herein generally provide an off-road mobile work machine with improved data authentication such that data from the mobile work machine may be relied upon for, without limitation, such things as payments, regulation compliance verification, warranty claims, equipment depreciation, et cetera.

FIG.1is a diagrammatic view of a mobile machine data capture system operating in a field in accordance with one embodiment. In the example illustrated inFIG.1, mobile machine1100is a tractor pulling a task sensor1110through field1010. In one example, task sensor1110is configured to include a soil organic matter (SOM) sensor1012which is able to provide an indication of soil organic matter as sensor1012contacts soil in field1010. In this example, a single element of each type is shown for simplicity. In other embodiments, there may be one or more of such elements. Further, a plurality of such elements may be used to detect element faults or to implement fault tolerance. In another example, preliminary validation of data could be accomplished by voting through mutual interlocking of primary sensors/data collectors. In other examples, the plurality of elements may enhance system capabilities such as task sensors deployed on equipment for per-row data collection. Mobile machine1100includes a robustly identifiable processor1120coupled to a robustly identifiable location/motion module1130. Location/motion module1130is configured to interact with environmental navigation signals (such as GPS, global navigation satellite signals, LORAN, or other suitable signals) to provide processor1120with an indication of the geographic position of mobile machine1100. Additionally, mobile machine1100includes a wireless transceiver1140configured to communicate wirelessly with one or more remote devices. Examples of such wireless communication include, without limitation, Bluetooth (such as Bluetooth Specification 2.1 rated at Power Class 2); a Wi-Fi specification (such as IEEE 802.11.a/b/g/n); a known RFID specification; cellular communication techniques (such as GSM/CDMA); WiMAX (IEEE 802.16), and/or satellite communication.

Each element of the mobile machine1100is termed “robustly identifiable” in order to indicate that it may not be copied or cloned from the device. In one example, robustly identifiable elements include, for example, a physically unclonable function “PUF.” Thus, the element cannot be replaced with a substitute or cloned physical replacement or a computer simulation with the same identifier. In some examples, the replacement could be used to falsify sensor data values, data location, data timestamp, et cetera prior to being added to a data ledger or store such as a block chain record. Further, a robustly identifiable element is, in one embodiment, packaged in a tamper-evident or tamper-proof way so that if replacement is attempted, it will not succeed without at least detection. Finally, a robustly identifiable element is connected with other elements in a way which protects the information being communicated. This may include encryption of messages but may also further include how encryption keys are assigned, stored, and managed, to ensure secure data exchange between the elements. By providing a number of robustly identifiable elements on the mobile machine1100, the elements above cannot be replaced to spoof georeferenced data collection. If such an element is replaced, it is done with external verification, such that the replacement is noted in a trusted way, such as in an immutable ledger (e.g., block chain record).

FIG.2is a flow diagram of a method of acquiring and authenticating mobile machine data in accordance with one embodiment. Method2000begins at block2020and proceeds to block2040for data collection. The collected data can include mobile machine data2060as well as other suitable data2070. An example of machine data2060can include the tractor going through the field and collecting data using one or more robustly identifiable sensors which will be described in greater detail below. Next, at block2030, data protection is performed. In one embodiment, data protection2030is performed using steganography. Steganography is a technique of hiding secret data within an ordinary, non-secret file or message in order to avoid detection. The secret data is then extracted at its destination. The secret data can include the authentication data. In another example, data protection2030is done using watermarking. Watermarking is the process of hiding digital information in a carrier signal; the hidden information should, but does not need to, contain a relation to the carrier signal. Digital watermarks may be used to verify the authenticity or integrity of the carrier signal or to show the identity of its owners. In some examples, data protection2030is done by a secret transformation of value representations such as encryption/decryption. In some other examples, data values are protected by a secret mapping of value representation pieces to storage locations, such as steganography. These various examples of data protection may be used alone or in combination.

Next, at block2100, the mobile machine performs on-board data authentication, which will be described in greater detail below. If the on-board data authentication fails, the mobile machine provides an identification of such failure and a non-trusted mode is entered. In such non-trusted mode, a third party could authenticate data and/or corroborate and transmit data, as required. However, if on-board data authentication is successful, method2000moves to on-board data transmission block2120. At on-board data transmission block2120, the mobile machine transmits the authenticated data using suitable wireless communication. Such wireless communication is performed using secure communication techniques, such as cryptography. Finally, at block2140, method2000ends.

FIG.3is a block diagram of a mobile machine data capture system in accordance with one embodiment. System3000includes robustly identifiable processor3020. Processor3020can include a microprocessor or any other suitable integrated circuitry that is capable of performing instructions to provide authentication. In one example, processor3020includes or is coupled to a source3024of challenge/response code. Challenge/response code3024can include instructions that cause processor3020cause or command processor3020to issue a challenge to a robustly-identifiable system as well as instructions to compare the robustly identifiable system's response to the challenge with an expected response. Further, challenge/response code3024may also include code to allow processor3020to access its own physically unclonable function module3026and compare a response with an expected response. In this way, processor3020can determine whether it, itself, is an authentic processor, or one that has been replaced.

As processor3020issues challenges to each robustly-identifiable system, and receives responses, processor3020determines whether each robustly identifiable system is authenticated. As shown inFIG.3, a first robustly-identifiable system is indicated at sensor module3040which includes, or is coupled to, one or more task sensors3060, such as a soil organic matter sensor, or other suitable sensor as well as a physically unclonable function (PUF) module3080. When sensor module3040receives a challenge from processor3020via communication line3100, sensor module3040employs physically unclonable function module3080to provide its response. In some examples, the response may be dedicated strictly to responding to the challenge. In other examples, the response may be part of a message which incorporates other data from a module.

A physically unclonable function is generally a physical object that, for a given input and conditions (i.e., challenge), provides a physically-defined “digital fingerprint” output (response) that serves as a unique identifier. Physically unclonable functions are sometimes based on unique physical variations that occur naturally during semiconductor manufacturing. A physical unclonable function is a physical entity embodied in a physical structure. Physical unclonable functions are available in integrated circuits, and are sometimes used in applications with high security requirements, such as cryptography.

System3000also includes a robustly-identifiable location/motion module3120. Location/motion module3120includes one or more location/motion sensors3140as well as location/motion physically unclonable function module3160. Location/motion sensors3140can include geographic location sensors, such as GPS, GLONASS (Russia), Galileo (EU), BeiDou, and/or fixed LORAN. Further, motion sensors can include suitable inertial measurement units, accelerometers, gyroscopes, or any suitable sensor that provides an indication relative to motion of the mobile machine. Location/motion module3120is coupled to a digital communication line3180in order to receive a challenge from processor3020. When such challenge is received, module3120accesses location/motion physically unclonable function module3160to provide a response.

Robustly identifiable communication module3200is coupled to processor3020and includes one or more wireless transceivers3240. Additionally, robustly identifiable communication module3200includes communication module physical unclonable function3260. Communication module3200is configured to receive a challenge from robustly identifiable processor3020via communication line3220and provide a response based on communication module physical unclonable function3260.

While each of robustly identifiable modules3040,3120, and3200, are illustrated as being coupled to robustly identifiable processor3020via respective communication lines3100,3180, and3220, it is expressly contemplated that all such robustly identifiable modules could be coupled to robustly identifiable processor3020via a single communication line or bus. Any of processor3020and robustly identifiable modules3040,3120, and3200may be in separate enclosures or shared enclosures. The enclosures may include physical tamper-proof features.

FIG.4is a flow diagram of a method of authenticating a robustly-identifiable system in accordance with one embodiment. This example is hierarchical with processor3020as lead. In other examples, other components may take the lead. In still other examples, a peer, hybrid peer/hierarchical or other architectures may be used as well. Method4000begins at block4020where a processor, such as processor3020, initializes. During such initialization, the processor may check its own robustly-identifiable function, such as challenging and comparing its own response utilizing a physically unclonable function, as described above. This is indicated generally at block4040. Additionally, other suitable techniques that generate a uniquely identifiable response based upon a challenge can be used, as indicated at block4060. Regardless of the technique, upon completion of initialization block4020, the processor or other suitable control circuitry of the robustly identifiable system can determine whether it is an authenticated physical device. In the event that the processor is unable to authenticate itself, method4000proceeds to failsafe block4120as indicated at reference numeral4030.

Next, control passes to block4080where the authenticated processor issues a challenge to a robustly-identifiable sensor module. For example, the authenticated processor may issue a challenge over a communication line, such as line3100, to a sensor module having a robustly identifiable aspect, such as a physically unclonable function module3080. The authenticated processor then receives a response from the robustly-identifiable sensor module and compares the received response with an expected response known by the authenticated processor. If the received response matches the expected response, control passes to block4100. However, if the received response does not match the expected response, indicating failure in authentication of the sensor module, control passes to failsafe block4120via line4140.

Next, at block4100, the authenticated processor issues an authentication challenge to a robustly-identifiable location/movement module, such as module3120. If the location/motion module issues the correct response, method4000proceeds to block4160. However, if the location/movement module fails to issue the expected response to the challenge, then control passes to failsafe block4120via line4180.

Next, at block4160, the authenticated processor issues a challenge to a communication module, such as communication module3200. In response, the communication module accesses its own robustly-identifiable indicator or physically unclonable function and provides a response to the challenge. If the response to the challenge is the expected response, method4000proceeds to block4200where trusted operation is initiated. During trusted operation, all data acquired and stored can be considered as trusted data. However, if the response of the communication module to the challenge does not match the expected response, control passes to failsafe module4120via line4220.

At fail safe module4120, data acquisition and capture can still occur. However, the processor will provide an indication that authentication failed such that an appropriate level of trust and/or external authentication/corroboration can be performed.

FIG.5is a diagrammatic view of a data capture system operating in a simultaneous mode in accordance with one embodiment. The simultaneous mode illustrates an additional level of authenticity that may be added by independent confirmation of field activity such as the soil organic matter (SOM) data collection. This confirmation could, in some embodiments, become part of a distributed immutable ledger. The simultaneous mode illustrated with respect toFIG.5can be performed upon authentication failure with respect to the method described with respect toFIG.4. However, simultaneous mode can also be performed in order to provide additional authenticity even when the authentication described with respect toFIG.4is completed successfully.

As shown inFIG.5, three independent soil organic matter measure surveys are being performed. They may be occurring simultaneously or separated in time. A terrestrial sensor system5100(illustrated diagrammatically as a mobile machine-tractor) similar to the one described with respect toFIG.1, collects georeferenced soil organic matter data from task sensor5110and sends it via transceiver5140over secure communications link5150to receiver5170for storage on secure server5180.

FIG.5also illustrates an aerial sensor system (illustrated diagrammatically as an unmanned aerial vehicle)5200collecting georeferenced soil organic matter data from task sensor5210and sending it via transceiver5240over secure communications link5250to receiver5270for storage on secure server5280. Aerial sensor system5200may have a pole, UAV, manned aircraft, satellite, et cetera, as a sensor platform.

Similarly, a manual sensor system5300collects georeferenced soil organic matter data from task sensor5310and sends it via transceiver5340over secure communications link5350to receiver5370for storage on secure server5380.

Secure servers5180,5280, and5380are connected by a secure network5400. The authentic georeferenced data collected by task sensors5110,5210, and5310may be combined and stored or otherwise persisted in a distributed, immutable ledger, such as a blockchain.

The distributed, immutable ledger may be used to document the amount of carbon or any other suitable chemical sequestered in the soil, for example. Surveys taken at a plurality of times may be used to document the change in sequestered carbon over time. This measured difference may be used to establish premiums, payments, and penalties. In one SOM example, mobile machine5100may be a farmer-owned tractor, aerial sensor system5200may be a USDA-owned drone, and manual sensor system5300may be a carbon exchange auditor point probe.

The measured values and trends may be used to guide farming practices such as tillage location, type, and depth. Further, the measured values may be used to guide planting and seeding depths, crop care chemical selection and prescription, and harvest residue management.

FIG.6is a flow diagram of a method of performing simultaneous machine data capture in accordance with one embodiment. Method6000begins at block6020and proceeds to block6040where data collection occurs. This data collection can include machine data6060as well as on any other suitable data, as indicated at block6070. Next, method6000proceeds to block6080where data watermarking is performed. Once the data watermarking is performed, flow splits with processing occurring at both on-board data authentication block6100as well as third-party data authentication block6160. On-board data authentication6100is generally performed with respect to the mobile machine, such as a tractor. Further, this block6100can include the steps or block described with respect toFIG.4.

Third-party data authentication block6160occurs where one or more third-parties authenticate or corroborate data captured by the machine. This authentication could be performed as set forth above, with respect to robustly-identifiable systems. However, the third-party authentication could also be performed in other ways. In the most secure embodiments, all third-parties will also check to see if their own components are expected using the robustly-identifiable techniques described above.

At block6120, the mobile machine transmits its acquired machine data regardless of whether the authentication for the on-board data was successful. However, in the event that the on-board data authentication at block6100was not successful, the on-board data transmission block6120will include an indication of failure of such authentication.

Turning to block6180, the third-party data transmission occurs. The data from the on-board data transmission as well as the third-party data transmission is then compared to make sure there are no discrepancies or that any discrepancies are within a margin of error. The margin can be specified depending on the type of transaction or operation being performed. Further, the actual provided data relative to the operation can be interpolated based on the on-board data transmission and the third-party data transmission. The final processed or interpolated data with respect to the operation may then be stored in an immutable ledger, such as using a blockchain. Further, the communication with the immutable ledger is preferably encrypted. These ledgers are generally accessed for read publicly and for write in an authenticated manner. The ledger's data cannot be altered (i.e. immutable). The communication with the immutable ledger is signed or otherwise authenticated to uniquely identify the entity communicating with the ledger, but the communication does not necessarily need to be encrypted.

FIG.7is a flow diagram of a method of performing simultaneous machine data capture in accordance with one embodiment. Method7000is similar to method6000and like components are numbered similarly. As can be seen, method7000includes an explicit data comparison step at block7020which determines whether the data from the on-board transmission block6120and the third-party data transmission block6180are discrepant. If the data are not discrepant, control passes to block7060where method7000ends by using the non-discrepant data. However, if block7020determines that the data is discrepant, or discrepant beyond a selected threshold (such as 5% or 10%) method7000generates a deviation signal at block7040indicating that the data discrepancy, which can allow those who reply upon the mobile machine's data to ascribe less trust or confidence in the data for critical decisions.

While embodiments described thus far have generally described a soil organic matter sensor, this is for illustration purposes only. It is expressly contemplated that embodiments described herein are applicable to any type of data acquisition with respect to any mobile machine where data authentication is important. Examples of other operations or industries where such data authentication is important include, without limitation, forestry, soil compaction, chemical application, tillage, planting/seeding, organic practices, and carbon sequestration. For example, cut-to-length timber harvesters have sensors for measuring tree length and diameter. The sensors have been proposed for measuring wood density. Such sensors could replace the soil organic matter sensor described above and provide an authenticated manner for capturing data with respect to wood volume being removed from a forest. Such data could be used to estimate the amount of carbon being removed from the forest in the form of wood.

In another example, referring toFIG.1, the mobile machine could instead be a construction soil compactor which comprises a compaction drum with a compaction sensor in addition to a task processor, location/motion sensor, transceiver, and network. Rather than measuring soil organic matter, the construction soil compactor compacts soil for a road bed. The compaction level must meet a contractual or project specification prior to, for example, putting a layer of concrete over the bed as a road. InFIG.5, modifications to machine5100could carry over from the above description ofFIG.1. Soil compaction data would be collected by a sub-contractor machine. Human5340, a Department of Transportation employee, may use a cone penetrometer to obtain soil compaction data. Drone5200may be owned and operator by the contractor who is monitoring work of the sub-contractor machine. Authenticated data from the three sources may be combined into a distributed immutable ledger, such as a blockchain-like distributed, immutable ledger to provide a record of operations occurring on the worksite.

The present discussion has mentioned processors and servers. In one embodiment, the processors and servers include computer processors with associated memory and timing circuitry, not separately shown. They are functional parts of the systems or devices to which they belong and are activated by, and facilitate the functionality of the other components or items in those systems. Example implementations of the invention may use one or more processors. In multi-processor implementations, the processors may be local, remote, or a mixture. The processors may share information via wired, wireless, or a mixture of such communications techniques. Further, in multi-processor embodiments, portions of computations may be fixedly or dynamically assigned to different processors.

A number of data stores have also been discussed. It will be noted they can each be broken into multiple data stores. All can be local to the systems accessing them, all can be remote, or some can be local while others are remote. All of these configurations are contemplated herein.

Also, the figures show a number of blocks with functionality ascribed to each block. It will be noted that fewer blocks can be used so the functionality is performed by fewer components. Also, more blocks can be used with the functionality distributed among more components.

FIG.8a block diagram of mobile machine1000, shown inFIG.1, except that it communicates with elements in a remote server architecture500. In an example embodiment, remote server architecture500can provide computation, software, data access, and storage services that do not require end-user knowledge of the physical location or configuration of the system that delivers the services. In various embodiments, remote servers can deliver the services over a wide area network, such as the internet, using appropriate protocols. For instance, remote servers can deliver applications over a wide area network and they can be accessed through a web browser or any other computing component. Software or components shown inFIG.1as well as the corresponding data, can be stored on servers at a remote location. The computing resources in a remote server environment can be consolidated at a remote data center location or they can be dispersed. Remote server infrastructures can deliver services through shared data centers, even though they appear as a single point of access for the user. Thus, the components and functions described herein can be provided from a remote server at a remote location using a remote server architecture. Alternatively, they can be provided from a conventional server, or they can be installed on client devices directly, or in other ways.

In the embodiment shown inFIG.8, some items are similar to those shown inFIG.5and they are similarly numbered.FIG.8specifically shows servers5180,5280, and5380can be located at a remote server location502. Therefore, mobile machine1000accesses those systems through remote server location502.

FIG.8also depicts another embodiment of a remote server architecture.FIG.8shows that it is also contemplated that some elements are disposed at remote server location502while others are not. By way of example, remote storage120can be disposed at a location separate from location502and accessed through the remote server at location502. Regardless of where they are located, they can be accessed directly by mobile machine1000, through a network (either a wide area network or a local area network), they can be hosted at a remote site by a service, or they can be provided as a service, or accessed by a connection service that resides in a remote location. Also, the data can be stored in substantially any location and intermittently accessed by, or forwarded to, interested parties.

FIG.9illustrates one example of a computing environment in which elements ofFIGS.1and/or5, or parts thereof, (for example) can be deployed. With reference toFIG.9, an exemplary system for implementing some embodiments includes a general-purpose computing device in the form of a computer810. Components of computer810may include, but are not limited to, a processing unit820(which can comprise processor108), a system memory830, and a system bus821that couples various system components including the system memory to the processing unit820. The system bus821may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. Memory, programs and/or code described with respect toFIGS.1,3and/or5can be deployed in corresponding portions ofFIG.9.

Computer810typically includes a variety of computer readable media. Computer readable media can be any available media that can be accessed by computer810and includes both volatile and nonvolatile media, removable and non-removable media. By way of example, and not limitation, computer readable media may comprise computer storage media and communication media. Computer storage media is different from, and does not include, a modulated data signal or carrier wave. It includes hardware storage media including both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by computer810. Communication media may embody computer readable instructions, data structures, program modules or other data in a transport mechanism and includes any information delivery media. The term “modulated data signal” means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal.

The system memory830includes computer storage media in the form of volatile and/or nonvolatile memory such as read only memory (ROM)831and random access memory (RAM)832. A basic input/output system833(BIOS), containing the basic routines that help to transfer information between elements within computer810, such as during start-up, is typically stored in ROM831. RAM832typically contains data and/or program modules that are immediately accessible to and/or presently being operated on by processing unit820. By way of example, and not limitation,FIG.9illustrates operating system834, application programs835, other program modules836, and program data837.

The computer810may also include other removable/non-removable volatile/nonvolatile computer storage media. By way of example only,FIG.9illustrates a hard disk drive841that reads from or writes to non-removable, nonvolatile magnetic media, a magnetic disk drive851, nonvolatile magnetic disk852, an optical disk drive855, and nonvolatile optical disk856. The hard disk drive841is typically connected to the system bus821through a non-removable memory interface such as interface840, and magnetic disk drive851and optical disk drive855are typically connected to the system bus821by a removable memory interface, such as interface850.

Alternatively, or in addition, the functionality described herein can be performed, at least in part, by one or more hardware logic components. For example, and without limitation, illustrative types of hardware logic components that can be used include Field-programmable Gate Arrays (FPGAs), Program-specific Integrated Circuits (e.g., ASICs), Program-specific Standard Products (e.g., ASSPs), System-on-a-chip systems (SOCs), Complex Programmable Logic Devices (CPLDs), etc.

The drives and their associated computer storage media discussed above and illustrated inFIG.9, provide storage of computer readable instructions, data structures, program modules and other data for the computer810. InFIG.9, for example, hard disk drive841is illustrated as storing operating system844, application programs845, other program modules846, and program data847. Note that these components can either be the same as or different from operating system834, application programs835, other program modules836, and program data837.

A user may enter commands and information into the computer810through input devices such as a keyboard862, a microphone863, and a pointing device861, such as a mouse, trackball or touch pad. Other input devices (not shown) may include a joystick, game pad, satellite dish, scanner, or the like. These and other input devices are often connected to the processing unit820through a user input interface860that is coupled to the system bus, but may be connected by other interface and bus structures. A visual display891or other type of display device is also connected to the system bus821via an interface, such as a video interface890. In addition to the monitor, computers may also include other peripheral output devices such as speakers897and printer896, which may be connected through an output peripheral interface895.

The computer810is operated in a networked environment using logical connections (such as a local area network—LAN, or wide area network WAN) to one or more remote computers, such as a remote computer880.

When used in a LAN networking environment, the computer810is connected to the LAN871through a network interface or adapter870. When used in a WAN networking environment, the computer810typically includes a modem872or other means for establishing communications over the WAN873, such as the Internet. In a networked environment, program modules may be stored in a remote memory storage device.FIG.9illustrates, for example, that remote application programs885can reside on remote computer880.

It should also be noted that the different embodiments described herein can be combined in different ways. That is, parts of one or more embodiments can be combined with parts of one or more other embodiments. All of this is contemplated herein.

Example 1 is a mobile work machine data capture system comprising: a robustly-identifiable sensor module having a task sensor that provides a task sensor signal indicative of a task; and a processor coupled to the robustly-identifiable sensor module, the processor being configured to issue a challenge to the robustly-identifiable sensor module and compare a response from the robustly-identifiable sensor module to an expected response to authenticate the robustly-identifiable sensor module, the processor being further configured to generate an indication of authentication failure if the response from the robustly-identifiable sensor module does not match the expected response.

Example 2 is the mobile work machine data capture system of any or all previous examples, wherein the robustly-identifiable sensor module includes a physically unclonable function module and wherein the response from the robustly-identifiable sensor module is based on a characteristic of the physically unclonable function module.

Example 3 is the mobile work machine data capture system of any or all previous examples, wherein the task sensor is a soil organic matter sensor.

Example 4 is the mobile work machine data capture system of any or all previous examples, wherein the task sensor is a soil compaction sensor.

Example 5 is the mobile work machine data capture system of any or all previous examples, and further comprising a first robustly-identifiable identifiable location/motion module coupled to the processor, the processor being configured to issue a challenge to the first robustly-identifiable location/motion module and compare a response from the first robustly-identifiable location/motion module to an expected response to authenticate the first robustly-identifiable location/motion module, the processor being further configured to generate an indication of authentication failure if the response from the first robustly-identifiable location/motion module does not match the expected response.

Example 6 is the mobile work machine data capture system of any or all previous examples, wherein the location/motion module includes a GPS receiver.

Example 7 is the mobile work machine data capture system of any or all previous examples, wherein the location/motion module includes an inertial measurement unit.

Example 8 is the mobile work machine data capture system of any or all previous examples, wherein the location/motion module includes a physically unclonable function module and wherein the response from the robustly-identifiable location/motion module is based on a characteristic of the physically unclonable function module.

Example 9 is the mobile work machine data capture system of any or all previous examples, and further comprising a second robustly-identifiable identifiable location/motion module coupled to the processor, the processor being configured to issue a challenge to the second robustly-identifiable location/motion module and compare a response from the second robustly-identifiable location/motion module to an expected response to authenticate the second robustly-identifiable location/motion module, the processor being further configured to generate an indication of authentication failure if the response from the second robustly-identifiable location/motion module does not match the expected response.

Example 10 is the mobile work machine data capture system of any or all previous examples, wherein the processor is a robustly-identifiable processor.

Example 11 is the mobile work machine data capture system of any or all previous examples, wherein the robustly-identifiable processor is configured to employ a processor physically unclonable function to authenticate the processor.

Example 12 is the mobile work machine data capture system of any or all previous examples, wherein and further comprising a robustly-identifiable identifiable wireless communication module coupled to the processor, the processor being configured to issue a challenge to the robustly-identifiable wireless communication module and compare a response from the robustly-identifiable wireless communication module to an expected response to authenticate the robustly-identifiable wireless communication module, the processor being further configured to generate an indication of authentication failure if the response from the robustly-identifiable wireless communication module does not match the expected response.

Example 13 is the mobile work machine data capture system of any or all previous examples, wherein the robustly-identifiable wireless communication module includes a physically unclonable function module and wherein the response from the robustly-identifiable wireless communication module is based on a characteristic of the physically unclonable function module.

Example 14 is the mobile work machine data capture system of any or all previous examples, wherein the robustly-identifiable wireless communication module is configured to securely communicate with a remote device.

Example 15 is the mobile work machine data capture system of any or all previous examples, wherein the secure communication includes cryptographic communication.

Example 16 is a system for authenticating data of a mobile work machine. The system includes a remote computer system; a first data capture system mounted to an off-road mobile machine, the first data capture system comprising: a robustly-identifiable sensor module having a task sensor that provides a task sensor signal indicative of a task; a wireless communication module; and a processor coupled to the robustly-identifiable sensor module and the communication module, the processor being configured to acquire data from the task sensor signal and transmit the acquired data to the remote computer system using the wireless communication module; and a second data capture system disposed to capture additional data relative to operation of the mobile machine and transmit the additional data to the remote computer system; andwherein the remote computer system is configured to receive the acquired data from the first data capture system and to receive the additional data from the second data capture system and combine the acquired data and the additional data to generate combined data and wherein the remote computer system is configured to store the combined data in an immutable ledger.

Example 17 is the system of any or all previous examples, wherein the immutable ledger is a distributed, immutable ledger that employs blockchain.

Example 18 is the system of any or all previous examples, wherein the second data capture system captures data relative to at least one of location, time, and actions of the mobile machine.

Example 19 is the system of any or all previous examples, wherein the remote computer system is configured to compare the acquired data with the additional data and generate a deviation signal if there is a discrepancy exceeding a pre-selected threshold.

Example 20 is a data capture system for a mobile machine. The data capture system comprises at least one robustly-identifiable task sensor; at least one robustly-identifiably processor coupled to the at least one robustly-identifiable task sensor; at least one robustly-identifiable location/motion module coupled to the at least one robustly-identifiable processor and configured to provide an indication of at least one of geographic location and relative machine motion; at least one robustly-identifiable wireless transceiver operably coupled to the at least one robustly-identifiable processor and configured to securely communicate with a remote device.

Although the subject matter has been described in language specific to structural features and/or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.