Authenticated self-delivery and energy-aware dispatch for renting autonomous service robots

1 . A system for authenticated self-delivery and return of an autonomous service robot, comprising:

at least one self-mobile robotic unit comprising:

a locomotion subsystem,

a navigation processor,

a radio interface,

a user interface,

a secure element storing a per-robot secret,

a control processor operably coupled to the navigation processor, radio interface, user interface, secure element, and the locomotion subsystem, and

a hardware activation gate that, in response to an enable signal, selectively couples power to a drive actuator and a manipulator actuator;

a server having at least one processor and memory storing:

a security service and

an assignment engine operable to compute for an available robotic unit an energy-feasible self-delivery and return plan that enforces a travel-radius constraint and a reserve-energy margin by evaluating a total energy budget including outbound travel energy, expected task energy, and return energy over a route through geofenced corridors, in response to a user request identifying a task class, a start time, a duration, and a service location;

wherein the security service is configured to generate a server nonce and a time-limited activation token computed from the nonce and the per-robot secret, and to derive a human-enterable short code bound to the activation token;

wherein the server is configured to transmit to the robotic unit (a) a server-signed trip plan defining at least the route through the geofenced corridors and (b) the time-limited activation token, over a mutually authenticated channel;

wherein the navigation processor is configured to, under autonomous control, execute a path plan to the service location using onboard sensing and obstacle avoidance; and

wherein the control processor is operable to, upon arrival of the robotic unit at the service location,

(i) verify the short code presented by a local user or verify a biometric factor bound to the activation token using the secure element,

(ii) assert and de-assert the enable signal to the hardware activation gate,

(iii) supervise bidirectional communications over the radio interface with the server during task execution,

(iv) cryptographically erase transient user data at completion of the task,

(v) sign and upload an audit log of control-critical events, and (vi) command the robotic unit to autonomously return under its own locomotion to a station,

wherein the control processor is further operable to verify a signature of the server-signed trip plan before executing the path plan; and

wherein the control processor is further operable, before asserting the enable signal, to perform mutual attestation with the server by: (a) generating, using a key stored in the secure element, a signed arrival tuple including at least a monotonic-clock timestamp and a location estimate; (b) transmitting the signed arrival tuple to the server for verification that the location estimate is within an authorized geofence and the timestamp is within an activation window; and (c) asserting the enable signal only upon receiving a server-signed attestation response that validates the signed arrival tuple.

2 . The system of claim 1 , wherein the user interface accepts a spoken code and the robotic unit performs on-device speech recognition to derive the code for verification without transmitting the spoken code to the server for recognition.

3 . The system of claim 2 , wherein the robotic unit performs mutual attestation by signing an arrival tuple including a timestamp and location estimate with a key stored in the secure element and transmitting the signature to the server for verification, wherein:

(a) the robotic unit receives from the server an attestation challenge comprising a fresh server nonce and a task identifier;

(b) the arrival tuple includes at least the task identifier, a monotonic-clock timestamp, the location estimate, and a pose uncertainty value, and further includes a firmware-measurement digest and a secure-element counter or sequence number to prevent replay; and

(c) the server returns a server-signed attestation response bound to the task identifier and a fresh server nonce, and the control processor asserts the enable signal to the hardware activation gate only while the server-signed attestation response remains valid.

4 . The system of claim 3 , wherein the hardware activation gate comprises a safety-rated relay that physically disconnects actuator power rails, the safety-rated relay being normally-open and defaulting to open upon loss of control power, fault, or watchdog timeout, and wherein the control processor asserts the enable signal only upon (i) successful local verification of the short code or biometric factor and (ii) successful verification of the server-signed attestation response.

5 . The system of claim 4 , wherein the server retains any evidence packages for a retention window and automatically deletes them thereafter, wherein each evidence package is encrypted under a per-task data-encryption key and the secure element implements key wrapping such that the per-task data-encryption key is wrapped by a key-encryption key that never leaves the secure element, and wherein cryptographic erasure includes destroying the key-encryption key and/or the wrapped key material such that the evidence package becomes unrecoverable in addition to the server-side deletion after the retention window.

6 . The system of claim 5 , wherein the assignment engine selects among multiple candidate robots by minimizing estimated arrival time subject to the travel radius and energy constraints and geofence travel time estimates, and subject to corridor constraints and time windows defined in the server-signed trip plan.

7 . The system of claim 6 , wherein the geofenced route includes waypoints at building ingress points and elevator lobbies, and the server communicates with a building controller over a mutually authenticated session to request door unlocking or elevator dispatch by presenting a time-limited, waypoint-bound access token, the robotic unit confirming access via onboard sensing and recording the request, controller response, and timing in the audit log, wherein the time-limited, waypoint-bound access token is derived from the server nonce and bound to (i) a waypoint identifier and (ii) an access time window, and the audit log entry for the request is signed using the secure element.

8 . A self-mobile robotic unit comprising:

a locomotion subsystem;

navigation sensors coupled to a navigation processor executing simultaneous localization and mapping and path-planning software;

a control processor operably coupled to the navigation processor, a radio interface, a user interface, and a secure element storing a per-robot secret and executable code for verifying activation tokens; and

a hardware activation gate interposed between a power source and at least one of a drive actuator and a manipulator actuator;

wherein the navigation processor is operable to compute and traverse, under autonomous control, a route to a service location and a return route;

wherein the robotic unit is operable to, upon arrival at the service location, perform a local challenge-response using a time-limited activation token bound to a server nonce and a task identifier;

wherein the control processor is further operable to issue a gate-control signal to actuate the hardware activation gate so as to selectively couple power to the at least one actuator only upon successful verification, supervise radio communications with a remote server during task execution, and sign control-critical events using the secure element; and

wherein the robotic unit is further operable to perform privacy-scoped sensing in which transient user audio and video buffers are processed in memory and cryptographically erased at task completion, and, when a hazard trigger occurs, to seal time-aligned sensor data including image frames each tagged with a monotonic-clock timestamp and corresponding metadata into a tamper-evident evidence package signed by the secure element;

wherein the robotic unit is further operable to verify, prior to navigating the route, a signature over a server-signed trip plan received from the remote server, the server-signed trip plan defining corridor constraints for the route; and

wherein the robotic unit is further operable, before actuating the hardware activation gate, to produce a signed arrival tuple including at least a monotonic-clock timestamp and a location estimate using a key stored in the secure element and to receive a server-signed attestation response confirming that the signed arrival tuple is verified and that the location estimate is within an authorized geofence.

9 . The self-mobile robotic unit of claim 8 , wherein the navigation processor executes a SLAM algorithm with loop closure and an A* path planner that adheres to a corridor map segment received from the remote server and updated by onboard sensing, the corridor map segment being included within the server-signed trip plan and subject to signature verification prior to use, and wherein updates to the corridor map segment generated by onboard sensing are uploaded to the server together with an integrity value and recorded in the signed audit log.

10 . The self-mobile robotic unit of claim 9 , wherein the secure element implements key wrapping for the evidence package such that cryptographic erasure is performed by destroying an enclave key, wherein:

(a) sensor frames sealed into the evidence package are encrypted under a per-task data-encryption key;

(b) the per-task data-encryption key is wrapped by a key-encryption key stored only within the secure element; and

(c) cryptographic erasure comprises destroying the key-encryption key and/or deleting wrapped key material in the secure element, thereby rendering the encrypted evidence package unrecoverable even if the encrypted evidence package persists in storage.

11 . The self-mobile robotic unit of claim 10 , further comprising a GNSS receiver used when available to improve global pose, the robotic unit falling back to vision-inertial odometry indoors, wherein, when indoors, the location estimate in the signed arrival tuple is expressed as a corridor-graph node identifier and compared against the corridor constraints of the server-signed trip plan, and wherein in a custody-loss mode the robotic unit uses intermittent GNSS pings and a motion classifier to detect transport dynamics inconsistent with self-locomotion.

12 . The self-mobile robotic unit of claim 11 , wherein the robotic unit performs mutual attestation by signing an arrival tuple including a timestamp and a location estimate with a key stored in the secure element and transmitting a signature to the remote server for verification, wherein the arrival tuple includes a task identifier, a monotonic-clock timestamp, a pose uncertainty value, and a firmware-measurement digest, and wherein the robotic unit actuates the hardware activation gate only after receiving and verifying a server-signed attestation response bound to the task identifier and validating geofence compliance and freshness.

13 . The self-mobile robotic unit of claim 12 , wherein the hardware activation gate comprises a safety-rated relay that physically disconnects actuator power rails, the safety-rated relay being normally-open and configured to drop out upon fault or watchdog timeout, and wherein the relay is energized only while the robotic unit maintains successful verification of (i) the activation token and (ii) the server-signed attestation response.

14 . A computer-implemented method for controlling an autonomous service robot, the method executed by at least one server and at least one robotic unit, comprising:

receiving, at the server, a task request including a task class, a start time, a duration, and a service location confirmed by a user;

computing, at the server, an energy-feasible self-delivery and return plan for a robotic unit by enforcing a travel radius and a reserve-energy margin and by evaluating outbound, task, and return energy over a geofenced route;

assigning, at the server, a robotic unit for the task; and

transmitting, from the server to the assigned robotic unit over a mutually authenticated channel, a server-signed trip plan defining at least corridor constraints for the geofenced route and a time-limited activation token derived from a server nonce and key material associated with the robotic unit and verifiable by a secure element;

executing, at a control processor of the robotic unit, perception, localization, and path-planning routines while supervising a radio interface and coordinating with a navigation processor to navigate, under autonomous control and using onboard sensors and the server-signed trip plan, to the service location under its own power;

upon arrival at the service location, performing, at the robotic unit, a local challenge-response with a user by verifying a short code or a biometric factor bound to the activation token using the secure element;

prior to driving the hardware activation gate, performing mutual attestation with the server by transmitting a signed arrival tuple including at least a monotonic-clock timestamp and a location estimate and receiving a server-signed attestation response confirming geofence compliance and freshness;

driving, from the control processor, a hardware activation gate so as to enable actuators only upon successful verification;

executing the task while streaming state for display on a user computing device comprising at least one of a smartphone, tablet, or laptop executing a client application and signing and logging control-critical events;

after completion of the task, cryptographically erasing transient user data, sealing any hazard-triggered evidence into a tamper-evident package signed by the secure element, and uploading a signed audit log; and

autonomously returning, under the robotic unit's own locomotion and under control of the control processor coordinating with the navigation processor, along an energy-feasible route to a station.

15 . The method of claim 14 , further comprising denying a user request to extend the task when the extension would violate a configured reserve energy margin, wherein the server recomputes an updated energy-feasible self-delivery and return plan in response to the extension request and (i) denies the extension if the updated plan would violate the reserve energy margin, and (ii) upon denial, instructs the robotic unit to close out the task and autonomously return under the corridor constraints of the server-signed trip plan.

16 . The method of claim 15 , wherein live location presented on the user device is generated from fused localization on the robotic unit, wherein the fused localization is continuously compared to the corridor constraints of the server-signed trip plan and a policy geofence, and wherein deviation beyond a tolerance triggers a custody-loss mode in which the server inhibits actuator enablement by withholding a server-signed attestation response and/or revoking the activation window.

17 . The method of claim 16 , further comprising, upon detection of a collision or manipulation fault by an onboard classifier, sealing synchronized sensor frames and timestamps into the evidence package together with a hash chain and a signature bound to the activation token, wherein:

(a) the timestamps comprise monotonic-clock timestamps;

(b) the hash chain is computed over ordered frame hashes and associated metadata such that removal or reordering is detectable; and

(c) the signature is generated by the secure element over at least (i) a root hash of the hash chain, (ii) the activation token, and (iii) the task identifier, thereby binding the evidence package to the authenticated task.

18 . The method of claim 17 , wherein, when the energy-feasible constraint fails for a full self-delivery, the server replans using a hybrid leg that includes a vehicle ride segment followed by a final self-locomotion segment, the robotic unit still performing local authentication and actuator gating upon arrival, wherein the server-signed trip plan defines (i) a pickup waypoint, (ii) a drop-off waypoint, and (iii) corridor constraints for the final self-locomotion segment from the drop-off waypoint to the service location, and the robotic unit verifies the signature over the server-signed trip plan before performing the final self-locomotion segment.

19 . The method of claim 18 , wherein the geofenced route includes waypoints through building ingress points and elevator lobbies, and the robot communicates with building controllers via the server to request door or elevator actuation, wherein:

(a) the server communicates with the building controller over a mutually authenticated session and presents a time-limited, waypoint-bound access token bound to an ingress waypoint identifier and access time window;

(b) the robot confirms access via onboard sensing; and

(c) the robot records the request, response, and timing in a secure-element-signed audit log.

20 . A non-transitory computer-readable medium storing instructions which, when executed by processors of the server and the robotic unit, cause performance of the method of claim 14 including verifying a signature over the server-signed trip plan and performing the mutual attestation prior to enabling the hardware activation gate.