Communicating with a vehicle tracking device via short message service (SMS) secured by single-use credentials
A system addresses a security vulnerability in sending commands to a vehicle tracking device via SMS text messaging. The system provides a single-use credential value for authenticating the SMS communication link before it can be used to command the vehicle tracking device. The single-use credential value, also referred to herein as a One-Time Personal Identification Number (OTPIN), is preferably time-based so that it can be used only once.
1. A method for providing secure communications between a backend server and a vehicle tracking device, comprising:
(a) generating a Short Message Service (SMS) command message including a command to be executed by the vehicle tracking device;
(b) generating a single-use credential value based at least in part on a shared key value and a first time value corresponding to a time at which the SMS command message is generated, wherein the first time value falls within a first time window having a limited duration;
(c) attaching the single-use credential value to the SMS command message;
(d) sending the SMS command message from the backend server to the vehicle tracking device via a wireless communication network;
(e) receiving the SMS command message at the vehicle tracking device;
(f) a processor of the vehicle tracking device generating a first expected credential value based at least in part on the shared key value and a second time value that corresponds to a time at which the SMS command message is received at the vehicle tracking device;
(g) the processor of the vehicle tracking device comparing the first expected credential value to the single-use credential value attached to the SMS command message;
(h) the vehicle tracking device executing the command included in the SMS command message based on the first expected credential value matching the single-use credential value attached to the SMS command message, wherein the first expected credential value matching the single-use credential value is conditioned upon the second time value falling within the first time window; and
(i) based on the first expected credential value not matching the single-use credential value because the second time value falls into a second time window that is subsequent to the first time window:
the processor of the vehicle tracking device generating a second expected credential value based at least in part on the shared key value and a third time value that falls within a preceding time window that immediately precedes the second time window;
the processor of the vehicle tracking device comparing the second expected credential value to the single-use credential value; and
the vehicle tracking device executing the command included in the SMS command message based on the second expected credential value matching the single-use credential value attached to the SMS command message, wherein the second expected credential value matching the single-use credential value is conditioned upon the first time value falling within the preceding time window.
2. The method of claim 1 wherein the preceding time window corresponds to the first time window.
3. The method of claim 1 wherein the time at which the SMS command message is received at the vehicle tracking device is determined based on reference to timing signals from Global Positioning System (GPS) satellites.
4. The method of claim 1 wherein step (c) comprises prepending the single-use credential value to the SMS command message.
5. The method of claim 1 wherein the command included in the SMS command message causes the vehicle tracking device to perform one or more of:
setting up cellular communications;
performing a firmware update; and
acquiring and transmitting its current GPS coordinates.
6. A method for providing secure communications between a backend server and a vehicle tracking device, comprising:
(a) generating a Short Message Service (SMS) command message including a command to be executed by the vehicle tracking device;
(b) generating a single-use credential value based at least in part on a shared key value and a first time value, wherein the single-use credential value is valid only during a first time window having a limited duration, and wherein the first time value falls within the first time window;
(c) attaching the single-use credential value to the SMS command message;
(d) attaching a timestamp value to the SMS command message, wherein the timestamp value corresponds to the first time value;
(e) sending the SMS command message from the backend server to the vehicle tracking device via a wireless communication network;
(f) receiving the SMS command message at the vehicle tracking device;
(g) a processor of the vehicle tracking device generating an expected credential value based at least in part on the shared key value and the timestamp value attached to the SMS command message;
(h) the processor of the vehicle tracking device comparing the expected credential value to the single-use credential value attached to the SMS command message; and
(i) the vehicle tracking device executing the command included in the SMS command message based on the expected credential value matching the single-use credential value attached to the SMS command message.
7. The method of claim 6 wherein the command included in the SMS command message causes the vehicle tracking device to perform one or more of:
setting up cellular communications;
performing a firmware update; and
acquiring and transmitting its current GPS coordinates.