Remote identification and management of manned and unmanned systems and devices
Embodiments of the present disclosure describe a secure, scalable and extensible aircraft and other system and device identity management (IdM) system that enables services for identity provisioning (idP), and identity validation, verification and authentication (idVV&A). The identity and management system uses dual-mode local broadcast and network connected device communication elements across a wide area network. The system serves as a Source System of Record (SSoR) that securely ingests private registration data, system/device identity verification and authentication requests and returns validated identity and activity information.
1. A dual-mode system for accessing at least one of a government data system and a third-party data system to identify manned and unmanned systems and devices, comprising:
a remote identification network;
a remote identity management server configured to access the at least one of the government data system and the third-party data system, and further configured to securely affiliate session IDs with at least one of identity information and activity authorization information of the systems and devices, including using the access to the at least one of the government data system and the third-party data system to provide activity telemetry data to the at least one of the government data system and the third-party data system and to obtain the at least one of the identity information and the activity authorization information of the systems and devices from the at least one of the government data system and the third-party data system;
a remote identification service provider connected to the remote identity management server via the remote identification network, the remote identification service provider communicating with the remote identity management server to provide authentication of credential information;
a first transmitter associated with a first one of the systems and devices, the first transmitter broadcasting at least one of a first session ID and first activity telemetry data of the first one of the systems and devices;
a second transmitter associated with a second one of the systems or devices and in data communication with the remote identification network, the second transmitter transmitting at least one of a second session ID and second activity telemetry data of the second one of the systems and devices to the remote identification service provider;
a first hardware device including at least a first processor, a first receiver, and a first display, the first hardware device configured to receive directly from the first transmitter and display the at least one of the first session ID and the first activity telemetry data; and
a second hardware device including at least a second processor and a second receiver, the second hardware device configured to receive directly from the first transmitter the at least one of the first session ID and the first activity telemetry data, and configured to communicate with the remote identification network, the second hardware device further configured to store credential information for the second hardware device and transmit the stored credential information and the at least one of the first session ID and the first activity telemetry data to the remote identification service provider, and upon authentication of the transmitted credential information to receive from the remote identification service provider at least one of the identity information and the activity authorization information for the first one and the second one of the systems and devices.
2. A dual-mode system for accessing at least one of a government data system and a third-party data system to identify a plurality of manned or unmanned systems and devices, and operable with a wide area network, comprising:
a remote identity management server in data communication with the wide area network and configured to access the at least one of the government data system and the third-party data system, including using the access to provide activity data to the at least one of the government data system and the third-party data system and to obtain at least one of identification information, activity authorization information, and activity plan information for the plurality of manned and unmanned systems and devices from the at least one of the government data system and the third-party data system;
a first hardware device including at least one receiver and wherein the first hardware device is:
configured to receive directly from a first subset of the plurality of manned or unmanned systems and devices at least one of first identification data and first activity data for each of the first subset of the plurality of manned or unmanned systems and devices;
in data communication with the wide area network;
configured to receive via the wide area network from a second subset of the plurality of manned and unmanned systems and devices at least one of second identification data and second activity data for each of the second subset of the plurality of manned or unmanned systems and devices;
configured to store credential information for the first hardware device and to transmit the credential information and the at least one of the first identification data and the first activity data to the remote identity management server for each of the first subset of the plurality of manned or unmanned systems and devices; and
configured to receive in response from the remote identity management server additional data about the plurality of manned or unmanned systems and devices including the at least one of the identification information, the activity authorization information, and the activity plan information; and
wherein the remote identity management server is further configured to mediate the additional data transmitted to the first hardware device based at least in part on the credential information and access granted under a policy.
3. The dual-mode system of claim 2 , wherein the additional data pertains to at least one of an operator of at least one of the plurality of manned or unmanned systems and devices, an owner of the at least one of the plurality of manned or unmanned systems and devices, and activity of the at least one of the plurality of manned or unmanned systems and devices.
4. The dual-mode system of claim 2 , wherein mediating the additional data includes masking and substituting select data of the additional data based at least in part on mediated access granted to the first hardware device by the credential information under the policy.
5. The dual-mode system of claim 4 , wherein the substituting select data includes the activity authorization information selected from a group consisting of authorized, unauthorized, and unknown.
6. The dual-mode system of claim 2 , wherein the first subset of the plurality of manned or unmanned systems and devices transmits at least one of the first identification data and first activity data via at least one of a transmitter and a transceiver.
7. The dual-mode system of claim 2 , wherein the second subset of the plurality of manned or unmanned systems and devices transmits at least one of the second identification data and second activity data via a transceiver in data communication with the wide-area-network.
8. The dual-mode system of claim 2 , further comprising:
at least a second hardware device including at least one receiver, and wherein the second hardware device is:
configured to receive directly from the second subset of the plurality of manned or unmanned systems and devices at least one of the second identification data and the second activity data;
in data communication with the wide area network; and
configured to store a second credential information for the second hardware device and to transmit the second credential information and the at least one of the second identification data and the second activity data to the remote identity management server for the second subset of the plurality of manned or unmanned systems and devices.
9. The dual-mode system of claim 8 , wherein: the at least second hardware device includes at least one transmitter, and wherein the second hardware device is:
configured to transmit an interrogation request to a third subset of the plurality of manned or unmanned systems and devices;
configured to receive from the third subset of the plurality of manned or unmanned systems and devices at least one of third identification data and third activity data; and
configured to transmit the second credential information and the at least one of the third identification data and the third activity data to the remote identity management server for the third subset of the plurality of manned or unmanned systems and devices.
10. The dual-mode system of claim 2 , wherein the first hardware device includes a display and the first hardware device is:
at least one of a passive and an active interrogation device; and
is configured to display at least a portion of the additional data about the plurality of manned or unmanned systems and devices.
11. The dual-mode system of claim 2 , wherein the first hardware device includes a handheld mobile device.
12. The dual-mode system of claim 2 , wherein the first hardware device is configured to encrypt and relay the at least one of the first identification data and the first activity data for each of the first subset of the plurality of manned or unmanned systems and devices.
13. The dual-mode system of claim 2 , wherein the at least one of identification information, activity authorization information, and activity plan information transmitted by the remote identity management server to the first hardware device can include personally identifiable information under the access granted to the credential information under the policy.
14. The dual-mode system of claim 2 , wherein the remote identity management server provides validation of the additional data.
15. The dual-mode system of claim 2 , wherein the additional data further includes real time and historical activity data about the plurality of manned or unmanned systems and devices.
16. The dual-mode system of claim 2 , wherein:
at least one of the remote identity management server and the at least one of the government data system and the third-party data system assigns a session ID to each of the plurality of manned or unmanned systems and devices; and at least one of the additional data and the identification information includes the session ID.
17. The dual-mode system of claim 2 , wherein the first hardware device is in direct data communication with a defense system and is configured to provide validation information for each of the plurality of manned or unmanned systems and devices that is determinative of whether each is authorized or unauthorized.
18. The dual-mode system of claim 2 , wherein the first hardware device includes a traffic control terminal.
19. The dual-mode system of claim 2 , wherein first hardware device is carried by at least one of the manned and unmanned systems and devices.
20. A dual-mode system for accessing at least one of a government data system and a third-party data system to identify systems and devices and operable with a wide area network, comprising:
a remote identity management server in data communication with the wide area network and adapted to access at least one of the government data system and the third-party data system, including using the access to provide activity data to the at least one of the government data system and the third-party data system and to obtain at least one of an identification information, activity authorization information, and activity plan information for the systems and devices from the at least one of the government data system and the third-party data systems;
a first radio associated with a first one of the systems and devices, the first radio transmitting to a first hardware device at least one of identification data and activity data of the first one of the systems and devices;
a second radio associated with a second one of the systems and devices and in data communication with the wide area network, the second radio transmitting at least one of identification data and activity data of the second one of the systems and devices to at least one of the remote identity management server and the at least one of the government data system and the third-party data system;
the first hardware device including at least one receiver capable of receiving directly from the first radio the at least one of identification data and activity data, the first hardware device also in data communication with the wide area network, the first hardware device configured to store a first credential information for the first hardware device and to transmit the first credential information and the at least one of identification data and activity data to the remote identity management server for the first one of the systems and devices, and upon the first hardware device presenting the first credential information to the remote identity management server, the first hardware device configured to receive from the remote identity management server at least one of additional identity information, activity authorization information and activity plan information for both the first one of the systems and devices and the second one of the systems and devices; and
at least a second hardware device including at least one receiver capable of receiving directly from the first radio the at least one of identification data and activity data, the second hardware device also in data communication with the wide area network, the second hardware device configured to store a second credential information for the second hardware device and to transmit the second credential information and the at least one of identification data and activity data to the remote identity management server for the first one of the systems and devices.