Aircraft flight security system and method

[0001] This application claims the benefit of the following U.S. Provisional Applications: Application No. 60/322,197 filed on Sep. 11, 2001; Application No. 60/322,902 filed on Sep. 17, 2001; Application No. 60/327,531 filed on Oct. 6, 2001; and Application No. 60/340,793 filed on Nov. 30, 2001.

[0002] This invention relates to vehicle security and public security in general, and more particularly to preventing unauthorized use of vehicles such as commercial aircraft.

[0003] Commercial aircraft are favorite targets of hijackers. It is desirable to prevent hijackers from taking unauthorized control of aircraft, as such hijacking activities compromise public safety. Due to the nature of aircraft operation, the pilots need immediate access to the controls at all times during the flight in order to insure and provide for a safe flight. The use of locks or keys can put access to the controls in jeopardy while flying. The use of persistent access codes, such as a password keyed to each individual pilot causes administrative problems for the airline. This is because pilots and crew change aircraft constantly, and often with little advance notice. Tight schedules preclude easy transfer of access codes from one aircraft to another. Storing large numbers of access codes on board each aircraft presents security risks. Furthermore, access codes and passwords must be updated constantly in order to provide good security, causing an additional administrative burden. Thus a better technique is required.

[0004] Embodiments of this invention provide systems whereby vehicles such as commercial aircraft may be effectively protected from unauthorized operating by hijackers or terrorists, without undue administrative burden on the part of the airline or crew. Furthermore, it is practical and cost effective. In an aspect of an embodiment of the invention, a non-persistent identifier is used to establish the identity of authorized personnel. Subsequently, when an unusual event is detected, or at certain specified points during the vehicle trip, the authorized personnel's identity is confirmed by re-entry of the non-persistent identifier, as a confirmation identifier, before the vehicle is allowed to continue with normal operations. When the trip is completed, the non-persistent identifiers are deleted.

[0009] For sake of clarity, the embodiment discussed herein is made with reference to a commercial aircraft such as a passenger or cargo-carrying aircraft. However, those skilled in the art will appreciate that alternate embodiments of the invention are also possible in general for vehicles of any sort. For example, busses, trains, ships, and other such vehicles can all be equipped with alternate embodiments of the systems and methods discussed herein.

[0010] FIG. 1 shows the installation of the hardware portion of the system in a aircraft control area, specifically the cockpit of an aircraft. For most aircraft, the cockpit is a restricted area, where only authorized flight crew are supposed to be. The cockpit has a yoke 100 for flight control, a control panel containing instruments 102 and switches 104 for various aircraft monitoring and control functions. The yoke 100 is linked to hydraulic and servo controls which in turn are connected to flight control surfaces such as the rudder, elevators, flaps and ailerons of the aircraft. A throttle control 106 is linked to and controls power from the engine or engines of the aircraft. In an embodiment of the invention, an identifier receiver such as a keypad 108 is located on the control panel. In other embodiments the identifier receiver may be a biometric device such as a microphone or retina scanner or fingerprint reader. The keypad 108 contains numerous keys 110, and may contain a display unit 112. The keypad 108 may be a 12-key touchpad, or any of various other designs. The cockpit also includes a warning light 114. This warning light 114 can be used to alert the pilot to a variety of events of interest to securing the aircraft, as discussed in detail below. The yoke 100 also includes a lock button 116. This button is used to lock out access to the flight controls, and is discussed in more detail below.

[0011] Turning to FIG. 2 an aircraft security system in accordance with an embodiment of the invention is depicted. The system includes one or more identifier receivers, such as keypads 108. These keypads 108 are located at various positions within the aircraft. For example, each pilot station and each flight attendant station within the aircraft may have a keypad 108 or other such identifier receiver associated with it. The identifier receivers all connect to a central computing unit 200 through an identifier processor 202.

[0012] The identifier processor 202 monitors and receives signals from the keypads 108. The identifier processor 202 processes the keypad data, and sends information back and forth to the central computing unit 200. The identifier processor 202 stores identifiers received from keypads 108, and compares comparison identifiers received later on with the stored identifiers. The identifier processor 202 communicates the results of these comparisons to the central computing unit 200. The identifier processor 202 is preferably a separate dedicated box, though it may also be a software module within the central computing unit 200. The box and keypads 108 are installed, along with connecting cables, when retrofitting existing aircraft. Communication means, such as a cable, connects the identifier processor 202 with the central computing unit 200.

[0013] The central computing unit 200 is the general Flight Management Computer (FMC) that handles various computational tasks throughout the flight. Various flight control input devices 210 also connect to the central computing unit 200. The hydraulic and servo controls 204 for the flight control surfaces also connect to the central computing unit. Various sensors 212 also connect to the central computing unit 200. The flight control input devices 210 generally include the yoke 100 and throttle 106 from FIG. 1, as well as rudder pedals and other pilot inputs. The hydraulic controls 204 are what power the aircraft flight control surfaces, such as the rudder and elevators. The controls 204 may include various sensors, relays, solenoids and the like, including hydraulic, electric, pneumatic and the like which allow the central computing unit 200 to interface with the aircraft flight control surfaces and other physical controls in the aircraft.

[0014] The aircraft flight control surfaces are generally hydraulically powered in order to reduce and assist with loads on the yoke 100. Sensors 212 are located in various manners throughout the aircraft, and provide flight data, such as airspeed, altitude, direction, and other information to the central computing unit 200, to assist in processing flight data. The central computing unit 200, flight control input devices 210, controls 204 and sensors 212 generally perform known functions.

[0015] The central computing unit 200 is situated between the flight control input devices 210 and the mechanical or hydraulic or servo controls 204 that operate the flight surfaces, engine speed, and other mechanisms. The central computing unit 200 also contains a aircraft control access manager 205, which receives information from the identifier processor 202 and uses this information to grant or deny access to the various aircraft controls 204. In one embodiment of the present invention, the central computing unit 200 has two or more different sets of flight control logic 206 and 208. These different sets of flight control logic 206, 208 may be provided as software updates to the central computing unit 200, as desired. The normal flight control logic 206 generally provides known functions, and supplies algorithms and logic rules for the proper handling of the aircraft control surfaces. Normally the signals from the flight control input devices 210 in the cockpit pass through the central computing unit 200 without any undue restrictions. However, if the identifier processor 202 should signal the aircraft control access manager 205 that a caution mode has been entered, the aircraft control access manager 205 may switch from normal flight control logic 206 to restricted flight control logic 208. When switching to restricted flight control logic 208, the aircraft control access manager 205 limits and overrides at least partially the signals from flight control input devices 210 coming from the pilot, thus preventing the pilot from performing certain actions on the flight control surfaces. Additional sets of flight control logic although not shown, may be provided in order to implement the functions described herein.

[0016] In an embodiment, the system described above is used to maintain secure access to the aircraft controls according to the procedure of FIG. 3. When the pilot first takes control of the plane at step 300, that is when pre-departure operations are being performed or the engines are started, the pilot is asked to enter a non-persistent identifier on the keypad 108. The non-persistent identifier is not pre-determined, and may be any number that the pilot wishes to enter, and may be as an example 3 or 4 digits long. For example, the number 243 may be used. The non-persistent identifier is not compared to a database or a reference number or authenticated in a traditional manner in any way. The pilot makes up his own non-persistent identifier, and does not share it with others. The non-persistent identifier entered by the pilot before takeoff is simply stored in the identifier processor 202. The non-persistent identifier is stored only for the duration of the flight.

[0017] One identifier per pilot is entered. The identifier need not be long to be secure. The pilot or captain does not share his identifier with others. Additional prompts on a display 112 on the keypad 108 may ask the user for the number of pilots and the number of flight crew to allow for the upcoming flight. The pilot may be required to enter the initial data twice, for redundancy and to prevent keying errors.

[0018] At step 302, in addition to the pilot(s), the flight crew may be permitted or required to enter their own non-persistent identifiers. The crew identifiers have slightly different functions, as described below. The identifier processor 202 may be configured to recognize different classes of non-persistent identifiers, such as pilot, co-pilot, flight crew, etc. The pilot for example first enters a non-persistent identifier, followed by a “P” or other designation for pilot. The co-pilot then enters his non-persistent identifier followed by a “CP”. Other information such as an employee identification number may also be entered. The different classes may have different access profiles. For example, a pilot class may have greater access rights to restricted areas such as the cockpit, or to flight control input devices 210, whereas a flight attendant class may have fewer or no access rights to such systems.

[0019] The initial entry of non-persistent identifiers may be restricted to a single keypad 108, to provide physical monitoring of the crew using the keypad 108. This keypad 108 may be located, for example, in a aircraft crew station such as the cockpit area, or one of the flight attendant stations. Thus some interaction of the crew occurs while preparing for flight. Alternately, a keypad 108 may be placed outside the aircraft in the terminal. When the crew boards, they enter a non-persistent identifier into the keypad 108 in the terminal, where their identity may be more easily confirmed by airline staff, such as staff at the boarding gate. The terminal keypad 108 is electronically connected to the identifier processor 202 aboard the aircraft.

[0020] At step 304, the non-persistent identifiers are confirmed. If two crew members should inadvertently enter the same non-persistent identifier, the system may issue a warning. All non-persistent identifiers are deleted from the system, and all crew members are required to enter new and different non-persistent identifiers. This prevents accidental disclosure of ones' non-persistent identifier.

[0021] Once the flight begins, or preferably once the aircraft doors are closed, at step 306 additional entry of a non-persistent identifier in normal operation is prevented. The aircraft control access manager 205 may control this automatically. For example, sensors 212 on the doors indicate when all the aircraft doors are closed. This data is sent to the central computing unit 200. If all the doors are closed, the aircraft control access manager 205 notifies the identifier processor 202 to prevent the further entry of new non-persistent identifiers. The central computing unit 200 and identifier processor 202 are securely located in the aircraft, and their computer programming may not be easily changed in flight.

[0022] The aircraft control access manager 205 will not release full control of the aircraft to the pilot until a non-persistent identifier is entered. After the pilot enters a non-persistent identifier, takeoff preparations may proceed at step 308. In one embodiment of the system, confirmation of the identifiers is required before takeoff. For example, just before takeoff, some several minutes after the non-persistent identifiers were initially entered, and after the airplane doors are closed and the flight crew are at their stations distributed throughout the plane, all members of the crew may be required to re-enter their non-persistent identifiers on local keypads 108, as confirmation identifiers, to confirm that all is in order. The identifier processor 202 compares these confirmation identifiers with the previously recorded non-persistent identifiers, to verify that every member of the flight crew has confirmed their non-persistent identifier.

[0023] If an incorrect confirmation identifier is entered, the keypad 108 where the incorrect confirmation identifier was entered may have a light or buzzer on it that shows an incorrect confirmation identifier was entered. If a confirmation identifier is entered incorrectly, the system may allow a second or third chance to enter the confirmation identifier correctly. If there is still an error, the system may require a reset procedure to be enacted. In an example procedure, the aircraft door is opened, and a reset code is issued and all the original non-persistent identifiers are re-entered.

[0024] Entry of these confirmation identifiers may occur when the pilot makes an announcement, when a tone is sounded, or when a digital display prompts the crew, just before the throttles are advanced for takeoff. The pilot may call for the confirmation identifier sequence to begin by entering a non-secret code on the keypad 108, or the aircraft control access manager 205 or identifier processor 202 may do so automatically. There is preferably only a short window of opportunity for each crew member to enter his or her confirmation identifier.

[0025] The confirmation identifier serves several purposes. It verifies that each crew member remembers their non-persistent identifier. It also finds any errors or attempts to enter fake identifiers, and it gives any one person on the crew one final chance to abort the flight. It also assures the plane cannot take off without the minimal required crew present.

[0026] Also, depending on the location of the keypad 108 on which the confirmation identifier was entered, for example next to the pilot's seat, copilot's seat, or flight attendant seat, the identifier processor 202 assigns access permission levels for the non-persistent identifier which was confirmed by the confirmation identifier, for the remaining duration of the flight. For example, a crew member may have entered a non-persistent identifier of 655 when first boarding the aircraft. The identifier processor 202 has the 655 number, but may not know if the crew member is a pilot or flight crew. When the confirmation identifiers are entered, the identifier processor checks to see which keypad 108 the confirmation identifier bearing the 655 number was entered from. If it is entered at the captain station, the 655 number is assigned pilot privileges for the flight. If the 655 number is entered at a flight attendant station, only flight attendant privileges are assigned to that non-persistent identifier.

[0027] At step 310, if all previously entered non-persistent identifiers are not confirmed, with no excess or shortages, a flight error occurs and the throttles or controls are computer-limited to prevent takeoff. Thus if any member of the flight crew does not have confidence in any other member of the flight crew, that member may abort the flight.

[0028] At step 312, if a restricted or unusual event occurs, for example the plane deviates from an assigned or prearranged course, the aircraft control access manager 205 may ask the pilot to re-enter his non-persistent identifier. If the pilot and/or co-pilot fail to re-enter their non-persistent identifiers, the plane is considered to no longer be under control of the original pilot, and switches to caution mode, or performs some other restriction action.

[0029] Additionally, the pilots or flight crew may use additional keypads 108 outside the cockpit to trigger a restricted event and lock access to the controls by entering their non-persistent identifier, followed by a standard lock code. The lock command may thus be used to put the plane in a stable state in the case of a struggle. In an embodiment of the invention, the flight crew has keypads 108 distributed throughout the aircraft at flight attendant stations. The flight attendant keypads may allow a cockpit door to be unlocked, and they may also allow the flight attendant to enter a lock or caution mode command to the aircraft control access manager 205. The flight attendant enters his non-persistent identifier, followed by a fixed code to open the cabin door, or another fixed code to issue a lock command, which tells the aircraft control access manager 205 to lock the pilot control input devices 210. It also locks the cockpit door. Each flight attendant may be allowed to issue only one lock command per flight to prevent improper interfering with the flight.

[0030] The distributed keypads 108 at different locations throughout the aircraft make it difficult for a hostile person or group to take over control of all keypads 108 at once. It also provides some redundancy in the case a keypad 108 should malfunction. After the lock command, one of the original pilots must re-enter their original non-persistent identifier to resume flying. If someone other than a pilot enters a lock command, such as a member of the flight crew, there may be a short delay, such a 10 seconds, before the lock signal takes effect, in order to allow the pilot to re-enter their non-persistent identifier and resume uninterrupted flight control.

[0031] Alternatively, at step 314, lock button 116 provided in the cockpit or on the flight yoke 100 is activated by the pilot or other flight crew. The identifier processor 202 constantly monitors the keypads 108 and lock button(s) 116. If the pilot steps away from the controls for a period of time, or is challenged, he may press the lock button 116. A command is sent from the lock button 116 to the identifier processor 202 and to the aircraft control access manager 205, and some or all pilot controls are then disabled. The pilot then must re-enter his non-persistent identifier, as a confirmation identifier, in order to regain control of the aircraft.

[0032] Alternately, the aircraft control access manager 205 is configured to ask or require the pilot to re-enter his non-persistent identifier several times during the flight, at step 316. These times are preferably at key points, for example such as when taking the plane off autopilot, or when dropping below a certain altitude or below a minimal ground clearance such as 3000 feet for a landing. Alternately, when the pilot places the aircraft on autopilot, the controls may be disabled until one of the pilots enters his non-persistent identifier, at step 318. The autopilot is prevented from being disengaged until a valid comparison identifier is entered.

[0033] If for any reason the pilot or other flight crew is required to provide his non-persistent identifier, and the pilot enters an incorrect identifier, then at step 320, the pilot is afforded the opportunity to re-enter his identifier. This guards against keying errors made by the pilot, who may be under the stress of an unusual event. However, it is desirable to prevent unauthorized personnel to guess the non-persistent identifier through repeated entry attempts. Therefore, upon detecting too many attempts, the identifier processor 202 will lock out the keypads 108 for a period of time, and will enter caution mode. The identifier processor 202 may initially lock out the keypads 108 for a short period of time, such as 2-3 minutes, upon detection of repeated identifier entry failures. If after this period expires, additional identifier entry failures are detected, the identifier processor 202 will lock out the keypads 108 for a longer period of time, such as 10-15 minutes, or longer.

[0034] During certain critical flight maneuvers, such as take-offs and landings, at step 322 the restriction action, such as a lock command, will not be immediately enforced. This prevents the sudden interruption of these critical flight maneuvers, and avoids the potentially disastrous consequences of such interruptions. The lock command may be delayed for a brief period of time, to allow the pilots time to complete the maneuver, or to cancel the lock command by entering their own non-persistent identifier.

[0035] If a lock command is issued, then at step 323 other systems located in the airplane, such as an optional lock on the cockpit door may be activated. The lock is electronically controlled, by the aircraft control access manager 205. A keypad 108 on the outside of the door allows pilots to enter their non-persistent identifiers to gain access. Flight attendants may also be permitted to enter their non-persistent identifiers. Under normal operations, the lock may require only one flight attendant to enter his/her non-persistent identifier, to gain access. This would aid in minimizing disruptions to the flight attendant's normal duties. Under caution mode conditions, however, the lock may require three or more flight attendants to all enter their non-persistent identifiers before the door will open.

[0036] Wires and sensing devices may be placed in the cockpit door. If forcible entry or an attempted forcible entry occurs the system triggers the lock command, the flight control input devices 210 are disabled, and the plane goes into caution mode until and unless the pilots re-enter their non-persistent identifiers. As noted above, the system may be configured to prevent or delay such lock triggering in the middle of certain critical maneuvers, such as takeoff and landing.

[0037] If the pilot is unable to or otherwise fails to re-enter his non-persistent identifier when taking the plane off autopilot, changing altitude, changing course, or when otherwise requested by the aircraft control access manager 205, a caution mode is entered at step 324. In the caution mode, at least partial access to the controls 204 of the airplane from the pilot are disabled. Automatic flight control systems, such as the autopilot or other systems controlled by the central computing unit 200, take over where pilot access is restricted, and prevent the aircraft from engaging in certain maneuvers, for example landing or reducing altitude below 3000 feet from the ground.

[0038] These automatic flight control systems are generally controlled by software portions of the central computing unit 200. The central computing unit 200 uses various flight control logic to regulate the movement of the flight control surfaces such as the rudder and the elevators. The algorithms help correct for pilot errors in normal flight. For example they prevent excessive rudder deflection at high speeds, while allowing more rudder deflection at low speeds for more control. When entering a caution mode, the central computing unit 200 switches the software control algorithms from a set of normal flight control logic 206 to a set of restricted flight control logic 208.

[0039] The restricted flight control logic 208 used in caution mode restricts the pilot's activities. The plane may still be flown, but for example cannot land or be steered below 3000 feet. Other limitations may also be placed on the pilot's activities. Course changes may be restricted or prevented. The aircraft may be allowed to land only at certain geographic locations. The restricted flight logic is designed to limit or prevent unauthorized piloting of the aircraft. By restricting the pilot's capabilities in certain limited ways, it is possible to allow the aircraft to continue flying, without allowing the aircraft to be precisely controlled in a manner than could be excessively destructive. If the pilot should re-enter his non-persistent identifier, at any time, the identifier processor 202 will compare the identifiers and upon recognizing a match will signal the aircraft control access manager 205 to switch the restricted flight control logic 208 back to normal flight control logic 206. The pilots may then regain full normal control of the aircraft.

[0040] If the pilots fail to supply their original non-persistent identifiers, and the ground controllers are not satisfied that the plane is in safe hands, the plane is considered in unauthorized or hostile hands, at step 326. At this point, additional flight control logic may be transferred from the ground to the central computing unit 200 in the aircraft, or preprogrammed flight control logic stored in the central computing unit 200 may be accessed, to determine, limit, or control which flight activities are permitted. The aircraft control access manager 205 may switch to a second restricted flight control logic that includes additional restrictions on flight activities. Such flight control logic may even cause the plane to come under the full flight control of a ground station. The pilot can still recover control of the aircraft and lock out the ground commands by entering his original non-persistent identifier.

[0041] In an extreme situation, at step 328 a backup system is activated in case of caution mode entry, or if all pilots forget their non-persistent identifiers. While each pilot makes up his own non-persistent identifiers when commencing pre-flight operations, a second secret identifier is permanently programmed into the identifier processor 202. A record of the second secret identifier is kept in a secure location on the ground. The second secret identifier is only accessed in the rare case of a caution mode entry, and is not handled in normal use.

[0042] To access the secret pre-arranged identifier, ground contact must be established, via radio or other means. If the ground controllers are satisfied that the plane is in safe hands, they may locate the second secret identifier stored in a database or elsewhere on the ground, and give that identifier to the new pilot, who may enter it to regain control of the plane. The new pilot may then be required to enter a new personal non-persistent identifier.

[0043] When using the second secret identifier, the aircraft control access manager 205 may be programmed to accept radio signals from the ground that can re-disable the flight control input devices 210 if a problem should occur, such as if the ground controllers realize they have been deceived by a hijacker. Also, multiple pre-arranged secret identifiers may be used, with different levels of activity permitted to the pilot by each identifier. Thus an initially untrusted replacement pilot may be given more limited access to the flight control input devices 210, and as the pilot becomes more trusted, additional access may be granted. The pre-arranged identifiers may be longer then the others, for example 12 or 16 digits long, to make attempts to guess the code more difficult.

[0044] At step 330, when the flight is over and at least one aircraft door is open, and as long as sensors 212 such as landing gear position and airspeed sensors indicate that the aircraft is on the ground, the non-persistent identifiers entered from the last flight are deleted. This may be done automatically by a reset command from the identifier processor 202, or alternately a designated reset command may be manually entered at one of the keypads 108. The plane may take off and land several times, but a new non-persistent identifier can not be entered unless one of the aircraft doors is opened, or some other specified flight termination event occurs, such as the aircraft auxiliary power unit is engaged, or the central computing unit 200 is connected to computers in the terminal. The non-persistent identifiers are intended to be retained until it is clear that the flight is over.

[0045] The reset code erases all the non-persistent identifiers stored in the computer. It also allows the crew to enter new non-persistent identifiers before the next flight proceeds, thereby allowing for crew changes. As discussed above, once the aircraft doors are closed and the flight begins, this ability to reset or delete the non-persistent identifiers is disabled. Because the pilot and flight crew non-persistent identifiers are automatically deleted when the doors are opened, they are not left stored in the identifier processor 202, where an unauthorized person such as a hacker could gain access to them. A pilot may therefore conveniently keep the same personal non-persistent identifier indefinitely, as long as no unauthorized person sees them enter their identifier on the keypad 108.

[0046] Turning to FIG. 4, on a hydraulically actuated control system, disengagement of the flight control input devices 210 is accomplished for example by switching a solenoid 440 that diverts hydraulic control signals on the shuttle valve 420 from the joystick linkage to an electrically operated valve 430 controlled by the central computing unit 210. The hydraulic system operates in series mode, so interaction between the flight control input devices 210 and the central computing unit 210 is eliminated. The central computing unit 210 connects to sensors 212 such as airspeed, pitch, yaw, etc, and directs the aircraft operation in a stable manner.

[0047] On airplanes with a manual control override, that is where the flight yoke 100 is still active at the same time the autopilot is active, caution mode disengages at least some of the aircraft functions from the yoke 100 or other flight control input devices 210, such as the elevator control. The autopilot, central computing unit 200. and electrically operated hydraulic valve 430 continue to control the aircraft without pilot input. The linkage disengage switch may be a solenoid operated device that is under control of the central computing unit 200. When activated, the disengage solenoid disengages a mechanical linkage coupling from the joystick to the flight control surfaces. The solenoid may have a pin-and-groove or pin-and-hole arrangement with a return spring or springs to decouple the mechanical inputs, yet allow failsafe re-coupling when the solenoid releases. The central computing unit 200 and autopilot system monitors it's own health while running. If the central computing unit 200 should fail, the manual disengage solenoid is spring loaded to re-engage and to provide pilot recovery. If for some reason the autopilot should quit working, the lock command may be automatically disabled. In this case, no security functions are available until the autopilot is fixed.

[0048] In this way, it is assured that only the original pilots are in control of the flight throughout the flight. Yet there is zero administration overhead on the part of the airline and ground crew in normal operation. Because the pilots make up their own registration codes at the time of the flight, there is no administrative overhead cost on the part of the airline in assigning and recording and managing passwords. There are no passwords for the ground crew to keep track of, and no keys or other codes to keep track of or lose. There is strong failure resistance, as any of the pilots may at any time regain control of the aircraft by entering their non-persistent identifier. The system may be used in combination with other security measures, such a pilot identification systems. The only inconvenience is the pilot must press a few buttons several times during the flight.

[0049] Various minor changes and modifications may be made to the sequences and actions and still fall within the scope of embodiments of the invention. The system may for example turn on the radio voice transmitters continuously if a lock command or caution mode is entered. An alert signal may be sent to the ground crew, which allows ground crews to gather better information. The system may or may not have a cabin door lock. The system may also permit landing activities below 3000 feet in a caution mode, but only at designated locations. Different altitude thresholds other than 3000 feet may be used.

[0050] If the system is in caution mode for more than a certain period of time, for example 10 minutes, and the pilot(s) do not respond with a proper non-persistent identifier, the central computing unit 210 may switch to a different flight control logic and accept electronic flight commands from the ground that steer the aircraft in a direction so as to avoid crashing in populated areas, or commands that land the aircraft. The commands received from the ground crew take effect unless a proper non-persistent identifier is entered.

[0051] Voiceprint, fingerprint, or retina scan, or other such biometric devices may be used as an aid in allowing the pilot to enter non-persistent identifiers. However, such devices should not be used exclusively as they may be easily defeated by placing a finger for example in a scanner after the pilot has been knocked out. Authentication devices such as metal keys or pre-arranged password codes may be used before the pilot is permitted to enter a reset code at the start of the flight as an extension of the system.

[0052] The keypad 108 preferably contains a display device 112, such as an L.E.D. digital display, to aid the pilot. The display may prompt the pilot to enter his non-persistent identifier, or warn the pilot a lock command has been issued from a flight attendant station. Lights 114 or buzzers may indicate a caution mode.

[0053] Although the term central computing unit is used, the actual computing mechanism and identifier processor may be distributed across several computers in the aircraft, or consolidated into a single computing unit. As used herein the term central computing unit or processor is meant to encompass all such configurations.

[0054] Thus embodiments of the invention provide effective and practical ways of providing security to prevent unauthorized aircraft use. In the foregoing specification, the invention has been described with reference to specific embodiments thereof. It will, however, be evident that various modifications and changes may be made thereto without departing from the broader spirit and scope of the invention. For example, the reader is to understand that the specific ordering and combination of process actions shown in the process flow diagrams described herein is merely illustrative, and the invention can be performed using different or additional process actions, or a different combination or ordering of process actions. The specification and drawings are, accordingly, to be regarded in an illustrative rather than restrictive sense, and the invention is not to be restricted or limited except in accordance with the following claims and their legal equivalents.