Beverage Machine Network Communication Module Isolation for Safety

Solution Overview

Problem

Networked beverage preparation machines are vulnerable to malware and unsuitable remote parameterization, which can lead to safety issues and degradation of the beverage preparation process, often occurring silently and without user knowledge.

Innovation Solution

The machine is designed with a communication module that cannot control the ingredient processing arrangement, preventing remote operation or interference with components like heaters or pumps, ensuring that the beverage preparation process remains unaffected by network data exchanges. This separation of the communication module from the control unit and ingredient processing arrangement prevents any data-driven reconfiguration that could compromise safety or integrity.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If the beverage machine is connected to a network for remote control and software updates, then the ease of operation and adaptability are improved, but the machine becomes vulnerable to malware and remote interference that can compromise safety and process integrity

Engineering Contradiction:

Improveremote control capabilityVSAvoidsafety against malware

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The control unit is divided into two independent parts: a communication module that handles network data exchange and a control module that manages the beverage preparation process. The communication module receives and stores incoming data, while the control module independently executes predefined control routines based on locally stored program code. This segmentation prevents remote code from directly controlling the beverage preparation process, thereby maintaining safety while enabling network connectivity.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

A memory device serves as an intermediary between the communication module and the control module. Incoming network data is stored in the memory device rather than being executed directly. The control module can only access and execute program code from its own internal memory, not from external network sources. This intermediary layer blocks malicious code from reaching the control functions while allowing legitimate data exchange.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of operation

If the communication module can control the ingredient processing arrangement, then the ease of operation is improved, but the risk of harmful factors from remote interference increases

Engineering Contradiction:

Improveremote operation capabilityVSAvoidremote interference risk

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The control unit is divided into two independent parts: a communication module that handles network data exchange and a control module that manages the beverage preparation process. The communication module receives and stores incoming data, while the control module independently executes predefined control routines based on locally stored program code. This segmentation prevents remote code from directly controlling the beverage preparation process, thereby maintaining safety while enabling network connectivity.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system is designed with inherent protection against remote interference by preventing the communication module from having direct control authority over the ingredient processing arrangement. The control architecture is established beforehand to ensure that only locally verified program code can control the processing arrangement, countering potential remote attacks before they can cause harm.

Inventive Principle:

Principle #9Preliminary anti-action

3Adaptability or versatility

If remote software updates are allowed, then the adaptability is improved, but the integrity of the control software may be compromised by malicious code

Engineering Contradiction:

Improvesoftware update capabilityVSAvoidcontrol software integrity

Core Design Contradiction:

Adaptability or versatilityVSStability of the object's composition

Solution Approach 1:

A memory device serves as an intermediary between the communication module and the control module. Incoming network data is stored in the memory device rather than being executed directly. The control module can only access and execute program code from its own internal memory, not from external network sources. This intermediary layer blocks malicious code from reaching the control functions while allowing legitimate data exchange.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The executable control code is extracted from the incoming network data and stored separately in the control module's internal memory. Only the data portion is accepted from the network, while the control logic remains isolated and protected. This separation ensures that even if data is compromised, the core control software integrity is maintained.

Inventive Principle:

Principle #2Taking out (Extraction)

Data Source

PatentEP2473084B2Beverage machine for a network

Publication Date: 2021.03.31 SOCIETE DES PRODUITS NESTLE SA

Figure 1
Figure 2~3

AI summary

A beverage preparation machine (1) comprises : an arrangement (40) for processing one or more beverage ingredients to dispense a beverage; a control unit (21) connected to the ingredient processing arrangement f or controlling the processing of such one or more beverage ingredients; and a communication module (11) for communication with an external network (50, 511). The communication module (11) is prevented from controlling the ingredient processing arrangement (40).