Building Access Policy Caching for Low-Latency Control Decisions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access control systems in Building Automation and Control Systems (BACS) face challenges such as inadequate security, resource constraints, scalability issues, and high communication overhead due to integration of wireless mesh standards and IP-based communication, which traditional computer network access control mechanisms cannot effectively address.
Innovation Solution
A Hybrid Access Decision Evaluation (HADE) method and system that uses a centralized decision point to derive and encode device-specific access policies, caching them locally for efficient access control, minimizing communication overhead and latency while ensuring scalability and resource efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If a centralized access control approach is used in BACS, then scalability is improved, but communication overhead and latency increase due to low-throughput wireless mesh links
Solution Approach 1:
The system performs preliminary actions by deriving and encoding device-specific access policies in advance at the central decision point, then caching them locally at accessed devices. This preparation work is done before actual access requests occur, so when access decisions are needed, the system can quickly retrieve pre-computed policies from local cache rather than communicating with the central point for every request. This resolves the contradiction by maintaining centralized policy management for scalability while enabling fast local decision-making to reduce communication latency.
2Loss of energy
If access control policies are cached locally at accessed devices, then communication overhead is reduced, but device memory and computational resources are consumed
Solution Approach 1:
The system extracts only the necessary device-specific access policies from the complete central policy set and caches them locally at accessed devices. Rather than storing all central policies or using complex data structures, the system derives and stores only the subset of policies relevant to each specific device. This extraction approach reduces the memory burden at accessed devices while still enabling effective local access control decisions, thus resolving the contradiction between reducing communication overhead and conserving device resources.
3Productivity
If device-specific access policies are derived and cached locally, then access control speed is improved, but policy management complexity increases
Solution Approach 1:
The system creates simplified copies of central access policies tailored for each accessed device. Instead of implementing complex policy management logic at every device, the central decision point derives device-specific policy copies that contain only the relevant access control rules for each device. These simplified policy copies can be easily stored and evaluated locally, enabling fast access control decisions without requiring complex policy management infrastructure at accessed devices. This copying approach resolves the contradiction by enabling fast local access control while keeping policy management simple and centralized.
Data Source
Figure 1~2
Figure 3~4
Figure 5
AI summary
The present invention relates to a method for access decision evaluation in a building automation and control system, the method comprising: sending, from an accessing device (10) to an accessed device (20), an access request, sending, from the accessed device (20) to a central decision evaluation apparatus (30), an evaluation request asking if the access request is granted or denied, evaluating, at the central decision evaluation apparatus (30), the evaluation request using one or more central access control policies in order to reach a decision on if the access request is granted or denied, deriving, at the central decision evaluation apparatus (30), the one or more central access control policies that was used for evaluation into a device specific access policy, sending, from the central decision evaluation apparatus (30) to the accessed device (20), the decision and the device specific access policy, and storing, at the accessed device (20), the device specific access policy.