Cloud-Authenticated Building Automation for Secure Multi-Site Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing building automation systems lack efficient and secure methods for managing and controlling various resources and appliances across multiple sites, requiring complex infrastructure modifications and lacking robust user authentication and authorization mechanisms.
Innovation Solution
A cloud-authenticated system (CASRM) that enables secure, virtualized network communication and management of resources and appliances using a Virtual Private Cloud (VPC) for secure data storage and communication, allowing seamless integration and control across different network protocols and providing customizable user interfaces and access privileges.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a cloud-authenticated system is implemented for managing building resources, then user authentication and authorization security is improved, but system complexity increases
Solution Approach 1:
The patent introduces a cloud-based authentication server as an intermediary between users and building resources. This server handles all authentication and authorization operations, providing secure access control without requiring complex authentication mechanisms to be implemented at each local device. The cloud server acts as a centralized mediator that simplifies the overall system architecture while maintaining high security standards.
Solution Approach 2:
The patent extracts the authentication and authorization functionality from the local building management systems and relocates it to a separate cloud-based authentication server. This extraction allows the core building management devices to remain simple while the security functions are handled by a specialized external service, resolving the contradiction between security requirements and system simplicity.
2Reliability
If virtualized network communication is used for cloud connectivity, then data security and integrity are improved, but network infrastructure complexity increases
Solution Approach 1:
The patent implements a Virtual Private Cloud (VPC) network that provides multiple functions including secure data transmission, isolated network environments, and encrypted communication channels. This universal network infrastructure handles various security requirements through a single standardized interface, avoiding the need for multiple separate security systems and reducing overall network complexity.
Solution Approach 2:
The patent creates virtual copies of network infrastructure components through VPC technology, allowing multiple isolated network environments to be implemented without physical duplication. These virtual network copies provide secure data transmission paths while consuming minimal physical resources, thereby enhancing security without proportionally increasing infrastructure complexity.
3Ease of operation
If direct cloud connectivity is enabled for resource management devices, then ease of operation is improved, but network vulnerability increases
Solution Approach 1:
The patent implements a nested network architecture where devices are first connected to a local virtual network, which is then nested within the broader VPC environment, and finally connected to the cloud. This multi-layered nesting provides progressive security filtering and isolation, allowing direct cloud connectivity while protecting devices through multiple protective layers.
Solution Approach 2:
The patent establishes security measures in advance by creating virtual network boundaries and authentication protocols before devices connect to the cloud. The VPC network pre-configures security policies, firewalls, and access controls that cushion devices from potential network threats before they can exploit vulnerabilities, enabling safe direct cloud connectivity.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
The Cloud-authenticated site resource management devices, apparatuses, methods and systems ("CASRM") transforms resource-use, weather, and user settings inputs into resource management schedule and control outputs. The CASRM achieves data transformation via using a building automation management device, comprising at least a processor a memory storing processor-executable instructions to receive, at a virtual cloud network controller, a data packet from a source building resource control device and to access a virtual routing table corresponding to a local virtual network associated with a control entity. The building automation management device may also determine a destination building resource control device based on the virtual routing table and at least one destination address in the data packet, and may send the data packet to the destination building resource control device.