Sandboxed BMS Controller Architecture for Secure Feature Expansion

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Building management system controllers have limited resources and capabilities, making it expensive and complicated to add additional functionalities.

Innovation Solution

Deploy a BMS control container and separate support containers within a sandbox environment, utilizing a publish-subscribe message broker for secure and efficient communication, with each container running on dedicated processing resources and implementing AI/ML algorithms.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If additional capabilities are added to building management system controllers, then functionality and versatility are improved, but system complexity and cost increase

Engineering Contradiction:

ImprovefunctionalityVSAvoidsystem complexity

Core Design Contradiction:

Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The BMS controller is divided into multiple isolated sandboxes (first sandbox for BMS control logic, second sandbox for message broker, third sandbox for support containers). Each sandbox contains specific functionalities, allowing the system to add capabilities by adding new sandboxes rather than complicating the existing structure. This segmentation enables independent deployment and management of different functions.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The sandbox architecture provides a universal platform that can host multiple different functionalities (BMS control logic, message broker, support containers) within a single controller device. The standardized sandbox interface allows various applications and services to run concurrently with guaranteed resource isolation, making the controller adaptable to diverse building management requirements.

Inventive Principle:

Principle #6Universality (Multi-functionality)

2Adaptability or versatility

If additional capabilities are added to building management system controllers, then functionality is improved, but cost increases

Engineering Contradiction:

ImprovefunctionalityVSAvoidcost

Core Design Contradiction:

Adaptability or versatilityVSEase of manufacture

Solution Approach 1:

By segmenting the controller into reusable sandboxes with standardized interfaces, the system allows functionalities to be added as independent modules. This reduces development and deployment costs compared to designing and manufacturing entirely new controller hardware for each additional capability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Support containers are nested within the sandbox architecture, allowing additional functionalities to be contained within existing structural frameworks. This nested organization enables efficient resource sharing and reduces the need for separate hardware implementations for each function.

Inventive Principle:

Principle #7Nested doll (Nesting)

3Productivity

If multiple applications run in the same environment, then resource utilization is improved, but security risks increase

Engineering Contradiction:

Improveresource utilizationVSAvoidsecurity

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system segments the execution environment into multiple isolated sandboxes that share the underlying hardware resources while maintaining strict boundaries. Each sandbox has controlled access to processing resources, allowing efficient resource utilization across multiple applications while preventing security breaches from propagating between applications.

Inventive Principle:

Principle #1Segmentation

4Reliability

If sandboxes restrict access to resources, then security is improved, but resource utilization may worsen

Engineering Contradiction:

ImprovesecurityVSAvoidresource utilization

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The sandbox architecture provides a universal resource management framework that enables multiple applications to share physical resources efficiently while maintaining security. The message broker sandbox acts as a universal communication infrastructure that all other sandboxes can access, maximizing resource utilization without compromising security boundaries.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Data Source

PatentUS20260050256A1Building management system controller with a BMS control container and one or more support containers operatively communicating via a publish-subscribe message broker

Publication Date: 2026.02.19 HONEYWELL INTERNATIONAL INC

AI summary

A BMS controller includes a BMS control container operating in a first sandbox that is associated with first processing resources of the BMS controller. The BMS control container implements BMS control logic that receives sensed values from external BMS sensors and provides one or more control signals to external BMS control devices that are based at least in part on the sensed values. The BMS controller includes a publish-subscribe message broker container operating in a second sandbox that is associated with second processing resources of the BMS controller. The BMS controller includes support containers that each operate in a corresponding sandbox associated with corresponding processing resources of the BMS controller. Each of the support containers communicate with the BMS control container and/or other support containers via the publish-subscribe message broker container.