Building management system with identity management and assurance services

• US 10,600,263 B2
• Filed: 09/26/2018
• Issued: 03/24/2020
• Est. Priority Date: 09/27/2017
• Status: Active Grant

• Current Assignee: Tyco Fire & Security GmbH (Johnson Controls International plc)
• Original Assignee: Johnson Controls Technology Company (Johnson Controls International plc)
• Inventors: Park, Youngchoon, Sinha, Sudhi R., Paulson, Erik S., Ainsworth, Peter A., Gallagher, Anne
• Primary Examiner(s): Wong, K.
• Application Number:
  US16/142,472
• Publication Number:
  US 20190096147A1
• Time in Patent Office: 545 Days
• Field of Search: None
• CPC Class Codes: G06F 16/288 Entity relationship models
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06Q 50/163 Real estate management
• CPC Class Codes: G07C 9/00563 using personal physical data of the operator, e.g. finger prints, retinal images, voicepatterns
• CPC Class Codes: G07C 9/00571 operated by interacting with a central unit
• CPC Class Codes: G07C 9/253 visually
• CPC Class Codes: G07C 9/257 electronically G07C9/26 takes precedence
• CPC Class Codes: G07C 9/27 with central registration

Abstract

A building management system includes an entity database and an identity management service. The entity database stores a plurality of interconnected smart entities. The smart entities include object entities representing a plurality of people or physical devices and data entities representing data associated with the people or physical devices. The smart entities are interconnected by relational objects indicating relationships between the object entities and the data entities. Each of the object entities includes a plurality of stored identity attributes. The identity management service is configured to receive a first identity attribute from a first device within a building, receive a second identity attribute from a second device within the building, compare the first and second identity attributes to the stored identity attributes of an object entity of the plurality of interconnected smart entities, and allow access to at least one of a building space, a device of building equipment, or a computer system in response to the first and second identity attributes matching the stored identity attributes of the object entity.

Claims

1. A building management system comprising:

an entity database storing a plurality of interconnected smart entities, the smart entities comprising object entities representing a plurality of people or physical devices and data entities representing data associated with the people or physical devices, the smart entities being interconnected by relational objects indicating relationships between the object entities and the data entities, each of the object entities comprising a plurality of stored identity attributes; and

an identity management service configured to;

receive a first identity attribute from a first device within a building;

receive a second identity attribute from a second device within the building;

compare the first and second identity attributes to the stored identity attributes of an object entity of the plurality of interconnected smart entities, the stored identity attributes corresponding to identification data of a corresponding person or physical device represented by the object entity and comprising the identification data corresponding to each of the first and second identity attributes; and

allow access to at least one of a building space, a device of building equipment, or a computer system in response to the first and second identity attributes matching the stored identity attributes of the object entity.

2. The building management system of claim 1, wherein:

the first device is an access card reader and the first identity attribute is a card ID attribute recorded by the access card reader; and

the second device is a security camera and the second identity attribute is an image of a person captured by the security camera.

3. The building management system of claim 1, wherein:

the first device is an access card reader and the first identity attribute is a card ID attribute recorded by the access card reader; and

the second device is a mobile device carried by a person and the second identity attribute is a mobile device ID attribute associated with the mobile device.

4. The building management system of claim 1, wherein:

the first device is a user interface device and the first identity attribute is a user identifier received from a user via the user interface device; and

the second device is a security camera and the second identity attribute is an image of a person captured by the security camera.

5. The building management system of claim 1, wherein:

the first device is a user interface device and the first identity attribute is a user identifier received from a user via the user interface device; and

the second device is a mobile device carried by a person and the second identity attribute is a mobile device ID attribute associated with the mobile device.

6. The building management system of claim 1, wherein:

the first device is one of a mobile device, an information technology (IT) device, an internet of things (IoT) sensor, a building equipment device, or a security device; and

the second device is another of the mobile device, the IT device, the IoT sensor, the building equipment device, or the security device.

7. The building management system of claim 1, wherein the identity management service is configured to:

determine a location associated with the first device in response to the first device providing the first identity attribute;

identify a building space in which the first device is located; and

select the second device from a set of devices located in the same building space as the first device.

8. The building management system of claim 1, wherein the identity management service is configured to deny access to at least one of the building space, the device of building equipment, or the computer system in response to at least one of the first and second identity attributes not matching the stored identity attributes of the object entity.

9. A method for controlling access to a building space, a device of building equipment, or a computer system in a building management system, the method comprising:

storing a plurality of interconnected smart entities in an entity database, the smart entities comprising object entities representing a plurality of people or physical devices and data entities representing data associated with the people or physical devices, the smart entities being interconnected by relational objects indicating relationships between the object entities and the data entities, each of the object entities comprising a plurality of stored identity attributes;

receiving a first identity attribute from a first device within a building;

receiving a second identity attribute from a second device within the building;

comparing the first and second identity attributes to the stored identity attributes of an object entity of the plurality of interconnected smart entities, the stored identity attributes corresponding to identification data of a corresponding person or physical device represented by the object entity and comprising the identification data corresponding to each of the first and second identity attributes; and

allowing access to at least one of a building space, a device of building equipment, or a computer system in response to the first and second identity attributes matching the stored identity attributes of the object entity.

10. The method of claim 9, wherein:

the first device is an access card reader and the first identity attribute is a card ID attribute recorded by the access card reader;

the second device is at least one of a security camera or a mobile device carried by a person; and

the second identity attribute is at least one of an image of a person captured by the security camera or a mobile device ID attribute associated with the mobile device.

11. The method of claim 9, wherein:

the first device is a user interface device and the first identity attribute is a user identifier received from a user via the user interface device;

the second device is at least one of a security camera or a mobile device carried by a person; and

the second identity attribute is at least one of an image of a person captured by the security camera or a mobile device ID attribute associated with the mobile device.

12. The method of claim 9, further comprising:

determining a location associated with the first device in response to the first device providing the first identity attribute;

identifying a building space in which the first device is located; and

selecting the second device from a set of devices located in the same building space as the first device.

13. A building management system comprising:

a plurality of devices of building equipment;

an entity database storing a plurality of interconnected smart entities, the smart entities comprising object entities representing the plurality of devices of building equipment and data entities representing data associated with the plurality of devices of building equipment, the smart entities being interconnected by relational objects indicating relationships between the object entities and the data entities, each object entity comprising a stored attribute indicating a version of software installed on a device of the building equipment represented by the object entity; and

an assurance service configured to automatically detect a version of software installed on each of the devices of building equipment by reading the stored attributes of the object entities and automatically update the software installed on one or more of the devices of building equipment in response to a determination that the version of software installed on the one or more of the devices of building equipment is not a latest version of the software.

14. The building management system of claim 13, wherein the assurance service comprises an identity and security service configured to ensure that each device of the building equipment is able to access configuration backups.

15. The building management system of claim 13, wherein the assurance service comprises a device management service configured to create a smart entity for each device of the building equipment and register each device of the building equipment with the corresponding smart entity.

16. The building management system of claim 13, wherein the assurance service comprises a transportation and messaging service configured to facilitate bidirectional communications between the assurance service and the building equipment.

17. The building management system of claim 13, wherein the assurance service comprises a device shadow/manifest service configured to synchronize at least one of configuration settings, parameters, or device-specific information between the building equipment and the assurance service.

18. The building management system of claim 13, wherein the assurance service comprises a package service configured to create a compressed data object comprising a configuration of the building equipment and store the compressed data object as a backup of the configuration.

19. The building management system of claim 13, wherein the assurance service comprises an asset and backup service configured to generate and present a user interface that lists each device of the building equipment and indicates whether a backup configuration of each device has been stored at the assurance service.

20. The building management system of claim 13, wherein the assurance service comprises a manual upload service configured to upload a backup configuration in response to a user request for the backup configuration.