Secured device access in a device automation system

• US 9,674,199 B2
• Filed: 11/21/2016
• Issued: 06/06/2017
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: SmartThings, Incorporated (Samsung Electronics Co. Ltd.)
• Inventors: Vlaminck, Scott David, O'Neill-Oine, Jesse Curtis, Florian, Jr., Robert Max, Hagins, Jeffrey
• Primary Examiner(s): Chan, Wing F
• Assistant Examiner(s): Tseng, Leon Y
• Application Number:
  US15/358,037
• Publication Number:
  US 20170078298A1
• Time in Patent Office: 197 Days
• Field of Search: 709203
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: H04L 12/2807 Exchanging configuration information on appliance services in a home automation network arrangements for maintenance or administration involving network analysis for automatically determining the actual topology of a network H04L41/12; hardware or software tools for network management using graphical user interfaces H04L41/22; address allocation H04L61/50
• CPC Class Codes: H04L 41/0803 Configuration setting
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/60 Subscription-based services using application servers or record carriers, e.g. SIM application toolkits
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

A secured device access method is implemented in a web-based device automation system whereby the configuration of an automation application for specific devices in a user'"'"'s automation environment and the installation of the automation application define the security scope for the automation application. Once the automation application is configured and installed, the automation application is only allowed access to the authorized devices in the user'"'"'s automation environment and the automation application may not access other devices in the user'"'"'s environment that have not been authorized.

Claims

1. A method of providing secured access to a device automation system implementing automatic control of one or more connected physical devices in a user'"'"'s automation environment, the user'"'"'s automation environment including a plurality of connected physical devices, connected to a data network to facilitate communication with a central server over the data network, the method comprising:

retrieving a physical graph describing the connected physical devices in the user'"'"'s automation environment;

receiving, from a client device, a selection of an automation application, wherein the automation application comprises one or more event handlers, each event handler specifying an event and an action, and wherein an event handler is executed to issue the specified action in response to the specified event;

receiving application configuration information for the selected automation application, the application configuration information identifying criteria including at least one selected from the group consisting of (i) one or more required device types, and (ii) one or more required device capabilities;

automatically filtering the physical graph to identify one or more connected physical devices in the user'"'"'s automation environment that meet the criteria identified by the configuration information;

authorizing one or more of the identified connected physical devices for access by the selected automation application wherein the authorized one or more connected physical devices are a selected subset of and not all of the plurality of connected physical devices, the remaining connected physical devices being devices that are not authorized for access by the selected automation application;

installing the selected automation application in the device automation system; and

in response to the installation of the selected automation application, restricting the installed automation application to access only the authorized connected physical devices, wherein the authorized connected physical devices are a subset of and not all of the plurality of connected physical devices in the user'"'"'s automation environment, and the automation application does not have access to any of the connected physical devices that are not authorized.

2. The method of claim 1 further comprising:

causing a list of the identified connected physical devices to be presented to a user; and

receiving a user initiated selection of the authorized connected physical devices.

3. The method of claim 1, wherein retrieving a physical graph describing the connected physical devices in the user'"'"'s automation environment comprises:

retrieving a physical graph describing one or more hub connected physical devices and one or more hubs in the user'"'"'s automation environment, the hub connected physical devices being configured to communicate with the central server through a hub, the hub connected physical devices being configured to receive commands from and issue data to the central server through the hub.

4. The method of claim 1, wherein retrieving a physical graph describing the connected physical devices in the user'"'"'s automation environment comprises:

retrieving a physical graph describing one or more direct-cloud connected physical devices in the user'"'"'s automation environment, the direct-cloud connected physical devices being configured to communicate directly with the central server, the direct-cloud connected physical devices being configured to receive commands from and issue data to the central server.

5. The method of claim 1, wherein retrieving a physical graph describing the connected physical devices in the user'"'"'s automation environment comprises:

retrieving a physical graph describing one or more cloud-to-cloud connected physical devices in the user'"'"'s automation environment, the cloud-to-cloud connected physical devices being configured to communicate with the central server through a third-party private data network, the cloud-to-cloud connected physical devices being configured to receive commands from and issue data to the central server through the third-party private data network.

6. The method of claim 1, wherein the received configuration information further defines a level of access authorized, wherein the level of access defines capabilities of the authorized one or more connected physical devices that the automation application may access.

7. The method of claim 1, wherein the received configuration information further defines a level of control authorized, wherein the level of control defines the nature of the control that the automation application may exercise over the authorized one or more connected physical devices.

8. The method of claim 1, wherein the received configuration information identifies both one or more required device types and one or more required device capabilities, and the automatic filtering of the physical graph identifies one or more connected physical devices in the user'"'"'s automation environment that are of the required device type(s) and have the required device capabilities.

9. A system for providing an secured access to a device automation system implementing automatic control of one or more physical devices in a user'"'"'s automation environment, the user'"'"'s automation environment including a plurality of connected physical devices, connected to a data network to facilitate communication with a central server over the data network, the system comprising a central server connected to the data network, the central server comprising a processor and a memory having programmed instructions, the processor and memory being configured to:

retrieve a physical graph describing the connected physical devices in the user'"'"'s automation environment;

receive, from a client device, a selection of an automation application, wherein the automation application comprises one or more event handlers, each event handler specifying an event and an action, and wherein an event handler is executed to issue the specified action in response to the specified event;

receive application configuration information for the selected automation application, the application configuration information identifying criteria including at least one of (i) one or more required device types, and (ii) one or more required device capabilities;

automatically filter the physical graph to identify one or more connected physical devices in the user'"'"'s automation environment that meet the criteria identified by the configuration information;

authorize one or more of the identified connected physical devices for access by the selected automation application, wherein the authorized one or more connected physical devices are a selected subset of and not all of the plurality of connected physical devices, the remaining connected physical devices being devices that are not authorized for access by the selected automation application;

install the selected automation application; and

in response to the installation of the selected automation application, restrict the installed automation application to access only the authorized connected physical devices, wherein the authorized connected physical devices are a subset of and not all of the plurality of connected physical devices in the user'"'"'s automation environment, and the automation application does not have access to any of the connected physical devices that are not authorized.

10. The system of claim 9, wherein the processor is further configured to:

cause a list of the identified connected physical devices to be presented to a user; and

receive a user initiated selection of the authorized connected physical devices.

11. The system of claim 9, wherein the processor is further configured to:

retrieve a physical graph describing one or more hub connected physical devices and one or more hubs in the user'"'"'s automation environment, the hub connected physical devices being configured to communicate with the central server through a hub, the hub connected physical devices being configured to receive commands from and issue data to the central server through the hub.

12. The system of claim 9, wherein the processor is further configured to:

retrieve a physical graph describing one or more direct-cloud connected physical devices in the user'"'"'s automation environment, the direct-cloud connected physical devices being configured to communicate directly with the central server, the direct-cloud connected physical devices being configured to receive commands from and issue data to the central server.

13. The system of claim 9, wherein the processor is further configured to:

retrieve a physical graph describing one or more cloud-to-cloud connected physical devices in the user'"'"'s automation environment, the cloud-to-cloud connected physical devices being configured to communicate with the central server through a third-party private data network, the cloud-to-cloud connected physical devices being configured to receive commands from and issue data to the central server through the third-party private data network.

14. The system of claim 9, wherein the received configuration information further defines a level of access authorized for the authorized connected physical device.

15. The system of claim 9, wherein the processor is further configured to:

received configuration information further defines a level of control authorized for the authorized one or more connected physical devices.

16. The system of claim 9, wherein the received configuration information identifies both one or more required device types and one or more required device capabilities, and the automatic filtering of the physical graph identifies one or more connected physical devices in the user'"'"'s automation environment that are of the required device type(s) and have the required device capabilities.