WHITE PAPER

Designing hyper-aware
smart buildings
Secure infrastructure and partner solutions
for education, enterprise, and government
applications

TABLE OF CONTENTSEXECUTIVE SUMMARYINTRODUCTION

BUSINESS TRANSFORMATION ENABLED

SMART BUILDING MARKET

PHYSICAL DISTANCE MONITORING AND CONTACT TRACINGSPACE UTILIZATION ANALYTICSMIGRATING FROM BREAK/FIX TO PREDICTIVE MAINTENANCE

BUILDING CONTROL AND DIGITAL TWIN ENABLEMENTAUTOMATING GUEST ACCESS TO ENHANCE STAFF EFFICIENCY

4
5
7
8
8
11
12
13
16

SECURELY SHARING SMART BUILDING WIRELESS NETWORKS WITHOUTLOSING CONTROL

17

SEAMLESS 5G TO WI-FI ROAMING WITHOUT DISTRIBUTED ANTENNASYSTEMS

18

REDUCING MEAN TIME TO REPAIR WITH REAL-TIME LOCATION SERVICES

VAPING DETECTION AND AIR QUALITY MONITORING

19
21
2

TABLE OF CONTENTSGUNSHOT DETECTIONCONNECTING AND PROTECTING REMOTE BUILDINGSREDUNDANT INTRA-SITE WIRELSS VIDEO AND DATA LINKS

21
23
27

MONITORING THE SWITCHING FABRIC TO DETECT SECURITYIMPACTING IoT ISSUES

29

CONTEXT-AWARE, REAL-TIME INTEGRATED EMERGENCY RESPONSE AND
NOTIFICATION

29

SECURING CONTROL NETWORKS THAT CAN”T PROTECT THEMSELVESSUMMARY3032

3

WHITE PAPEREXECUTIVE OVERVIEW
At its core, the Internet of Things (IoT) is an amalgamation ofmachines in the physical world, logical representations of thephysical phenomena acted upon by those machines (voltage,
temperature, flow, speed), contextual data generated by
networks connecting the machines (identity, location,
applications in use), and business applications that analyze,
mine, share, and respond to those data. In smart building
applications, the machines and applications are tailoredto optimizing human activity monitoring, organizational

DESIGNING HYPER-AWARE SMART BUILDINGS• Human Productivity Optimization- Automating Guest Access To Enhance Staff Efficiency(Aruba, Envoy)- Securely Sharing Smart Building Wireless Networks
Without Losing Control (Aruba MultiZone)- Seamless 5G To Wi-Fi Roaming Without Distributed
Antenna Systems (AirPass)- Reducing Mean Time To Repair With Real-Time Location
Services (Aruba APs and Meridian)• Building Security

redesign, augmented reality, human productivity, and health- Vaping And Air Quality Monitoring (IP video)

and safety- Gunshot Detection (AmberBox)

By securely interfacing IoT devices, and generating contextual
information, Aruba’s networks enable building control
and business applications to become hyper-aware of theiroperating environments. Aruba’s unified infrastructure, zerotrust security, and AI-powered software - used in conjunction
with solutions from key technology partners - enable facility
owners to successfully deploy and exploit IoT solutions. The
richer the set of available data and context, the greater theopportunities to boost efficiency, productivity, profitability,
reliability, safety, and security.

- Connecting And Protecting Remote Buildings (VIA, RAPs,
SD-Branch)- Redundant Intra-Site Wireless Video And Data Links(Aruba 5/60GHz Access Point)- Monitoring The Switching Fabric To Detect SecurityImpacting IoT Issues (Aruba NAE Python scripting)- Context-Aware, Real-Time Integrated Emergency
Response And Notification (Meridian and Patrocinium)- Securing Control Networks That Can’t Protect
Themselves (Claroty, Microsoft CyberX, Nozomi,
Tenable Indegy)

Solutions from Aruba and its technology partners areapplicable across a broad range of smart building enterprise,
education, and government markets. Use cases and partners
discussed in this white paper include:• Human Activity Monitoring- Physical Distance Monitoring And Contact Tracing(AiRISTA Flow, AisleLabs, CohuHD, CXapp, Kiana,
Patrocinium, SkyFii)• Human Productivity Organizational Redesign- Space Utilization Analytics (Lone Rooftop)• Augmented Reality- Migrating From Break/Fix to Predictive Maintenance(ABB)- Building Control And Digital Twin Enablement (EnOcean
and Microsoft)4

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGSINTRODUCTION

The challenge is that cognitively-aware building applications

What is a smart building, and why is the Internet of Thingsneed edge data to deduct status and infer occupant needs.

(IoT) relevant to it? A smart building is an instrumented

For example, an automated meeting room reservation

structure in which applications are cognizant of thesystem needs identity, presence, calendar, and location data

contextual status of the environment, occupants, energy

to know when attendees are present so a meeting can start,requirements, service needs, security, and safety. IoT is

and to infer when a room can be released due to non-use.

collectively the eyes and ears of a smart building, andPhysical layer and protocol converters can address data

generates logical representations of physical data, i.e.,

exchange, however, trusting building systems enough totemperature, enthalpy, current consumption, and occupancy,

share context and data is highly problematic.

among many others. These data are supplemented withThe ‘Achilles heel’ of smart building IoT is security because

contextual information generated by a smart building’s data
network, i.e., identity, location, and applications in use. The
combination of data and context enables smart buildings to
become cognizant of, and responsive to, the occupants andtheir environment. The richer the set of data and context, themore adaptive the building can become. Some buildings have
only limited cognizance, while others are fully instrumented
and hyper-aware.

IoT devices are fundamentally untrustworthy. The reason is
simple. The engineers who design IoT devices are typicallytrained on process reliability and application-specificarchitectures, and their objective is to make products work
reliably for as long as possible. Cybersecurity expertise sitswith information technology (IT) engineers. Adhering strictly
to a zero trust framework, IoT devices should not be allowed
on a network unless and until trust can be asserted to the

Before the advent of IP networks, building systems operated

same standard as it is with IT devices.

autonomously from each other with independent wiring

Addressing the shortcomings of IoT device security isn’t

plants, devices, and applications for telephone, fire alarm,
security, closed circuit television (CCTV), power management,
lighting, and heating/ventilation/air conditioning/refrigeration(HVACR). The protocols, communication infrastructure, andeven the means of powering each system were tailored to thespecific application: telephony for line-powered handsets; fire
alarms to line-powered sensors and long battery life; security
for high speed, multi-drop sensors; video for analog signalingover coaxial cable; and so on.
Building systems started converging with the advent ofmodern IP networks and the adoption of the Building
Automation and Control (BACnet) communication protocol
as an ISO standard in 2003. Sensors and actuators, however,
have remained stubbornly isolated from IP networks,
relying on specialized, non-interoperable physical layers andprotocols. At the edge, smart building devices are a towerof babel, teeming with systems that operate in parallel but
can communicate only thru KNX, DALI, ZigBee, LONWORKS,
Hochiki SD, Wiegand, and other gateways.
In some cases local regulations have mandated isolation,
fire alarms being a case in point. In other instances,manufacturers have wanted their devices to be isolated
because it locks customers into lucrative service contracts.
Regardless of the reason, many building systems remain
isolated and unable to share edge data.

a trivial task. The diversity of installed legacy devices isvast; many have been in service for decades and predate
the advent of both modern cybersecurity and theInternet. Replacing legacy devices is often technically andeconomically unviable, not to mention highly disruption to
on-going operations. Many new IoT devices also lack soundcybersecurity features. For this reason many CISOs will
not permit either building IoT devices or gateways on their
networks, a testament to the scope of the problem.
The goal should be to create a zero trust defensive
framework in which no device or user is trusted until provenotherwise. The framework should leverage contextual
information from a multitude of sources to scrutinize userand device security posture before and after they connect.
Doing so helps overcome the limitations of fixed security
perimeters tied to physical boundaries, which break downin the face of IoT devices that can connect and work frompractically anywhere.
IoT security should include the layered protective
mechanisms in accordance with a zero trust framework:• Authenticating source/destination devices and monitoring
traffic patterns;• Encrypting data packets using commercial and, whereapplicable, government encryption standards;

5

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

Zero Trust Network Framework
1. Identify sensitive data
2. Flow of sensitive data
3. Zero trust micro-perimeters
4. Continuous monitoring with security analytics
5. Security automation and orchestration
Zero Trust
Network

Zero Trust
Data

Zero Trust
PeopleZero Trust
DevicesZero TrustWorkload

Visibility
andAnalytics

Security
Automation andOrchestration

Figure 1: Zero Trust Framework• Micro-segmenting traffic inside secure tunnels tomachine (M2M) authentication works in newer IoT devices

ensure devices communicate only with their intended

but not in many legacy devices, creating trust gaps between

applications;generations of devices and gateways.

• Fingerprinting IoT devices to determine if they are trusted,
untrusted or unknown, and then applying appropriate
roles and context-based policies that control access andnetwork services;• Inspecting north-south traffic with application firewalls
and malware detection systems to monitor and manage
behavior;• Leveraging enterprise mobility management (EMM),
mobile application management (MAM) and mobile device

The building control market is very conservative, and therate of technological change has been significantly slower
than the consumer product industry. As a consequence,
today’s smart building solutions require expertise outside
the realm of traditional building automation companies.
Unified communications, cloud-based productivity tools,
and augmented reality expertise are needed for activity
monitoring, intelligent spaces, and servicing complex

management (MDM) systems to monitor behavior andprotect other devices in the event of a policy breach; andData• Relying on AI-based analytics to continuously look foranomalous behavior even after trust has been asserted.

Analytics

Legacy IoT devices can be identified as known or unknown
upon connecting to the network using their MAC addressin an external or internal database. The profiling data

ClearPass/NextGen/
Firewall/MDM Policies

should flag if a device changes its mode of operation ormasquerades as another IoT device – a common issue with

Controller Roles

MAC-based authentication - and then automatically modify
the device’s authorization privileges. For example, if a
Windows tablet PC tries to masquerade as a chiller, network

Controller
Secular Tunnel

access should be immediately denied.
Mitigating IoT security risks requires a blended approach

Controller
Encryptionthat includes methods taken from mobile, cloud, automation,and physical security. The sheer breadth of IoT solutions
mandates an array of embedded trust, device identity,
secure credential, and real-time visibility solutions. New
and unfamiliar cybersecurity risks include: IoT solutions

Controller/ClearPass
Authentication

ProtocolConversion

can change the state of a digital environment, in addition to
generating data, and this variability of state requires a newview of cybersecurity; IoT environments include unattended

Physical Layer(PHY) Conversion

endpoints – locally and in remote sites - that can be both
physically probed and logically attacked; and machine-to-

DeviceFigure 2: IIoT Protection Mechanisms
6

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

systems, respectively. Cybersecurity has to underpin all

has been taken literally to mean connecting all devices to thesmart building systems, and is not a core skill for mostInternet. The overarching objective of IoT is not to connect

smart building suppliers, nor are location-based services

every device to the Internet. IoT devices are vessels forwhich have long been the province of IT. And finally there’scontext and data, and the objective is to tap only relevant

analytics, a family of highly specialized tools that help

information and devices.

companies monetize the data they collect and yet anotherprovince of IT.

How does one determine what is or is not relevant
information? Relevance is established by a chain that

Bridging the divide between IT and automation vendors

stretches from the enterprise’s strategic goals, to businessis paramount to the successful implementation of a zero

objectives designed to achieve those goals, to what Gartner3

trust framework. Aruba’s policy enforcement firewall andcalls “business moments” – transient, customer-related

encryption, working in concert with secure tunneling andopportunities that can be dynamically exploited. A business

the ClearPass Policy Manager, can protect IoT systems andmoment is the point of convergence between the owner’s

secure the network edge. However, policies are only as

strategic goals and relevant IoT context and data that

effective as the information used to build them, and thatwhen properly exploited will positively change reliability,

must be based on a deep understanding of automation

performance, and/or safety.

processes and procedures underpinning facility operations.
Applying a collaborative systems approach to the problem
will help identify the IoT threat vectors and the security
technologies needed for remediation.

These business moments must be carefully orchestrated,even if they appear spontaneous to the building occupant orowner. Success hinges on a second chain that stretches fromrelevant IoT context and data thru the IoT architecture that

Transforming untrusted IoT devices into trusted data willaccesses and conveys them to a target business moment. If

allow the strategic business goals of cognitively awarethe chain is poorly executed, say because the IoT architecturebuildings to be realized without incurring unacceptable risk.

can’t extract relevant information, then the business moment

Let’s now examine how to align a company’s strategic goals

may pass without result, or could even trigger negativewith the implementation of cognitively aware buildings.

results to the detriment of the strategic goals.

BUSINESS TRANSFORMATION ENABLED

Strategic Goals

Some years ago the head of the Industrial Engineering
Department of Yale University said, “If I had only one hour tosolve a problem, I would spend up to two-thirds of that hour
attempting to define what the problem is.”1 In the same vein,

Flow of
Strategic
Goals

Business Objectives
Point of Convergence:
Business momentsa woodsman was once asked, “What would you do if you had
just five minutes to chop down a tree?” He answered, “I would

IoT
Architecture

spend the first two and a half minutes sharpening my axe.”2
Regardless of your industry or task, it’s important to beprepared, carefully defining your objectives and selecting the

IoT
Device Context& Datatools needed to achieve them.
Sadly, this lesson is often overlooked when it comes to

Flow of IoTContext andData

Figure 3: IoT Strategic Hierarchy

smart building IoT projects. Whether it’s the allure - ormisunderstanding - of the IoT concept, fear of being left

And so we return full circle to the professor and thebehind by competitors, or pressure to do somethingwoodsman. The first order of business in any smart building

new, companies frequently rush head first into smart

IoT project is to identify the strategic business goals to bebuilding projects without clearly defining objectives, value

achieved. Those should flow down into a series of specificpropositions, or the suitability of tools. The result is a highobjectives that rely on successfully delivered businessrate of failure, and disillusionment among customers.

moments. The IoT architecture is the tool by which relevant

Originally intended to describe an ecosystem ofinterconnected machines, the phrase “Internet of Things”

IoT context and data can be extracted and exploited toreorient behavior, attitudes, and actions in favor of thestrategic goals.
7

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGSBusiness goals and objectives inform the smart building

roughly $3 per square foot (0.092 per square meter) per

IoT architecture and relevant devices to tap, not the otheryear for utilities, $30 for rent, and $300 per for payroll.

way around. IoT solutions selected for eye candy appeal orThis “3-30-300” rule of thumb makes clear that the biggest

hype alone will go wanting. Aruba’s goal is to help customers

financial benefits can be obtained by making people more

identify relevant IoT data and context, define and successfully

productive and efficient. Pivoting toward human productivity

deliver business moments, and, in turn, attain their business

optimization also improves space efficiency, which in turnobjectives and strategic goals.

reduces both real estate footprint and energy costs.

Where does one start this process? The first order ofHistorically smart building initiatives focused on energy

business in any smart building project is to identify theefficiency because this was – and remains – ones of thecustomer’s strategic goals and the associated businessspecialties of building automation vendors. Prioritizing

objectives that must be met. Those will inform the businesshuman productivity requires a second pivot towards vendors

moments for which the IoT architecture needs to extract

and applications that specialize in creating cognitively aware

relevant IoT data and context. Is the objective to reduce real

digital workplaces. IoT can change the way in which machines

estate footprint by more efficiently using space and managing

and humans interact to make people more productive. Donepeople? Enhance personal safety with social distancing andwell, frictionless machine-human interchanges belie thethermographic monitoring? Enhance building security andcomplexity of the computing, security, and communications

surveillance? Lower energy consumption? The answer(s) will

systems needed to accomplish the task. This challenges us

impact the business moments that need to be delivered, andto find new ways to simplify human interaction with complex

what constitutes relevant data and context.

machine-based systems, and new ways to train integrators toBusiness moments inform the IoT architecture, not the otherinstall and support these systems.

way around. One-size-fits-all smart building solutions are

The breadth of smart building initiatives mandates close

doomed to fail because they won’t be tailored to deliverattention to what a customer is trying to achieve. For

meaningful business moments.

example, is a point solution required to address a specificThis document presents IoT use cases that are relevant to abroad range of smart building applications. Most of the use
cases include at least one Aruba technology partner whose

problem, i.e., identifying the location of an active shooter? Or
is an optimized system-level solution required, i.e., migratingfrom break/fix to site-wide predictive maintenance?

solution, used in concert with Aruba infrastructure, helps

In all cases an extensible platform will be required because

address strategic business challenges.

smart building requirements change over time; a platform
allows customers to build a broad range of services today

SMART BUILDING MARKET

and into the future. That platform is necessary but is by

According to McKinsey4 the total economic impact of IoT in

itself insufficient to build a solution since no one vendor

smart buildings in 2025 will be $70B-$140B. The top areas

makes a universal set of end customer solutions. Technology

they identified include human productivity monitoring

partners are an essential component of any use case. Aruba($48B-$115B), energy monitoring ($12B-$21B), and building

has curated a world-class cohort of infrastructure, security,

security ($3B-$6B):

and location technology partners, the solutions of which• Human activity monitoring is expected to increase
productivity by 5%;• Human productivity organizational redesign is expected toyield 3-4% productivity gains;• Augmented reality is expected to yield 10% productivity
gains;• Energy monitoring should reduce costs by 20%; and• Building security should yield a 20-50% reduction in laborcosts.
Commercial real estate services company Jones Lang
LaSalle observed that, in general real, estate tenants spend

have been validated interoperable with Aruba infrastructure.
Common use cases that leverage solutions from Aruba andits technology partners to create cognizant smart buildings
are presented below.

PHYSICAL DISTANCE MONITORING AND CONTACTTRACING
Workplace safety extends beyond physical andenvironmental hazards. Today, physical distance monitoring
and contact tracing are essential for back-to-work andstay-healthy-at-work initiatives. Whether mandated by local
regulations or company policies, maintaining safe distances8

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

from other workers and infection control tracing are top ofmind for facilities teams. While there is no single physicaldistance monitoring and contact tracing application thatwill work for all enterprises, real-time location services

Aislelabs provides a real-time footfall and occupancy

and identity stores have an essential role to play in every

monitoring to promote social distancing in large sites without

workplace infection control solution.

the need to download an app or obtain opt-in approval. The

Aruba has teamed with multiple technology partners todeliver a broad range of health monitoring solutions. The
solutions fall into four categories:• Physical distancing enforced by wearable tags or

solution uses personally-owned, Wi-Fi enabled smart phones
or tablets, together with existing Aruba Wi-Fi infrastructure,
to anonymously log the movement of people and area
occupancy in an auditable database. Violation alerting is
triggered based on programmable thresholds.

wristbands for situations in which a personally-owned
device is not suitable;• Application-based physical distancing solutions that run
on personally-owned or company issued devices;• Presence detection systems that pick-up Wi-Fi signals
from personally-owned or company issued devices, but
do not require an application; and• Thermographic and facial recognition systems thatmonitor the temperature of individuals’ heads, and canprocess dozens of people simultaneously.

Fig 5: AisleLabs COVID-19 Social Distancing Solution

The AiRISTA Flow Social Distancing and Contact Tracing
Solution uses a wireless tag worn by employees to help
enforce guidelines for social distancing and automate
contact tracing. The tags communicate with each other

CohuHD’s Thermographic System is an intelligent thermal

autonomously, without supervisory control, and trigger when

imaging, radiometric detection, optical imaging, andthey are closer than 2 meters apart. The user is signaled

facial recognition solution. The system automatically andhaptically and the devices forward the incident via Aruba

simultaneously identifies the faces of more than thirty people

access points to the AiRISTA Flow cloud-based software

within one second, reads forehead temperatures, and alerts

system.

when a reading is above normal. All measurements arerecorded together with location for trend analysis. If a hightemperature reading is detected the system can respondautomatically using voice synthesis, triggered relay outputs,
and access control interfaces. The camera uses a US
Department of Commerce compliant SoC.

Fig 4: AiRISTA Flow BLE Proximity Tags With Haptic Feedback

9WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

Figure 6: CohuHD Non-Contact Thermographic And Facial Recognition Camera

The CxApp Touchless Application leverages Meridian BLE
Beacons strategically placed around the workplace, and the
Meridian cloud service for location data. The mobile app
sends notifications based on crowded times, vacant times,

The Patrocinium Safe Return Application leverages Meridian

and total employees per square foot, all based on real-time

BLE Beacons, the Meridian cloud service for location

occupancy within the environment.

data, and Patrocinium’s ArcInsight analytics package. The
application runs on personally-owned or corporate-issued
smartphones and tablets, and automatically detects whenother personnel are too close. The location and identity of
the individuals are sent to the analytics application via Aruba
Wi-Fi for contact tracing.

Kiana Analytics’ Rapid Containment Application uses realtime location data, collected by existing Aruba access points
from Wi-Fi enabled mobile phones and tablets, to identify thepresence and movement of people. The application analyzes
social transmission vectors, including locations and contact
trees, to help mitigate spreading of communicable diseases.

OccupancyNow is an automated occupancy and social
distancing management toolkit from SkyFii. The cloudbased solution uses real-time location data from existing
Aruba infrastructure to maintain safe occupancy andsocial distancing guidelines, automatically alert staff whenoccupancy counts reach a set threshold, and facilitatecontact tracing via with Skyfii’s analytics and communication
tools. OccupancyNow also helps track whether routine
cleaning and sanitization procedures are being performed.

10

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

Figure 7: SkyFii OccupancyNow Dashboard

SPACE UTILIZATION ANALYTICS(PIE) is a cloud-based technology platform that uses ALE to

We commonly think of Wi-Fi networks as access ramps onto

automate occupancy data collection traditionally undertaken

corporate networks and the Internet, but Aruba accessmanually by staff members equipped with clipboards andpoints are also IoT platforms that generate contextual

spreadsheets.

information business-critical services and applications.

Understanding the utilization, frequency, recency, and other

Location data identifying the position of people and assets
are especially valued because they can be applied in so many
ways including space utilization, facility operations, processoptimization, safety, and energy management. Successful
exploitation of location starts with simplifying the collection
and dissemination of location data, and then extracting deep
insights by leveraging a powerful analytics engine.

parameters impacting how space is used can better inform
space requirements and spending decisions. Oversubscribedspaces can be identified and expanded, while underutilized
floors or even entire buildings can be decommissioned
or subleased. Real-time reporting and alerts broaden thenumber of use cases. For example, adjusting cleaningschedules based on actual space usage and real-time

Aruba’s Analytics & Location Engine (ALE) software simplifies

cleaning demand lowers costs and directs resources only

location data collection by calculating the x/y position of allto spaces that need them. Similarly, predicting corporate

associated and unassociated Wi-Fi enabled smartphones,

cafeteria usage based on building occupancy can minimize

laptops, tablets, and IoT devices within range of Aruba accessfood wastage.

points. These data are then aggregated and streamed toReal-time analytics can also boost productivity. Statistics

analytics applications over a secure link. Aruba has built astable of analytics partners that consume ALE data to deliver
location-enriched business insights.

show that 40% of flex space workers routinely waste working
time looking for available hoteling desks. PIE-enabledmobile apps and kiosks can instantly identify which spaces
are available so workers don’t have to hunt on their own.
PIE’s Building Intelligence Dashboard draws from real-time
location data, and allows cross-comparisons between sites.
PIE data are centrally stored and managed, and can be easily

Lone Rooftop is an ArubaEdge technology partner thatleverages ALE data to show facility and real estate managers
in real-time how many people are in the building, and where
and when they’re present. Their Position Intelligence Engine

shared with new applications that require location data.
The joint solution uses Aruba 802.11ac and 802.11ax accesspoints, ALE, and AirWave Management Platform alreadydeployed on site. No access points need to be ripped-and11

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

Access points
Aruba
Wireless
LAN Controller

Aruba
ALE

Aruba
AirWave
Lone Rooftop
PIE Prepare

Existing infrastructure

New infrastructure

Hosted by organization

PIE CloudHosted by Amazon Ireland

Figure 8: Aruba and Lone Rooftop Integration Overview

replaced, no occupancy sensors or people counters areequipment running non-stop. Addressing maintenancerequired. All that’s needed is an instance of ALE 2.0 or higher.

proactively to minimize downtime, and maximize the

PIE anonymizes personally identifiable data: the systemcounts the number of people in spaces but cannot identify

utilization and performance of assets, can reduce
maintenance costs by up to 40%.

who they are. The cloud-based solutions can be quickly

Predictive maintenance is an essential tool in this quest.

brought online and produce meaningful insights in just a

By instrumenting equipment, monitoring for degradation,

matter of weeks.

and identifying potential problems in advance of failure,

Combining an Aruba mobility network with Lone Rooftop
space analytics delivers some very unique value propositions:• Space analytics can be easily retrofit to existing Aruba
deployments;• Implementation does not require occupancy, footfall, orvideo sensors;• Adds/moves/changes to the building layout are easily
accommodated without rewiring; and• Anonymized data overcome the privacy and union labor
restrictions of video-based analytics.

predictive maintenance can provide visibility into theperformance of assets, ensure high availability, and maximize
the returns on often substantial capital investments.
The challenge is that identifying the source of possible
failures is not always a simple task. Sensor networks andgateways have traditionally been expensive to deploy, andcan have vulnerable attack surfaces that keep CISOs awakeat night. COOs, in turn, fret whether innovative AI predictive
maintenance solutions require resources beyond the meansof facilities teams.

Space analytics are an essential element of a contextually

Spending on predictive maintenance is expected to hit $12.9

aware building, allowing owners and tenants to assessbillion in the next two years. Juggling the high cost asset

real estate footprints and predict future needs based on

performance management solutions, and its security risks,

actual usage. Aruba’s secure mobility platform is the ideal

against the benefits of lower downtime and fewer disruptions

foundation on which to build space analytics for facilities ofis a challenging calculus.

virtually any size.

An optimal solution is to leverage secure, robust ITMIGRATING FROM BREAK/FIX TO PREDICTIVE
MAINTENANCE
Up-time and defect-free processes are prime objectives ofinfrastructure that is already deployed in a building tocapture machine status from IoT sensors. A dual-use IT/IoT
network is more economical to deploy and can eliminate
gateways and the security threat they pose.

operations groups, whose charge is to keep buildings and
12

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGSThe Aruba-ABB solution works with brownfield andgreenfield deployments of any Aruba 802.11ac and 802.11ax
access points equipped with a BLE radio and AOS 8.6 or later.
ABB is a technology leader in industrial digital transformation

This means that predictive maintenance monitoring can beof electrification, automation, motion, and robotics. Thru its

retrofitted to existing Aruba WLAN deployments without

ABB Ability™ digital platform, ABB drives improvements in

adding additional IT gear or gateways.

productivity, reliability, and efficiency.

The joint ABB-Aruba solution delivers the operational

The ABB Ability Smart Sensor is a battery-powered, multi-

visibility and robustness demanded by COOs, without thesensor device that monitors rotating machinery like motor

expense of a dedicated wired sensor system. Wirelessdrives, chillers and pumps for abnormal behavior indicative

communication allows Ability Smart Sensor to be deployedof pending failure. Status is communicated over a secure

anywhere without expensive conduit or enclosures. These

Bluetooth link, and analyzed by ABB’s advanced algorithms.

savings extend throughout the life cycle of a deployment

Facilities engineers are automatically notified of out-of-since adds, moves, and changes are easy and inexpensive.

normal conditions well before failure, allowing repairs to be

The intersection between facilities and IT has historically

performed before processes are impacted.

been a point of friction, but not so with the ABB-Aruba joint

The Smart Sensor helps customers move from break/fix

solution. Both companies are respected leaders in IoT andto predictive maintenance, a digital transformation that

IT, respectively, and the joint integration allows data to flow

reduces downtime, enhances asset utilization, and optimizes

reliably and securely between systems. Visibility and robustscheduling of field engineers. All of which ultimately boost

design address the uptime concerns of COOs, while I/O-to-efficiency and profitability.

application security and policy management check the box

ABB and Aruba have partnered to enable Aruba Wi-Fi 5 and
Wi-Fi 6 multi-radio access points to securely collect andforward ABB Ability™ Smart Sensor data to the ABB Ability™
Condition Monitoring application. Using Aruba zero trust
infrastructure as a data collection platform provides uniform
security and visibility across both IT and IoT domains. It
eliminates the costs and security risks and costs associatedwith large fleets of gateways. Since gateways filter raw data
streams that can be rich in visibility data, removing them has
the added benefit of improving visibility all the way down toindividual sensors.

End User
Equipment

for CISOs. And the cost savings will cheer CFOs.

BUILDING CONTROL AND DIGITAL TWINENABLEMENT
Situational awareness is essential to building a cognitively
aware building. IoT devices are the eyes and ears of asoftware defined building, and are given voice by the secureconnectivity infrastructure through which they talk withsmart building applications. The better instrumented thebuilding, the more informed the insights that can be madeacross time and space, including projections of futureoccupant and system behavior. Energy monitoring cuts

ABB SmartSensorAruba
Access Point

Aruba
WLAN Network Controller

ABB
Cloud

KPI Data

Aruba APIGW Workﬂows

Cloud Interface

ABB Smart Sensors measure andpre-process several parameters like
temperature, vibration, magnetic
ﬁeld and others

Customized for Smart
Sensor Communication

Load Measurements,
Update Firmware
Support for Aruba API andCommunication on Stack

Advanced Data Analytics
Fault Prediction

Figure 9: Aruba and ABB Integration Overview
13WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

across many building sub-systems, encompassing a wide

As buildings deploy next-generation Wi-Fi 6 wirelessvariety of IoT telemetry including power quality, power

networks for human activity monitoring, that same secure IT

consumption, leak detection, air and fluid flow, enthalpy,

infrastructure can be leveraged for building monitoring andrefrigeration, lighting, temperature, and humidity.

digital twin applications. Advanced access points that have

Digital twin modeling combines IoT monitoring data withbuilt-in IoT radios, and support for external USB adapters,

artificial intelligence, historical data, domain knowledge

can serve as IoT data gathering platforms.

expertise, and graph modeling to establish and analyze

The remaining hurdle is to eliminate batteries wherever

relationships between and among building devices andpossible. Energy harvesting technology derives, captures,

systems. By creating real-time simulation models in theand stores power from external sources, e.g., kinetic anddigital world that change and learn in lock-step with thevisible light. Miniaturized energy harvesting power sources,building, digital twins can identify sub-optimized processes,

embedded inside IoT sensors, can solve this problem andrecommend operational enhancements, assess complex

allow building sensors to be placed wherever needed with nosystems that would be too difficult for a human to track, andwires or maintenance.

monitor the trajectory of energy usage needed for proactive
interventions.
The benefits of building monitoring and digital twin modelinghinge on the availability of timely access to relevant IoT
data. Securely and economically interfacing IoT monitoring
devices across a building can be challenging. The breadth oftelemetry to be gathered, interfacing with legacy IoT devices
that use non-interoperable protocols, securing the data path,and importantly the cost of deployment – initially and during

EnOcean, a venture-funded spin-off of Siemens AG, is thecreator of the ISO/IEC 14543-3-10/11 energy harvesting
800/900MHz wireless standard. More than 400 EnOcean

adds/moves/changes – can be daunting and expensive.

Alliance vendors build facility monitoring and control systems

Wired monitoring systems require dedicated cabling, which isand no wires to communicate, making them economical toexpensive to deploy and labor intensive to maintain. WirelessIoT devices are more economical to deploy but the cost ofusing this standard. Sensors require no batteries for power,
deploy and maintenance-free.

battery maintenance can be prohibitive.

TEMPERATURE

LEAK DETECTORSHUMIDITY

LIGHT LEVEL

RS-232 SERIALENTHALPYMODBUSPOSITIONDEEP
PACKET
INSPECTION

SECURE
TUNNEL

Aruba Security
Infrastructure

TO APPS
Controller
Switches

DYNAMICALLY SEGMENTED & SECURELY TUNNELED

Figure 10: Aruba Access Points Are IoT Platforms For EnOcean Device Data
14

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

RS-232, RS-485, ModBus, LONWORKS, BACnet, KNX, and
DALI control systems and devices are supported via locallypowered, EnOcean-enabled gateways. These gateways
extend the reach of monitoring and digital twin applications
into legacy infrastructure, yielding deeper visibility andinsights without incurring the cost of ripping-and-replacing
installed devices.

The wide range of available ISO/IEC 14543-3-10/11 compatible
devices, combined with the security and extensibility of
Aruba infrastructure, delivers an extraordinarily flexible
and economical way to monitor energy and other building
functions. The solution can be extended into satellite
buildings and branches should remote monitoring andcontrol be needed.

EnOcean and Aruba have partnered to allow Aruba WiFi 5 and Wi-Fi 6 access points equipped with EnOcean
800/900MHz USB adapters, and using Aruba OS version
8.7 or later, to communicate bi-directionally with ISO/IEC
14543-3-10/11 compatible devices. With literally thousandsof such devices and gateways from which to choose,
virtually any smart building monitoring application can be

Customers that want digital twin modeling and telemetry

accommodated. The joint solution can be retrofitted tomonitoring can simply point Aruba’s Web socket connection

existing Aruba deployments, extending the value of sunkto Microsoft’s Azure IoT Hub – on-premise or in the Azure

capital investments.

cloud. Azure IoT Hub will extract the telemetry data from the

Aruba access points stream EnOcean telemetry data in realtime via protobuf to monitoring applications over a secure

protobuf stream, and make it available to the Azure Digital
Twins IoT service.

Web socket connection. Applications can be on-premise, or

The Azure Digital Twins service creates spatial intelligencein a public or private cloud. The EnOcean Alliance includes

graphs to model relationships and interactions. Thru thesoftware application vendors as well as device vendors, andservice users can build reusable, highly scalable, spatially-

ensures interoperability between both.

aware digital models based on their physical plants, and use
them to identify optimize processes and remedy issues.

Figure 11: EnOcean Ecosystem

15

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGSAUTOMATING GUEST ACCESS TO ENHANCE STAFF
EFFICIENCY

Aruba and its technology partners have a proven solution by

Enhancing human productivity necessitates making devices

the building Wi-Fi network, guided to their hoteling space orand the environments in which they work more cognizant

destination using wayfinding, and enable personally-ownedof, and automatically adaptive to, the needs of employees,

devices to securely connect to projection screens and otherguests, service personnel, and contractors. On-boarding

network resources in designated areas.

guests on to building networks has historically been

Key components include Aruba Wi-Fi 6 Access Points,

challenging because of network security concerns. In somecases, access is simply refused, forcing visitors to use
cellular networks that by-pass plant IT security and can’ttake advantage of on-site applications and servers. The
trick is to both simplify guest access so it doesn’t create anadministrative burden, and implement security policies thattightly control what guests can do and access while on the
network.

which visitors can be automatically badged and enrolled on

ClearPass Guest Access, ClearPass Policy Manager, Envoy’s
visitor management solution, WPA3 Enhanced Open, andan Access Code captive portal. Performance of the offeredservices are monitored using the Aruba User Experience
Insight (UXI) solution to ensure that service level agreements
are satisfied and application performance meets guidelines.
A comprehensive validate reference design guide for guest
access is available on request.

Access Points
Guest Devices

Skybook

INTERNET

Firewall

Registration
Display(UX) Sensor
Mobility
Controller
Conference Room
AirGroup Devices
Figure 12: Automated Guest Access Solution To Enhance Staff Efficiency

16

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

Aruba 500 Series Wi-Fi 6 Access Points are recommended

and safety increase pressure to open up wireless networks

because of their Wi-Fi performance and integrated IoT

and avoid the cost and RF interference of parallel networks.

radios for smart building sensing and control. ArubaOS 8.4

Both IT and facilities groups are struggling to find a mutuallyor newer code running on a Mobility Conductor/Mobility

acceptable solution.

Controller, Aruba Instant, and/or Central are supported. A
comprehensive validated reference design is available forcontroller-based deployments.

Several years ago the US Department of Defense (DOD)
encountered a very similar situation. There was pressure
to use one common network to support secret (SIPR) and

ClearPass 6.7.2 or newer is required. ClearPass runs on

non-secret (NIPR) traffic. These distinct traffic flows were

hardware appliances with pre-installed software or as amanaged by different groups, each of which needed total

Virtual Machine under VMware (ESXi 5.5, 6.0, 6.5 or higher),control over who access to the traffic they manages. Security

Microsoft Hyper-V Server (2012 R2 or 2016 R2), Hyper-V on

was paramount, and there could be no sharing of data across

Microsoft Windows Server (2012 R2 or 2016 R2), and KVM

groups or unauthorized network access within a group.

(CentOS 7.5).

Aruba solved the issue by developing MultiZone, a
networking solution that allows each of up to five groups todefine authentication, access, operation, and management
rules applicable to, and enforced within, their unique“Zone.” One Aruba controller is assigned to the PrimaryZone, managed by IT, which handles access points and RF

Envoy Visitors is a guest management platform for a modern

settings, and directs access points to authenticate to Data

front desk that helps streamline guest sign-in. When guests

Zone controllers. Separate Data Zone controllers handle

arrive, Envoy makes it easy for them to register, presents

authentication, access, operation, and management rules forrelevant non-disclosure and health/safety forms for

the SIPR and NIPR groups. MultiZone supports up to five Data

completion, and notifies hosts of the guest’s arrival via e-mailZones.

or SMS. Simultaneously, ClearPass dynamically provisions
temporary Wi-Fi access credentials for their devices sends
an individualized security code for Wi-Fi access via e-mailor SMS.

The multi-tenancy design of MultiZone is ideal for smart
building applications. Separate Data Zones can be allocatedto the groups managing, say, building controls, machine-asa-service, corporate services, contractors, and auditors, Each

Envoy leverages ClearPass’ microservice extensions

group separately controls who and what is allowed accessrunning in a container independent of the ClearPass

into their Data Zone, including Internet and VPN connectivity

operating system. ClearPass extensions are used to interact

to remote services. Defense-related enterprises can use

with external systems, including advanced two-factor

MultiZone in conjunction Aruba’s commercial solutions forauthentication services and IIoT firewalls.

classified applications, including elliptic curve encryption and

The joint Aruba/Envoy solution automates the entire

other FIPS 140-2 and Common Criteria related services.

onboarding process, minimizing the need for manual

In a MultiZone system IT manages the overall infrastructureassistance, and ensuring that security standards arethrough the Primary Zone but cannot access Data Zone

enforced throughout the visit. Never again will guests, service

traffic. Uniform visibility and security can be achieved while

personnel, and contractors need to circumvent IT security

simultaneously respecting the access control rights of Data

just to obtain reliable connectivity.

Zone owners.

SECURELY SHARING SMART BUILDING WIRELESSNETWORKS WITHOUT LOSING CONTROL
Smart building wireless network access is typically tightly
controlled out of concern that critical services and devices,such as Wi-Fi calling, could be negatively impacted bywireless users. However, growing demands for mobile device
wireless access to enhance worker efficiency, productivity
17

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGSEmailManagement

Database
Voice/Video

CA/Authentication

SSID: CSfC
WPA2 Enterprise
Outer Tunnel

SIPR Network
Services

File Servers

Client VPN: VPN
Inner Tunnel

Black Network(Unclass)

Gray Network

SSID: NIPR
WPA2 Enterprise

EmailManagement

Database
Voice/Video

CA/Authentication

NIPR Network
Services

File Servers

Figure 13: Aruba Multizone Solution

SEAMLESS 5G TO WI-FI 6 ROAMING WITHOUT
DISTRIBUTED ANTENNA SYSTEMSFor decades, indoor cellular issues have been addressed by

If you can’t connect with people and machines inside

infrastructure operates as extended antennas for one

a building, then you can’t extract or share information.

or more cellular carriers. More recently, indoor small cell

The prevalence of low-emission glass, energy-efficient(also called “femtocell”) networks have been deployed byconstruction materials, and evolving building codes haveindividual mobile network operators (MNOs). Unlike DAS, amade indoor wireless coverage from outdoor cellular

separate layer of equipment is required for each MNO. Bothnetworks a recurring challenge. This results in inconsistent

DAS and small cells are complex, very costly, and are rarely

experiences for mobile users and devices as they roam incost effective for facilities with less than 200,000 ft2 (20,000

and out of buildings. These problems are compounded withm2) - the bulk of commercial properties worldwide.

deploying distributed antenna systems (DAS). This expensive

high-speed 5G, which operates at higher frequencies that do
not penetrate indoors as far as 3G or 4G cellular.

ROAMINGEXCHANGE

Guest VLAN

Data
Path

Authentication
Path

Enterprise SSID
(802.1X – Corp)

Open SSID

Passpoint SSID
(802.1X)

Figure 14: Aruba AirPass System Architecture
18

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGSOver 150 MNOs in nearly 50 countries have embraced Wi-Fi

Wi-Fi networks, and the inconvenience of navigating captive

Calling. This service leverages the existing Wi-Fi network,

portals. Secure connectivity is assured regardless of where

which when properly designed provides pervasive coveragepeople and IoT devices work or roam,throughout a building. 5G includes support for Wi-Fi 6
owners do not need to choose between 5G and Wi-Fi 6: Wi-

REDUCING MEAN TIME TO REPAIR WITH REAL-TIME
LOCATION SERVICESFi Calling and other services can be performed over both.

Many building subsystems today have siloed repositories of

For this reason, wireless LANs are the premier and mostIoT device data. Even though these data are rich with insights

economical onramps for indoor cellular devices.

if properly mined, the justification for isolation is that these

Aruba Air Pass is the industry’s first seamless cellular

data are needed for facilities-owned processes which, if

integration as a radio access network (RAN), so building

roaming solution designed to unify enterprise and mobile

exposed, could be attacked or impacted by IT actions such as

network experiences. The service enables smart building 5G

system updates, reboots, or maintenance.

initiatives - including visitor and IoT device on-boarding and

The downside of isolating data is that it deprives applications

roaming - to be accomplished with enterprise-class securityof valuable insights that could make a building more

over Wi-Fi 6 without the high cost of a DAS or issues withcognizant if mined in conjunction with other data sets, i.e.,inconsistent cellular connectivity.

location data and predictive maintenance. Sharing contextual

Air Pass uses pre-negotiated agreements with MNOs

data – location, users, devices, and applications that originatethat support the Wi-Fi CERTIFIED Passpoint standard
to automatically gain network access using cellular SIM
credentials for authentication. No captive portals, usernames, or passwords are required. Aruba ClearPass provide
high security network access control so that public andprivate resources remain secure and separate. Mobile
subscribers, and Passpoint-capable IoT devices, can thenfrom IoT devices and the personnel who use and manage
them – can significantly enhance cognitive insights. With
proper data life cycle governance these sources can besafely and securely shared, and reveal trends in real estateutilization, occupant time and motion optimization, excessive
energy consumption relative to peer buildings, and so on.

roam between the cellular and Wi-Fi networks in complianceApplicationRole of Location-Based Services

with IT security standards.

Human productivity
optimization

Guide occupants to meetings andplaces of interest

Air Pass is managed by Aruba Central, a massively scalable

Improve time and motion paths

cloud-based network operations, assurance, and security
platform. Aruba Central simplifies the deployment,
management, and orchestration of wireless, wired, and SDWAN environments. This includes delivering 5G and Wi-Fi 6 to
the network and customer edge, complete with built-in andthird-party services.
Mobile users and IoT devices are increasingly accessing cloudservices and other bandwidth-intensive applications likeaugmented and virtual reality. Air Pass leverages Air Slice for
SLA-grade application assurance by dynamically allocating
radio resources such as time, frequency, and spatial streams
to specified users, devices, and applications.

Validate contractor activity
Predictive maintenanceWayfinding to guide service personnel

Inventory optimization

Quickly find displays and high value
equipment

Health and safety

Guide occupants to muster points
Social distance monitoring

Figure 15: Location-based services by application

From among the many types of available contextual data,
location data are particularly insightful. Location data
can guide us unescorted through facilities, improving our
experience without encumbering others to assist us. They
can help us keep track of people wherever they work or

Reliably connecting people and IoT devices inside a building isroam. And they can track capital assets so they can beessential for context-aware engagement, safety, and security.

quickly located and repaired.

Air Pass marks an end to a dependence on expensive
DAS systems. It also overcomes connectivity, security, andconvenience issues associated with indoor cellular coverage
gaps, insecure open wireless networks, manually hunting for

19

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

Where
are they?

Hazardous
Location
Notification

Personal
Tracking

Where
Am I?

WayfndingWhere
is it?

Time&
MotionAsset
Tracking

Figure 16: Aruba Location Services and Target Applications

Large buildings and campuses can be difficult to navigate.
If someone is delayed or lost traversing the facility theconsequences can range in severity from lost revenue ortime to loss of life. Engineers, contractors, and public safety
officers can all benefit when a self-navigation solution –“wayfinding” – delivers them to their destinations quickly andFig 18: AP-375EX Access Point For Hazardous
Areas Like Propane Storage And Fuel Refilling

Typical smart building wayfinding applications include:• Guiding employees to meetings, points of interest, andmuster stations;• Navigating service personnel to machines in need to
repair; and• Providing visitors with self-service navigation around large
facilities.

unassisted.
Additionally, the contextual data generated along the way
can be mined for business-relevant information. Examples
include notification of hazardous areas that require safety
gear, flagging occupied areas in the event of a security
incident, and tracking contractor time spent on site relative
to what was billed.
Aruba’s Meridian platform is a mobile application platformthat provides self-guided wayfinding, geofencing, and pushmessaging services for a broad range of IoT applications. The
system consists of the following components:• Location Beacons - standalone or integrated into Aruba
access points;

Self-guided wayfinding directs users to a point of interest,and offers a simple way to pinpoint their current location,
search for points of interest, and access turn-by-turn
directions, inside or outside. A glowing dot shows the user’s
location on a map, and tracks their progress along the route.
Users can retrieve turn-by-turn directions from their current
location without entering a starting point, an important timesaver in emergencies that require mustering to safe areas.
Wayfinding also enables contractors to navigate sites without
assistance, conserving operational and administrative
resources from acting as guides. Upon nearing a target
destination, a logical geofence can be triggered and pusha contextually-relevant message or notify a relevant• Meridian Application (App) for tablets and phones; andapplication, i.e., retrieve machine service records. The• Meridian cloud service.

power of Meridian comes from the context it applies to

Beacons use Bluetooth Low Energy (BLE) to broadcast anuser engagement, the precision of its geofencing, and theanchor location that is picked up by the Meridian App andflexibility with which it can interact with other systems.

shared with the cloud service to assist with locationing.
Beacons are built into Aruba Wi-Fi 5 and Wi-Fi 6 accesspoints, including Class 1 Division 2/ATEX Zone 2 models
qualified for HazLoc environments. Standalone battery- andUSB-powered beacons are also available.

Reducing mean time to repair (MTTR) is a prime exampleof the value Meridian brings to smart building facilities
applications. Imagine that the bearing on a motor drive
starts to wear unevenly, and is picked up by multi-axis
accelerometer in an ABB Ability Smart Sensor. The sensor
relays an alert via an Aruba access point to the ABB Ability
monitoring application, which dispatches an engineer
preemptively before the bearing fails.
Instead of leaving it to the engineer to navigate the buildingon his or her own, however, the Meridian App triggers a

Fig 17: AP-530 Wi-Fi 6 Access Point
With 802.11ax, BLE, And 802.15.4 Radios

geofence when the engineer enters the building – notifying
the Finance Department when work commences - and thenguides the engineer using turn-by-turn navigation to thefailing motor drive.
20

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

and triggered an alarm. The problem is that many products
contain ammonia, including body sprays, resulting in a highfalse alarm rate.
An alternate solution is to use two different sensors to detectammonia and other chemicals present in e-cigarette vapors.
Dual-trigger sensors have a much lower false alarm rate, andraise confidence that a vaping alert is valid.

Fig 19: Meridian Turn-By-Turn Wayfinding

As the engineer approaches the machine another geofence istriggered, recalling the service record for that drive and again
notifying Finance that repair work has commenced. Once therepair has been effected the engineer is guided to back to

IP Video is a New York-based developer of smart building
physical security sensors. Their HALO IIoT Smart Sensor
is a multi-function security and environmental monitoring
devices that hosts chemical sensors, audio detection, and avoice synthesizer.

his/her truck and a third geofence notifies Finance that thework has been completed.
In large sites, wayfinding can reduce the mean time to repair
by tens of minutes per incident, making engineers more
efficient and reducing the risk of equipment failing while
awaiting the arrival of service personnel. Equally important,Figure 20: HALO Smart Sensor Powered
by Aruba Switches and Pass-Thru PoE Access Points

the same location services can reconcile service charges

IP Video and Aruba have collaborated to enable plants toand labor allocations, a complex tasks at sites with many

combat vaping through automated sensing and response.

contractors and/or service engineers.

Powered by Aruba PoE pass-thru access points and PoE
switches, HALO detects vaping and THC using dual-triggers

VAPING DETECTION AND AIR QUALITY
MONITORING

to reduce false alarms. HALO incorporates multiple sensors

In 2016 the U.S. Food and Drug Administration (FDA)

can detect particulates, carbon dioxide, carbon monoxide,

mandated that electronic cigarettes (e-cigarette) products

volatile organic compounds (VOCs), oxidizing agents, andbe regulated as tobacco products, and subsequently banned

ethanol. These features make HALO well suited to air quality

the sale of these products to minors. That same year amonitoring applications. Audio monitoring enables HALO to

World Health Organization (WHO) report recommended

detect gunshots and cries for help, while a voice synthesizer

that e-cigarettes be banned in indoor areas and whereverlets HALO respond to occupants with context-appropriate

smoking is prohibited. Since then governments worldwide

messages, i.e., in response to a verbal request for “help”

have enacted laws that prohibit e-cigarette usage (vaping)

HALO can respond that “help is on the way.” Voice detection

everywhere that smoking is banned. In particular, schools

and response are processed locally, not in the cloud, toworldwide have been revising rules to ban vaping on school

ensure that privacy is maintained.

grounds. The hospitality and transportation industries, in

The joint solution is ideal for enforcing no-vaping rules, andparticular, have forbidden vaping in hotel rooms, airplanes,
and trains.

so it can serve additional roles, too. On-board sensors

monitoring for other signs of danger.

The challenge has been how best to enforce no-vaping rules

GUNSHOT DETECTION

since the vapors can be difficult to detect. E-cigarette vapor

One of the most dangerous situations faced by firstcontains ammonia, and the first vaping detection sensors

responders is a live shooter inside a plant. Without knowing

simply detected when a preset level of ammonia was present

the location of, and weapons used by, the shooter, first21

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

responders imperil themselves when they come on thesensors interface with the access points’ USB ports, which

scene. Situational awareness can save lives and speed

provide both power and data access. Sensor spacing

apprehension of the perpetrator.

matches access point spacing required for voice applications.

Emerging technologies for public safety sit at the cuttingedge of the detection and mitigation of threatening
situations, with gunshot detection being an essential element

AmberBox sensors do not interfere with the access point’s
ability to deliver high performance voice, video, location, andtelemetry.

in that toolbox. Despite claims about sophisticated machine

The sensors use acoustic and infrared data to recognize

learning algorithms, older generation gunshot detection

when firearms are discharged. Within roughly 3.6 seconds,

systems based on acoustic sensor arrays were notoriously

the sensor identifies the actual gunshot signature and relays

prone to false alarms.

an alert using the USB port. Access points use secure tunnels

The most current generation of gunshot detection relies on
multiple sensing mechanisms – muzzle flash, impulse, andpattern matching – to validate the presence, type, and evenbarrel length of discharged firearms. The result is fewer false
alarms and more efficient routing of first responders to active
shooter-involved incidents.
Installing a dedicated network to support gunshot detectors
is not economically viable, and many CISOs will not permit
such overlay networks. Additionally, battery-operated
sensors on dedicated wireless networks, like LoRa, present

to relay data to the AmberBox monitoring application.
Automatic alerts can then be sent to law enforcement via
the AmberBox cloud-based e911-certified platform, withadditional notifications to plants security or other responding
parties. A conference call line is automatically established toshare information and coordinate efficiently.
AmberBox can also immediately activate building security
systems while alerting personnel with SMS, e-mail and call
notification. Real-time shooter location tracking can beviewed through the Web or a mobile response platform.

cybersecurity risks by bypassing standard IT security

Dynamic segmentation of IIoT traffic is maintained

monitoring tools. There are also maintenance issues

throughout the Aruba infrastructure, protecting the rest of

associated with battery replacement.

the network against compromised devices. Aruba switches

Aruba’s Wi-Fi 6 access points overcome these issues
by providing a USB port that supplies power and data
communications for gunshot detectors. Standard Aruba
security mechanisms help protect against malicious orunintentional security breaches.

automatically set-up secure connections with Aruba accesspoints without the need for separate VLANs, regardless ofthe switch port into which they’re connected. This featuresimplifies the initial deployment of the access points, andminimizes opportunities for miswiring during adds, moves,and changes over the life of the deployment.
Key benefits of a jointly deployed solution include:

AmberBox, a leading provider of next-generation gunshot
detectors, and Aruba have partnered to ensure that first
responders can be reliably notified when an active incident
is in process. Applications include both plants and corporate
offices• Gunshot detectors can be placed where needed without
new cabling or PoE injectors;• No maintenance required, unlike with battery operated
systems;• Uses existing Aruba access points and leverages Aruba
security mechanisms; and• Supplements security solutions from Aruba and otherpartners including occupant safety monitoring, video
surveillance, door locking controls, and wayfinding
solutions.
Jointly deployed with AmberBox sensors, Aruba accessFigure 21: Amberbox Gunshot Detector

points dramatically improve situational awareness so first
responders know what they’re facing on arrival.

The joint solution works with Aruba Wi-Fi 6 (802.11ax) or
Wi-Fi 5 (802.11ac) access points already deployed on-site,
avoiding the need for a separate overlay network. AmberBox
22

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGSGUNSHOTS

DETECTOR

ARUBA ACCESS POINT

POLICEKEYCARD ACCESSELEVATOR LOCKDOWNBUILDING SECURITY PERSONNEL

KEY PERSONNELNOTIFICATIONLOCKDOWNMASS NOTIFICATION

ﬁgure 1.0_081519_amberbox-psoa
Figure 22: AmberBox Gunshot Detection And Notification
SystemCONNECTING AND PROTECTING REMOTE
BUILDINGS

site it could be unattended for large parts of the day. Remote

Industry analysts have long opined that the rise of smart

because of the vulnerability of IoT devices running insidemachines, cognitive technologies, and algorithmic business

them, and the complexity of setting up and managing securemodels could render obsolete the competitive advantage

remote access solutions.

of offshoring. Hyper-automation, it is argued, will be more

Virtual private network (VPN) access has historically been

influential than labor arbitrage in driving profitability andenhancing productivity. Smart machines will accomplish thisby classifying content, finding patterns, and extrapolating
generalizations from those patterns.

sites are particularly at risk of break-ins and cyber attacks

essential for security and vexing to set up: the labor savings
that come from centralized VPN management are often offset
by the complexity of system configuration and modifications.
Additionally, VPNs don’t protect endpoints or data at rest,

Labor arbitrage aside, there is no denying the central roleand need to be supplemented with firewalls, intrusionof IoT on the journey to run businesses more efficiently,

protection systems, and other endpoint defenses. These

productively, and profitably. The underpinnings of IoT are

solutions can be difficult to integrate with IoT devices, andthe sensors, actuators, and related control systems that for

confusing for users because the remote access methods –decades have been running our buildings and campuses.

like VPN authentication – differ from those used at corporate

Large, geographically-distributed companies have buildings

facilities.

spread across broad areas, and depending on the remote

Figure 23: Limitations Of Traditional VPNs
23

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

Aruba addresses these issues by simplifying remote site

centralizes encryption, and runs Aruba’s unique role-based

access and connectivity to IoT devices. Solutions are tailored

firewall. Every IoT device and field engineering laptop/tablet

to the type and number of IoT devices on site.

is assigned a unique identity by the role-based firewall to

If the remote site uses a standalone IoT controller runningLinux, Windows, iOS, MacOS, or Android operating systems,
Aruba’s VIA VPN Client application can be used. VIA can also

regulate how and when the device connects to and uses the
network. Identity follows the devices, regardless of how or
where they connect to the VPN network.

be used by field engineers and contractors with ruggedized

IoT device MAC addresses can be spoofed, so the identity of

laptops or tablets. VIA scans and selects the best Ethernet

headless devices needs to be supplemented by the controller

or broadband connection from the IoT device to the mainwith strong authentication protocols (like 802.1x) and role-building network. Unlike traditional VPN clients, VIA offers

based contextual data. These data include location, time ofa zero- touch experience and automatically connects to anday, day of week, and current security posture, which are

Aruba VPN concentrator controller on which it has beenused to provide more granular role based access control.

allow-listed.

A role is applied during the authentication process, before

High security government or defense-related buildings can

the device has network access, using Active Directory,

run the VIA Suite B VPN client. The client is a hybrid IPsec/

RADIUS, LDAP, or comparable data. Unlike simple Access

SSL VPN. When used in conjunction with an Aruba VPN

Control Lists (ACLs), Aruba’s stateful role-based firewall willconcentrator controller running the Aruba OS Advanced

actually track upper-layer flows to ensure that unauthorized

Cryptography (ACR) module, ACR supports elliptic curve

traffic can’t bypass access control. For example, a packet

cryptography validated for classified information.

claiming to be part of an established Telnet session would

VIA sets up a secure, encrypted tunnel to an Aruba VPN
concentrator controller at the main buildings or data center.

be blocked unless there was an actual established Telnet
session underway.

The controller runs the Aruba Operating System (AOS) andterminates the VPN tunnels, manages identity assignment,
APIS/INTEGRATIONRADIUS/LDAP/ADREMOTEWIRELESS LANCONTROL

REMOTEWIRELESS SECURITYCONTROLMANAGEMENTGE ENT HOOKSVPNSERVERPEF

Distributed Policy
Enforcement
Firewall Engine

TO IOT DEVICES

Figure 24: Aruba VPN Concentrator Controller

24

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

Many remote sites have multiple IoT devices, devices
that cannot run a VIA client, and/or need a secure local
Ethernet and/or Wi-Fi network. In these instance a Remote
Access Point (RAP) can be used to provide secure remoteconnectivity to Ethernet or Wi-Fi based IoT devices using abroadband WAN and/or cellular connection. Like VIA, a RAP
uses a zero-touch mechanisms to set up a secure, encrypted
tunnel with an Aruba VPN concentrator controller at the plantor data center. Suite B support is available on TAA-compliant
RAPs. Unlike VIA, RAPs include local Ethernet ports, WiFi access, and the option to plug-in a cellular modem forprimary or redundant back-up wide area communications.

CLIENT VPN
PEF

SECURE
WI-FI

Distributed Policy
Enforcement
Firewall Engine

CELLULAR MODEMSECUREWIRED

Figure 25: Aruba Remote Access Point

A side benefit of role-based access is that controls are

An example remote monitoring application is shown below.

available to optimize the bandwidth utilization of Wi-Fi

In this case the objective is to remotely supervise a chiller

enabled devices. Since Wi-Fi is a shared medium, significant

that has I/O information of value to facility management andbenefits accrue from limiting the maximum amount ofenergy optimization applications. The chiller has an available

bandwidth consumption for some devices, and guaranteeing

Ethernet port but lacks modern security features or VPN

a minimum bandwidth level for others. These mechanisms

support. The Ethernet port is connected to a RAP, which

help limit the impact of denial of service attacks while

establishes a secure IPsec tunnel via Internet broadband

allowing critical IoT devices to continue operating.

with a cellular back-up. Chiller I/O data are streamed thru

IoT devices and field engineering laptops/tablets areauthenticated, and data encrypted, without any client
software or manual intervention. The result is high security

the tunnel to the building or campus IoT application. RAP
updates are pushed automatically from time to time, and no
manual or local intervention is required.

connectivity with remote IoT sites and users that is easily
configured, requires no user training, and delivers a plugand-play IoT monitoring experience.

25

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

Figure 26: Remote Chiller Monitoring

For sites than need secure, high-bandwidth connectivity withenters and exits a remote site, regardless of uplink type,back-up communication paths with service level agreements,

making it easy to manage WAN environments using publica software defined WAN may be appropriate.

WAN connections.

Larger remote sites may benefit from a wide area network

To ensure uniform security, access policies dynamically follow(WAN) connection. Traditional WAN infrastructure is complex,

IoT devices (such as replacement parts) and field engineeringand on a large scale can require hundreds of routers,

tools (like ruggedized laptops and tablets) as they movefirewalls, and network security systems. Provisioning andbetween buildings. High availability active/active and active/

maintaining Multiprotocol Label Switching (MPLS) and otherstandby modes deliver full redundancy for sites that need it.

dedicated WAN links is time consuming, and can require
expensive on-site configuration and maintenance. Direct
Internet Access (DIA) services are less expensive than MPLS,
however, best path selection for applications requires
probing paths and mapping flows.

SD-WAN Gateways located at remote sites are designed tosupport multiple broadband, MPLS, or cellular links. Policybased routing ensures that traffic can be routed acrossmultiple private or public WAN uplinks based in the traffic
type, link health, device profile, user role, and destination.

Aruba’s SD Branch solution addresses these issues by

Smart building traffic can be routed over the best available

providing a central point for configuring routing and accessuplink based on factors such as throughout, latency, jitter,

control policies, and a simple means of pushing thoseand packet loss.

policies to remote sites. There is no on-premise management
equipment to update or maintain. WAN management isorchestrated through the Aruba Central cloud, from which
it’s easy to distribute routes and build secure, scalable VPN
tunnels on demand. Aruba Central can monitor where traffic

Regardless of whether you need to monitor a single remote
IoT device, and small buildings with multiple IoT devices, or a
critical site requiring fault-tolerant WAN links, Aruba has you
covered.

26

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

Figure 27: Aruba Remote SCADA Site Connectivity

REDUNDANT INTRA-SITE WIRELESS VIDEO ANDDATA LINKS

Wireless data links are easier to deploy than buried cables,

Outdoor surveillance video and remote gate control systems

link can make it prohibitive for short-haul links under 400

often require outdoor data links. The choice between wired
or wireless data links typically comes down to cost. If a wired
network requires reaching across a parking lot or gully tosurveillance cameras or an out building, it can easily takedays of work to trench and repair asphalt or concrete. If thereis hazardous buried material in the path, pipelines to cross,however, the cost of a point-to-point high-speed microwave
meters. Less expensive links represent a single point of
failure because they typically don’t offer redundancy andcan be impacted by nearby cellular networks. Additionally,in areas subject to high winds, even the slightest movementof the mounting brackets can throw an antenna out ofalignment and require a service call.

or the right of way is unavailable, the challenges continue tomount.
Plant Site

Applications

Network

Adjacent Building

Radio
Radio

Router

PoE Switch
PoE Switch

IP Phone

Surveillance Video

Figure 28: Point-To-Point Extension of a Plant Network to an Adjacent Building27

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

Aruba’s AP-387 is a high-speed, dual-radio, point-to-point

for precision alignment, or high-cost skilled labor, duringlink that addresses the shortcomings of today’s point-to-

installation. Just point one radio in the general direction ofpoint links. Incorporating a 60GHz millimeter wave radio withthe other, even if they are separated by as much as 20 stories

electrically steerable antenna array, the AP-387 provides

of elevation, and the radios will link up.

automatic fallback to a 5GHz radio in the event that rain orsnow attenuate the 60GHz signal. Redundant radios ensurethat the link is always optimized, offering an aggregate peakrate of 3.37Gbps and a fallback rate of 867Mbps. Advanced

Weighing just 1.2kg each, the radios can be commissioned bya single installer. The AP-387 includes an integrated BLE radiofor hands-free set-up.

cellular coexistence minimizes interference from cellular

Extending data links to other buildings and on-site locations

networks, distributed antenna systems, and commercial

shouldn’t compromise reliability or your budget. The AP-

small cells, and femtocell equipment.

387 can provide a redundant, point-to-point link up to 400

The auto-adjusting 60GHz antennas can dramatically reducelabor costs throughout the life of the site. The radios will
intelligently link with alignment ±45 degrees azimuth, andmeters, and with an aggregate peak rate of 3.37Gbps it can
support a very broad range of IoT, telephony, streaming
video, and physical security applications.

±17 degrees elevation; the 5GHz radio fixed sector antennas
cover the same alignment zone. This eliminates the need

Figure 29: Aruba AP-387 High-Speed Outdoor Point-To-Point Link

28

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGSMONITORING THE SWITCHING FABRIC TO DETECT
SECURITY-IMPACTING IOT ISSUES

Aruba’s Network Analytics Engine (NAE) uses Python scripts

As buildings become more automated, the need to rapidly

rules for actions to take when certain conditions are true.

detect and correct IoT system errors grows in importance.

CX is database-driven, and any factor can be monitored overTake, for example, a video surveillance system that uses

time and acted upon. Python scripts typically target IIoT

networked cameras with on-board artificial intelligence toperformance, security, and scale.

count people, detect tailgating thru access control portals,

In the example above, the camera flows would be monitored

and alert when motion detection thresholds are crossed.
These tasks require streaming data from cameras toapplication servers. In this machine-to-machine application,
if the video stream starts going astray there is no humanwatching in real-time to detect image degradation on amonitor.

to define which switch resources to monitor and, optionally,

with NAE scripts, and an automated notification sent toservice personnel if degradation is detected in the data
stream or switching fabric itself. Proactively addressing avideo system problem prior to failure can prevent damage
from undetected perimeter security breaches.

application for both operations optimization and preventive

CONTEXT-AWARE, REAL-TIME INTEGRATEDEMERGENCY RESPONSE AND NOTIFICATION

maintenance. Since the only common element among

Building security teams have an obligation to protect the

many machine-to-machine applications is the building’s

wellbeing of people who work in, visit, or travel through their

LAN that links everything together, it makes sense to lookfacilities. Posted evacuation plans and audio/visual alarms

for an automated supervisory solution that runs within theare often considered sufficient for this purpose, but in reality

switching fabric.

they aren’t. During an incident people need context-relevant

An automated supervisory system is essential in thisAn automated supervisory system is essential in thisapplication for both operations optimization and preventive

information pushed to them to keep them safe under highly
fluid circumstances.

maintenance. Since the only common element among

Moreover, first responders need the ability to communicate

many machine-to-machine applications is the building’s

in real-time with those in imminent danger, who need

LAN that links everything together, it makes sense to lookassistance exiting the facility, and who are in safe areas but

for an automated supervisory solution that runs within the

don’t know it. Active communication can often make theswitching fabric.

difference between a well-managed incident and a nightmare
scenario.
Patrocinium, in partnership with Aruba, addresses integrated
emergency response and notification by combining Meridian
indoor location services with an innovative mobile app. The
solution informs people of incidents and what actions shouldtake based on danger in or near their specific location.
Communication occurs in real time with tenants, visitors, andFigure 30: Aruba CX 8400 High-Availability Switch

Aruba’s CX switch operating system uses a databasecentric design and a programmatic interface to the entire
database schema. All internal states, protocols, and statistics
are expressed in the database, providing visibility into
everything that happens on the network. With a databasedriven operating system, any factor can be monitored andperformance compared over time.

staff, and unique 4D graphics enables first responders to see
where people are situated within buildings.
All that is required for 4D support is a Meridian subscription
and Aruba Beacons, standalone or embedded within Wi‑Fi
access points, throughout the facility. Patrocinium’s app
leverages Meridian’s maps and indoor location, in addition
to GPS, to provide a new level of visibility. Unlike GPS-only
based location services that cannot differentiate between
floors, Aruba’s BLE indoor location incorporates that critical
4th dimension

29

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

Figure 31: Meridian-Based Patrocinium Emergency Response Platform

Generic crisis management and emergency notification tools• A4D picture with longitude, latitude, floor number, andthat use text, e-mail, social media, and audio/visual alarms

time gives first responders more details than they could

to alert people of danger fall short because they can’t isolate

obtain from just GPS;

those in danger from other occupants, or provide real-timesituational awareness.
Working together, the Patrocinium Platform and Meridian
location services fill this critical gap. Doing away with lists
and opt-in workflows. Patrocinium instead uses patented
software to automatically notify occupants when they arewithin a danger zone geofence without first signing up foralerts. To protect user privacy, Patrocinium’s geofencing
technology only visualizes individuals’ locations when they

• Exact location is presented when a user declares
themselves safe/unsafe via the mobile app;
• Easily integrates into existing branded mobile apps - a
dedicated app is not required;• Responders can send specific information to targetedrecipients; and• Incident recording ensures that all relevant data are
saved for digital auditing and reporting.
Patrocinium and Aruba have created an event-triggered

are in or near danger, or need assistance.

process that generates an immediate, personalized flow ofThis event-triggered process generates an immediate,

visitors can see their location relative to an incident, send

personalized flow of information to anyone at risk of being
affected by an incident. Occupants are shown their location,
relevant pushed updates, perimeters, and safe zones. If
help is needed it’s one button-push away. In essence, users
become sensors for the security team.
Key benefits include:• Situational awareness indoors so users can see theirlocation relative to incidents, fire extinguishers, exits, andother safety-related data;• Wayfinding guides users to stairwells, exits, andinformation to those affected by an incident. Employees andand receive updates, and see perimeters and safe zones.

SECURING CONTROL NETWORKS THAT CAN’TPROTECT THEMSELVES
Building plants typically deploy Operational Technology(OT) like closed-loop sensors, actuators, programmable
logic controllers, and human machine interfaces to run
chillers, water treatment, power distribution, and otherfacilities-related infrastructure. Historically OT systems were
air gapped from the rest of the building systems because

designated outdoor muster areas;

30

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGS

facilities teams wanted full responsibility for their operation.

ClearPass Policy Manager uses device profiling, role-based

Unfortunately, cyber attacks on plants and equipment haveaccess control, and real-time policy enforcement to identify,

crossed air gaps. That has turned a spotlight on the security

on-board, and control devices. OT security partners enhanceof OT systems, and a pivot away from air gaps to active OT

these services by discovering OT devices, flagging risks andmonitoring.

abnormalities, and enforcing security postures.

The objective of active OT monitoring is to provide uniform

The joint solution allows IT administrators to centrally

visibility and security policies across the OT control systems,

manage connected devices and enforce policies governing

programmable logic controllers, and related devices. Since

what those devices can do: OT retains control of their

OT systems use unique physical layers (PHY) and protocols,devices, IT obtains uniform visibility and security policies

specialized tools are needed to monitor them and share data

across the entire enterprise, and the end user avoids costly

with the building’s ClearPass IT security policy manager.

downtime, safety incidents, and loss of intellectual property.

Inserting eyes and ears into an OT network requires tight

When an OT device connects to the network it is discoveredalignment with the operating modes of OT infrastructure.

by the OT security system, which synchronizes with ClearPass

In addition to understanding the OT physical layers andPolicy Manager to give it a comprehensive view of all IT andprotocols, the monitoring system needs to have a library of

OT devices. The supplied context can be used by Aruba todevices types, know correct and abnormal operating modes,

dynamically segment OT communications – a foundationaland do no harm in both normal operating and failure modes.

element of a zero trust framework – ensuring that devices

Aruba has partnered with best-in-class OT security
companies to help bridge the IT and OT security divide.
These partners couple deep knowledge of industrial control
systems and machine learning-based threat analytics with abi-directional link to ClearPass Policy Manager. The solution
identifies OT devices, finds vulnerabilities, detects threats,
and responds in a manner appropriate to the customer’s
needs, i.e., alert only, remediate thru ClearPass access
control, or alert and remediate.

only communicate with appropriate applications.
These features enable OT managers to:• Gain insight into network devices across IT and OT
networks;• Utilize contextual data to deploy seamless edge security;and• Ensure that only devices compliant with the latest updates
are allowed on the network.
OT security partners currently include Claroty, Microsoft
CyberX, Nozomi, and Tenable Indegy. Additional partner
integrations are anticipated in the near future.

Figure 32: OT Security System Integration With Aruba ClearPass
31

WHITE PAPER

DESIGNING HYPER-AWARE SMART BUILDINGSSUMMARY
The availability of IoT data and relevant context enablesbuildings to adapt to the environment and occupants.
The richer the set of available data and context, the more
adaptive the building can become.
Working in concert with key technology partners, Aruba’s
unified infrastructure, zero-trust security, and AI powered
solutions enable cognizant buildings that can boost
efficiency, productivity, reliability, safety, security, andprofitability.
Please contact us for more information on how we canhelp your facilities make the digital transformation to hyperawareness.

CITATIONS
1 W illiam H. Markle, “The Manufacturing Manager’s Skills” in The Manufacturing Man and His Job by Robert E. Finley and Henry R. Ziobro, American Management
Association, Inc., New York 1966
2 C. R. Jaccard, “Objectives and Philosophy of Public Affairs Education” in Increasing Understanding of Public Problems and Policies: A Group Study of Four Topics in
the Farm Foundation, Chicago, Illinois 1956
3 A business moment is a transient set of context-sensitive interactions between people, business, and things that yield a negotiated result as opposed to apredetermined result, i.e., a personalized, targeted offer from a retailer based on location, time, and CRM data. See Frank Buytendijk, Digital Connectivism Tenet
4: We Do Not Differentiate Between People and Things, Gartner, 1 November 2016.
4 McKinsey Global Institute, Unlocking The Potential Of The Internet of Things, June 201532

© Copyright 2020 Hewlett Packard Enterprise Development LP. The information contained herein is subject to change without
notice. The only warranties for Hewlett Packard Enterprise products and services are set forth in the express warranty statements
accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. Hewlett
Packard Enterprise shall not be liable for technical or editorial errors or omissions contained herein.
WP_SmartBuildings_102020 a00100717enw

Contact Us

Share