Patent Description:
Connected lighting refers to a system of one or more lighting devices which are controlled not by (or not only by) a traditional wired, electrical on-off or dimmer circuit, but rather by using a data communications protocol via a wired or more often wireless connection, e.g. a wired or wireless network. These connected lighting networks form what is commonly known as Internet of Things (IoT) or more specifically Internet of Lighting (IoL). Typically, the lighting devices, or even individual lamps within a lighting device, may each be equipped with a wireless receiver or transceiver for receiving lighting control commands from a lighting control device according to a wireless networking protocol such as Zigbee, Wi-Fi or Bluetooth.

IoT solutions such as connected lighting are complex networks of devices and sensors that exchange data and provide control functionality over networks and the cloud. With more and more data being exposed to more and more applications, security becomes a major challenge. The network devices such as connected lighting devices in a lighting network that have network connectivity are vulnerable.

Personal data that is collected by IoT lighting devices is of value to data hackers and identity thieves. Also, a cyber-attack on IoT solutions has the potential to cripple physical services and lighting infrastructure. While the importance of IoT security is widely understood and agreed upon, the actual design and implementation of IoT security bring new challenges and opportunities. To improve security and reduce the risk of hacker attacks, different security measures such as using end-to-end cryptographic algorithms, providing security fixes and software updates are used.

<CIT> discloses a method for detecting malicious behavior from smart appliances within a network. Network traffic data and identification data is collected about smart appliances within a network. The data is sent to a behavior analysis engine, which computes confidence levels for anomalies within the network traffic that may be caused by malicious behavior. Based on confidence levels, network traffic is blocked relating to the anomaly.

The inventors have realized that IoT devices, such as resource constrained lighting devices often have limited computing power and memory capacity, making it difficult to use complex cryptographic algorithms that require more resources than the lighting devices provide. The inventors have further realized that the update of IoT lighting devices with regular security fixes and updates are very often not performed on time. For example, in a home-based environment, users are either not aware of the need for updates or believe that updating is a difficult process which requires a trained technical person. It may become even more complicated in an office-based or an outdoor environment, where users may not have the authentication rights to perform the update (e.g. only the building or office manager may do so). Therefore, a large number of IoT lighting devices will operate with an old software (firmware) and may cause a security threat.

It is therefore an object of the present invention to overcome at least some of the problems raised above and other related network security problems and to provide secure operation of a lighting network, especially in view of the limitations of the lighting devices in the lighting network. In the context of the invention, as it is nearly impossible to provide an absolute secure operation with no risks, it should be understood that `with secure operation', it is meant to provide an enhanced security of operation.

According to a first aspect, the object is achieved by a method to provide secure operation of a lighting network, the lighting network comprising a lighting device arranged for illuminating an environment and a local controller for controlling the lighting device, wherein the lighting network is further controllable by an external controller, external to the lighting network, wherein the method comprises: determining a configuration status of the lighting network, analyzing the determined configuration status, switching an operational mode of the lighting network between a normal mode and a secured mode based on the analysis; wherein in the normal mode, the lighting network is operably connected to the external controller, and a light rendering function of the lighting device is being controlled by the external controller according to a predetermined set of functions, and wherein in the secured mode, the light rendering function of the lighting device is being controlled by the external controller according to a subset of the predetermined set of functions.

The method provides enhanced security to the operation of the lighting network. The method comprises determining a configuration status of the lighting network. A configuration comprises a functional arrangement of elements such as a software and/or hardware; wherein the configuration status comprises a version of a hardware, software and/or device settings of some or all such elements.

In an example, the software may be a firmware and the configuration status may be a version of the firmware. The determination of the configuration status may comprise determining the version of the software being used and/or the device settings of the lighting network. The configuration status of the lighting network may represent the configuration status of the lighting devices of the lighting network or of individual components of the lighting devices.

The method further comprises analyzing the determined configuration status of the lighting network. For example, the analysis on the determined configuration status may be performed in view of one or more of: whether the determined configuration status is, e.g. the latest version available for the software; whether the determined configuration status is vulnerable to a known security threat; whether network traffic shows signs of any malicious activity, such as malware operating in the network traffic. The analysis may be performed using anomaly detection in a network behavior analysis, which is a way to enhance the security of a network by monitoring traffic and noting unusual actions or departures from normal operation.

Based on the analysis, the method further comprises switching an operational mode of the lighting network between a normal mode and a secured mode. In the normal mode, the lighting network is operably connected to the external controller, and a light rendering function of the lighting device is being controlled by the external controller according to a predetermined set of functions. The predetermined set of functions may comprise illuminating an environment; and/or changing one or more of: color, color temperature, intensity, beam width, beam direction, illumination intensity, other parameters of one or more of light sources of the lighting devices.

In the secured mode, the light rendering function of the lighting device is being controlled by the external controller according to a subset of the predetermined set of functions. The subset of the predetermined set of function may comprise, e.g. illuminating the environment. In typical IoT systems, the operation of IoT devices is based on connectivity, e.g. connectivity to the internet, and disconnection from such an external network causes an operational failure for the complete system. It is different for the lighting network which can still operate locally in the secured mode with limited or no connectivity to the external controller. Therefore, the method provides secure operation of the lighting network, notwithstanding the limitations of the lighting devices in the lighting network.

The step of analyzing comprises detecting whether the determined configuration status requires a change; and wherein the method comprises changing the configuration of the lighting network in the secured mode, switching the operational mode of the lighting network from the secured mode to the normal mode when the configuration is changed. The determined configuration status may require a change when the determined configuration status is indicative of an insecure operation of the lighting network.

An insecure operation may be indicative of a vulnerable operation of the lighting network to a security risk, e.g. when an anomaly is detected in network traffic and/or an indication is received about a vulnerability associated with the determined configuration status. The method, based on such detection, may comprise switching the operational mode of the lighting network, e.g. from the normal mode to the secured mode and may further comprise changing the configuration. The changing of the configuration comprises updating, upgrading or downgrading configuration and/or change device settings. For example, updating firmware with a different version. The changing of the configuration may be performed by the external controller, e.g. in the secured mode. After the configuration has been changed, which is indicative of a secure operation of the lighting network, the operational mode of the lighting network is switched to the normal mode. The operational mode may be switched to the normal mode for a predetermined test time period, e.g. to test the network security. If the network traffic is observed to be secured, e.g. no anomaly is found, the operational mode may be kept as the normal mode. Alternatively, the operational mode is switched back to the secured mode and a different configuration may be used.

In an embodiment, the changing of the configuration may be performed by the local controller, and wherein a required configuration may be stored in the local controller and the configuration of the lighting network may be changed based on said stored required configuration.

As an alternative to changing configuration via the external controller, the required configuration may be stored in the local controller. For example, the local controller may receive the required configuration, e.g. software and/or device settings, from the external controller and may store it in a memory. The local controller may be then arranged for changing the configuration of the lighting network, e.g. in the secured mode.

In the secured mode, the lighting network may be further arranged to be operably disconnected from the external controller and the lighting rendering function is being controlled by the local controller.

The lighting network may be further arranged to be operably disconnected from the external controller when any form of connection of the lighting network with the external controller may cause security risks. In this example, the subset of the predetermined set of functions is an empty set, i.e. the external controller does not control the light rendering function of the lighting devices. The local controller may be arranged for controlling light rendering function of the lighting device according to the subset of the predetermined set of functions, e.g. the local controller may be arranged for controlling the lighting device for illuminating the environment.

In the secured mode, information intended for the external controller may be stored in the local controller and said information may be communicated upon restoring of the normal mode. The lighting network may further comprise a sensing device, and wherein said information is one or more of: sensing data, status data, control data, configuration data, diagnostic data, maintenance requests, data processing requests.

Furthermore, the lighting network may further comprise a sensing device, a HVAC equipment, a fire alarm etc. These devices may need to communicate sensing signals or other signals with the external controller. This information may be intended for the external controller such that the information is processed, e.g. for control, maintenance, diagnostic, End-of-Life (EoL) analysis etc. The external controller may be located in a remote server, such as cloud, which offers computational advantages to process the information in the remote server. In the secured mode, information intended for the external controller may be stored in the local controller and said information is communicated upon restoring of the normal mode.

In the secured mode, the lighting network may be arranged for advertising a type of security hazard and/or the required configuration.

The lighting network, e.g. based on the analysis, may advertise the type of security hazard, e.g. certain anomaly detected, and/or the required configuration which may be best suited to address the vulnerability.

The step of determining the configuration status of the lighting network may be based on a trigger, and wherein the trigger generation may be time-based such that the trigger is generated periodically, at random time moments or at predetermined time moments.

The determination can be initiated based on a trigger such that the trigger may be timely generated, e.g. periodically, random etc. Such time-based trigger maintains a timely check on the configuration status and keeps the configuration status up-to-date.

The step of determining the configuration status of the lighting network may be based on a trigger, and wherein the trigger generation may be event-based such that the trigger may be generated when a malicious activity is observed in the lighting network.

Additionally, or alternatively the trigger may be generated based on an event. Examples of such events may include one or more of: when a malicious activity is observed in the lighting network, when the lighting devices start behaving in an unexcepted way, communication signals are dropped and/or rerouted to wrong destinations, lack or no control on the lighting devices.

The step of determining the configuration status of the lighting network may be based on a trigger, and wherein the trigger is generated when an update to the current configuration is available.

Additionally, or alternatively the trigger may be generated based on receiving an indication of the availability of an updated configuration, such that a user is made aware that the configuration is older and needs to be changed.

The analysis may be performed by using anomaly detection in a network behavior analysis and wherein the anomaly detection may use at least one of: a statistical method, a rule-based method, a distance-based method, a profiling-based method, a model-based method.

According to a second aspect, the object is achieved by a controller for providing secure operation of a lighting network, the lighting network comprising a lighting device arranged for illuminating an environment and a local controller for controlling the lighting device, wherein the lighting network is further controllable by an external controller, external to the lighting network, the controller comprising a processor for executing the method according to the first aspect. The controller may further comprise an input and output interface respectively and a memory. The input to the controller may be the trigger signal to initiate a determination according to the first aspect. The output of the controller may be an update signal to a user indicating that a configuration is changed. The memory may be used to store a required configuration.

According to a third aspect, the object is achieved by a computer program product comprising instructions configured to execute according to the first aspect, when executed on a controller according to the second aspect.

It should be understood that the computer program product and the controller may have similar and/or identical embodiments and advantages as the above-mentioned methods.

The above, as well as additional objects, features and advantages of the disclosed systems, devices and methods will be better understood through the following illustrative and non-limiting detailed description of embodiments of systems, devices and methods, with reference to the appended drawings, in which:.

There are many open challenges with the security of IoT devices in an IoT system, such as lighting devices in a connected lighting system. Specifically, a common issue with the loT lighting devices is that they are often resource-constrained such that they do not contain the computational resources necessary to implement advanced security measures such as end-to-end encryption techniques.

As mentioned, personal data that is collected by the IoT lighting devices is of value to data hackers and identity thieves. Also, a cyber-attack on IoT solutions has the potential to cripple physical services and lighting infrastructure. In a home-based environment, due to a security loophole, for instance, a user may lose control of the lighting devices of his/her home remotely, communication and/or control signals for the lighting devices may be dropped and/or rerouted to wrong destinations. Furthermore, the lighting devices may start behaving in an abnormal way, e.g. suddenly a lighting device is powered on with full brightness at night or a power outage of all the lighting devices in a user's home. In an extreme situation of a security breach, the lighting network may transmit the signals about a user presence/absence to unknown remote devices/server, resulting in a theft or other serious consequences.

In an office environment, a power outage may lead to several security issues. At any crowded location such as a theatre or a cinema, an abnormal behavior of the lighting devices such as power outage, abnormal flickering etc., may cause chaos within the crowd, leading to serious consequences. In a factory, where people are working such abnormality in the lighting devices may risk human lives. These are a few examples of such situations where the security of the connected lighting system is very imperative, and a security breach may lead towards financial consequences and even risk to human lives. Other examples may also be considered. The invention provides an enhanced security to the operation of a lighting network such that these security compromises can be avoided.

<FIG> shows schematically and exemplary a system <NUM> comprising alighting network <NUM>. The lighting network <NUM>, in this example, comprises three lighting devices <NUM>-<NUM>. The lighting network <NUM> may comprise one or more lighting devices. A lighting device <NUM>-<NUM> is a device or structure arranged to emit light suitable for illuminating an environment, providing or substantially contributing to the illumination on a scale adequate for that purpose. A lighting device <NUM>-<NUM> comprises at least one light source or lamp, such as an LED-based lamp, gas-discharge lamp or filament bulb, etc., optionally any associated support, casing or other such housing. Each of the lighting devices <NUM>-<NUM> may take any of a variety of forms, e.g. a ceiling mounted luminaire, a wall-mounted luminaire, a wall washer, or a free-standing luminaire (and the luminaires need not necessarily all be of the same type).

The lighting network <NUM> further comprises a local controller <NUM> and a communication unit <NUM> which is exemplary shown to be comprised in the local controller <NUM>. However, the communication unit <NUM> can be external to the local controller <NUM>. The communication unit <NUM> can be a gateway which is used to receive and transmit communication signals to and from the lighting network <NUM>. A gateway is a piece of networking hardware used for networks that allows data to flow from one discrete network to another. The lighting network <NUM> may, for instance, further comprise (not shown in the figure) a sensing device, a fire alarm, a HVAC equipment for heating, ventilation and cooling etc. The sensing device may include motion sensors (such as PIR sensors), light sensors for detecting ambient light levels, temperature sensors, humidity sensors, gas sensors such as CO2 sensors, particle measurement sensors, audio sensors and imaging sensors such as cameras. Different combinations of multiple sensor types are possible, depending on the application or situation.

The local controller <NUM> may be arranged for controlling the operation of the lighting devices <NUM>-<NUM>. The local controller <NUM> may be a switch, e.g. a legacy wall switch. The local controller <NUM> may be a sensing device, e.g. a temperature sensor, a presence sensor, and may be arranged for generating a sensing signal, wherein the lighting devices <NUM>-<NUM> may be arranged to be controlled based on the generated sensing signal. The local controller <NUM> may be arranged for controlling the lighting devices <NUM>-<NUM> via wired means or a wireless means, e.g. by using a wireless protocol such as Wi-Fi, Bluetooth or Zigbee etc. The local controller <NUM> may be a computer software which may be based on programmed rules. The local controller <NUM> may be implemented in each of the lighting device <NUM>-<NUM>. The local controller <NUM> may be implemented external to the lighting device <NUM>-<NUM>.

The local controller <NUM> may further comprise a processor (not shown) and a memory (not shown), wherein the local controller <NUM> may be provided in a single chip or integrated circuit or plural chips or integrated circuits, optionally provided as a chipset, an application-specific integrated circuit (ASIC), field-programmable gate array (FPGA), digital signal processor (DSP), graphics processing units (GPUs), etc..

The system <NUM> may further comprise external networks <NUM> and <NUM>, external to the lighting network <NUM>. These networks <NUM>-<NUM> are exemplary shown as lighting networks but they may be other forms of networks, e.g. computer networks. The external network <NUM> comprises three lighting devices <NUM>-<NUM>, a controller <NUM>, and a communication unit <NUM> which is exemplary shown to be comprised in the controller <NUM>. However, the communication unit <NUM> can be external to the local controller <NUM>. The communication unit <NUM> can be a gateway which is used to receive and transmit communication signals to and from the external network <NUM>. The external network <NUM> comprises two lighting devices <NUM>-<NUM>, a controller <NUM>, and a communication unit <NUM> which is exemplary shown to be comprised in the controller <NUM>. However, the communication unit <NUM> can be external to the local controller <NUM>. The communication unit <NUM> can be a gateway which is used to receive and transmit communication signals to and from the external network <NUM>. The external networks <NUM>-<NUM> may, for instance, further comprise (not shown) a sensing device, a HVAC equipment (not shown) for heating, ventilation and cooling etc..

The system <NUM> may further comprise an external controller <NUM> and a communication unit <NUM> which is exemplary shown to be comprised in the external controller <NUM>. The external controller <NUM> is external to the lighting network <NUM>. The external controller <NUM>, in this exemplary figure, is shown to be located in a remote server <NUM>. The external controller <NUM> may be located in the external networks <NUM>-<NUM>. The external controller <NUM> via the communication unit <NUM> is arranged for communicating with the lighting network <NUM> and the external networks <NUM>-<NUM>. In this exemplary figure, the external networks <NUM>-<NUM> is arranged for communicating with the lighting network <NUM> via the external controller <NUM>. Alternatively, or additionally, the lighting network <NUM> may have a direct communication link with the external networks <NUM>-<NUM>.

In an example, the system <NUM> may be situated in a building, for instance, an office, a residential complex, a shopping mall, a grocery store, a cinema, a theatre, a factory etc. The lighting network <NUM> may be located in a room of the building. The external networks <NUM>-<NUM> may be located in other rooms of the building. The external controller <NUM> may be located in the remote server <NUM>, for instance, on a user device such as mobile phone, laptop or tablet etc., cloud, internet etc. The external controller <NUM> may be a building management system (BMS), otherwise known as a building automation system (BAS), which is a computer-based control system installed in buildings that controls and monitors the building's mechanical and electrical equipment such as ventilation, lighting, power systems, fire systems, and security systems.

In another example, the system <NUM> may be situated in an outdoor environment, e.g. in a town or a city. The example of such a system <NUM> is Philips CityTouch which is a street lighting management comprising smart street lights. The lighting network <NUM> may be located in a town of a city and may comprise lighting devices <NUM>-<NUM>, e.g. as streetlights. The external networks <NUM>-<NUM> may be located in other towns of the city. The external controller <NUM> may be located in the remote server <NUM>, such as a software system to remotely monitor, control and manage street lightings.

As the lighting network <NUM> may have a network connectivity with the external controller <NUM> and the external networks <NUM>-<NUM>, causing it to be vulnerable to security threats. A cyber-attack on the lighting network <NUM> and/or the external networks <NUM>-<NUM> has the potential to cripple physical services and lighting infrastructure. Specifically, in view that the lighting devices <NUM>-<NUM> have limited computing power and memory capacity, making it difficult to use complex cryptographic algorithms that require more resources than the lighting devices <NUM>-<NUM> can provide. The objective of the present invention is to present a method to provide secure operation of the lighting network <NUM>, wherein the method is schematically and exemplary illustrated in <FIG>.

<FIG> shows schematically and exemplary a flowchart illustrating an example useful for understanding the invention of a method <NUM> of providing secure operation of the lighting network <NUM>. In the determining step <NUM>, a configuration status of the lighting network <NUM> is determined. The determination of the configuration status may comprise determining the version of the software being used or the values of the device settings of the lighting network. The determination <NUM> may be performed in the external controller <NUM> and/or in the local controller <NUM>. The configuration status of the lighting network <NUM> may be the configuration status of the lighting devices <NUM>-<NUM> of the lighting network <NUM>. The configuration status of the lighting network <NUM> may be the configuration status of individual components of the lighting devices <NUM>-<NUM>, e.g. driver, networking chip (transceiver), microcontroller etc. The configuration status of the lighting network <NUM> may be the configuration status of the local controller <NUM> or any other elements in the lighting network <NUM>. The configuration status of the lighting network <NUM> reads onto any of the above case.

A configuration may comprise a functional arrangement of elements such as a software and/or hardware; wherein the configuration status may be a representation of some or all such elements such as version of the hardware, software and/or device settings. The configuration may comprise a software or data stored in the lighting network <NUM>; wherein the configuration status is, e.g. a version of the software or the values of the configuration parameters. The configuration may be a firmware of the lighting network <NUM>, wherein the configuration status may be the version of the firmware. Firmware is a permanent software programmed into a read-only memory of the lighting network <NUM>, wherein the method <NUM> further comprises determining <NUM> the current version of the firmware. The configuration may be data such as configuration parameters and/or device settings, e.g. the lighting device may be configured to allocate a specific size of memory for a certain light rendering function.

The step of determining <NUM> the configuration status of the lighting network <NUM> may be based on a trigger, and wherein the trigger generation may be time-based such that the trigger is generated periodically, at random time moments or at predetermined time moments. The predetermined time-moments for trigger generation may be set by a user or it may be automatically generated based on historic data from the lighting network <NUM>.

The trigger generation may be event-based such that the trigger may be generated when a malicious activity is observed in the lighting network. The network traffic may be monitored for detecting any malicious activity, e.g. a malware is operating in the network traffic. Malware is any software intentionally designed to cause damage to a network. Malware models are generated which for the tell-tale signs of known and unknown malware, malicious tools, and zero-day exploits that attackers use to get an initial foothold in the network. The malicious activity may be observed by using anomaly detection from the lighting network <NUM>. Visualization tools may be used to monitor the network traffic. When the system detects any such malicious activity, the trigger to determine the configuration status of the lighting network <NUM> may be generated. Alternatively, the event may be a recent cyber-attack on a similar network or an information about a potential cyber-attack due to a vulnerable configuration.

The trigger may be generated when an indication of the availability of an updated configuration, e.g. software and/or device settings, is received. The updated configuration is usually provided in a patch, which is a set of changes to the configuration designed to update, fix, or improve it. This includes fixing security vulnerabilities and other bugs, with such patches usually being called bugfixes or bug fixes and improving the usability or performance.

The method <NUM> may further comprise analyzing <NUM> the determined configuration status. The analysis <NUM> of the determined configuration status may be based on the vulnerability of the lighting network <NUM>. The analysis <NUM> can be performed in the external controller <NUM> and/or in the local controller <NUM>. The analysis <NUM> is performed by using anomaly detection in a network behavior analysis. Network Behavior Analysis (NBA) is a way to enhance the security of a network by monitoring traffic and noting unusual actions or departures from normal operation. Conventional intrusion prevention system solutions defend a network's perimeter by using packet inspection, signature detection and real-time blocking. NBA programs watch what's happening inside the network, aggregating data from many points to support offline analysis. After establishing a benchmark for normal traffic, the NBA program passively monitors network activity and flags unknown, new or unusual patterns that might indicate the presence of a threat.

The anomaly detection, e.g. in NBA, may use at least one of: a statistical method, a rule-based method, a distance-based method, a profiling-based method, a model-based method, as explained below:.

Statistical methods: statistical methods monitor the user or system behavior by measuring certain variables over time (e.g. login and logout time of each session in intrusion detection domain). The basic models keep averages of these variables and detect whether thresholds are exceeded based on the standard deviation of the variable. More advanced statistical models also compare profiles of long-term and short-term user activities.

Distance-based methods: distance-based approaches attempt to overcome limitations of statistical outlier detection approaches and they detect outliers by computing distances among points. Several distance-based outlier detection algorithms are used for detecting anomalies in network traffic.

Rule-based methods: rule-based systems used in anomaly detection characterize normal behavior of users, networks and/or computer systems by a set of rules.

Profiling-based methods: in profiling methods, profiles of normal behavior are built for different types of network traffic, users, programs etc., and deviations from them are considered as intrusions.

Model-based methods: in the model-based approaches, anomalies are detected as deviations for the model that represents the normal behavior.

The method <NUM> may further comprise switching <NUM> an operational mode of the lighting network <NUM> between a normal mode and a secured mode based on the analysis <NUM>.

In the normal mode, the lighting network <NUM> is operably connected to the external controller <NUM>, and a light rendering function of the lighting devices <NUM>-<NUM> is being controlled by the external controller <NUM> according to a predetermined set of functions. The external controller <NUM> may control the light rendering function of one or more lighting devices <NUM>-<NUM>. The predetermined set of functions may comprise illuminating an environment, and/or changing one or more of: color, color temperature, intensity, beam width, beam direction, illumination intensity, other parameters of one or more of light sources of the lighting devices <NUM>-<NUM>. In the normal mode, the external controller <NUM> may change the configuration status of the lighting network <NUM>. In normal mode, the lighting network <NUM> may be arranged for communicating information, for example, sensing data, status data, control data, configuration data, diagnostic data, maintenance requests, data processing requests, with the external controller <NUM>. The information is intended for the external controller <NUM> such that the information is processed, for instance, for control, maintenance, diagnostic, End-of-Life (EoL) analysis etc. The external controller <NUM> may be located in the remote server <NUM>, such as cloud, which offers computational advantages to process the information in the remote server <NUM>.

In the secured mode, the light rendering function of the lighting devices <NUM>-<NUM> is being controlled by the external controller <NUM> according to a subset of the predetermined set of functions. For example, the subset of the predetermined set of function may comprise illuminating the environment and/or changing illumination intensity. As an example, in the secured mode, the lighting network <NUM> may only be arranged for communicating with the external controller <NUM> but may not be arranged for communicating with the external networks <NUM>-<NUM>. As another example, in the secured mode, the information intended for the external controller <NUM> may be stored in the local controller <NUM> and said information is communicated upon restoring of the normal mode. The information may be processed locally in the local controller <NUM>. The lighting network may be arranged for advertising a type of security hazard and/or a required configuration. Based on the analysis <NUM>, the local controller <NUM> may advertise the vulnerability the lighting network <NUM> is exposed to and/or the potential configuration which may address the vulnerability. In networks, security fixes, e.g. patches, are used to change the configuration status. Although patches are meant to fix problem of security vulnerability, poorly designed patches can sometimes introduce new problems. Therefore, the local controller <NUM> may advertise that a previous or different patch is suitable.

In the secured mode, the lighting network <NUM> may be further arranged to be operably disconnected from the external controller <NUM> and the light rendering function may be controlled by the local controller <NUM>. In this example, the subset of the predetermined set of functions is an empty set, i.e. the external controller <NUM> does not control the light rendering function of the lighting devices <NUM>-<NUM>. The empty set or null set is the unique set having no elements. In this example, the lighting network <NUM> may be disconneted from the external network(s) <NUM>-<NUM> as well, whether the communication of the lighting network <NUM> with external networks <NUM>-<NUM> may be direct or via the external controller <NUM>. The local controller <NUM> may be arranged for controlling the operation of the lighting devices <NUM>-<NUM>. The lighting network <NUM> may not communicate information, for example, sensing data, status data, control data, configuration data, diagnostic data, maintenance requests, data processing requests, with the external controller <NUM>. The information intended for the external controller <NUM> may be stored in the local controller <NUM> and the information may be processed, for instance, for control, maintenance, diagnostic, End-of-Life (EoL) analysis etc., locally in the local controller <NUM>. The local controller <NUM> may perform a subset of information processing such as control and maintenance. The information may be communicated in the normal mode. In the example of system <NUM> being a building, the local controller <NUM> may be a switch in a room which is arranged for controlling the light rendering functions of the lighting devices <NUM>-<NUM>. The external controller <NUM>, e.g. building central control and the external networks <NUM>-<NUM>, e.g. lighting networks in other rooms, in this example, are disconnected from the lighting network <NUM>.

<FIG> shows schematically and exemplary a flowchart illustrating an embodiment of a method <NUM> of providing secure operation of the lighting network. In the determining step <NUM>, a configuration status of the lighting network <NUM> is determined and the determined configuration status is analyzed in step <NUM>, wherein the analysis <NUM> comprises: detecting <NUM> whether the determined configuration status requires a change. The determined configuration status may require a change when it is detected that the lighting network is vulnerable, for instance when an anomaly is detected in the network traffic, a newer configuration compared to the determined configuration is available, the determined configuration status is known to be an under-performing configuration and exposed to security risks etc. In case of anomaly, the network traffic is monitored for detecting any malicious activity, e.g. a malware is operating in the network traffic.

The local controller <NUM> and/or the external controller <NUM> may receive an indication of the availability of an updated configuration. In the step of detecting <NUM>, the determined configuration status may be compared with the available configuration status. For example, the configuration may be the firmware, and the version of installed firmware is compared to the presently available version of the firmware. If the installed firmware is an older version, the detecting step <NUM> indicates that the configuration requires a change. Alternatively, for instance, a bug is found in the determined configuration such that it renders the lighting network <NUM> vulnerable to security breach, the detecting step <NUM> indicates that the configuration status requires a change.

The method <NUM> may further comprise switching <NUM> the operational mode of the lighting network from the normal mode to the secured mode based on the detection <NUM>. In the step <NUM>, the configuration of the lighting network <NUM> is changed. In case, when the presently available configuration is newer compared to the determined configuration, the configuration of the lighting network <NUM> is updated. When a malicious activity is detected, the configuration may be changed to a more suitable version providing security to the detected malicious activity. Also, in case when it is indicated that the determined configuration status is prone to security vulnerability, the configuration may be changed to a different configuration, e.g. newer or older, which provides better security and is not vulnerable. The change of the configuration may be performed by the local controller <NUM> and/or by the external controller <NUM>. The process of changing the configuration is schematically and exemplary shown in <FIG>.

The method <NUM> may further comprise switching <NUM> the operational mode from the secured mode to the normal mode when the configuration is changed. Ones the potential security threats are treated and the vulnerabilities of the lighting network <NUM> to security compromises are addressed, the lighting network <NUM> is switched back to the normal mode. The lighting network <NUM> may be kept in the normal mode for a test period of time, and the network traffic is strictly observed. If the vulnerabilities are not completely addressed, the lighting network <NUM> may be again switched back to the secured mode for, e.g. to use a different configuration.

<FIG> shows schematically and exemplary a lighting network <NUM> and a local controller <NUM> illustrating an embodiment to change the configuration of the lighting network <NUM>. The lighting network <NUM> may comprise lighting devices <NUM>-<NUM>, a local controller <NUM>, and a communication unit <NUM> shown exemplary to be comprised in the local controller <NUM>. The change of configuration may be automatic, e.g. based on a trigger, or manual, e.g. based on a user input. In an embodiment, the configuration of the lighting network <NUM> may be changed via the local controller <NUM>, which may be arranged for receiving and storing the configuration. The local controller <NUM> may be arranged for receiving the configuration in the normal mode and may be arranged for changing the configuration of the lighting network <NUM> in the normal mode. Alternatively, local controller <NUM> may be arranged for receiving the configuration in the normal mode and may be arranged for changing the configuration of the lighting network <NUM> in the secured mode. Further, local controller <NUM> may be arranged for receiving and changing the configuration in the secured mode.

Alternatively, the external controller <NUM> may be arranged for changing the configuration of the lighting network <NUM>. The external controller <NUM> in this exemplary figure is shown to be located in a user device <NUM>, e.g. a mobile phone, tablet, laptop, with a user interface to indicate the availability of the configuration and to change the configuration. The external controller <NUM> may be connected to a remote server, e.g. internet, to receive configuration. The external controller <NUM> may be operably connected to the communication unit <NUM> of the lighting network <NUM>. In an embodiment, the external controller <NUM> may be wirelessly connected to the communication unit <NUM>, which includes a wireless transceiver and provides communication over radio frequency, using a protocol such as Wi-Fi, Bluetooth or Zigbee. The configuration may be changed in the normal mode or in the secured mode via the external controller <NUM>.

In the example of system <NUM> being a building. The external controller <NUM>, which in this example is a user mobile device is connected to a Wi-fi network and receives a configuration such as a software. The mobile device communicates with the communication unit <NUM>, e.g. a gateway, for instance, over the Wi-fi link and indicates the availability of the configuration. In case when the configuration status of the lighting devices <NUM>-<NUM> is determined which requires a change, the gateway communicates with the lighting devices <NUM>-<NUM>, e.g. over the Zigbee link. The mobile device changes the configuration of the lighting devices <NUM>-<NUM> via the gateway of the lighting network <NUM>. In an embodiment, the mobile device may require a authentication to change the configuration status. The authentication may require one or more of: a password, a pin code, fingerprints etc. The authentication may be a single-factor or multi-factor authentication. The local controller may be comprised in a local user device (not shown) which may have communication link, e.g. wireless or wired, with the lighting devices <NUM>-<NUM>. The local user device may receive configuration such a software, e.g. in a normal mode, and may change the configuration of the lighting devices <NUM>-<NUM>, e.g. in a secured mode.

<FIG> shows schematically and exemplary a controller <NUM> for providing secured operation of the lighting network. The local controller <NUM> may comprise a processor <NUM>, a communication unit <NUM>, an input and output interface <NUM>-<NUM> respectively and a memory <NUM>. The processor <NUM> is arranged for executing the steps of the method <NUM>-<NUM>. The controller <NUM> may be implemented in a unit separate from the lighting network <NUM> and/or external controller <NUM>, such as wall panel, desktop computer terminal, or even a portable terminal such as a laptop, tablet or smartphone. Alternatively, the controller <NUM> may be incorporated into the lighting network <NUM> or external controller <NUM>. Further, the controller <NUM> may be implemented in a single unit or in the form of distributed functionality distributed amongst multiple separate units (e.g. a distributed server comprising multiple server units at one or more geographical sites, or a distributed control function distributed amongst the lighting network <NUM> or amongst the lighting network <NUM> and external controller <NUM>). Furthermore, the controller <NUM> may be implemented in the form of software stored on a memory (comprising one or more memory devices) and arranged for execution on a processor (comprising one or more processing units), or the controller <NUM> may be implemented in the form of dedicated hardware circuitry, or configurable or reconfigurable circuitry such as a PGA or FPGA, or any combination of these.

The method <NUM>-<NUM> may be executed by computer program code of a computer program product when the computer program product is run on a processing unit of a computing device, such as the processor <NUM> of the controller <NUM>.

Claim 1:
A method (<NUM>) to provide secure operation of a lighting network (<NUM>), the lighting network comprising a lighting device (<NUM>, <NUM>,<NUM>) arranged for illuminating an environment and a local controller (<NUM>) for controlling the lighting device, wherein the lighting network is further controllable by an external controller (<NUM>), external to the lighting network, wherein the method comprises:
- determining (<NUM>) a configuration status of the lighting network, wherein a configuration comprises a functional arrangement of elements of the lighting network; and wherein the configuration status comprises a version of a hardware, software and/or device settings of some or all of the elements;
- analyzing (<NUM>) the determined configuration status, wherein the analysis of the determined configuration status is based on vulnerability of the lighting network, and the step of analyzing comprises detecting (<NUM>) whether the determined configuration status requires a change;
- switching (<NUM>) an operational mode of the lighting network from a normal mode to a secured mode based on the detection;
- changing (<NUM>) the configuration of the lighting network in the secured mode,
wherein changing of the configuration comprises updating, upgrading or downgrading configuration and/or changing device settings,
- switching (<NUM>) the operational mode of the lighting network from the secured mode to the normal mode after the configuration is changed;
wherein in the normal mode, the lighting network is operably connected to the external controller, and a light rendering function of the lighting device is being controlled by the external controller according to a predetermined set of functions, and wherein in the secured mode, the light rendering function of the lighting device is being controlled by the external controller according to a subset of the predetermined set of functions.