Patent Description:
The invention further relates to a method of receiving status information reflecting a current status of a device and causing first status information to be presented on a first user device and second status information to be presented on a second user device.

The number of connected <NUM>/<NUM>-enabled devices continues to grow. Many of these devices continuously collect the data to support a multitude of services either for user or company benefits. The common services that use data are security, context awareness, personalized recommendations, amongst others.

Connected products such as lighting use real-time and historical data to improve their behavior and offer personalization and smart services to the users. With a growing number of connected devices, the data collected becomes more precise and as a result might lead to undesired privacy related behaviors.

It is known to limit the collection and use of privacy-sensitive data. For example, <CIT> discloses a method and corresponding system for use in a Networked Lighting Control System whereby an individual can determine various privacy settings for data collected that relates to an area in which he/she is being monitored. These various settings include selecting by the individual what specific types of data can be/cannot be collected; whether he/she can be linked to the collected data; and limiting the purpose for which the data can be used.

A drawback of the method of <CIT> is that if a user does not want certain data to be shared with others, he can disable logging of this data, but then, he does not have access to this data himself either. This is especially disadvantageous when this data helps the user control a device. <CIT> discloses a lighting network that includes sensors which monitor status information.

Then invention is defined by the subject-matter of the independent claims.

It is a first object of the invention to provide a system, which allows a user to protect privacy-sensitive device status information in a manner that does not make the user's control of the device inconvenient.

It is a second object of the invention to provide a method, which allows a user to protect privacy-sensitive device status information in a manner that does not make the user's control of the device inconvenient.

According to the invention, a system for receiving status information reflecting a current status of a device and causing first status information to be presented on a first user device and second status information to be presented on a second user device comprises at least one input interface, at least one output interface, and at least one processor configured to use said at least one input interface to receive said status information reflecting said current status of said device, determine said first status information for presentation on said first user device, said first status information reflecting said current status of said device, use said at least one output interface to cause said first status information to be presented on said first user device, and use said at least one output interface to cause said second status information to be presented on said second user device, said second status information reflecting said current status of said device in dependence on whether a privacy mode is active for said device.

By causing accurate device status information to be presented on the first user device and causing either accurate or non-accurate device status information, depending on whether a privacy mode is active for the device, to be presented on the second user device, a user can protect privacy-sensitive device status information from others without making his control of the device inconvenient. For example, he may not want others to know that a certain lamp has been switched on, but still want to be able to check himself that this lamp has been switched on. Said device may be a lighting device and said status may comprise at least one of a current on/off setting, a current light output level and a current color setting, for example.

Said at least one processor may be configured to use said at least one output interface to transmit said first status information to said first user device, determine said second status information, and use said at least one output interface to transmit said second status information to said second user device. This is beneficial if the system is comprised in a bridge or Internet server, for example.

Alternatively, said system may be comprised in said first user device and said at least one processor may be configured to transmit a command to a further device, said command commanding said further device to cause said second status information to be presented on said second user device. In this case, it is the first user device that informs the second user device of the relevant status information and decides which status information will be presented on the second user device.

Said at least one processor may be configured to use said at least one input interface to receive a control command for controlling said device and use said at least one output interface to control said device according to said control command in dependence on whether said privacy mode is active for said device. This allows control of the device to be prohibited for users who are not allowed to see the current status of the device when the privacy mode is active for the device.

Said at least one processor may be configured to determine said second status information such that said second status information does not reflect said current status or a fictitious status of said device and indicates that a privacy mode is active for said device upon determining that said privacy mode is active for said device. This avoids causing confusion to the user of the second user device as to what the status of the device is, but this makes it impossible to hide the fact that the privacy mode is active, which is a drawback if this fact is itself privacy-sensitive information.

Said at least one processor may be configured to determine said second status information such that said second status information identifies a user who activated said privacy mode and/or a user device on which said privacy mode was activated. This makes it easier to find out how to disable the privacy mode if desired.

Said at least one processor is configured to determine a fictitious current status for said device and include said fictitious current status in said second status information upon determining that said privacy mode is active for said device. For example, said fictitious current status may be a last known status of said device before said privacy mode was activated for said device, said fictitious current status may be randomly determined or said fictitious current status may be determined based on a plurality of previous statuses of said device. This allows the fact that the privacy mode is active to be hidden, which is a benefit if this fact is itself privacy-sensitive information.

Said privacy mode may have been activated on said first user device and/or by a user of said first user device. Thus, the user that activates the privacy mode is allowed to see the actual status information.

Said first user device may be connected to the same local network as said device and said second user device may be connected to a different local network than said device. For example, a user that is at home is able to see the actual status information, while another user that was given permission to control devices while visiting this user's home, but who is no longer in this user's home is not able to see the actual status information.

Said first user device may be used by a user identified in first user information associated with said privacy mode and/or said second user device may be used by a user identified in second user information associated with said privacy mode. This makes it possible to identify specific users who should be able to see or specific users who should not be able to see the actual status information when the privacy mode is active.

Said privacy mode may be automatically activated upon selection of a first light scene associated with said privacy mode or upon use of first light control means associated with said privacy mode and/or automatically deactivated upon selection of a second light scene not associated with said privacy mode or upon use of second light control means not associated with said privacy mode. This makes it unnecessary for a user to activate and/or deactivate the privacy mode manually in certain cases. The light scenes may be user selected or automatically selected (e.g. time based, based on a sensor trigger). The first light control means and the second light control means may each comprise, for example, a specific physical interface, e.g. a dimmer switch, or a specific app e.g. HueSync.

Said privacy mode may be automatically activated or deactivated upon detection of the presence of one or more specified persons and/or the absence of one or more specified persons and/or based on a user-specified schedule (e.g. from <NUM> to <NUM>). This makes it unnecessary for a user to activate the privacy mode manually in certain cases. For example, two users both have a control app for controlling lighting devices in their home and the first user may be able to specify that the privacy mode is automatically activated when the first user is detected and the second user is not detected. The privacy mode may then be automatically deactivated as soon as the second user is detected.

According to the invention, a method of receiving status information reflecting a current status of a device and causing first status information to be presented on a first user device and second status information to be presented on a second user device comprises receiving said status information reflecting said current status of said device, determining said first status information for presentation on said first user device, said first status information reflecting said current status of said device, causing said first status information to be presented on said first user device, and causing said second status information to be presented on said second user device, said second status information reflecting said current status of said device in dependence on whether a privacy mode is active for said device. Said method may be performed by software running on a programmable device. This software may be provided as a computer program product.

A non-transitory computer-readable storage medium stores at least one software code portion, the software code portion, when executed or processed by a computer, being configured to perform executable operations for receiving status information reflecting a current status of a device and causing first status information to be presented on a first user device and second status information to be presented on a second user device.

The executable operations comprise receiving said status information reflecting said current status of said device, determining said first status information for presentation on said first user device, said first status information reflecting said current status of said device, causing said first status information to be presented on said first user device, and causing said second status information to be presented on said second user device, said second status information reflecting said current status of said device in dependence on whether a privacy mode is active for said device.

<FIG> shows a first embodiment of the system for receiving status information reflecting a current status of a device and causing first status information to be presented on a first user device and second status information to be presented on a second user device. In this first embodiment, the system is a mobile device <NUM> and the mobile device <NUM> is also the first user device. The second user device is a mobile device <NUM> or <NUM>.

Mobile devices <NUM>, <NUM> and <NUM> run an app for controlling lighting devices <NUM>-<NUM>, which may be Hue lamps, for example. The lighting devices <NUM>-<NUM> communicate with a (light) bridge <NUM>, e.g. using Zigbee technology. The bridge <NUM> may be a Philips Hue bridge, for example. The mobile devices <NUM> and <NUM> are able to control the lighting devices <NUM>-<NUM> via a wireless LAN access point <NUM> and the bridge <NUM>. The wireless LAN access point <NUM> is connected to the Internet <NUM>. An Internet server <NUM> is also connected to the Internet <NUM>. The mobile device <NUM> is able to control the lighting devices <NUM>-<NUM> via Internet server <NUM>.

The mobile device <NUM> comprises a transceiver <NUM>, a transmitter <NUM>, a processor <NUM>, memory <NUM>, and a display <NUM>. The processor <NUM> is configured to use the receiver <NUM> to receive the status information reflecting the current status of one of lighting devices <NUM>-<NUM> from the bridge <NUM> or the Internet server <NUM> and determine the first status information for presentation on the mobile device <NUM>. The status of lighting devices <NUM>-<NUM> comprises a current on/off setting and/or a current light output level and/or a current color setting, for example. The first status information reflects the current status of the device and may be the same as the status information received the from bridge <NUM> or the Internet server <NUM>, for example.

The processor <NUM> is further configured to use the display <NUM> to cause the first status information to be presented on the mobile device <NUM> and use the transmitter <NUM> to cause the second status information to be presented on the mobile device <NUM> or <NUM>. The second status information reflects the current status of the device in dependence on whether a privacy mode is active for the device.

In the embodiment of <FIG>, the processor <NUM> is configured to use the transmitter <NUM> to transmit a command commanding a further device to cause the second status information to be presented on the second user device. The command may be transmitted to the mobile device <NUM> or <NUM>, the bridge <NUM> or the Internet server <NUM>, for example.

Information on whether a privacy mode is active for a lighting device or for all lighting devices may be obtained from the bridge <NUM> or the Internet server <NUM>, for example. There are several possible reasons why the user of the mobile device <NUM> is allowed to see the actual status information and the user of the mobile device <NUM> or <NUM> is not, e.g.:.

When the privacy mode is active, one or more of the following restrictions may additionally be applied:.

When the privacy mode is active, not only may the current state of one or more devices not be shown on certain user devices, the currently active light scene, last user actions and/or the presence sensor state might also not be shown on these certain user devices. However, when presence is detected, the system would typically still behave in the same way, e.g. switch on the lights. When the system does not share states of devices and possibly data collected by these devices with any other smart home systems such as Amazon Echo or Google Home in privacy mode, it may still allow the devices to be controlled using these other smart home systems.

The activation of the privacy mode may be triggered by the activation of a specific light scene (e.g. a relax scene) or routine (e.g. a fall asleep routine). During the time that this light scene or routine is active, the events detected by associated connected devices (e.g. devices in the room or area in which the relax scene generates its effect) may be processed according to the restrictions of the privacy mode.

A selective privacy mode may be implemented where the privacy mode is only activated in a specific room (e.g. bedroom), i.e. for the devices in that room, and not in the whole house. The privacy mode may be automatically deactivated if a user changes the scene, at the end of a routine, or due to timeout. The privacy mode could also be automatically deactivated when a user is detected to have left his home.

Two different levels of privacy could be implemented:.

An implementor may choose one of these privacy levels or may implement both privacy levels and allow a user or administrator to select the level of privacy he wishes to use.

In the embodiment of the mobile device <NUM> shown in <FIG>, the mobile device <NUM> comprises one processor <NUM>. In an alternative embodiment, the mobile device <NUM> comprises multiple processors. The processor <NUM> of the mobile device <NUM> may be a general-purpose processor, e.g. from ARM or Qualcomm or an application-specific processor. The processor <NUM> of the mobile device <NUM> may run an Android or iOS operating system for example. The display <NUM> may comprise an LCD or OLED display panel, for example. The display <NUM> may be a touch screen, for example. The processor <NUM> may use this touch screen to provide a user interface, for example. The memory <NUM> may comprise one or more memory units. The memory <NUM> may comprise solid state memory, for example.

The receiver <NUM> and the transmitter <NUM> may use one or more wireless communication technologies, e.g. Wi-Fi (IEEE <NUM>) for communicating with the wireless LAN access point <NUM>, for example. In an alternative embodiment, multiple receivers and/or multiple transmitters are used instead of a single receiver and a single transmitter. In the embodiment shown in <FIG>, a separate receiver and a separate transmitter are used. In an alternative embodiment, the receiver <NUM> and the transmitter <NUM> are combined into a transceiver. The mobile device <NUM> may comprise other components typical for a mobile device such as a battery and a power connector. The invention may be implemented using a computer program running on one or more processors.

In the embodiment of <FIG>, the lighting devices <NUM>-<NUM> are controlled by the mobile devices <NUM> and <NUM> via the bridge <NUM>. In an alternative embodiment, one or more of the lighting devices <NUM>-<NUM> are controlled by one or more of the mobile devices <NUM> and <NUM> without a bridge, e.g. directly via Bluetooth. In the embodiment of <FIG>, the Internet server <NUM> receives data from and transmits data to the lighting devices <NUM>-<NUM> via the bridge <NUM>. In an alternative embodiment, the Internet server <NUM> receives data from and transmits data to one or more of the lighting devices <NUM>-<NUM> without a bridge.

<FIG> shows a first embodiment of the system for receiving status information reflecting a current status of a device and causing first status information to be presented on a first user device and second status information to be presented on a second user device. In this second embodiment, the system is a computer <NUM>, the first user device is a mobile device <NUM> and the second user device is a mobile device <NUM> or <NUM>. The computer <NUM> is connected to the Internet <NUM> and acts as a server. The mobile devices <NUM>-<NUM> are able to control the lighting devices <NUM>-<NUM> via computer <NUM>.

The computer <NUM> comprises a receiver <NUM>, a transmitter <NUM>, a processor <NUM>, and storage means <NUM>. The processor <NUM> is configured to use the receiver <NUM> to receive the status information reflecting the current status of one of lighting devices <NUM>-<NUM> from the bridge <NUM> and determine the first status information for presentation on the mobile device <NUM>. The first status information reflects the current status of the device and may be the same as the status information received the from bridge <NUM>, for example.

The processor <NUM> is further configured to use the transmitter <NUM> to cause the first status information to be presented on the mobile device <NUM> and cause the second status information to be presented on the mobile device <NUM> or <NUM>. The second status information reflects the current status of the device in dependence on whether a privacy mode is active for the device.

In the embodiment of <FIG>, the processor <NUM> is configured to use the transmitter <NUM> to transmit the first status information to the mobile device <NUM>, e.g. on request of the mobile device <NUM>, determine the second status information, and use the transmitter <NUM> to transmit the second status information to the mobile device <NUM> or <NUM>, e.g. on request of the mobile device <NUM> or <NUM>.

In the embodiment of the computer <NUM> shown in <FIG>, the computer <NUM> comprises one processor <NUM>. In an alternative embodiment, the computer <NUM> comprises multiple processors. The processor <NUM> of the computer <NUM> may be a general-purpose processor, e.g. from Intel or AMD, or an application-specific processor. The processor <NUM> of the computer <NUM> may run a Windows or Unix-based operating system for example. The storage means <NUM> may comprise one or more memory units. The storage means <NUM> may comprise one or more hard disks and/or solid-state memory, for example. The storage means <NUM> may be used to store an operating system, applications and application data, for example.

The receiver <NUM> and the transmitter <NUM> may use one or more wired and/or wireless communication technologies such as Ethernet and/or Wi-Fi (IEEE <NUM>) to communicate with the wireless LAN access point <NUM>, for example. In an alternative embodiment, multiple receivers and/or multiple transmitters are used instead of a single receiver and a single transmitter. In the embodiment shown in <FIG>, a separate receiver and a separate transmitter are used. In an alternative embodiment, the receiver <NUM> and the transmitter <NUM> are combined into a transceiver. The computer <NUM> may comprise other components typical for a computer such as a power connector. The invention may be implemented using a computer program running on one or more processors.

In the embodiment of <FIG>, the computer <NUM> receives data from and transmits data to the lighting devices <NUM>-<NUM> via the bridge <NUM>. In an alternative embodiment, the computer <NUM> receives data from and transmits data to one or more of the lighting devices <NUM>-<NUM> without a bridge.

<FIG> shows a first embodiment of the system for receiving status information reflecting a current status of a device and causing first status information to be presented on a first user device and second status information to be presented on a second user device. In this third embodiment, the system is a bridge <NUM>, the first user device is a mobile device <NUM> and the second user device is a mobile device <NUM> or <NUM>. The mobile devices <NUM> and <NUM> are able to control the lighting devices <NUM>-<NUM> via the wireless LAN access point <NUM> and the bridge <NUM>. The mobile device <NUM> is able to control the lighting devices <NUM>-<NUM> via Internet server <NUM>.

The bridge <NUM> comprises a receiver <NUM>, a transmitter <NUM>, a processor <NUM>, and a memory <NUM>. The processor <NUM> is configured to use the receiver <NUM> to receive the status information reflecting the current status of one of the lighting devices <NUM>-<NUM> from the device itself (i.e. one of the lighting devices <NUM>-<NUM>) and determine the first status information for presentation on the mobile device <NUM>. The status information reflects the current status of the device and may be the same as the status information received the from device, for example.

The processor <NUM> is configured to use the transmitter to cause the first status information to be presented on the mobile device <NUM> and cause the second status information to be presented on the mobile device <NUM> and <NUM>. The second status information reflects the current status of the device in dependence on whether a privacy mode is active for the device.

In the embodiment of <FIG>, the processor <NUM> is configured to use the transmitter <NUM> transmit the first status information to the mobile device <NUM>, determine the second status information, and use transmitter <NUM> to transmit the second status information to the mobile device <NUM> or <NUM>.

In the embodiment of the bridge <NUM> shown in <FIG>, the bridge <NUM> comprises one processor <NUM>. In an alternative embodiment, the bridge <NUM> comprises multiple processors. The processor <NUM> of the bridge <NUM> may be a general-purpose processor, e.g. ARM-based, or an application-specific processor. The processor <NUM> of the bridge <NUM> may run a Unix-based operating system for example. The memory <NUM> may comprise one or more memory units. The memory <NUM> may comprise solid-state memory, for example. The memory <NUM> may be used to store a table of connected lights, for example.

The receiver <NUM> and the transmitter <NUM> may use one or more wired or wireless communication technologies, e.g. Ethernet for communicating with the wireless LAN access point <NUM> and Zigbee for communicating with the lighting devices <NUM>-<NUM>, for example. In an alternative embodiment, multiple receivers and/or multiple transmitters are used instead of a single receiver and a single transmitter. In the embodiment shown in <FIG>, a separate receiver and a separate transmitter are used. In an alternative embodiment, the receiver <NUM> and the transmitter <NUM> are combined into a transceiver. The bridge <NUM> may comprise other components typical for a network device such as a power connector. The invention may be implemented using a computer program running on one or more processors.

In the embodiments of <FIG>, the system of the invention comprises a mobile device, a computer or a bridge. In an alternative embodiment, the system of the invention is a different device. In the embodiments of <FIG>, the system of the invention comprises a single device. In an alternative embodiment, the system of the invention comprises a plurality of devices. Although the user devices are mobile devices in the examples of <FIG>, other types of devices may be used as user devices.

To enable privacy mode, the system is able to switch between a privacy mode and a normal mode, i.e. a mode in which the privacy mode is not active. The privacy mode can be set for all devices in a home or for a subset of devices in the home (e.g. all devices in a certain room or a single device), for example. The devices may be lighting devices, for example.

In the privacy mode a set of restrictions on system operation is applied. These restrictions could be defined by the user or by the system. Typically, the operation of the system will include the following steps - (<NUM>) setting up and configuring; (<NUM>) activation of the privacy mode; (<NUM>) maintaining privacy mode with set restrictions; (<NUM>) switching back to the normal mode of operation. Steps <NUM> and <NUM> will be explained with the help of <FIG>. Step <NUM> will be explained with the help of <FIG>, <FIG> and <FIG>.

A method according to the invention of receiving status information reflecting a current status of a device and causing first status information to be presented on a first user device and second status information to be presented on a second user device is shown in <FIG>. A step <NUM> comprises receiving the status information reflecting the current status of the device.

A step <NUM> comprises determining the first status information for presentation on the first user device. The first status information reflects the current status of the device and may be the same as the status information received in step <NUM>. A step <NUM> comprises causing the first status information to be presented on the first user device. A step <NUM> comprises causing the second status information to be presented on the second user device. The second status information reflects the current status of the device in dependence on whether a privacy mode is active for the device.

In addition to restricting the sharing of status information by preventing the current status of a device to be displayed on certain user devices in the privacy mode, one or more additional restrictions may be applied while maintaining the privacy mode:.

A second embodiment of the method of receiving status information reflecting a current status of a device and causing status information to be presented on user devices is shown in <FIG>. In the embodiment of <FIG>, step <NUM> of <FIG> comprises a sub step <NUM> and step <NUM> of <FIG> comprises sub steps <NUM>-<NUM>.

In the embodiment of <FIG>, the method is performed by the first device. In step <NUM>, the first status information (determined in step <NUM>) is presented on a display of the first device. The first sub step of step <NUM>, i.e. step <NUM>, comprises checking whether a privacy mode is active for the device whose status information was received in step <NUM>. If not, then step <NUM> is performed. Step <NUM> comprises determining second status information that is the same as the first status information determined in step <NUM>.

If the privacy mode is active, step <NUM> is performed. Step <NUM> comprises determining the second status information such that the second status information does not reflect the current status or a fictitious status of the device and indicates that a privacy mode is active for the device upon determining that the privacy mode is active for the device. In the embodiment of <FIG>, step <NUM> also comprises determining the second status information such that the second status information identifies a user who activated the privacy mode and/or a user device on which the privacy mode was activated. Step <NUM> comprises transmitting the second status information to the second user device.

<FIG> shows a first example of a user interface shown on first and second user devices. The first user device <NUM> is used by a user named "Dan". The name of the user is identified by label <NUM> on display <NUM> of the first user device <NUM>. The second user device <NUM> is used by a user name "Laura". The name of the user is identified by label <NUM> on display <NUM> of the second user device <NUM>.

Both user devices show a user interface for controlling lighting devices <NUM>-<NUM> of <FIG>. Panel <NUM> reflects the current status of lighting device <NUM> and can be used to control the lighting device <NUM>. Panel <NUM> reflects the current status of lighting device <NUM> and can be used to control the lighting device <NUM>. Panel <NUM> reflects the current status of lighting device <NUM> and can be used to control lighting device <NUM>.

Each panel shows a name of the corresponding lighting device. For example, panels <NUM> and <NUM> show the name of lighting device <NUM>. Furthermore, each panel has a color that corresponds to the color rendered by the corresponding lighting device. Each panel also shows a dim level with the help of a circle rendered on top of a bar, e.g. circles <NUM> and <NUM>, and shows whether the corresponding light is on or off with a switch, e.g. switches <NUM>, <NUM> and <NUM>. If a switch is off, as is the case in panel <NUM>, then the panel is not colored and the bar and circle representing the dim level are not shown.

Panel <NUM> is shown when the privacy mode is active for the lighting device <NUM>. The status information displayed in panel <NUM> has been determined in step <NUM> of <FIG>. Status information for lighting device <NUM> is also shown in panel <NUM>, but the actual status is not shown to Laura due to the privacy mode being active. Instead, the message <NUM> comprising the text "set to private by dan" is shown. In the example of <FIG>, the panel <NUM> shows who has activated the privacy mode (the user named "Dan") and control of the lighting device <NUM> is disabled when the privacy mode is active for the lighting device <NUM>, i.e. an empty oval <NUM> is shown instead of a switch.

A third embodiment of the method of receiving status information reflecting a current status of a device and causing status information to be presented on user devices is shown in <FIG>. In the embodiment of <FIG>, step <NUM> comprises a sub step <NUM> instead of sub step <NUM> of <FIG>, step <NUM> of <FIG> is replaced with a step <NUM> and steps <NUM> and <NUM> are performed after step <NUM>.

In the embodiment of <FIG>, the method is performed by a device other than the first device, e.g. a bridge or an Internet server. In step <NUM>, the first status information (determined in step <NUM>) is transmitted to the first user device. After it has been determined in step <NUM> that a privacy mode is active for the device whose status information was received in step <NUM>, step <NUM> is performed.

Step <NUM> comprises determining the second status information by determining a fictitious current status for the device and include the fictitious current status in the second status information upon determining that the privacy mode is active for the device. The fictitious current status may be a last known status of the device before the privacy mode was activated for the device, the fictitious current status may be randomly determined or the fictitious current status may be determined based on a plurality of previous statuses of the device, for example.

Step <NUM> comprises receiving a control command for controlling the device from the second user device. Step <NUM> comprises controlling the device according to the control command in dependence on whether the privacy mode is active for the device. If the user of the second user device is located near the device, the user would learn that the privacy mode is active for the device if it does not respond to his commands. On the other hand, the user of the second user device would likely know the actual current status of the device anyway if he is located near the device, and therefore also know that the privacy mode is active for this device.

The second status information may be updated to reflect the content of the control command in step <NUM>. In this case, if the user of the second user device is located remotely, he may get the impression that he indeed was able to control the device. This is not shown in <FIG>.

<FIG> shows a second example of a user interface shown on first and second user devices. In the example of <FIG>, a panel <NUM> is shown on display <NUM> of the second user device <NUM> instead of the panel <NUM> of <FIG>. The status information displayed in panel <NUM> has been determined in step <NUM> of <FIG> and includes a fictitious current status. Switch <NUM> shown in panel <NUM> indicates that the lighting device <NUM> is turned off, while lighting device <NUM> is in fact turned on, as shown in panel <NUM> displayed on the first user device <NUM>.

Before the privacy mode is maintained, the privacy mode is typically setup and configured. In a simple embodiment, the privacy mode is defined by the system itself, such that the user does not have any control on what and how restrictions are enabled. In another embodiment, the user could define if the whole (lighting) system or only part of it should be restricted when privacy mode is activated and how restrictive the mode should be. Moreover, the user could also define how the mode is activated, including auto activation if certain conditions are met. Moreover, the user could define visibility of the (lighting) system based on user access level including informing the user if the system is in the privacy mode.

The privacy mode is maintained as soon as it has been activated. The privacy mode could be manually enabled by the user. Alternatively, the user/system might define a set of rules when the privacy mode is enabled. These rules could include - routines and schedules (e.g. activate the privacy mode on weekends, or on a specific day defined in the schedule), associated with the state of the system (e.g. if a specific scene in the hue lights is active privacy mode is also activated), associated with the presence of a specific device or a person (e.g. if person A is detected the system automatically switches to a privacy mode), the presence based activation could also include a combination of users and devices including unknown devices and unknown people (e.g. if person A and B detected activate the privacy mode, while if A, B, and C person detected do not activate it).

In a more advanced system, the user may delegate the activation to the system, by indicating that the system should switch to private mode upon detecting events that according to the system have a high likelihood of being privacy-sensitive, e.g. the use of specific light control means or activation of a specific system state like a streaming state. The system may also have learned from previous activations of the privacy mode by the user himself, and (suggest to) activate the private mode upon detecting similar circumstances.

Similar to activation switching back to normal mode may either be manual or can be based on predefined rules. The system could switch back to normal mode if conditions for a privacy mode are not met anymore, if a timeout (timer expiry) happens (e.g. the privacy mode could only be activated for a certain time span and then need to be reactivated again), or if certain conditions are met that overrule the privacy mode (e.g. unknown person detected the privacy mode is immediately switched off), for example. If (soft) security applications are active (e.g. hue out of home), de-activation of a private mode might require user authentication.

<FIG> shows a first embodiment of a method of automatically activating and deactivating a privacy mode. A privacy mode may relate to a single device or to multiple devices. A privacy mode may relate to one or more specified devices or to all devices in a location, e.g. home. In the embodiment of <FIG>, each device can be set into privacy mode individually. In the embodiment of <FIG>, a privacy mode is automatically activated if a scene associated with the privacy mode is selected or a certain timer (of a user-specified schedule) expires. In the embodiment of <FIG>, a privacy mode is automatically deactivated if a scene not associated with any privacy mode is selected or a certain other timer (of the user-specified schedule) expires.

A step <NUM> comprises manual or automatic selection of a first scene, which is associated with one or more lighting devices and with a privacy mode for these one or more lighting devices. Step <NUM> comprises rendering this first scene on these on or more lighting devices. Step <NUM> is performed after step <NUM> and comprises activating the privacy mode for these one or more lighting devices if the privacy mode is not already active for these one or more lighting devices. Step <NUM> further comprises recording the reason for activating the privacy mode, e.g. by identifying the scene which has been selected in step <NUM>.

A step <NUM> comprises manual or automatic selection of a second scene, which is associated with the same one or more lighting devices, but is not associated with the privacy mode. Step <NUM> comprises rendering this second scene on these on or more lighting devices. Step <NUM> is performed after step <NUM>. Step <NUM> comprises checking whether the privacy mode is active and if so, whether selection of the first scene was the only reason for activating the privacy mode.

If the privacy mode is not active, then no further step is performed. If the privacy mode is active and selection of the first scene was the only reason for activating the privacy mode, then step <NUM> is performed. Step <NUM> comprises deactivating the privacy mode and removing the recorded reason for activating the privacy mode. If the privacy mode is active and selection of the first scene was not the only reason for activating the privacy mode, then step <NUM> is performed. Step <NUM> comprises removing selection of the first scene as recorded reason for automatically activating the privacy mode. Another reason for automatically activating the privacy mode may then still remain recorded, e.g. a timer of the user-specified schedule expiring.

A step <NUM> comprises a timer of the user-specified time schedule expiring. A step <NUM> comprises determining whether the expired timer corresponds to the start or end of a privacy time window. If the timer corresponds to the start of a privacy time window, step <NUM> is performed. If the timer corresponds to the end of a privacy time window, step <NUM> is performed. In an alternative embodiment, steps <NUM> and <NUM> or steps <NUM>, <NUM>, <NUM>, and <NUM> are omitted.

<FIG> shows a second embodiment of a method of automatically activating and deactivating a privacy mode. In the embodiment of <FIG>, the privacy mode is automatically activated upon detection of the presence of one or more specified persons and/or the absence of one or more specified persons.

A step <NUM> comprises identifying which persons are present. Identification of persons may be performed using cameras, for example. Alternatively, persons may be identified based on RF (e.g. Bluetooth or Wi-Fi) transmissions by their user devices.

A step <NUM> comprises checking whether a person from group X is present. If such a person's presence is detected, then step <NUM> is performed and a privacy mode associated with this event is activated for the one or more devices associated with the privacy mode, if not already activated. If such a person's presence is not detected, then step <NUM> is performed and the privacy mode is deactivated if this person's presence was the only reason for activating the privacy mode.

A step <NUM> comprises checking whether a person from group Y is present. If such a person's presence is not detected, then step <NUM> is performed and the privacy mode is deactivated if this person's presence (in combination with the presence of a person from group Z) was the only reason for activating the privacy mode. If such a person's presence is detected, then a step <NUM> is performed.

Step <NUM> comprises checking whether a person from group Z who is associated with the detected person from group Y is also present. If such a person's presence is not detected, i.e. this person is detected to be absent, then step <NUM> is performed and a privacy mode associated with this event is activated for the one or more devices associated with the privacy mode, if not already activated. If such a person's presence is detected in step <NUM>, then no further step is performed.

Step <NUM> is also performed after step <NUM>. If a person from group Z is determined to be present, then step <NUM> is performed and the privacy mode is deactivated if this person's absence (in combination with the presence of a person from group Y) was the only reason for activating the privacy mode. A person can be in both group Y and group Z, but not in both group X and group Y or in both group X and group Z.

In an example application, two users both have a control app for controlling lighting devices in their home and the first user may be able to specify that the privacy mode is automatically activated when the first user (from group Y) is detected and the second user (from group Z) is not detected and automatically deactivated again when either the first user is no longer detected or the second user is detected. In an alternative embodiment, the steps of <FIG> are combined.

<FIG> depicts a block diagram illustrating an exemplary data processing system that may perform the method as described with reference to <FIG>, <FIG>, <FIG>, <FIG>.

<FIG> shows the input device <NUM> and the output device <NUM> as being separate from the network adapter <NUM>. However, additionally or alternatively, input may be received via the network adapter <NUM> and output be transmitted via the network adapter <NUM>. For example, the data processing system <NUM> may be a cloud server. In this case, the input may be received from and the output may be transmitted to a user device that acts as a terminal.

The corresponding structures, materials, acts, and equivalents of all means or step plus function elements in the claims below are intended to include any structure, material, or act for performing the function in combination with other claimed elements as specifically claimed.

Claim 1:
A system (<NUM>,<NUM>,<NUM>) for receiving status information reflecting a current status of a device (<NUM>-<NUM>) and causing first status information to be presented on a first user device (<NUM>,<NUM>) and second status information to be presented on a second user device (<NUM>,<NUM>),
wherein the device (<NUM>-<NUM>) is a lighting device, the system (<NUM>,<NUM>,<NUM>) comprising:
at least one input interface (<NUM>,<NUM>,<NUM>);
at least one output interface (<NUM>,<NUM>,<NUM>,<NUM>); and
at least one processor (<NUM>,<NUM>,<NUM>) configured to:
- use said at least one input interface (<NUM>,<NUM>,<NUM>) to receive said status information reflecting said current status of said device (<NUM>-<NUM>),
- determine said first status information for presentation on said first user device (<NUM>,<NUM>), said first status information reflecting said current status of said device (<NUM>-<NUM>),
- use said at least one output interface (<NUM>,<NUM>,<NUM>) to cause said first status information to be presented on said first user device (<NUM>,<NUM>), and
- use said at least one output interface (<NUM>,<NUM>,<NUM>) to cause said second status information to be presented on said second user device (<NUM>,<NUM>), said second status information reflecting said current status of said device (<NUM>-<NUM>) in dependence on whether a privacy mode is active for said device (<NUM>-<NUM>),
wherein said at least one processor (<NUM>,<NUM>,<NUM>) is configured to determine a fictitious current status for said device (<NUM>-<NUM>) and include said fictitious current status in said second status information when said privacy mode is active for said device (<NUM>-<NUM>).