# US 12,603,877 B2 · Method and device for controlling the execution of at least one action of an object connected in a communication network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,877 B2 - Document ID: US12603877B2 - Status: Granted - Kind: B2 - Application number: 18/910,150 - Filed: 2024-10-09 - Published: 2025-04-10 - Granted: 2026-04-14 - Earliest claimed: 2023-10-10 - Assignees: Somfy Activites SA - Applicants: Somfy Activites SA - Inventors: Laurent Monteremand; Frédéric Janot - Web page: https://patentgrep.com/patent/US12603877B2 ## CPC - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/10: {for controlling access to devices or network resources} - G06F 21/10: Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04W 12/08: Access security - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04W 84/18: Self-organising networks, e.g. ad-hoc networks or sensor networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract This method comprises opening (82) a secure connection between a connected building object and a remote controller, implementing a first security certificate of the connected object and a second security certificate of the remote controller, and receiving via said secure connection (42) a command to perform at least one action issued by the remote controller, followed by the steps of: extracting (86) a value from a predetermined field of the second security certificate, referred to as the remote controller's access authorisation value; checking (90), in a structure for storing associations between access authorisation values and sets of authorised commands, that said received command belongs to a set of at least one authorised command associated with said access value; and if the check is positive, executing (92) at least one action associated with the received command. ## Claims ### Claim 1 A method for controlling the execution of at least one action by a connected building object in a communication network, said connected building object comprising a network interface allowing connection to said communication network, said execution of the at least one action being commanded by a remote controller adapted to connect to said communication network, the method being implemented by a processing unit of said connected building object adapted to execute the at least one action of the connected building object, and comprising at least the steps of: opening a secure connection between said connected building object and the remote controller by implementing a first security certificate of the connected building object and a second security certificate from the remote controller, wherein the step of opening the secure connection allows encrypted communication between said connected building object and the remote controller, and further comprising reception of the second security certificate from the remote controller; receiving, via said secure connection, a command to execute said at least one action issued by said remote controller, according to a communication protocol; extracting a value from a predetermined field of the remote controller's second security certificate, referred to as the remote controller's access authorisation value; checking, in a storage structure for storing associations between access authorization values and sets of authorized commands, that said received command belongs to a set of at least one authorized command associated with said access authorisation value, the storage structure being stored in an electronic memory of said connected building object; and when the check is positive, executing said at least one action associated with the received command. ### Claim 2 (depends on 1) The method according to claim 1, further comprising a step wherein, in the event of a negative check, said at least one action associated with the received command is not carried out, and a warning is sent via said secure connection. ### Claim 3 (depends on 1) The method according to claim 1, wherein the extraction step further comprises extracting a second value from a predetermined field of the second security certificate from the remote controller in order to obtain an identifier of a third party operating said remote controller. ### Claim 4 (depends on 3) The method according to claim 3, further comprising a step of storing, in an execution report, said received command in association with the identifier of the third party operating said remote controller. ### Claim 5 (depends on 1) The method according claim 1, further comprising the processing unit of the connected building object being configured to open a plurality of secure connections in parallel, wherein the opening of a secure connection with a given remote controller depends on the access authorisation value extracted from the second security certificate of said remote controller. ### Claim 6 (depends on 1) The method according to claim 1, wherein the checking step implements the storage structure in the form of a table associating, with each access authorisation value of the remote controller, a list of at least one command for the execution of at least one action by the connected building object. ### Claim 7 (depends on 1) The method according to claim 1, further comprising the connected building object storing the first security certificate of the connected building object, wherein in the step of opening the secure connection, the processing unit of the connected building object determines whether the second security certificate received from the remote controller and the first security certificate of the connected building object are signed by the same trusted third party, in order to register the second security certificate from the remote controller as a trusted security certificate in a public key infrastructure contained in its electronic memory. ### Claim 8 (depends on 1) The method according to claim 1, further comprising a step of downloading into the electronic memory of the connected building object an update file storing at least one executable program implemented by the processing unit of the connected building object, wherein the received command is one command out of a set of commands for adjusting the connected building object, wherein the at least one action associated with the received command includes executing the update file. ### Claim 9 (depends on 1) The method according to claim 1, wherein said connected building object is a home automation device of an automation system for a building. ### Claim 10 (depends on 1) A non-transitory computer readable medium comprising software instructions which, when executed by a programmable electronic device, implement the method for controlling the execution of at least one action by a connected building object according to claim 1. ### Claim 11 A system for controlling the execution of at least one action by a connected building object in a communication network, the system comprising: a remote controller adapted to connect to said communication network and to command the execution of said at least one action by the connected building object; and the connected building object; wherein the connected building object comprises: a network interface allowing connection to said communication network; a processor adapted to execute said at least one action of the connected building object, and comprising at least: an opening module that opens a secure connection between said connected building object and the remote controller by implementing a first security certificate of the connected building object and a second security certificate from the remote controller, wherein the opening of the secure connection allows encrypted communication between said connected building object and the remote controller, and further comprising reception of the second security certificate from the remote controller; a receiving module that receives, via said secure connection, a command to execute said at least one action issued by said remote controller, according to a communication protocol; a module for extracting a value from a predetermined field of the remote controller's second security certificate, referred to as the remote controller's access authorisation value; a module for checking, in a storage structure for storing associations between access authorization values and sets of authorized commands, that said received command belongs to a set of at least one authorized command associated with said access authorisation value, the storage structure being stored in an electronic memory of said connected building object; and a module for executing, when the check is positive, said at least one action associated with the received command.