Building management system with identity management and assurance services
A building management system includes an entity database that stores a plurality of interconnected smart entities. The smart entities include object entities representing a plurality of people or physical devices and data entities representing data associated with the people or physical devices. The smart entities are interconnected by relational objects indicating relationships between the object entities and the data entities. Each of the object entities includes a plurality of stored identity attributes. An identity management service is configured to receive a first identity attribute from a first device within a building, receive a second identity attribute from a second device within the building, compare the first and second identity attributes to the stored identity attributes of an object entity of the plurality of interconnected smart entities, and allow access to at least one of a building space, a device of building equipment, or a computer system.
1. A building identity system of a building comprising one or more storage devices configured to store:
an entity graph, the entity graph including a plurality of entities and a plurality of relationships between the plurality of entities, wherein the plurality of entities include an entity representing a user or a device, wherein the entity graph further includes a first identity attribute of the entity associated with a first system of the building and a second identity attribute of the entity associated with a second system of the building; and
instructions that, when executed by one or more processors, cause the one or more processors to:
read at least one of the first identity attribute or the second identity attribute from the entity graph; and
manage identity verification for the user or the device for at least one of the first system of the building or the second system of the building based on at least one of the first identity attribute or the second identity attribute.
2. The building identity system of claim 1 , wherein the instructions cause the one or more processors to:
receive a first value of the first identity attribute from a first device within the building;
receive a second value of the second identity attribute from a second device within the building;
compare the first value of the first identity attribute and the second value of the second identity attribute to the first identity attribute and the second identity attribute stored by the entity graph; and
allow access to at least one of a building space, a device of building equipment, or a computer system in response to the first value matching the first identity attribute stored by the entity graph and the second value matching the second identity attribute stored by the entity graph.
3. The building identity system of claim 1 , wherein:
the first system is an access card reader and the first identity attribute is a card identity attribute recorded by the access card reader; and
the second system is a security camera and the second identity attribute is an image of a person captured by the security camera.
4. The building identity system of claim 1 , wherein:
the first system is an access card reader and the first identity attribute is a card identity attribute recorded by the access card reader; and
the second system is a mobile device carried by a person and the second identity attribute is a mobile device identity attribute associated with the mobile device.
5. The building identity system of claim 1 , wherein:
the first system is a user interface device and the first identity attribute is a user identifier received from the user via the user interface device; and
the second system is a security camera and the second identity attribute is an image of a person captured by the security camera.
6. The building identity system of claim 1 , wherein:
the first system is a user interface device and the first identity attribute is a user identifier received from the user via the user interface device; and
the second system is a mobile device carried by a person and the second identity attribute is a mobile device identity attribute associated with the mobile device.
7. The building identity system of claim 1 , wherein:
the first system is one of a mobile device, an information technology (IT) device, an internet of things (IoT) sensor, a building equipment device, or a security device; and
the second system is another of the mobile device, the IT device, the IoT sensor, the building equipment device, or the security device.
8. The building identity system of claim 1 , further comprising a plurality of devices of building equipment;
wherein the entity graph further includes an indication of a version of software installed on each of the plurality of devices of building equipment; and
wherein the instructions cause the one or more processors to:
detect the version of software installed on each of the plurality of devices of building equipment by reading the entity graph; and
update software installed on one or more of the plurality of devices of building equipment in response to a determination that the version of software installed on the one or more of the plurality of devices of building equipment is not a latest version of the software.
9. The building identity system of claim 8 , wherein the instructions cause the one or more processors to create a smart entity for each of the plurality of devices of building equipment and register each of the plurality of devices of building equipment with a corresponding smart entity.
10. The building identity system of claim 8 , wherein the instructions cause the one or more processors to create a compressed data object comprising a configuration of building equipment and store the compressed data object as a backup of the configuration.
11. The building identity system of claim 8 , wherein the instructions cause the one or more processors to generate and present a user interface that lists each device of building equipment and indicates whether a backup configuration of each of the plurality of devices of building equipment has been stored.
12. A method of identity management, the method comprising:
storing, by one or more processing circuits, an entity graph in one or more storage devices, the entity graph including a plurality of entities and a plurality of relationships between the plurality of entities, wherein the plurality of entities include an entity representing a user or a device, wherein the entity graph further includes a first identity attribute of the entity associated with a first system of the building and a second identity attribute of the entity associated with a second system of the building;
reading, by the one or more processing circuits, at least one of the first identity attribute or the second identity attribute from the entity graph; and
managing, by the one or more processing circuits, identity verification for the user or the device for at least one of the first system of the building or the second system of the building based on at least one of the first identity attribute or the second identity attribute.
13. The method of claim 12 , further comprising:
receiving, by the one or more processing circuits, a first value of the first identity attribute from a first device within the building;
receiving, by the one or more processing circuits, a second value of the second identity attribute from a second device within the building;
comparing, by the one or more processing circuits, the first value of the first identity attribute and the second value of the second identity attribute to the first identity attribute and the second identity attribute stored by the entity graph; and
allowing, by the one or more processing circuits, access to at least one of a building space, a device of building equipment, or a computer system in response to the first value matching the first identity attribute stored by the entity graph and the second value matching the second identity attribute stored by the entity graph.
14. The method of claim 12 , wherein:
the first system is an access card reader and the first identity attribute is a card identity attribute recorded by the access card reader; and
the second system is a security camera and the second identity attribute is an image of a person captured by the security camera.
15. The method of claim 12 , wherein:
the first system is an access card reader and the first identity attribute is a card identity attribute recorded by the access card reader; and
the second system is a mobile device carried by a person and the second identity attribute is a mobile device identity attribute associated with the mobile device.
16. The method of claim 12 , wherein:
the first system is a user interface device and the first identity attribute is a user identifier received from the user via the user interface device; and
the second system is a security camera and the second identity attribute is an image of a person captured by the security camera.
17. The method of claim 12 , wherein:
the first system is a user interface device and the first identity attribute is a user identifier received from the user via the user interface device; and
the second system is a mobile device carried by a person and the second identity attribute is a mobile device identity attribute associated with the mobile device.
18. The method of claim 12 , wherein:
the first system is one of a mobile device, an information technology (IT) device, an internet of things (IoT) sensor, a building equipment device, or a security device; and
the second system is another of the mobile device, the IT device, the IoT sensor, the building equipment device, or the security device.
19. An identity management system comprising one or more storage devices configured to store:
an entity graph, the entity graph including a plurality of entities and a plurality of relationships between the plurality of entities, wherein the plurality of entities include an entity representing a user or a device, wherein the entity graph further includes a first identity attribute of the entity associated with a first system of the building and a second identity attribute of the entity associated with a second system of the building; and
instructions that, when executed by one or more processors, cause the one or more processors to:
read at least one of the first identity attribute or the second identity attribute from the entity graph;
receive at least one of a first value of the first identity attribute from a first device within the building or a second value of the second identity attribute from a second device within the building; and
manage identity verification for the user or the device for at least one of the first system of the building or the second system of the building based on at least one of the first identity attribute or the second identity attribute and at least one of the first value of the first identity attribute or the second value of the second identity attribute.
20. The identity management system of claim 19 , wherein the instructions cause the one or more processors to:
compare the first value of the first identity attribute and the second value of the second identity attribute to the first identity attribute and the second identity attribute stored by the entity graph; and
allow access to at least one of a building space, a device of building equipment, or a computer system in response to the first value matching the first identity attribute stored by the entity graph and the second value matching the second identity attribute stored by the entity graph.