WO2025157412A1 - Quarantine for household appliance - Google Patents

Abstract

A system comprises a household appliance and a controller. The household appliance comprises communications circuitry operable to transmit monitoring data to a user device via a server, the monitoring data being for monitoring operation of the household appliance at the user device. The controller is configured to receive a signal generated in dependence on a state of software on the household appliance. The controller is also configured to, in response to receiving the signal, initiate a quarantine process by interrupting transmission of the monitoring data from the household appliance to the user device via the server.

Description

QUARANTINE FOR HOUSEHOLD APPLIANCE

Technical Field

The present disclosure concerns a household appliance. In particular, but not exclusively, the present disclosure concerns measures, including apparatus, systems, methods and computer programs, for quarantining a household appliance.

Background

Household appliances, also referred to as domestic or home appliances, are used to perform household tasks such as cooking, cleaning, storing food, etc. Examples of such household appliances include ovens, refrigerators, freezers, hobs, dishwashers, washing machines, tumble dryers, air conditioning units and vacuum cleaners.

Some household appliances may be monitored by a user directly, via a display device of the household appliance, e.g. a liquid crystal display (LCD) device. The display device may display various content relating to the operation of the household appliance, such as the value of a timer, a current operating program or operating settings of the household appliance, etc. Additionally, some household appliances may be monitored by a user remotely. For example, a household appliance may be equipped with communications circuitry, such as a Wi-Fi transceiver. This allows the appliance to be monitored based on data transmitted via a communications network. A user may then use a personal user device, such as a mobile phone or smartwatch, to monitor operation of the household appliance. The household appliance may communicate with the user device via a server.

Household appliances may operate using software, e.g. firmware, executing on the household appliance. Software on the household appliance may be updated using update data received via the communications network, in an over-the-air software update process. The software may be updated, for example, when a new version of the software becomes available.

It is desirable to provide an improved household appliance and/or improved systems and methods for operating a household appliance.

Summary

According to an aspect of the present disclosure, there is provided a system comprising: a household appliance, the household appliance comprising communications circuitry operable to transmit monitoring data to a user device via a server, the monitoring data being for monitoring operation of the household appliance at the user device; and a controller configured to: receive a signal generated in dependence on a state of software on the household appliance; and in response to receiving the signal, initiate a quarantine process by interrupting transmission of the monitoring data from the household appliance to the user device via the server.

In embodiments, interrupting transmission of the monitoring data comprises preventing the communications circuitry from transmitting the monitoring data to the server.

In embodiments, interrupting transmission of the monitoring data comprises switching the communications circuitry from an activated state, in which the communications circuitry is configured to transmit the monitoring data to the server, to a deactivated state.

In embodiments, the communications circuitry comprises one or more wireless antennas, and interrupting transmission of the monitoring data comprises disabling the one or more wireless antennas.

In embodiments, when the transmission of the monitoring data is interrupted, the server is operable to receive the monitoring data from the household appliance. In some such embodiments, interrupting transmission of the monitoring data comprises preventing the server from transmitting the received monitoring data to the user device.

In embodiments, the controller is configured to, in response to receiving the signal, prevent the server from transmitting the monitoring data to a further server.

In embodiments, interrupting transmission of the monitoring data comprises discarding and/or revoking one or more credentials of the household appliance.

In embodiments, the signal is generated in dependence on a version of the software on the household appliance.

In embodiments, the signal is generated based on a comparison between the version of the software on the household appliance and a latest version of the software.

In embodiments, the signal is generated in response to an amount of traffic sent from the household appliance to the server exceeding a predetermined threshold.

In embodiments, the quarantine process comprises operating the household appliance in either a first quarantine mode having a first severity level or a second quarantine mode having a second, higher, severity level. In some such embodiments, the controller is configured to: based on the state of the software on the household appliance, determine a quarantine mode, of the first and second quarantine modes, in which the household appliance is to be operated; and cause the household appliance to be operated in the determined quarantine mode.

In embodiments, in the first quarantine mode, the household appliance is operable to send to the server configuration data for configuring the household appliance. In embodiments, in the second quarantine mode, the household appliance is prevented from sending the configuration data to the server.

In embodiments, the controller is comprised in the household appliance. In embodiments, the signal is received from the server via the communications circuitry.

In embodiments, the system comprises the server. In some such embodiments, the controller is comprised in the server.

In embodiments, the signal is received from the household appliance.

In embodiments, interrupting the transmission of the monitoring data comprises adding an identifier of the household appliance to a blacklist and/or removing the identifier of the household appliance from a whitelist.

In embodiments, the controller is configured to, in response to receiving the signal, discard monitoring data received at the server from the household appliance.

In embodiments, the controller is configured to, in response to a software update being performed on the household appliance, allow transmission of the monitoring data from the household appliance to the user device via the server.

In embodiments, prior to allowing transmission of the monitoring data from the household appliance to the user device via the server, the controller is configured to initiate a re-provisioning process for configuring communications between the household appliance and the server.

In embodiments, when the transmission of the monitoring data is interrupted, the communications circuitry is configured to receive update data for an over-the-air software update process for the household appliance, and the controller is configured to update the software on the household appliance using the received update data.

In embodiments, the update data is received from the server.

In embodiments, the communications circuitry is operable to transmit the monitoring data via a first communications channel between the household appliance and the server. In embodiments, the communications circuitry is operable to receive update data for an over-the- air software update process for the household appliance from the server via a second, different, communications channel between the household appliance and the server. In embodiments, when the transmission of the monitoring data is interrupted, the controller is configured to allow communications via the second communications channel.

In embodiments, when the transmission of the monitoring data is interrupted, the controller is configured to prevent communications via the second communications channel.

In embodiments, in response to receiving the signal, the controller is configured to cause an output device to generate an output indicating to a user of the household appliance that a software update of the household appliance is available.

In embodiments, when the transmission of the monitoring data is interrupted, the household appliance is operable to communicate with the user device via a short-range wireless communications network.

According to another aspect of the present disclosure, there is provided a system comprising: a household appliance, the household appliance comprising communications circuitry operable to transmit monitoring data to a server, wherein the household appliance is operable to perform a primary function comprising a household task, wherein the monitoring data is for monitoring performance of the primary function of the household appliance; and a controller configured to: receive a signal generated in dependence on a state of software on the household appliance; and in response to receiving the signal, initiate a quarantine process by interrupting transmission of the monitoring data from the household appliance to the server.

According to another aspect of the present disclosure, there is provided a method comprising: receiving a signal generated in dependence on a state of software on a household appliance, the household appliance comprising communications circuitry operable to transmit monitoring data to a user device via a server, the monitoring data being for monitoring operation of the household appliance at the user device; and in response to receiving the signal, initiating a quarantine process by interrupting transmission of the monitoring data from the household appliance to the user device via the server.

According to another aspect of the present disclosure, there is provided a computer program comprising a set of instructions which, when executed by a computerised device, cause the computerised device to perform a method comprising: receiving a signal generated in dependence on a state of software on a household appliance, the household appliance comprising communications circuitry operable to transmit monitoring data to a user device via a server, the monitoring data being for monitoring operation of the household appliance at the user device; and in response to receiving the signal, initiating a quarantine process by interrupting transmission of the monitoring data from the household appliance to the user device via the server.

According to yet another aspect of the present disclosure, there is provided a household appliance comprising communications circuitry operable to transmit monitoring data to a user device via a server, the monitoring data being for monitoring operation of the household appliance at the user device; and a controller configured to initiate a quarantine process by interrupting transmission of the monitoring data from the household appliance to the user device via the server in response to a signal generated in dependence on a state of software on the household appliance.

It will of course be appreciated that features described in relation to one aspect of the present invention may be incorporated into other aspects of the present invention. For example, a method of the invention may incorporate any of the features described with reference to an apparatus of the invention and vice versa.

Brief description of the drawings

Embodiments of the present disclosure will now be described by way of example only with reference to the accompanying drawings, of which:

Figure 1 is a perspective view of a household appliance according to embodiments;

Figure 2 is a schematic diagram of a system including a household appliance according to embodiments;

Figure 3 is a schematic diagram of a household appliance according to embodiments;

Figure 4 is a flow diagram showing a method according to embodiments; and

Figures 5A-5C are schematic diagrams of a system including a household appliance according to embodiments.

Detailed Description

Figure 1 shows a perspective view of a household appliance, according to embodiments. The household appliance 100, and/or components thereof, may be used to implement the methods described herein. A household (or “domestic”) appliance may be configured to perform one or more household tasks, such as cooking, cleaning, or storing food. As such, the household appliance 100 may comprise a cooking appliance, a cleaning appliance, a food storage appliance, etc. In the example shown in Figure 1, the household appliance 100 comprises an oven. Other examples of household appliances (which may be used to implement the presently-described methods) include, but are not limited to, refrigerators, freezers, air conditioning appliances, heating appliances, washing machines, tumble dryers, dishwashers, vacuum cleaners, hobs, microwaves, and toasters. The one or more household tasks performed by the household appliance 100 may be considered the primary function of the household appliance 100, which may additionally have one or more secondary functions.

In the embodiments shown in Figure 1, the household appliance 100 comprises a door 140. Opening the door 140 allows an internal cavity (not shown) of the household appliance 100 to be accessed. The door 140 may be opened and closed using a door opening mechanism 145, e.g. a handle. In alternative embodiments, for example where the household appliance 100 comprises a hob or an air conditioning unit, the household appliance 100 does not include a door or a door opening mechanism.

In the embodiments shown in Figure 1, the household appliance 100 comprises a display device 110. The display device 110 is an example of an output device. The display device 110 is operable to provide an output for a user, e.g. in the form of one or more displayed content items. In embodiments, the display device 110 comprises a liquid crystal display (LCD) device, such as a thin-film-transistor LCD (TFT LCD). In alternative embodiments, the household appliance 100 does not comprise the display device 110. In embodiments, the household appliance 100 comprises other output devices additionally or alternatively to the display device 110, such as a speaker, a haptic output device, etc. The household display may also comprise a user input device. The user input device may comprise one or more controls, knobs, dials, buttons, soft keys and/or other means for allowing a user to input instructions. The display device 110 may comprise a touch screen which also provides at least part of said user input device.

Figure 2 shows a schematic diagram of a system 200, according to embodiments. The system 200 comprises the household appliance 100 described above with reference to Figure 1. The household appliance 100 is operable to send and receive data via a communications network 210 which may comprise one or more different communication networks. The communications networks 210 may, for example, comprise a wireless communications network, such as a wireless local area network (WLAN), and one or more other networks, such as the Internet. The WLAN may be a Wi-Fi network. The communications network may additionally, or as an alternative to a Wi-Fi WLAN, comprise a Wireless Personal Area Network (WPAN) such as a Bluetooth network. Specifically, it may comprise a Bluetooth Low Energy (BLE) network. In the embodiments shown in Figure 2, the household appliance 100 comprises communications circuitry 205. In embodiments, the communications circuity 205 comprises a wireless communications unit, such as a wireless transceiver. For example, the communications circuitry 205 may comprise one or more wireless antennas. The communications circuitry 205 may comprise a printed circuit board (PCB) including both a transmitter and a receiver, or may comprise separate transmitter and receiver PCBs. The household appliance 100 can send and/or receive data via the communications network 210 through use of the communications circuitry 205. That is, the household appliance 100 may be able to send data, receive data, or both send and receive data. In embodiments, operation of the household appliance 100 may be monitored based on monitoring data sent via the communications circuitry 205. In some embodiments, operations of the household appliance 100 may be controlled remotely in accordance with remote control data received through the communications circuitry.

In embodiments, the communications unit 205 comprises a Wi-Fi unit operable to send data for monitoring the household appliance 100 to a server via the Internet. For example, the communications circuitry 205 may be configured to communicate with a gateway, e.g. a WiFi router. As mentioned above, the network 210 may comprise the Internet and/or a home network. In alternative embodiments, the household appliance 100 comprises communications circuitry that is not configured to perform wireless communications. For example, such communications circuitry may be configured to allow monitoring of the household appliance 100 via an Ethernet connection, or other wired communications mechanism. The methods described herein may also be implemented using such communications circuitry.

The system 200 also comprises a server 220. The server 220 is remotely located from the household appliance 100. The server 220 is operable to send and/or receive data via the communications network 210. As such, the server 220 is operable to receive monitoring data from the household appliance 100, for monitoring operation of the household appliance 100. In some embodiments, the server 220 is also operable to send remote control data to the household appliance 100, for remotely controlling operation of the household appliance 100. In some embodiments, the server 220 is operable to communicate with the household appliance 100 without the use of the communications network 210. For example, the server 220 and the household appliance 100 may communicate with one another via one or more cables and/or wires. As such, the communications network 210 may be omitted in some embodiments. In embodiments, the system 200 also comprises a user device 230. The user device 230 may be remotely located from the household appliance 100, although it will be understood that in some embodiments (or during some time periods) the user device 230 is not located remotely from the appliance 100. The user device 230 may be referred to as a “personal device” of a user of the household appliance 100. The user device 230 may comprise a mobile phone, personal computer, smartwatch device, tablet computer, etc. The user device 230 is operable to send and/or receive data via the communications network 210. For example, the user device 230 may be operable to receive data from the server 220 and/or directly or indirectly from the household appliance 100. In embodiments, the user device 230 may be used to monitor (e.g. remotely monitor) operation of the household appliance 100.

When operation of the household appliance 100 is to be monitored via the user device 230, the communications circuitry 205 is operable to transmit monitoring data to the user device 230 via the server 220. In some embodiments, the appliance 100 sends monitoring data to the server 220, which then forwards the received monitoring data to the user device 230. Alternatively, the appliance 100 may send first monitoring data to the server 220, and the server 220 may generate second monitoring data, using the first monitoring data, and send the second monitoring data to the user device 230. Accordingly, the server 220 may either simply forward data received from the appliance 100 to the user device 230, or may modify the received data, and/or generate new data, for sending to the user device 230. It will be understood that in either case, the appliance 100 transmits monitoring data to the user device 230 via the server 220.

In embodiments, the monitoring data sent from the appliance 100 indicates operational information of the appliance 100. The operational information may include, for example, the status of the household appliance 100, one or more operating parameters of the household appliance 100, an operating program of the household appliance 100, sensor data generated by one or more sensors of the household appliance 100, the value of a timer associated with the household appliance 100, user inputs received at the appliance, etc. For example, where the appliance 100 comprises a cooker, the operational information may include a current cooking temperature, a current cooking program, a time until the current cooking program is completed, an event corresponding to, for example, a user input to turn the cooker on or turn the cooker off or other user action on the cooker, etc. As such, the operational information indicated by the monitoring data may be dynamic, i.e. changing over time. In response to receiving such data, the server 220 is configured to send monitoring data (which may be the same as the received monitoring data, or may be different monitoring data) indicative of the operational information of the household appliance 100 to the user device 230. The user device 230 may then output the operational information to the user, e.g. via a visual display of the user device 230. This allows the user to monitor operation of the household appliance 100 via the user device 230, which may (in some embodiments, in some circumstances and/or during some time periods) be located remotely from the household appliance 100.

In embodiments, the household appliance 100 is configured to communicate with the user device 230 directly, additionally or alternatively to communicating via the server 220. For example, the household appliance may be configured to communicate with the user device 230 via a short-range wireless communications network, e.g. via Bluetooth. For example, the household appliance 100 may communicate directly with the user device 230 using WLAN technology or WPAN technology and may also communicate with the server 220, and indirectly with the user device 230, using WLAN technology and the Internet. As such, in embodiments, the communications circuitry 205 of the appliance 100 may comprise a short- range wireless communication unit such as a BLE communication unit. In alternative embodiments, the household appliance 100 is configured to communicate with the user device 230 via the server 220 but is not able to communicate with the user device 230 directly.

In embodiments, the household appliance 100 may also be monitored by a user directly, i.e. without the use of a user device 230 or server 220. For example, where the household appliance 100 comprises a display device such as the display device 110 described above with reference to Figure 1, the user may monitor operation of the household appliance 100 via the display device 110 of the household appliance 100 instead of, or in addition to, the user device 230. In some embodiments, the household appliance 100 may be monitored both directly and indirectly using the user device 230.

In embodiments, the server 220 comprises a controller (not shown) capable of controlling the household appliance 100 and/or the user device 230. In embodiments, the controller of the server 220 is configured to control the transmission of monitoring data from the appliance 100 to the user device 230 via the server 220, e.g. by controlling the communications circuitry 205 of the appliance 100, as will be described in more detail below. Additionally or alternatively, the controller of the server 220 may be configured to control a display (not shown) of the user device 230 to enable monitoring of the household appliance 100 via the user device 230.

In embodiments, the system 200 comprises a further household appliance (not shown). The further household appliance may be configured to communicate with the first household appliance 100 via the network 210. Such communication may be provided via the server 220 or may be direct, i.e. without the server 220. The first household appliance 100 and the further household appliance may comprise different types of household appliance. For example, the first household appliance 100 may comprise an oven and the further household appliance may comprise a hob. In embodiments, the further household appliance comprises a controller (not shown) operable to control the first household appliance 100. In embodiments, the first household appliance 100 is configured to control the further household appliance. In alternative embodiments, the system 200 does not comprise a further household appliance.

In embodiments, the system 200 comprises a further server (not shown). The further server may be configured to communicate with the server 220. For example, the server 220 may be configured to send monitoring data for monitoring the household appliance 100 to the further server. The further server may, in turn, be arranged to communicate with one or more further household appliances, further user devices, and/or still further servers. In alternative embodiments, the system 200 does not comprise a further server. Although throughout the description will refer to a server or further server, it will be understood that the server and the further server could, each or together, comprise at least parts of one or more distinct servers communicatively connected in a computing cloud. The functions of the server and the further server could be distributed across one or more of the servers of the computing cloud.

In embodiments, the system 200 comprises a quarantine orchestrator entity (not shown). The quarantine orchestrator entity may be configured to manage and/or orchestrate the quarantining of household appliances. The quarantine orchestrator entity comprises a network node such as a server, and may be configured to communicate with the server 220 and/or with the appliance 100. In alternative embodiments, the system 200 does not comprise a quarantine orchestrator entity. As will be discussed below, quarantining of household appliances may instead be managed and/or orchestrated by the server 220, by the appliance 100, or by a combination of both. Accordingly, a quarantine orchestrator entity may be omitted in some embodiments. In some cases, quarantining of household appliances is managed and/or orchestrated by a quarantine orchestrator entity in combination with the server 220 and/or the appliance 100.

Figure 3 shows a schematic block diagram of the household appliance 100, according to embodiments.

In the embodiments shown in Figure 3, the household appliance 100 comprises a controller 310. The controller 310 is operable to perform various data processing and/or control functions, as will be described in more detail below. The controller 310 may comprise one or more components. The one or more components may be implemented in hardware and/or software. The one or more components may be co-located or may be located remotely from each other in the household appliance 100. The controller 310 may be embodied as one or more software functions and/or hardware modules. In embodiments, the controller 310 comprises one or more processors configured to process instructions and/or data. Operations performed by the one or more processors may be carried out by hardware and/or software. The controller 310 may be configured to implement at least some of the methods described herein. In embodiments, the controller 310 is operable to output control signals for controlling one or more components of the household appliance 100. In embodiments, the controller 310 is operable to receive signals from one or more components of the household appliance 100, and to control one or more components of the household appliance 100 based on such received signals. In alternative embodiments, at least some of the methods described herein are implemented by a controller that is not comprised in the household appliance 100. For example, the relevant methods may be implemented by a controller of a server, such as the server 220 described above with reference to Figure 2. The controller of the server may be implemented in a similar manner to that described with respect to the controller 310 of the appliance 100. Accordingly, the controller 310 of the household appliance 100, or at least the controller functionality associated with the relevant methods described herein, may be omitted in some embodiments.

The household appliance 100 comprises communications circuitry 205, such as a WiFi unit, as described with reference to Figure 2 above. In embodiments, the controller 310 is operable to control the communications circuitry 205. In particular, the controller 310 is operable to cause the communications circuitry 205 to transmit signals to a server, e.g. via a network. For example, the controller 310 may be operable to send signals to the communications circuitry 205 to enable remote monitoring of the household appliance 100. Additionally or alternatively, the controller 310 may be operable to receive signals from the communications circuitry 205. Such signals may be based on data received via the communications circuitry 205 from a server, for example.

In embodiments, the household appliance 100 comprises a display device 110, as described with reference to Figure 1 above. The controller 310 is operable to control the display device 110, e.g. to cause the display device 110 to display an output for a user. In embodiments, the controller 310 is operable to control the content displayed by the display device 110. For example, the controller 310 may be operable to cause predetermined content to be displayed or not displayed by the display device 110, and/or to adjust the content displayed by the display device 110.

In embodiments, the household appliance 100 comprises a door 140, as described with reference to Figure 1 above. In embodiments, the controller 310 is operable to receive a signal generated in response to a user opening and/or closing the door 140, e.g. by such an operation being sensed by sensor equipment. The controller 310 may be operable to control the household appliance 100 in response to receipt of such a signal.

In embodiments, the household appliance 100 comprises a user input device 320. The user input device 320 may comprise a touch screen device, for example. The controller 310 is operable to receive signals generated in response to a user interacting with the user input device 320, e.g. by such an operation being sensed by one or more sensors. The controller 310 may be operable to control the appliance 100 in response to receipt of such a signal.

In embodiments, the household appliance 100 comprises a heating element 330. The heating element 330 may, for example, be operable to convert electrical energy into heat. The heating element 330 may be controlled by a user of the household appliance, e.g. by activating the heating element 330 and/or setting a desired operating temperature of the household appliance 100. In embodiments, the controller 310 is operable to receive a signal generated in response to a user attempting to control the heating element 330, e.g. by such an operation being sensed by one or more sensors and/or being detected upon actuation of a user input device. The controller 310 may be operable to control the household appliance 100 in response to receipt of such a signal. In embodiments, the controller 310 is operable to control the heating element. For example, the controller 310 may be operable to apply energy (e.g. electrical energy) to the heating element 330, e.g. via one or more control signals generated by the controller 310.

In embodiments, the household appliance 100 comprises a timer 340. The timer 340 may be controlled by a user of the household appliance 100, e.g. to set a desired time after which an alarm may sound and/or operation of the household appliance 100 may start or stop. In embodiments, the controller 310 is operable to receive a signal generated in response to a user attempting to control the timer 340, e.g. by such an operation being sensed by one or more sensors and/or being detected upon actuation of a user input device. The controller 310 is operable to control the household appliance 100 in response to receipt of such a signal. In embodiments, the controller 310 is operable to control the timer 340. In embodiments, the household appliance 100 also comprises one or more sensors 350. The one or more sensors 350 may be arranged to sense performance and/or operation of the household appliance 100. The one or more sensors 350 may comprise heat sensors, motion sensors, image sensors, etc. In embodiments, the one or more sensors 350 are configured to sense user input at a user input device, e.g. a touch screen. For example, the one or more sensors 350 may comprise resistive or capacitive sensors or other sensors of a touch screen interface. In embodiments, the one or more sensors 350 are configured to output sensor data to the controller 310, to enable the controller 310 to control the household appliance 100 on the basis of sensor data. As such, the controller 310 may be operable to receive sensor data (e.g. signals comprising the sensor data) from the one or more sensors 350. In embodiments, the controller 310 is operable to control the one or more sensors 350, e.g. via one or more control signals generated by the controller 310.

The household appliance 100 also comprises a memory 360. The memory 360 is operable to store various data according to embodiments. The memory may comprise at least one volatile memory, at least one non-volatile memory, and/or at least one data storage unit. The volatile memory, non-volatile memory and/or data storage unit may be configured to store computer-readable information and/or instructions for use/execution by the controller 310.

The household appliance 100 may comprise more, fewer and/or different components in alternative embodiments. In particular, at least some of the components of the household appliance 100 shown in Figures 1, 2 and/or 3 may be omitted (e.g. may not be required) in some embodiments. For example, at least one of the display device 110, door 140, door opening mechanism 145, communications unit 205, user input device 320, heating element 330, timer 340, sensors 350 and memory 360 may be omitted in some embodiments. In some embodiments, the household appliance 100 does not comprise the controller 310 or at least some of the components of the controller 310. For example, the controller 310, or components of the controller, may be comprised in a further entity (e.g. a server or a further household appliance) that is capable of communicating with and optionally controlling the household appliance 100. The household appliance 100 may also comprise other components, in addition to or instead of for example the heating element, for realising the function(s) of the household appliance 100, such as one or more of the following components: a pump arrangement, a drum drive arrangement, a heat-pump arrangement, condensers, compressors, motors, fans and/or ionisers. Figure 4 shows a method 400 according to embodiments. The method 400 may be used to operate a system comprising the household appliance 100 described above with reference to Figures 1 to 3. The household appliance 100 comprises communications circuitry 205. The communications circuitry 205 is operable to transmit monitoring data to a user device 230 via a server 220, the monitoring data being for monitoring operation of the household appliance at the user device 230. In embodiments, the method 400 is performed at least in part by the controller 310 of the household appliance 100. That is, the controller 310 is configured to perform at least some of the steps of the method 400. In alternative embodiments, the method 400 is performed at least in part by a controller that is separate from the household appliance 100. For example, the method 400 may be performed at least in part by a controller of the server 220, or by a controller of a quarantine orchestrator entity that is configured to manage and/or oversee the quarantining of household appliances. In alternative embodiments, some of the steps of the method 400 are performed by the controller 310 of the household appliance 100 and some other steps of the method 400 are performed by a controller of the server 220 and/or of the quarantine orchestrator entity.

In step 410, a signal generated in dependence on a state of software on the household appliance 100 is received.

In step 420, in response to receiving the signal, a quarantine process is initiated by interrupting transmission of the monitoring data from the household appliance 100 to the user device 230 via the server 220.

As such, the household appliance 100 is quarantined based on the state of software on the household appliance 100. The state of the software may include, for example, which version of the software is currently running on the appliance 100, whether or not a particular software update has been successfully installed on the appliance 100, whether the software on the appliance 100 is associated with an identified security issue, etc. By interrupting transmission of the monitoring data in dependence on the state of the software on the household appliance 100, the household appliance 100 may be isolated, or ‘quarantined’, from one or more entities that are (directly or indirectly) communicatively coupled to the appliance 100, such as the server 220, the user device 230, other household appliances, other servers and/or other user devices. Those entities can therefore be protected from data, originating at the household appliance 100, which might negatively impact them. For example, if the household appliance 100 is running a software version that is unstable and/or has code defects or bugs, the appliance 100 may try to send excess data to the server 220, which may be difficult for the server 220 to handle and/or which may cause processing and/or storage issues at the server 220 or at other entities in communication with the server 220. As another example, if the appliance 100 is missing a particular software update, the appliance 100 may be vulnerable to breaches of security. Such breaches may cause the appliance 100, unbeknownst to the user of the appliance 100, to send potentially harmful data to the server 220. By quarantining the appliance 100 in dependence on the state of software on the appliance 100, the impact of such issues may be reduced and/or avoided.

As mentioned, the communications circuitry 205 is able, when the appliance 100 is not quarantined, to transmit monitoring data to the user device 230 via the server 220. Such monitoring data may be transmitted from the appliance 100 continuously, periodically, and/or when requested by the server 220. In embodiments, the monitoring data is transmitted from the appliance 100 in response to a trigger. The trigger may comprise the expiry of a predetermined time period from a previous transmission of monitoring data, the receipt of a request for the monitoring data from the server 220, a change in operating state of the appliance 100, detection of a user input by a user, etc. When the quarantine process is initiated, transmission of the monitoring data from the appliance 100 to the user device 230 via the server 220 is interrupted. In embodiments where, when the appliance 100 is not under quarantine, the monitoring data is transmitted periodically or in response to a trigger, interrupting transmission of the monitoring data (to place the appliance 100 under quarantine) may comprise preventing the transmission of the monitoring data (and optionally preventing future transmissions) from the appliance 100 to the user device via the server 220.

In embodiments where the method 400 is performed at least in part by a controller 310 of the household appliance 100, the signal received at step 410 may be received from the server 220 via the communications circuitry 205. Alternatively, the signal may be received from a quarantine orchestrator entity. In either case, such a signal may comprise an instruction for the appliance 100 to enter a quarantine mode. Alternatively, the signal may be generated by the appliance 100 itself, independently of the server 220.

In embodiments where the method 400 is performed at least in part by a controller of the server 220, or of a quarantine orchestrator entity distinct from the server 220, the signal received at step 410 may be received from the household appliance 100. Such a signal may comprise data indicating the state of the software on the appliance 100, e.g. which version of the software is currently running on the appliance 100. The server 220 (or the quarantine orchestrator entity) may then initiate a quarantine process for the appliance 100 based on the received information. Alternatively, the signal may be generated by the server or quarantine orchestrator entity themselves, independently of the household appliances, by analysing stored data associated with the state of software on the household appliance held by the server, quarantine orchestrator entity or other entity.

In embodiments, interrupting transmission of the monitoring data comprises preventing the communications circuitry 205 from transmitting the monitoring data to the server 220. That is, the appliance 100 is prevented from sending to the server 220 monitoring data which would otherwise be sent, thereby interrupting transmission of the monitoring data from the appliance 100 to the user device 230 via the server 220. This may protect the server 220 (as well as other entities in communication with the server 220, such as the user device 230) from excess and/or potentially harmful data that could otherwise be sent from the appliance 100. Preventing the communications circuitry 205 from transmitting the monitoring data may be caused by the server 220 (e.g. based on an instruction received at the appliance 100 from the server 220), or alternatively may be performed by the appliance 100 independently of the server 220 (e.g. based on an instruction generated by the controller 310 of the appliance 100).

In embodiments, interrupting transmission of the monitoring data comprises switching the communications circuitry 205 from an activated state, in which the communications circuitry 205 is configured to transmit the monitoring data to the server 220, to a deactivated state. When the communications circuitry 205 is in the deactivated state, the household appliance 100 is unable to send monitoring data to the server 220. For example, where the method 400 is performed at least in part by the controller 310 of the appliance 100, the controller 310 may be configured to switch the communications circuitry 205 from the activated state to the de-activated state via one or more control signals generated by the controller 310. In embodiments, deactivating the communications circuitry 205 may involve disabling a Wi-Fi function of the appliance 100. In embodiments, the communications circuitry 205 comprises one or more wireless antennas, and interrupting transmission of the monitoring data comprises disabling the one or more wireless antennas. The one or more wireless antennas may, when they are not disabled, be operable to transmit and/or receive signals via a wireless communications network, such as a WLAN or WPAN. Accordingly, disabling the one or more wireless antennas prevents the household appliance 100 from sending the monitoring data (and optionally also other data) to the server 220. In embodiments, the method 400 comprises preventing the communications circuitry 205 from being switched from the deactivated state back to the activated state. For example, where a Wi-Fi function of the appliance 100 is disabled, a corresponding icon on a user interface of the appliance 100 and/or the user device 230 may be “greyed out” to prevent a user from re-enabling the Wi-Fi function of the appliance 100 until the quarantine has been lifted. In embodiments, interrupting transmission of the monitoring data comprises the appliance 100 discarding, or “forgetting”, a password of the home network, e.g. a Wi-Fi password. Such an action may be performed in response to receipt of an instruction from the server 220, for example.

In embodiments, when the transmission of the monitoring data is interrupted (that is, during the quarantine of the appliance 100), the server 220 is operable to receive the monitoring data from the household appliance 100. In such embodiments, interrupting transmission of the monitoring data comprises preventing the server 220 from transmitting the received monitoring data to the user device 230. As such, in some embodiments, the appliance 100 continues to send the monitoring data to the server 220, but the server 220 does not send monitoring data to the user device 230, thereby interrupting transmission of the monitoring data from the appliance 100 to the user device 230 via the server 220. Therefore, interrupting transmission of the monitoring data from the appliance 100 to the user device 230 via the server 220 may occur at the appliance 100 (e.g. by preventing the appliance 100 from sending the monitoring the data to the server 220) and/or at the server 220 (e.g. by preventing the server 220 from sending the monitoring data to the user device 230).

In embodiments, the server 220 is prevented from sending the monitoring data to the user device 230 based on a signal received from the appliance 100. For example, the appliance 100 may send a signal to the server 220 indicating the state of the software on the appliance 100 (e.g. which version of the software is running on the appliance 100), and the server 220 may cease sending monitoring data to the user device 230 in response to receipt of the signal. Additionally or alternatively, the appliance 100 may send a signal to the server 220 comprising an instruction to cease sending monitoring data to the user device 230, the instruction being generated in dependence on the state of the software on the appliance 100.

In embodiments, the method 400 comprises, in response to receiving the signal, preventing the server 220 from transmitting the monitoring data to a further server. This protects the further server (and optionally also further entities in communication with the further server) from excess and/or potentially harmful data originating at the appliance 100. The further server may be operable to communicate with further household appliances, further user devices, and/or still further servers. In embodiments, the server 220 is prevented from transmitting the monitoring data to the user device 230, to the further server, or to both the user device 230 and the further server. In embodiments, when the appliance 100 is not in the quarantined state, the server 220 is operable to transmit monitoring data for monitoring the appliance 100 to one or more further household appliances and/or one or more further user devices. The one or more further household appliances and/or one or more further user devices may be used, additionally or alternatively to the user device 230, to monitor operation of the household appliance 100. In some such embodiments, interrupting transmission of the monitoring data comprises preventing the server 220 from transmitting the monitoring data to the one or more further household appliances and/or one or more further user devices.

In embodiments, interrupting transmission of the monitoring data comprises discarding and/or revoking one or more credentials of the household appliance 100. The one or more credentials may comprise a digital identifier of the appliance 100, a password, a certificate, etc. The one or more credentials may be used to permit (and selectively deny) data originating from the appliance 100 to be sent to the user device 230 and/or other entities. In embodiments, the one or more credentials are known to both the appliance 100 and the server 220. Discarding and/or revoking the one or more credentials may be performed at the appliance 100 and/or at the server 220. For example, in embodiments, the server 220 may instruct the appliance 100 to discard its own credentials. Once the credentials of the appliance 100 are lost, the appliance 100 is no longer able to transmit monitoring data to the user device 230 via the server 220. In some cases, the appliance 100 may discard its credentials independently of the server 220, e.g. in response to the appliance 100 itself identifying a security issue on the appliance 100. In embodiments, interrupting transmission of the monitoring data comprises the server 220 revoking the one or more credentials of the household appliance 100. Once the credentials are revoked by the server 220, the appliance 100 is not able to transmit monitoring data to the user device 230 via the server 220. In embodiments, the revoked credentials may be restored when the quarantine of the household appliance 100 is to be lifted.

In embodiments, the signal received at step 410 is generated in dependence on a version of the software on the household appliance 100. In embodiments, the signal is generated based on a comparison between the version of the software on the household appliance 100 and a latest version of the software. For example, if the version of the software on the appliance 100 is determined not to be the latest version of the software (e.g. if the appliance 100 is missing a particular software update), then the quarantine process for the appliance 100 may be initiated. The user may be given an opportunity to update the software to the latest version before the quarantine process is initiated, as will be described in more detail below. In embodiments, the signal comprises data indicating the version of the software on the household appliance 100. For example, the appliance 100 may send the signal to the server 220 to inform the server 220 (or a quarantine orchestrator entity) of the version of the software on the appliance 100. In embodiments, the signal is generated in response to a determination that the version of the software on the appliance 100 is not a latest and/or a desired version of the software. For example, the server 220 or quarantine orchestrator entity may send the signal to the appliance 100 in response to determining that the software running on the appliance 100 is not the latest version of the software.

In embodiments, the signal is generated in response to an amount of traffic sent from the household appliance 100 to the server 220 exceeding a predetermined threshold. If the software running on the appliance 100 has code defects or is unstable, this may cause the appliance 100 to send excess traffic to the server 220. The server 220 may compare the amount of traffic (e.g. monitoring data) received from the appliance 100 with a predetermined threshold, and if the amount of received traffic from the appliance 100 exceeds the threshold, the quarantine process for the appliance 100 is initiated. As such, the server 220 and/or other entities in communication with the server 220 may be protected from excess traffic which could potentially cause processing, transmission and/or storage issues. Again, the user may be given an opportunity to update the software to address any defects before the quarantine process is initiated.

In embodiments, the method 400 comprises, in response to receiving the signal, discarding monitoring data received at the server 220 from the household appliance 100. That is, rather than forwarding the monitoring data to other entities (e.g. the user device 230), storing the monitoring data or otherwise processing the monitoring data, the received monitoring data is discarded. This reduces the impact, e.g. in terms of storage and/or processing at the server 220, of excess and/or potentially harmful data being transmitted from the household appliance 100.

In embodiments, interrupting the transmission of the monitoring data comprises adding an identifier of the household appliance 100 to a blacklist and/or removing the identifier of the household appliance 100 from a whitelist. The blacklist and/or whitelist may be stored and managed at the server 220 or at a further entity, such as a quarantine orchestrator entity. The identifier of the appliance 100 may comprise a certificate number of the appliance 100, for example. The certificate number or other identifier of the appliance 100 may be provided to the server 220 during a provisioning process of the appliance 100. In embodiments, adding the identifier to the blacklist and/or removing the identifier from the whitelist enables monitoring data received at the server 220 from the appliance 100 to be ignored and/or discarded, rather than being forwarded to the user device 230 or other entities, stored or further processed.

In embodiments, interrupting the transmission of the monitoring data comprises a combination of actions described above. For example, the one or more credentials of the appliance 100 may be discarded at the appliance 100 and also may be revoked at the server 220. Similarly, the communications circuitry 205 of the appliance 100 may be deactivated and the server 220 may also add an identifier of the appliance 100 to a blacklist, etc.

In embodiments, the quarantine process comprises operating the household appliance 100 in either a first quarantine mode having a first severity level or a second quarantine mode having a second, higher, severity level. The first quarantine mode may be referred to as “soft quarantine” and the second quarantine mode may be referred to as “hard quarantine”. In embodiments, the method 400 comprises determining, based on the state of the software on the household appliance 100, a quarantine mode, of the first and second quarantine modes, in which the household appliance 100 is to be operated, and causing the household appliance 100 to be operated in the determined quarantine mode.

The determination of whether the appliance 100 is to be operated in the soft quarantine mode or the hard quarantine mode may be made based on a severity of one or more issues that could potentially arise from the state of the software on the appliance 100. For example, the soft quarantine mode may be imposed if the appliance 100 is running a version of software that is unstable or has coding defects which has the potential to cause behaviours such as sending excess traffic to the server 220. Such behaviours, if left unchecked, could cause difficulties for the server 220 and/or other entities in communication with the server 220, but may be deemed to be less severe than behaviours impacting security, safety, etc. The hard quarantine mode, on the other hand, may be imposed if the appliance 100 is missing a software update which potentially impacts security or safety, for example, or if malware is detected on the appliance 100. As such, in embodiments, the appliance 100 is operated in the hard quarantine mode as opposed to the soft quarantine mode if the state of the software on the appliance 100 indicates a safety or security issue. Therefore, a more flexible and adaptable quarantining mechanism is provided for the appliance 100, where the severity of the quarantine is dependent on the severity of the determined software issue and/or the potential impact of such.

In embodiments, the determination of whether the appliance 100 is to be operated in the soft quarantine mode or the hard quarantine mode is made by the server 220. In alternative embodiments, the determination is made by the appliance 100 itself, independently of the server. In further alternative embodiments, the determination is made by a further entity, such as a quarantine orchestrator entity configured to manage and/or oversee the quarantining of household appliances.

In embodiments, one or more functions of the household appliance 100 that are enabled when the household appliance 100 is operated in the soft quarantine mode, are disabled when the household appliance 100 is operated in the hard quarantine mode. This is in addition to the transmission of monitoring data from the appliance 100 to the user device 230 via the server 220, which is interrupted in both hard and soft quarantine modes (though may, optionally, be interrupted using different methods in the different quarantine modes). In embodiments, the one or more functions comprise an ability of the household appliance 100 to receive update data for an over-the-air software update from the server 220 and/or from other servers. In embodiments, the one or more functions comprise an ability of the household appliance 100 to send configuration data for configuring the appliance 100 to the server 220, and/or to receive configuration data from the server 220. The configuration data may comprise, for example, data indicating one or more credentials and/or identifiers of the appliance 100, data indicating one or more properties and/or settings of a home network, data identifying the user device 230 to be used for monitoring the appliance 100, etc. The configuration data is different to the monitoring data. As such, in embodiments, in the soft quarantine mode the household appliance 100 is operable to send to the server 220 configuration data for configuring the household appliance 100, and in the hard quarantine mode the household appliance 100 is prevented from sending the configuration data to the server 220. Therefore, the appliance 100 may be able to communicate with the server 220 in the soft quarantine mode but may be prevented from communicating with the server 220 in the hard quarantine mode. The configuration data and/or the update data may be communicated between the appliance 100 and the server 220 via a communications channel that is separate (e.g. logically separate) from the communications channel that is used for the transmission of monitoring data from the appliance 100 to the server 220, as will be discussed below.

In embodiments, interrupting the transmission of the monitoring data from the appliance 100 to the user device 230 via the server 220 comprises performing a first action if the appliance 100 is to be operated in the soft quarantine mode, and performing a second, different action if the appliance 100 is to be operated in the hard quarantine mode. For example, if the appliance 100 is to be operated in the soft quarantine mode, interrupting the transmission of the monitoring data may comprise, at the server 220, adding an identifier of the appliance 100 to a blacklist and/or temporarily revoking one or more credentials of the appliance 100. Such actions may be reversed in order to lift the quarantine of the appliance 100, without the need for re-provisioning of the appliance 100. If the appliance 100 is to be operated in the hard quarantine mode, on the other hand, interrupting the transmission of the monitoring data may comprise the appliance 100 discarding its own credentials, disabling the communications circuitry 205, etc. Such actions may require re-provisioning of the appliance 100 in order for the quarantine to be lifted and for transmission of the monitoring data to resume.

In embodiments, causing the household appliance 100 to be operated in the soft quarantine mode may be performed autonomously, without human intervention. Similarly, lifting the quarantine of the appliance 100 in such circumstances may be performed when a software update is performed on the appliance by a user without further human intervention. On the other hand, in some embodiments, causing the appliance 100 to be operated in the hard quarantine mode and/or lifting the quarantine of the appliance 100 when it has been operated in the hard quarantine mode may involve human oversight, e.g. by an information security officer.

In embodiments, the method 400 comprises, in response to a software update being performed on the household appliance 100, allowing transmission of the monitoring data from the household appliance 100 to the user device 230 via the server 220. In other words, in response to the software update being performed, the quarantine of the appliance 100 may be lifted. Performing the software update may comprise installing a security patch on the household appliance 100, updating the software to a latest version of the software, etc. Performing the software update may comprise a user initiating the software update or at least a user giving permission for a software update, via a user input device on the appliance and/or on the user device.

In embodiments, the method 400 comprises, prior to allowing transmission of the monitoring data from the household appliance 100 to the user device 230 via the server 220, initiating a re-provisioning process for configuring communications between the household appliance 100 and the server 220. The re-provisioning process may be performed prior to, after, or simultaneously with, a software update being performed on the household appliance 100. In embodiments, the software update is performed in response to completion of the reprovisioning process. In alternative embodiments, the re-provisioning process is initiated in response to the software update being performed. Whether or not the re-provisioning process is performed may depend on a quarantine mode in which the appliance 100 has been operated. That is, the re-provisioning process may be performed if the appliance 100 has been operated in the hard quarantine mode, but not if the appliance 100 has been operated in the soft quarantine mode. This may be because, for example, in the hard quarantine mode the credentials of the appliance 100 are discarded by the appliance 100 (and thus the establishment of new credentials may be required or the previous credentials recovered), whereas in the soft quarantine mode the credentials of the appliance 100 are not discarded by the appliance 100.

In embodiments, the re-provisioning process is performed at least in part by the user device 230, which may be communicatively coupled directly to the appliance 100 via a short- range wireless communications network. In embodiments, the re-provisioning process comprises enabling a Wi-Fi function of the appliance 100 and/or connecting the appliance 100 to a home network. In embodiments, the re-provisioning process comprises configuring a communications channel between the appliance 100 and the server 220 and/or between the appliance 100 and the user device 230. In embodiments, the re-provisioning process comprises establishing (or re-establishing) one or more credentials of the appliance 100.

In embodiments, when the transmission of the monitoring data is interrupted, the communications circuitry 205 is configured to receive update data for an over-the-air software update process for the household appliance 100. In such embodiments, the method 400 comprises updating the software on the household appliance 100 using the received update data. In embodiments, the update data is received from the server 220 or from another dedicated over-the-air update server. This may be the case, for example, when the appliance 100 is operated in the soft quarantine mode, in which the appliance 100 remains capable of receiving update data from the server 220. In alternative embodiments, the update data is received directly from the user device 230, e.g. via short-range wireless communications between the user device 230 and the appliance 100. This may be the case, for example, when the appliance 100 is operated in the hard quarantine mode, in which the appliance 100 is not able to receive data from the server 220.

In embodiments, the communications circuitry 205 is operable to transmit the monitoring data via a first communications channel between the household appliance 100 and the server 220. In embodiments, the communications circuitry 205 is operable to receive update data for an over-the-air software update process for the household appliance 100 from the server 220 via a second, different, communications channel between the household appliance 100 and the server 220. In embodiments, the second communications channel may additionally or alternatively be used for sending configuration data from the appliance 100 to the server 220 and/or from the server 220 to the appliance 100, as discussed above.

In embodiments, the method 400 comprises, when the transmission of the monitoring data is interrupted, allowing communications via the second communications channel. This may correspond to the soft quarantine mode discussed above. That is, transmission of monitoring data via the first channel may be interrupted, but the receipt of software updates via the second channel is permitted. This allows the server 220 to trigger a software update on the household appliance 100, by sending update data via the second channel. As such, the software update may be performed independently of a user. Such a software update may enable the quarantine of the household appliance 100 to be lifted.

In alternative embodiments, the method 400 comprises, when the transmission of the monitoring data is interrupted, preventing also communications via the second communications channel. This may correspond to the hard quarantine mode discussed above. That is, transmission of monitoring data via the first channel may be interrupted, and the receipt of software updates via the second channel is also prevented. In such embodiments, software updates on the household appliance 100 may require the performance of a user action on the appliance 100 directly or via the user device 230, since the appliance 100 is prevented from receiving update data from the server 220.

In embodiments, when the transmission of the monitoring data is interrupted, the household appliance 100 is operable to communicate with the user device 230 directly via a wireless communications network. This could be a short-range wireless communications network such as a BLE communications network. Such direct communications may be used to perform a software update on the household appliance 100, e.g. by forwarding update data received at the user device 230 from the server 220, to the household appliance 100. As such, the appliance 100 may be operable to communicate with the user device 230 directly, in addition to communicating with the user device 230 via the server 220. In alternative embodiments, direct communications between the appliance 100 and the user device 230 via the wireless communications network are prevented when the transmission of the monitoring data is interrupted. In further alternative embodiments, the appliance 100 is not able to communicate with the user device 230 directly, but only via the server 220.

In embodiments, the method 400 comprises, in response to receiving the signal at step 410, causing an output device to generate an output indicating to a user of the household appliance 100 that a software update of the household appliance is available. The output device may be comprised in the household appliance 100 and/or in the user device 230. In embodiments, the output comprises a visual output, e.g. provided on the display 110 of the appliance 100 or on a display of the user device 230. That is, the output device may comprise a display device. Additionally or alternatively, the output may comprise an audio output, e.g. provided via a speaker. In embodiments, the output comprises a prompt for the user to perform a software update on the household appliance 100. The software update may be initiated by operating the household appliance 100 directly and/or by operating the user device 230. In embodiments, the user device 230 receives update data for the software update from the server 220 and forwards the update data to the appliance 100. Alternatively, the appliance 100 may receive the update data from the server 220 itself without the user device 230 acting as an intermediary. The software on the household appliance 100 may then be updated using the received update data. When the software update of the household appliance 100 has been completed, the quarantine of the household appliance 100 may be lifted, and transmission of monitoring data to the user device 230 via the server 220 may be permitted to resume. In embodiments, the quarantine process may be initiated in response to a combination of receiving the signal and a time period for the user to accept the software update elapsing. That is, the user may be given a time period to update the software before the appliance is put into quarantine. The time period may be a few days, a week or any suitable time period. The server, appliance and or a quarantine orchestrator entity may set a timer to count down the time period and initiate the quarantine process at the end of the time period if the software update has not been performed on the appliance. The time period may be determined in dependence on the severity of the software issue. The user may be reminded one or more times during the time period by messages on the output device on the appliance and/or the output device of the user device. The output device may display or otherwise communicate a warning that the appliance will be put into quarantine at the end of the time period unless the software update is performed. In some circumstances, for example if a software update is needed to address a serious safety or security issue, the user may not be given a time period to accept the software update before the quarantine process is initiated.

In embodiments, the method comprises, following the operation to initiate a quarantine process at step 420, causing the output device to generate an output indicating to a user of the household appliance 100 that the appliance has been put into quarantine. As mentioned above, the output device may be comprised in the household appliance 100 and/or in the user device 230.

Figures 5A-5C show schematically a system 500 according to embodiments. The system 500 comprises the household appliance 100, the server 220 and the user device 230, as described above.

In the scenario shown in Figure 5A, the household appliance 100 is not under quarantine. For example, the software on the household appliance 100 may be up-to-date in this scenario. The household appliance 100 communicates with the server 220 via a first communications channel 510 and via a second communications channel 520. The first communications channel 510 is used for sending monitoring data for monitoring operation of the appliance 100 from the appliance 100 to the server 220. In embodiments, the first communications channel 510 is also used for sending remote control data for controlling operation of the appliance 100 from the server 220 to the appliance 100. The second communications channel 520 may be used for sending update data for over-the-air software updates from the server 220 to the appliance 100. Additionally or alternatively, the second communications channel 520 may be used for sending configuration data for configuring the household appliance 100 from the appliance 100 to the server 220 and/or from the server 220 to the appliance 100. The user device 230 is operable to communicate with the server via a further communications channel 530. The further communications channel 530 may be used, for example, for sending monitoring data for monitoring operation of the appliance 100 from the server 220 to the user device 230. In embodiments, the further communications channel 530 is also used for sending remote control commands for controlling operation of the appliance 100 from the user device 230 to the server 220. In the embodiments shown in Figure 5A, the household appliance 100 and the user device 230 are also in direct communication with each other, via a short-range communications channel 540, such as Bluetooth.

In the scenario shown in Figure 5B, the household appliance 100 is operated in a soft quarantine mode. In this case, communication of data via the first communications channel 510 between the appliance 100 and the server 220 is prevented. This is shown with a dashed line in Figure 5B. As such, the transmission of monitoring data from the appliance 100 to the user device 230 via the server 220 is interrupted. However, the second communications channel 520 between the appliance 100 and the server 220 remains available. As such, when the appliance 100 is being operated in the soft quarantine mode, the server 220 can send update data to the appliance 100 via the second communications channel 520, to trigger an over-the-air software update of the appliance 100. The software update can thus be performed without user intervention in this case. Once the software update is completed, the quarantine of the appliance 100 may be lifted, and use of the first communications channel 510 may be resumed.

In the scenario shown in Figure 5C, the household appliance 100 is operated in a hard quarantine mode. In this case, communication of data via both the first communications channel 510 and the second communications channel 520 is prevented. This is shown with dashed lines in Figure 5C. As such, the appliance 100 is unable to communicate with the server 220, and vice-versa. When the appliance 100 is being operated in the hard quarantine mode, a software update for the appliance 100 may be performed locally by a user (e.g. by a user operating the appliance 100 directly or via the user device 230), since the server 220 cannot send update data via the second communications channel 520.

The first communications channel 510 and/or the second communications channel 520 may operate using Hypertext Transfer Protocol, HTTP and/or MQ Telemetry Transport, MQTT, communications protocols. These communications protocols may also be used to selectively disable the first communications channel 510 and/or the second communications channel 520. For example, the use of one or both of these protocols may be selectively disabled for the appliance 100 when the appliance 100 is quarantined. Alternatively, dedicated endpoints (e.g. URLs) for one or both protocols can be specified which may be selectively disabled or blocked. Alternatively, specific topics having a given endpoint address may be selectively blocked, e.g. in the MQTT protocol. Such a topic may correspond to the name of the channel the appliance 100 can otherwise send or/and receive data to/from. In embodiments, the first communications channel 510 and/or the second communications channel 520 may be controlled using remote service agents implemented as software/firmware components within or external to the appliance 100. Additionally or alternatively, the communications circuitry of the appliance 100 itself (e.g. a Wi-Fi, Bluetooth or Ethernet module on the appliance 100) may be selectively disabled.

In the embodiments shown in Figures 5B and 5C, the short-range communications channel 540 between the appliance 100 and the user device 230 remains available when the appliance 100 is quarantined. In alternative embodiments, communication of data via the short- range communications channel 540 is prevented when the appliance 100 is being operated in the soft and/or hard quarantine mode.

While, throughout the description, the direct communication between the appliance and the user device has been described to be performed over a short-range communications channel such as a BLE communication channel, any suitable communication technology can be used for the direct communication. For example, the direct communication may be realised, provided that the appliance comprises a Wi-Fi unit and it has not been deactivated, using WiFi technology whereby one of the appliance and the user device activates a software enabled access point (SoftAP) mode and the other one of the appliance and the user device activates a station mode.

In the embodiments shown in Figures 5B and 5C, communication of data via the first communications channel 510 is prevented when the appliance 100 is quarantined. As discussed above, however, in some embodiments the appliance 100 continues to send monitoring data to the server 220 via the first communications channel 510. In such embodiments, the server 220 interrupts transmission of the monitoring data to the user device 230, e.g. by adding an identifier of the appliance 100 to a blacklist and/or by revoking one or more credentials of the appliance 100.

In embodiments, the appliance 100 is still operable to perform its primary function when the appliance 100 is quarantined. The primary function comprises performing a household task. For example, if the appliance 100 is a cooker, the appliance 100 may still perform a cooking operation even when the appliance 100 is quarantined (that is, when transmission of monitoring data from the appliance 100 is interrupted). Similarly, if the appliance 100 is a dishwasher, the appliance 100 may still perform a washing operation when the appliance 100 is quarantined.

It is to be understood that any feature described in relation to any one embodiment and/or aspect may be used alone, or in combination with other features described, and may also be used in combination with one or more features of any other of the embodiments and/or aspects, or any combination of any other of the embodiments and/or aspects.

In embodiments of the present disclosure, the household appliance 100 comprises a controller 310. The controller 310 may be configured to perform various methods described herein. Additionally or alternatively, the methods described herein may be performed by a controller comprised in an entity other than the household appliance 100, e.g. the server 220. In either case, the controller may comprise a processing system. Such a processing system may comprise one or more processors and/or memory. Each device, component, or function as described in relation to any of the examples described herein, for example the server 220, user device 230, communications unit 205, and quarantine orchestrator entity, may similarly comprise a processor or may be comprised in apparatus comprising a processor. One or more aspects of the embodiments described herein comprise processes performed by apparatus. In some examples, the apparatus comprises one or more processors configured to carry out these processes. In this regard, embodiments may be implemented at least in part by computer software stored in (non-transitory) memory and executable by the processor, or by hardware, or by a combination of tangibly stored software and hardware (and tangibly stored firmware). Embodiments also extend to computer programs, particularly computer programs on or in a carrier, adapted for putting the above described embodiments into practice.

The one or more processors of processing systems may comprise a central processing unit (CPU). The one or more processors may comprise a graphics processing unit (GPU). The one or more processors may comprise one or more of a field programmable gate array (FPGA), a programmable logic device (PLD), or a complex programmable logic device (CPLD). The one or more processors may comprise an application specific integrated circuit (ASIC). It will be appreciated by the skilled person that many other types of device, in addition to the examples provided, may be used to provide the one or more processors. The one or more processors may comprise multiple co-located processors or multiple disparately located processors. Operations performed by the one or more processors may be carried out by one or more of hardware, firmware, and software. It will be appreciated that processing systems may comprise more, fewer and/or different components from those described.

The techniques described herein may be implemented in software or hardware, or may be implemented using a combination of software and hardware. They may include configuring an apparatus to carry out and/or support any or all of techniques described herein. Although at least some aspects of the examples described herein with reference to the drawings comprise computer processes performed in processing systems or processors, examples described herein also extend to computer programs, for example computer programs on or in a carrier, adapted for putting the examples into practice. The carrier may be any entity or device capable of carrying the program. The carrier may comprise a computer readable storage media. Examples of tangible computer-readable storage media include, but are not limited to, an optical medium (e.g., CD-ROM, DVD-ROM or Blu-ray), flash memory card, floppy or hard disk or any other medium capable of storing computer-readable instructions such as firmware or microcode in at least one ROM or RAM or Programmable ROM (PROM) chips.

Various measures (e.g. methods, systems, household appliances, computer programs) are provided to operate a system comprising a household appliance. The household appliance comprises communications circuitry operable to transmit monitoring data to a server. The household appliance is operable to perform a primary function comprising a household task, and the monitoring data is for monitoring performance of the primary function of the household appliance. The system comprises a controller configured to: receive a signal generated in dependence on a state of software on the household appliance; and in response to receiving the signal, initiate a quarantine process by interrupting transmission of the monitoring data from the household appliance to the server.

Various measures (e.g. methods, systems, household appliances, computer programs) are provided to operate a household appliance. The household appliance comprises communications circuitry operable to receive signals for controlling operation of the household appliance from a server via a network. The household appliance also comprises a controller configured to: receive a signal generated in dependence on a state of software on the household appliance; and in response to receiving the signal, disable one or more functions of the household appliance. The signal may be received via the communication circuitry or generated within the household appliance, e.g. by another component of the controller.

In embodiments, the one or more functions comprise one or more connectivity functions, e.g. a Wi-Fi connectivity function of the appliance. In embodiments, the one or more functions comprise a primary function of the appliance. The primary function of the appliance is, or is related to, performing a household task. For example, the one or more functions may comprise a cooking function, a cleaning function, etc. As such, in embodiments, the household appliance is prevented from performing its primary function in dependence on the state of the software on the appliance. In embodiments, the one or more functions of the appliance are reenabled in response to a software update being performed on the appliance.

Although it has been described that one or more functions of the household appliance are disabled in dependence on the state of software on the appliance, at least some of the methods described above can be used to disable functions for other reasons, including, for example, because of a hardware fault in order to prevent unsafe operation of the appliance. As such, in embodiments, the controller may be configured to receive a signal generated in dependence on a state of software and/or a signal indicating detection of a fault in the appliance. The fault can be a hardware fault or a software fault. The controller may be configured to, in response to receiving the signal, disable one or more functions of the household appliance. As mentioned above, the function could be a primary function in order to, for example, prevent unsafe operation of the appliance until a service engineer can repair the appliance or until a software update addressing the fault is performed on the appliance. The one or more functions of the appliance may be re-enabled in response to a software update being performed on the appliance and/or in response to the fault being repaired, for example as a result of replacement of a part or maintenance of the appliance. Disabling one or more primary functions may include configuring a setting or software, via an over-the-air update, such that one or more components of the household appliance 100, for performing the primary functions, including a heating element, a pump arrangement, a drum drive arrangement, a heat-pump arrangement, condensers, compressors, motors, fans and/or ionisers are disabled. In some implementations this could be realised by reconfiguring the controller or the part of the controller operating the component to prevent it from controlling the component.

Where in the foregoing description, integers or elements are mentioned which have known, obvious or foreseeable equivalents, then such equivalents are herein incorporated as if individually set forth. Reference should be made to the claims for determining the true scope of the present disclosure, which should be construed so as to encompass any such equivalents. It will also be appreciated by the reader that integers or features of the present disclosure that are described as preferable, advantageous, convenient or the like are optional and do not limit the scope of the independent claims. Moreover, it is to be understood that such optional integers or features, whilst of possible benefit in some embodiments of the present disclosure, may not be desirable, and may therefore be absent, in other embodiments.

Claims

1. A system comprising: a household appliance, the household appliance comprising communications circuitry operable to transmit monitoring data to a user device via a server, the monitoring data being for monitoring operation of the household appliance at the user device; and a controller configured to: receive a signal generated in dependence on a state of software on the household appliance; and in response to receiving the signal, initiate a quarantine process by interrupting transmission of the monitoring data from the household appliance to the user device via the server.

2. A system according to claim 1, wherein interrupting transmission of the monitoring data comprises preventing the communications circuitry from transmitting the monitoring data to the server.

3. A system according to claim 2, wherein interrupting transmission of the monitoring data comprises switching the communications circuitry from an activated state, in which the communications circuitry is configured to transmit the monitoring data to the server, to a deactivated state.

4. A system according to claim 2 or claim 3, wherein the communications circuitry comprises one or more wireless antennas, and wherein interrupting transmission of the monitoring data comprises disabling the one or more wireless antennas.

5. A system according to claim 1, wherein, when the transmission of the monitoring data is interrupted, the server is operable to receive the monitoring data from the household appliance, and wherein interrupting transmission of the monitoring data comprises preventing the server from transmitting the received monitoring data to the user device.

6. A system according to claim 5, wherein the controller is configured to, in response to receiving the signal, prevent the server from transmitting the monitoring data to a further server.

7. A system according to any preceding claim, wherein interrupting transmission of the monitoring data comprises discarding and/or revoking one or more credentials of the household appliance.

8. A system according to any preceding claim, wherein the signal is generated in dependence on a version of the software on the household appliance.

9. A system according to claim 8, wherein the signal is generated based on a comparison between the version of the software on the household appliance and a latest version of the software.

10. A system according to any preceding claim, wherein the signal is generated in response to expiry of a predetermined time period for a user to accept and/or perform a software update for the household appliance.

11. A system according to any preceding claim, wherein the signal is generated in response to an amount of traffic sent from the household appliance to the server exceeding a predetermined threshold.

12. A system according to any preceding claim, wherein the quarantine process comprises operating the household appliance in either a first quarantine mode having a first severity level or a second quarantine mode having a second, higher, severity level, and wherein the controller is configured to: based on the state of the software on the household appliance, determine a quarantine mode, of the first and second quarantine modes, in which the household appliance is to be operated; and cause the household appliance to be operated in the determined quarantine mode.

13. A system according to claim 12, wherein, in the first quarantine mode, the household appliance is operable to send to the server configuration data for configuring the household appliance, and wherein, in the second quarantine mode, the household appliance is prevented from sending the configuration data to the server.

14. A system according to any preceding claim, wherein the controller is comprised in the household appliance.

15. A system according to claim 14, wherein the signal is received from the server via the communications circuitry.

16. A system according to any of claims 1 to 13, the system comprising the server, wherein the controller is comprised in the server.

17. A system according to claim 16, wherein the signal is received from the household appliance.

18. A system according to claim 16 or claim 17, wherein the controller is configured to, in response to receiving the signal, discard monitoring data received at the server from the household appliance.

19. A system according to any preceding claim, wherein interrupting the transmission of the monitoring data comprises adding an identifier of the household appliance to a blacklist and/or removing the identifier of the household appliance from a whitelist.

20. A system according to any preceding claim, wherein the controller is configured to, in response to a software update being performed on the household appliance, allow transmission of the monitoring data from the household appliance to the user device via the server.

21. A system according to claim 20, wherein, prior to allowing transmission of the monitoring data from the household appliance to the user device via the server, the controller is configured to initiate a re-provisioning process for configuring communications between the household appliance and the server.

22. A system according to any preceding claim, wherein, when the transmission of the monitoring data is interrupted, the communications circuitry is configured to receive update data for an over-the-air software update process for the household appliance, and the controller is configured to update the software on the household appliance using the received update data.

23. A system according to claim 22, wherein the update data is received from the server.

24. A system according to any preceding claim, wherein the communications circuitry is operable to transmit the monitoring data via a first communications channel between the household appliance and the server, and wherein the communications circuitry is operable to receive update data for an over- the-air software update process for the household appliance from the server via a second, different, communications channel between the household appliance and the server.

25. A system according to claim 24, wherein, when the transmission of the monitoring data is interrupted, the controller is configured to allow communications via the second communications channel.

26. A system according to claim 24, wherein, when the transmission of the monitoring data is interrupted, the controller is configured to prevent communications via the second communications channel.

27. A system according to any preceding claim, wherein, in response to receiving the signal, the controller is configured to cause an output device to generate an output indicating to a user of the household appliance that a software update of the household appliance is available.

28. A system according to any preceding claim, wherein, when the transmission of the monitoring data is interrupted, the household appliance is operable to communicate with the user device via a short-range wireless communications network.

29. A system comprising: a household appliance, the household appliance comprising communications circuitry operable to transmit monitoring data to a server, wherein the household appliance is operable to perform a primary function comprising a household task, wherein the monitoring data is for monitoring performance of the primary function of the household appliance; and a controller configured to: receive a signal generated in dependence on a state of software on the household appliance; and in response to receiving the signal, initiate a quarantine process by interrupting transmission of the monitoring data from the household appliance to the server.

30. A method comprising: receiving a signal generated in dependence on a state of software on a household appliance, the household appliance comprising communications circuitry operable to transmit monitoring data to a user device via a server, the monitoring data being for monitoring operation of the household appliance at the user device; and in response to receiving the signal, initiating a quarantine process by interrupting transmission of the monitoring data from the household appliance to the user device via the server.

31. A computer program comprising a set of instructions which, when executed by a computerised device, cause the computerised device to perform a method comprising: receiving a signal generated in dependence on a state of software on a household appliance, the household appliance comprising communications circuitry operable to transmit monitoring data to a user device via a server, the monitoring data being for monitoring operation of the household appliance at the user device; and in response to receiving the signal, initiating a quarantine process by interrupting transmission of the monitoring data from the household appliance to the user device via the server.