OpenThread for multi floor building with multiple flats per floor and one super admin (lanlord)

[FutronicsMP]

Hi, I would like to ask you what would be the best way to achieve OpenThread/Matter network for multiple floor buildings with multiple flats per floor? We would like to have the below functionality:

• each flat has its own Border Router which provides coverage for this flat (together with other devices in a flat which can create mesh)
• each flat owner is able to add his own devices to his network and control them
• devices in each flat are only seen by the flat owner which did the commissioning (neighbors cannot see and control other neighbors' devices)
• ** some devices in flats like utility valves can be controlled by the authorized landlord (building owner)**
• border routers in flats can be connected to different Internet Service Providers or be on the same LAN network which provides Internet Sevices

I think OpenThread was not prepared for such a scenario and the biggest challenge is to have one authorized Landlord which can control specific devices like utility valves in all flats. Could you please advise what would be the best way to achieve that and if OpenThread with Matter on top is the right technology to achieve that? We consider having BorderRouters with custom functionality on top which will connect to landlord cloud service and will allow controlling specific devices (utility valves, circuit breakers) in owners' flats - but here I have question if this custom functionality is needed - or maybe OpenThread/Matter already have some functions which can allow to do that?

[jwhui]

@FutronicsMP , thanks for reaching out with this interesting use case.

It sounds like you want something like VPNs, where each flat owner has access to a subset of the network infrastructure but the building owner has access to all of the building's network infrastructure. But because you are looking for a shared network infrastructure, one party needs to own the network infrastructure and provide access to another party. It wasn't clear from your description whether the building or flat owners own the border routers.

Today, access to a given Thread network is determined by possession of the associated Thread Network Key. So when it comes to adding Thread devices, it comes down to the network infrastructure owner providing another user access to the Thread Network Key. While Thread does have a Thread Commissioning process, it does not prohibit other methods for providing the Thread Network Key. Existing application layers including Weave, HomeKit, and Matter all have their own methods for providing Thread Network Keys.

If you are building custom logic into the Thread Border Routers, I think it is possible to come up with a scheme that allows for secure sharing of Thread Network Keys between the various parties. Whether or not that satisfies your requirements is for you to determine :)

[FutronicsMP]

We are considering providing BR for each flat together with utility valves and other devices which can be controlled by the landlord. At the same time we wish to allow the reuse BR for other home devices which the homeowner would like to attach to his network. The homeowner should be able to control by HomeKit/Matter devices usually controlled by landlords (all supporting Matter).

It looks like border routers provided by the landlord should have OpenThread, Matter Controller, WiFi/Ethernet.
I consider that OpenThread can operate with only one active dataset so devices provided by landlord and devices obtained by homeowners on the open market will use the same active dataset.

How to assure in such a configuration that the landlord will have the possibility to see only devices assigned to him and will not see other homeowner devices and will not have the possibility to control them?

We wish landlords to have the possibility to control homeowners' utility through UI panels in the cloud. My only idea so far is that BR (with Matter controller) provided by the landlord should have some bridge interface on top of BR Matter controller (existing in each flat), which allow remote access through cloud-based UI landlord panel only for devices which was commissioned by Border Router Matter controller. Homeowner devices should be then commissioned to the network by another Matter controller for example installed on a mobile phone. Does Matter specification consider having multiple Matter controllers? How Matter controller is authorized in the network?

[jwhui]

I think it helps to view Thread in the same way that Wi-Fi works today. The building and flat owners can have access to the same Thread network but the building and flat owners can have their own Matter fabrics. Because the building and flat owners will both have access to the Thread network, they will both be able to "see" each others devices at the network level. However, control via the Matter fabric can only be done via the respective owner.

[MichalPoterek]

Thank you Jonathan for your answer. Am I well understood that as a Matter fabric I should consider it as a Matter controller?

[jwhui]

Matter Fabric are the set of devices that are operating under the same administrative domain. A Matter Controller is a device role that can operate in a given Matter Fabric.