WO2022079343A1

WO2022079343A1 - Privacy protection for a passenger of an elevator system

Info

Publication number: WO2022079343A1
Application number: PCT/FI2020/050682
Authority: WO
Inventors: Mika BELOV; Mikko PIIRONEN
Original assignee: Kone Corporation
Priority date: 2020-10-15
Filing date: 2020-10-15
Publication date: 2022-04-21

Abstract

Apparatuses, methods and computer programs for privacy protection for a passenger of an elevator system are disclosed. At least some of the disclosed embodiments allow selectively hiding passenger-specific destination information from other passengers. If it is determined for privacy reasons that elevator destination information related to a given passenger should not be displayed on elevator system state information public displays legible from the current area, then these displays are prevented from showing this information. At the same time, showing this information on a display of a wireless communication device carried by the given passenger may optionally be allowed.

Description

PRIVACY PROTECTION FOR A PASSENGER OF AN ELEVATOR SYSTEM

TECHNICAL FIELD

The present disclosure relates to the field of elevators , and, more particularly, to privacy protection for a passenger of an elevator system .

BACKGROUND

In modern elevator systems public display devices showing elevator system state information including passenger specific destination information ( such as elevator guidance , or EG, screens ) are becoming more and more popular . In particular, these are popular in multitenant type office buildings . Such buildings are often intelligent in the sense that they contain an automati zed visitor management system in place of a traditional human receptionist . However, this means that the destination information of elevator calls of customers or passengers or end-users are shown on public display devices vis ible to everyone and anyone on the same el evator lobby . Thus , the passengers may be worried about the privacy of the destination information of their elevator calls for various reasons . Thus , there is a need to selectively hide such passenger-specific destination information from other passengers .

SUMMARY

This summary is provided to introduce a selection of concepts in a s implif ied form that are further described below in the detailed description . This summary is not intended to identify key features or essential features of the claimed subj ect matter, nor is it intended to be used to limit the scope of the claimed subj ect matter .

It is an obj ect of the present disclosure to allow privacy protection for a passenger of an elevator system . The foregoing and other obj ects are achieved by the features of the independent claims . Further implementation forms are apparent from the dependent claims , the description and the figures .

According to a first aspect of the disclosure , an apparatus is provided . The apparatus comprises at least one processor, and at least one memory including computer program code . The at least one memory and the computer program code are configured to , with the at least one processor, cause the apparatus at least to perform : identifying a passenger arriving at a current area of an elevator system; determining whether or not privacy protection is to be used for the identified passenger while in the current area ; in response to determining that the privacy protection i s to be used for the identi fied passenger, instructing at least one elevator system state information public display legible from the current area to disallow displaying destination information related to the identified passenger ; or in response to determining that the privacy protection is not to be used for the identified passenger, instructing the at least one elevator system state information public display legible from the current area to allow displaying the destination information related to the identified passenger .

In an implementation form of the first aspect , the at least one memory and the computer program code are configured to , with the at least one processor, cause the apparatus to perform the identifying of the passenger using a first identification signaling received from an access control system .

In an implementation form of the first aspect , the first identification signaling is received from a turnstile gate or a destination operating panel connected to the access control system .

In an implementation form of the first aspect , the at least one memory and the computer program code are configured to , with the at least one processor, cause the apparatus to perform the identifying of the passenger using a second identification signaling received from a biometric identification sensor .

In an implementation form of the first aspect , the biometric identification sensor comprises a facial recognition sensor .

In an implementation form of the first aspect , the at least one memory and the computer program code are configured to , with the at least one processor, cause the apparatus to perform the identifying of the passenger using a third identification signaling received, via a short-range wireless connection transceiver, from a wireless communication device carried by the passenger .

In an implementation form of the first aspect , the short-range wireless connection transceiver is comprised in at least one of the at least one elevator system state information public display .

In an implementation form of the first aspect , the third identification signaling is received via a near field communication based wireless connection or a Bluetooth low energy based wireless connection between the short-range wireless connection transceiver and the wireless communication device .

In an implementation form of the first aspect , the at least one memory and the computer program code are configured to , with the at least one processor, cause the apparatus to perform the determining of whether or not the privacy protection is to be used based on a privacy setting in a user profile of the identified passenger . The privacy setting indicates whether or not the privacy protection is to be used for the identified passenger while in the current area .

In an implementation form of the first aspect , the privacy setting is manually set by the passenger .

In an implementation form of the first aspect , the privacy setting is automatically set by an external elevator call management entity^

In an implementation form of the first aspect , the at least one memory and the computer program code are configured to , with the at least one processor, cause the apparatus to perform the determining of whether or not the privacy protection i s to be used in response to determining whether or not an amount of people in the current area exceeds a first threshold, respectively .

In an implementation form of the first aspect , the at least one memory and the computer program code are configured to , with the at least one processor, cause the apparatus to perform the determining of whether or not the privacy protection is to be used in response to determining whether or not a proximity of the identified passenger to one of the at least one elevator system state information public display falls below a second threshold, respectively .

In an implementation form of the first aspect , the at least one memory and the computer program code are configured to , with the at least one processor, cause the apparatus to perform the determining of whether or not the proximity of the identified passenger falls below the second threshold based on whether or not a short-range wireless connection is established between a short-range wireless connection transceiver comprised in the one of the at least one elevator system state information public display and a wireless communication device carried by the passenger, respectively .

In an implementation form of the first aspect , the at least one memory and the computer program code are configured to , with the at least one processor, cause the apparatus to perform the determining of whether or not the proximity of the identified passenger fal ls below the second threshold based on tracking information received from a biometric identification sensor comprising a facial recognition sensor .

In an implementation form of the first aspect , the at least one memory and the computer program code are configured to , with the at least one processor, cause the apparatus to perform instructing a wireless communication device carried by the passenger to allow displaying the destination information related to the identified pas senger on a display of the wireles s communication device , in response to determining that the privacy protection is to be used for the identified passenger .

In an implementation form of the first aspect , the at least one memory and the computer program code are configured to , with the at least one processor, cause the apparatus to perform instructing an unsecure elevator system state information public display legible from the current area to identify a secure elevator system state information public display legible from the current area and allowed to display the destination information related to the identified passenger, in response to determining that the privacy protection is to be used for the identified passenger .

In an implementation form of the first aspect , the at least one memory and the computer program code are configured to , with the at least one processor, cause the apparatus to perform informing the identified passenger about a secure elevator system state information public display legible from the current area and allowed to display the destination information related to the identified passenger, after the identifying of the passenger and in response to determining that the privacy protection is to be used for the identified passenger .

In an implementation form of the first aspect , the apparatus comprises an elevator control unit .

In an implementation form of the first aspect , the apparatus comprises a cloud server .

According to a second aspect of the disclosure , a method of privacy protection for a passenger of an elevator system is provided . The method comprises identifying, by a processor, a passenger arriving at a current area of an elevator system. The method further comprises determining, by the processor, whether or not privacy protection is to be used for the identified passenger while in the current area . The method further comprises in response to determining that the privacy protection i s to be used for the identi fied passenger, instructing, by the processor, at least one elevator system state information public display legible from the current area to disallow displaying destination information related to the identified passenger ; or in response to determining that the privacy protection is not to be used for the identified passenger, instructing, by the processor, the at least one elevator system state information public display legible from the current area to allow displaying the destination information related to the identified passenger .

In an implementation form of the second aspect , the identifying of the passenger is performed using a first identification signaling received from an access control system .

In an implementation form of the second aspect , the first identification signaling is received from a turnstile gate or a destination operating panel connected to the access control system .

In an implementation form of the second aspect , the identifying of the passenger is performed using a second identification signaling received from a biometric identification sensor .

In an implementation form of the second aspect , the biometric identification sensor comprises a facial recognition sensor .

In an implementation form of the second aspect , the identifying of the passenger is performed using a third identification signaling received, via a short- range wireless connection transceiver, from a wireless communication device carried by the passenger .

In an implementation form of the second aspect , the short-range wireless connection transceiver is comprised in at least one of the at least one elevator system state information public display .

In an implementation form of the second aspect , the third identification signaling is received via a near field communication based wireless connection or a Bluetooth low energy based wireless connection between the short-range wireless connection transceiver and the wireless communication device .

In an implementation form of the second aspect , the determining of whether or not the privacy protection is to be used is performed based on a privacy setting in a user profile of the identified passenger . The privacy setting indicates whether or not the privacy protection is to be used for the identi fied passenger whi le in the current area .

In an implementation form of the second aspect , the privacy setting is manually set by the passenger .

In an implementation form of the second aspect , the privacy setting is automatically set by an external elevator call management entity .

In an implementation form of the second aspect , the determining of whether or not the privacy protection is to be used is performed in response to determining whether or not an amount of people in the current area exceeds a first threshold, respectively . In an implementation form of the second aspect , the determining of whether or not the privacy protection is to be used is performed in response to determining whether or not a proximity of the identi fied passenger to one of the at least one elevator system state information public display falls below a second threshold, respectively .

In an implementation form of the second aspect , the determining of whether or not the proximity of the identified passenger falls below the second threshold is performed based on whether or not a short-range wireless connection is established between a short-range wireless connection transceiver comprised in the one of the at least one elevator system state information public display and a wireless communication device carried by the passenger, respectively .

In an implementation form of the second aspect , the determining of whether or not the proximity of the identified passenger falls below the second threshold is performed based on tracking information received from a biometric identification sensor comprising a facial recognition sensor .

In an implementation form of the second aspect , the method further comprises instructing a wireless communication device carried by the passenger to allow displaying the destination information related to the identi fied passenger on a display of the wireless communication device , further in response to determining that the privacy protection is to be used for the identified passenger .

In an implementation form of the second aspect , the method further comprises instructing an unsecure elevator system state information public display legible from the current area to identify a secure elevator system state information public display legible from the current area and allowed to display the destination in- formation related to the identified passenger, in response to determining that the privacy protection is to be used for the identified passenger .

In an implementation form of the second aspect , the method further comprises informing the identified passenger about a secure elevator system state information public display legible from the current area and allowed to display the destination information related to the identified passenger, after the identifying of the passenger and in response to determining that the privacy protection is to be used for the identified passenger .

According to a third aspect of the disclosure , a computer program product is provided . The computer program product comprises program code configured to perform the following when executed on a data-processing system : identifying a passenger arriving at a current area of an elevator system; determining whether or not privacy protection is to be used for the identified passenger while in the current area ; in response to determining that the privacy protection i s to be used for the identi fied passenger, instructing at least one elevator system state information public display legible from the current area to disallow displaying destination information related to the identified passenger ; or in response to determining that the privacy protection is not to be used for the identified passenger, instructing the at least one elevator system state information public display legible from the current area to allow displaying the destination information related to the identified passenger .

According to a fourth aspect of the disclosure , an elevator system is provided . The elevator system comprises the apparatus according to the first aspect . The invention allows privacy protection for a passenger of an elevator system . More specifically, the invention allows selectively hiding passenger-specific destination information from other passengers . I f it is determined for privacy reasons ( such as the current area being crowded, or a user/user' s employer having opted to protect his /her privacy via switching on a corresponding user profile setting) that elevator destination information related to a given passenger should not be displayed on elevator system state information public displays legible from the current area, then these displays are prevented from showing this information . At the same time , showing this information on a display of a wireless communication device carried by the given passenger may optionally be allowed . Similarly, if the given passenger goes sufficiently close to one of these elevator system state information public displays , showing this information on this specific display may optionally be allowed, since being close to the display would block displayed information from being visible to other passengers .

Many of the features will be more readily appreciated as they become better understood by reference to the following detailed description considered in connection with the accompanying drawings .

DESCRIPTION OF THE DRAWINGS

In the following, example embodiments are described in more detail with reference to the attached figures and drawings , in which :

Fig . 1 is a block diagram illustrating an elevator system according to an embodiment of the present disclosure ;

Fig . 2A is a block diagram illustrating an apparatus according to an embodiment of the present dis closure ; Fig . 2B is a block diagram illustrating another apparatus according to another embodiment of the present disclosure ; and

Fig . 3 is a flow chart illustrating a method according to an embodiment of the present disclosure .

In the following, identical reference signs refer to identical or at least functionally equivalent features .

DETAILED DESCRIPTION

In the following description, reference is made to the accompanying drawings , which form part of the disclosure , and in which are shown, by way of illustration, specific aspects in which the invention may be placed . It is understood that other aspects may be utili zed, and structural or logical changes may be made without departing from the scope of the invention . The following detailed description, therefore , is not to be taken in a limiting sense , as the scope of the invention is defined in the appended claims .

For instance , it is understood that a disclosure in connection with a described method may also hold true for a corresponding device or system configured to perform the method and vice versa . For example , if a specific method step is described, a corresponding device may include a unit to perform the described method step, even i f such unit is not explicitly described or il lustrated in the f igures . On the other hand, for example , if a specific apparatus or device is described based on functional units , a corresponding method may include a step performing the described functionality, even if such step is not explicitly described or illustrated in the figures . Further, it is understood that the features of the various example aspects described herein may be combined with each other, unless specifically noted otherwise . In the following, a general description of an elevator system 100 in which various embodiments of the present disclosure may be implemented is provided with reference to Fig . 1 .

The elevator system 100 comprises an elevator control unit 200 and at least one elevator car 110 controlled by the elevator control unit 200 . The elevator control unit 200 may comprise an elevator controller for a single elevator car, or an elevator group controller 310 for a group of elevator cars . The elevator control unit 200 is configured to control various functions related to processing elevator calls and transporting elevator cars based on information ( including information about the amount of people in the lobbies and the elevator cars of the elevator system 100 ) collected by an access control system 120 connected to the elevator control unit 200 .

The elevator system 100 further comprises the access control system 120 for providing access control functions for the building in which the elevator system 100 is located . In the example of Fig . 1 , the elevator system 100 further comprises at least one turnstile gate 140 connected to the access control system 120 and at least one destination operating panel ( DOP) 130 (provided outside elevator cars - typically at each floor) also connected to the access control system 120 . The at least one destination operating panel 130 may also be directly connected to the elevator control unit 200 .

The at least one turnstile gate 140 may comprise an elevator system state information public display 141 that can be used to show various state information related to the elevator system 100 , such as destination information ( including e . g . destination floor data) related to passengers who are currently in the same area 190 ( such as a lobby or the like ) as the display 141 . The at least one turnstile gate 140 may further comprise e . g . a radio-frequency identification (RFID) reader (not shown in Fig. 1) . When a passenger

171 e.g. swipes or otherwise enters his/her RFID enabled access card 181 to the RFID reader of the turnstile gate 140, identification data related to the passenger 171 is received from the access card 181, and sent to the access control system 120 from which the identification data may be forwarded to the elevator control unit 200.

The at least one destination operating panel 130 may comprise an elevator system state information public display 131 that can be used to show various state information related to the elevator system 100, such as destination information related to passengers who are currently in the same area 190 (such as a lobby or the like) as the display 131. The at least one destination operating panel 130 may further comprise e.g. a radio-frequency identification (RFID) reader (not shown in Fig. 1) . When, instead of using the turnstile gate 140, the passenger 171 e.g. swipes or otherwise enters his/her RFID enabled access card 181 to the RFID reader of the destination operating panel 130, identification data related to the passenger 171 is received from the access card 181, and sent to the access control system 120 from which the identification data may be forwarded to the elevator control unit 200. In addition to access control related functionalities, the destination operating panel 130 may be used by a passenger e.g. to enter or register his/her destination floor before entering the elevator car 110.

In the example of Fig. 1, the elevator system 100 further comprises a cloud server 210 connected to the elevator control unit 200. One or more passengers

172 may carry a wireless communication device 182 (with a display 183) , such as a smart phone or the like. The wireless communication device 182 may include a mobile elevator application which may used e.g. to control and/or personalize various aspects of the elevator system 100. For example, the mobile elevator application may be used to modify various settings of a passenger / end-user specific user profile ( such as selecting a speci fic elevator car that the passenger wishes to always use ) . In the example of Fig . 1 , the various functionalities and services related to the passenger / end-user specific control and/or personali zation of the various aspects of the elevator system 100 are implemented in the cloud server 210 . The wireless communication device 182 ( and consequently the mobile elevator application) is communicatively connected to the cloud server 210 . Accordingly, the mobile elevator application serves as user interface to the functionalities and services provided by the cloud server 210 .

In some embodiments , the passenger / end-user specific user profile may be integrated in the access control system 120 (e . g . in the access card 181 ) . Alternatively, the passenger / end-user specific user profile may be integrated in the elevator control unit 200 or the cloud server 210 .

In the example of Fig . 1 , the elevator system 100 is connected to an external elevator call management entity 220 communicatively connected to the elevator control unit 200 . The term "external" in the external elevator call management entity indicates that the elevator call management entity is not a part of the elevator system 100 but rather an external entity that is configured to communicate with the elevator system 100 e . g . via a suitable application programming interface (API ) to manage elevator call related information ( such as entering destination floor data) of a visiting customer / passenger / end-user .

In the example of Fig . 1 , the external elevator call management entity comprises a visitor management system . The visitor management system 220 is configured to provide various visitor management functionalities , such as granting access rights to a visited office building or the l ike for the duration of the vis it for a visiting customer / passenger / end-user. In another embodiment, the external elevator call management entity may comprise e.g. an automatic guided vehicle (AGV) system. For example, the AGV system may be integrated to the elevator system 100 using e.g. an open platform communications (OPC) interface or a robotics API. Using e.g. these kinds of integration interfaces allows the AGV system to make elevator calls or destination calls "remotely", that is e.g. locally through a local area network (LAN) or via a cloud API . When this kind of a call is registered by the elevator system 100, the elevator system 100 may show e.g. destination details related to the call. The AGV system may be used e.g. to deliver material (s) , food or the like e.g. in hotels or hospitals. Privacy protection in this scenario may mean e.g. that an AGV type call may also comprise a "privacy" bit, so that the elevator system 100 does not show e.g. any details about which elevator is serving the AGV and what is the destination floor.

In the example of Fig. 1, the elevator system 100 further comprises a stand-alone elevator system state information public display 150 legible from the current area (such as a lobby or the like) 190. The display 150 may be e.g. an elevator guidance (EG) screen .

In the example of Fig. 1, the elevator system 100 further comprises a biometric identification sensor 160. More specifically, the biometric identification sensor 160 may comprise a facial recognition sensor. The biometric identification sensor 160 may be comprised in a digital camera or the like. For example, the biometric identification sensor 160 may include one or more three- dimensional (3D) sensors to capture information about the shape of a face in order to identify distinctive features on the surface of the face. Alternatively/ad- ditionally, the biometric identification sensor 160 may include e.g. one or more thermal sensors or sensors suitable for skin texture analysis techniques. In addition to identifying passengers 171, 172, 173, the biometric identification sensor 160 may be used to track the movement and/or location of identified passengers 171, 172, 173.

Next, an example embodiment of an apparatus 200 is described based on Fig. 2A. Some of the features of the described units are optional features which provide further advantages.

Fig. 2A is a block diagram illustrating the apparatus 200, according to an embodiment of the present disclosure. In the embodiment of Fig. 2A, the apparatus 200 comprises the elevator control unit 200 of Fig. 1.

The apparatus 200 comprises at least one processor or a processing unit 202, and at least one memory 204 including computer program code and coupled to the at least one processor 202, which may be used to implement the functionalities described later in more detail. The apparatus 200 may further comprise at least one transceiver 206 coupled to the at least one processor 202. The at least one transceiver 206 may comprise a wired transceiver and/or a wireless transceiver.

The at least one processor 202 may include, e.g., one or more of various processing devices, such as a co-processor, a microprocessor, a controller, a digital signal processor (DSP) , a processing circuitry with or without an accompanying DSP, or various other processing devices including integrated circuits such as, for example, an application specific integrated circuit (ASIC) , a field programmable gate array (FPGA) , a microcontroller unit (MCU) , a hardware accelerator, a special-purpose computer chip, or the like.

The at least one memory 204 may be configured to store e.g. computer programs and the like. The at least one memory 204 may include one or more volatile memory devices, one or more non-volatile memory devices, and/or a combination of one or more volatile memory devices and non-volatile memory devices . For example , the at least one memory 204 may be embodied as magnetic storage devices ( such as hard disk drives , etc . ) , optical magnetic storage devices , and semiconductor memories ( such as mask ROM, PROM (programmable ROM) , EPROM (erasable PROM) , flash ROM, RAM ( random access memory) , etc . ) .

The at least one memory 204 and the computer program code are configured to , with the at least one processor 202 , cause the apparatus 200 to perform identifying a pas senger 171 , 172 , 173 who i s arriving at a current area 190 of the elevator system 100 . Herein, the term "current area" refers to locations or a site or the like from which at least one of the elevator system state information public displays is currently legible to one or more passengers ( in at least one position and/or posture of the passenger in question) , whi le these one or more passengers are on a current floor . For example , at least in some embodiments , the current area 190 may comprise a current lobby or the like of the elevator system 100 .

For example , the at least one memory 204 and the computer program code may be configured to , with the at least one processor 202 , cause the apparatus 200 to perform the identifying of the passenger 171 , 172 , 173 using a first identification signaling received from the access control system 120 . In an example , the first identification signaling may be received from the turnstile gate 140 or the destination operating panel 130 connected to the access control system 120 .

In another example , the at least one memory 204 and the computer program code may be configured to , with the at least one processor 202 , cause the apparatus 200 to perform the identifying of the passenger 171 , 172 , 173 using a second identification signaling received from the biometric identification sensor 160 . In an example , the biometric identification sensor 160 may comprise a facial recognition sensor .

In yet another example , the at least one memory 204 and the computer program code may be configured to , with the at least one processor 202 , cause the apparatus 200 to perform the identifying of the passenger 171 ,

172 , 173 using a third identification signaling received, via the short-range wireless connection transceiver 132 , from the wireless communication device 182 carried by the passenger 171 , 172 , 173 . In an example , the short-range wireless connection transceiver may be comprised in at least one of the at least one elevator system state information public display 131 , 141 , 150 .

For example , the third identification signaling may be received via a near field communication based wireless connection or a Bluetooth low energy based wireless connection between the short-range wireless connection transceiver 132 and the wireless communication device 182 . In this example, the wireless communication device 182 also compri ses a near field communication and/or Bluetooth low energy enabled short-range wireless connection transceiver (not shown in Fig . 1 ) .

The at least one memory 204 and the computer program code are further configured to , with the at least one processor 202 , cause the apparatus 200 to perform determining whether or not privacy protection is to be used for the identified passenger 171 , 172 , 173 while the identified passenger 171 , 172 , 173 is in the current area 190 .

For example , the at least one memory 204 and the computer program code may be configured to , with the at least one processor 202 , cause the apparatus 200 to perform the determining of whether or not the privacy protection is to be used based on a privacy setting in a user profile of the identified passenger 171 , 172 ,

173 . The privacy setting indicates whether or not the privacy protection is to be used for the identified passenger 171 , 172 , 173 while the identified passenger 171 , 172 , 173 is in the current area 190 . In an example , the privacy setting may be manually set by the passenger 171 , 172 , 173 . This feature allows the passenger to manually switch the privacy on e . g . when the pas senger (who is a tenant in the building in thi s example ) goes to the area 190 to fetch visitors and does not wish to disclose the destination of the visitors to onlookers in the area 190 . In another example , the privacy setting may be automatically set by the external elevator cal l management entity 220 . In yet another example , the privacy setting may be manually or automatically set by an employer or the like of the passenger 171 , 172 , 173 .

In an example , whether the privacy in the privacy setting of the user profile is set to on or off may depend e . g . on a current infectious disease or pandemic situation, such as a COVID- 19 situation or the like .

In another example , the at least one memory 204 and the computer program code may be configured to , with the at least one processor 202 , cause the apparatus 200 to determine that the privacy protection is to be used in response to determining that an amount of people in the current area 190 exceeds a first threshold . Correspondingly, the at least one memory 204 and the computer program code may be configured to, with the at least one processor 202 , cause the apparatus 200 to determine that the privacy protection is not to be used in response to determining that the amount of people in the current area 190 does not exceed the first threshold . In other words , if the current area 190 is determined to be too crowded, the privacy protection may be automatically switched on .

In yet another example , the at least one memory 204 and the computer program code may be configured to, with the at least one processor 202 , cause the apparatus 200 to determine that the privacy protection is to be used in response to determining that a proximity or distance of the identified passenger 171 , 172 , 173 to one of the at least one elevator system state information public display 131 , 141 , 150 falls below a second threshold . Correspondingly, the at least one memory 204 and the computer program code may be configured to , with the at least one processor 202 , cause the apparatus 200 to determine that the privacy protection is not to be used in response to determining that the proximity or distance of the identified passenger 171 , 172 , 173 to the one of the at least one elevator system state information public display 131 , 141 , 150 does not fall below the second threshold . In other words , if the given passenger goes suff iciently close to one of these elevator system state information public displays , showing this information on this specific display may optionally be allowed, since being close to the display would block displayed information from being visible to other passengers . This feature allows the passenger to easily check his /her destination information e . g . in case of having forgotten it , without sacrificing his /her privacy .

For example , the at least one memory 204 and the computer program code may be configured to , with the at least one processor 202 , cause the apparatus 200 to determine that the proximity of the identified passenger 171 , 172 , 173 falls below the second threshold when a short-range wireless connection is established between the short-range wireless connection transceiver 132 comprised in the one of the at least one elevator system state information public display 131 , 141 , 150 and the wireless communication device 182 carried by the passenger 171 , 172 , 173 . Correspondingly, the at least one memory 204 and the computer program code may be configured to, with the at least one processor 202 , cause the apparatus 200 to determine that the proximity of the identi fied pas senger 171 , 172 , 173 does not fall below the second threshold when the short-range wireless connection is not established between the short-range wireless connection transceiver 132 comprised in the one of the at least one elevator system state information public display 131 , 141 , 150 and the wireless communication device 182 carried by the passenger 171 , 172 , 173 .

In another example , the at least one memory 204 and the computer program code may be configured to , with the at least one processor 202 , cause the apparatus 200 to determine that the proximity of the identif ied pas senger 171 , 172 , 173 falls below the second threshold when tracking information received from the biometric identification sensor 160 comprising the facial recognition sensor indicates the proximity of the identified passenger 171 , 172 , 173 falling below the second threshold . Correspondingly, the at least one memory 204 and the computer program code may be configured to , with the at least one processor 202 , cause the apparatus 200 to determine that the proximity of the identified passenger 171 , 172 , 173 does not fal l below the second threshold when the tracking information received from the biometric identification sensor 160 comprising the facial recognition sensor indicates the proximity of the identified passenger 171 , 172 , 173 not falling below the second threshold .

In response to determining that the privacy protection is to be used for the identified passenger 171 , 172 , 173 , the at least one memory 204 and the computer program code are further configured to , with the at least one processor 202 , cause the apparatus 200 to perform instructing at least one elevator system state information public display 131 , 141 , 150 legible from the current area 190 to disallow displaying destination information related to the identified passenger 171 , 172 , 173 . In response to determining that the privacy protection is not to be used for the identified passenger, the at least one memory 204 and the computer program code are further configured to , with the at least one processor 202 , cause the apparatus 200 to perform instructing the at least one elevator system state information public display 131 , 141 , 150 legible from the current area 190 to allow displaying the destination information related to the identified passenger 171 , 172 , 173 .

In an embodiment , the at least one memory 204 and the computer program code may be configured to , with the at least one processor 202 , cause the apparatus 200 to perform instructing a wireless communication device 182 carried by the passenger 171 , 172 , 173 to allow displaying the destination information related to the identi fied passenger 171 , 172 , 173 on a display 183 of the wireless communication device 182 , in response to determining that the privacy protection is to be used for the identified passenger 171 , 172 , 173 .

In an embodiment , the at least one memory 204 and the computer program code may be configured to , with the at least one processor 202 , cause the apparatus 200 to perform instructing an unsecure elevator system state information public display 150 legible from the current area 190 to identify (e . g . by displaying information about ) a secure elevator system state information public display 131 legible from the current area 190 and allowed to display the destination information related to the identified pas senger 171 , 172 , 173 , in response to determining that the privacy protection is to be used for the identified passenger 171 , 172 , 173 . Herein, the terms "secure" and "unsecure" are used to indicate privacy related security of the various elevator system state information public displays legible from the current area 190 relative to each other . Thus , e . g . a large elevator guidance screen 150 installed in a location/po- sition in which it is visible to more than e.g. one person at a time may be classified unsecure relative to e.g. an elevator system state information public display 131 comprised in a destination operating panel 130. Destination operating panels 130 are typically used by one person at a time and their respective displays 131 are typically visible only to the person using them. Accordingly, e.g. displays 131 may be classified secure relative to e.g. displays 151 in the present context. In this embodiment, the unsecure elevator system state information public display(s) 150 may include e.g. the same elevator system state information public display (s) 150 that is/are disallowed to display the destination information related to the identified passenger in response to determining that the privacy protection is to be used for the identified passenger.

In an embodiment, the at least one memory 204 and the computer program code may be configured to, with the at least one processor 202, cause the apparatus 200 to perform informing the identified passenger 171, 172, 173 about a secure elevator system state information public display 131 legible from the current area 190 and allowed to display the destination information related to the identified passenger 171, 172, 173, after the identifying of the passenger 171, 172, 173 and in response to determining that the privacy protection is to be used for the identified passenger 171, 172, 173. For example, when the identified passenger 171, 172, 173 is selecting his/her destination floor, the identified passenger 171, 172, 173 may already be informed (e.g. via one or more of the various elevator system state information public displays legible from the current area 190) that his/her destination information is not visible in unsecure display(s) (e.g. display 150) and guide the identified passenger 171, 172, 173 to check (if needed) his /her destination information from a secure display (e . g . display 131 ) .

Next , an example embodiment of an apparatus 210 is described based on Fig . 2B . Some of the features of the described units are optional features which provide further advantages .

Fig . 2B is a block diagram illustrating the apparatus 210 , according to an embodiment of the present disclosure . In the embodiment of Fig . 2B, the apparatus 210 comprises the cloud server 210 of Fig . 1 .

The apparatus 210 comprises at least one processor or a processing unit 212 , and at least one memory 214 including computer program code and coupled to the at least one processor 212 , which may be used to implement the functionalities described later in more detail . The apparatus 210 may further comprise at least one transceiver 216 coupled to the at least one processor 212 . The at least one transceiver 216 may comprise a wired transceiver and/or a wireless transceiver .

The at least one processor or a processing unit 212 is functionally equivalent to the at least one processor or a processing unit 202 of the elevator control unit 200 . The at least one memory 214 is functionally equivalent to the at least one memory 204 of the elevator control unit 200 . The at least one transceiver 216 is functionally equivalent to the at least one transceiver 206 of the elevator control unit 200 . The functionalities and parameters of the cloud server 210 are equivalent to the functionalities and parameters of the elevator control unit 200 , and thus are not repeated here .

Fig . 3 is a flow diagram illustrating a method 300 of privacy protection for a passenger of an elevator system according to an embodiment of the present disclosure .

At operation 302 , a processor identifies a passenger arriving at a current area of an elevator system . At operation 304 , the processor determines whether or not privacy protection is to be used for the identified passenger while in the current area .

At operation 306 , the processor instructs at least one elevator system state information public display legible from the current area to disallow displaying destination information related to the identified passenger, in response to determining that the privacy protection is to be used for the identified passenger .

At optional operation 310 , the processor may instruct a wireless communication device carried by the passenger to allow displaying the destination information related to the identified passenger on a display of the wireless communication device , further in response to determining that the privacy protection is to be used for the identified passenger .

Alternatively, at operation 308 , the processor instructs the at least one elevator system state information public display legible from the current area to allow displaying destination information related to the identified passenger, in response to determining that the privacy protection is not to be used for the identified passenger .

The method 300 may be performed by the elevator control unit 200 or the cloud server 210 . The operations 302 , 304 , 306 , 308 , 310 can, for example , be performed by the at least one processor 202 , the transceiver 206 , and the memory 204 . Alternatively, the operations 302 , 304 , 306 , 308 , 310 can, for example , be performed by the at least one processor 212 , the transceiver 216 , and the memory 214 . Further features of the method 300 directly result from the functionalities and parameters of the elevator control unit 200 and the cloud server 210 , and thus are not repeated here . The method 300 can be performed by a computer program .

The functionality described herein can be performed, at least in part , by one or more computer program product components such as software components . Alternatively, or in addition, the functionality described herein can be performed, at least in part , by one or more hardware logic components . For example , and without limitation, illustrative types of hardware logic components that can be used include Field-programmable Gate Arrays ( FPGAs ) , Program-specific Integrated Circuits (AS ICs ) , Program-specific Standard Products (ASSPs ) , System-on-a-chip systems ( SOCs ) , Complex Programmable Logic Devices (CPLDs ) , and Graphics Processing Units (GPUs ) .

Any range or device value given herein may be extended or altered without losing the effect sought . Further, any embodiment may be combined with another embodiment unless explicitly disallowed .

Although the subj ect matter has been described in language specific to structural features and/or acts , it i s to be understood that the subj ect matter def ined in the appended claims is not necessarily limited to the specific features or acts described above . Rather, the specific features and acts described above are disclosed as examples of implementing the claims and other equivalent features and acts are intended to be within the scope of the claims .

It will be understood that the benefits and advantages described above may relate to one embodiment or may relate to several embodiments . The embodiments are not limited to those that solve any or all of the stated problems or those that have any or all of the stated benefits and advantages . It wil l further be understood that reference to ' an ' item may refer to one or more of those items .

The steps of the methods described herein may be carried out in any suitable order, or simultaneously where appropriate . Additionally, individual blocks may be deleted from any of the methods without departing from the spirit and scope of the subj ect matter described herein . Aspects of any of the embodiments described above may be combined with aspects of any of the other embodiments described to form further embodiments without losing the effect sought .

The term ' comprising ' is used herein to mean including the method, blocks or elements identified, but that such blocks or elements do not comprise an exclusive list and a method or apparatus may contain additional blocks or elements .

It will be understood that the above description is given by way of example only and that various modifications may be made by those s ki lled in the art . The above specification, examples and data provide a complete description of the structure and use of example embodiments . Although various embodiments have been described above with a certain degree of particularity, or with reference to one or more individual embodiments , those skilled in the art could make numerous alterations to the disclosed embodiments without departing from the scope of this specification .

Claims

28 CLAIMS :

1. An apparatus (200, 210) , comprising: at least one processor (202, 212) ; and at least one memory (204, 214) including computer program code; the at least one memory (204, 214) and the computer program code being configured to, with the at least one processor (202, 212) , cause the apparatus (200, 210) at least to perform: identifying a passenger (171, 172, 173) arriving at a current area (190) of an elevator system (100) ; determining whether or not privacy protection is to be used for the identified passenger (171, 172, 173) while in the current area (190) ; in response to determining that the privacy protection is to be used for the identified passenger (171, 172, 173) , instructing at least one elevator system state information public display (131, 141, 150) legible from the current area (190) to disallow displaying destination information related to the identified passenger (171, 172, 173) ; or in response to determining that the privacy protection is not to be used for the identified passenger (171, 172, 173) , instructing the at least one elevator system state information public display (131, 141, 150) legible from the current area (190) to allow displaying the destination information related to the identified passenger (171, 172, 173) .

2. The apparatus (200, 210) according to claim 1, wherein the at least one memory (204, 214) and the computer program code are configured to, with the at least one processor (202, 212) , cause the apparatus (200, 210) to perform the identifying of the passenger (171, 172, 173) using a first identification signaling received from an access control system (120) .

3. The apparatus (200, 210) according to claim 2, wherein the first identification signaling is received from a turnstile gate (140) or a destination operating panel (130) connected to the access control system (120) .

4. The apparatus (200, 210) according to claim 1, wherein the at least one memory (204, 214) and the computer program code are configured to, with the at least one processor (202, 212) , cause the apparatus (200, 210) to perform the identifying of the passenger (171, 172, 173) using a second identification signaling received from a biometric identification sensor (160) .

5. The apparatus (200, 210) according to claim 4, wherein the biometric identification sensor (160) comprises a facial recognition sensor.

6. The apparatus (200, 210) according to claim 1, wherein the at least one memory (204, 214) and the computer program code are configured to, with the at least one processor (202, 212) , cause the apparatus (200, 210) to perform the identifying of the passenger (171, 172, 173) using a third identification signaling received, via a short-range wireless connection transceiver (132) , from a wireless communication device (182) carried by the passenger (171, 172, 173) .

7. The apparatus (200, 210) according to claim 6, wherein the short-range wireless connection transceiver (132) is comprised in at least one of the at least one elevator system state information public display (131, 141, 150) .

8. The apparatus (200, 210) according to claim 6 or 7, wherein the third identification signaling is received via a near field communication based wireless connection or a Bluetooth low energy based wireless connection between the short-range wireless connection transceiver (132) and the wireless communication device (182) .

9. The apparatus (200, 210) according to any of claims 1 to 8, wherein the at least one memory (204, 214) and the computer program code are configured to, with the at least one processor (202, 212) , cause the apparatus (200, 210) to perform the determining of whether or not the privacy protection is to be used based on a privacy setting in a user profile of the identified passenger (171, 172, 173) , the privacy setting indicating whether or not the privacy protection is to be used for the identified passenger (171, 172, 173) while in the current area (190) .

10. The apparatus (200, 210) according to claim 9, wherein the privacy setting is manually set by the passenger (171, 172, 173) .

11. The apparatus (200, 210) according to claim 9, wherein the privacy setting is automatically set by an external elevator call management entity (220) .

12. The apparatus (200, 210) according to any of claims 1 to 8, wherein the at least one memory (204, 214) and the computer program code are configured to, with the at least one processor (202, 212) , cause the apparatus (200, 210) to perform the determining of whether or not the privacy protection is to be used in response to determining whether or not an amount of people in the current area (190) exceeds a first threshold, respectively.

13. The apparatus (200, 210) according to any of claims 1 to 8, wherein the at least one memory (204, 214) and the computer program code are configured to, with the at least one processor (202, 212) , cause the apparatus (200, 210) to perform the determining of whether or not the privacy protection is to be used in response to determining whether or not a proximity of the identified passenger (171, 172, 173) to one of the at least one elevator system state information public display (131, 141, 150) falls below a second threshold, respectively .

14. The apparatus (200, 210) according to claim 13, wherein the at least one memory (204, 214) and the computer program code are configured to, with the at least one processor (202, 212) , cause the apparatus (200, 210) to perform the determining of whether or not the proximity of the identified passenger (171, 172, 173) falls below the second threshold based on whether or not a short-range wireless connection is established between a short-range wireless connection transceiver (132) comprised in the one of the at least one elevator system state information public display (131, 141, 150) and a wireless communication device (182) carried by the passenger (171, 172, 173) , respectively.

15. The apparatus (200, 210) according to claim 13, wherein the at least one memory (204, 214) and the computer program code are configured to, with the at least one processor (202, 212) , cause the apparatus (200, 210) to perform the determining of whether or not the proximity of the identified passenger (171, 172, 173) falls below the second threshold based on tracking information received from a biometric identification sensor (160) comprising a facial recognition sensor.

16. The apparatus (200, 210) according to any of claims 1 to 15, wherein the at least one memory (204, 214) and the computer program code are configured to, with the at least one processor (202, 212) , cause the apparatus (200, 210) to perform instructing a wireless communication device (182) carried by the passenger (171, 172, 173) to allow displaying the destination information related to the identified passenger (171, 172, 173) on a display (183) of the wireless communication device (182) , in response to determining that the privacy protection is to be used for the identified passenger (171, 172, 173) .

17. The apparatus (200, 210) according to any of claims 1 to 15, wherein the at least one memory (204, 214) and the computer program code are configured to, 32 with the at least one processor (202, 212) , cause the apparatus (200, 210) to perform instructing an unsecure elevator system state information public display (150) legible from the current area (190) to identify a secure elevator system state information public display (131) legible from the current area (190) and allowed to display the destination information related to the identified passenger (171, 172, 173) , in response to determining that the privacy protection is to be used for the identified passenger (171, 172, 173) .

18. The apparatus (200, 210) according to any of claims 1 to 15, wherein the at least one memory (204, 214) and the computer program code are configured to, with the at least one processor (202, 212) , cause the apparatus (200, 210) to perform informing the identified passenger (171, 172, 173) about a secure elevator system state information public display (131) legible from the current area (190) and allowed to display the destination information related to the identified passenger (171, 172, 173) , after the identifying of the passenger (171, 172, 173) and in response to determining that the privacy protection is to be used for the identified passenger (171, 172, 173) .

19. The apparatus (200) according to any of claims 1 to 18, wherein the apparatus (200) comprises an elevator control unit.

20. The apparatus (210) according to any of claims 1 to 18, wherein the apparatus (210) comprises a cloud server.

21. A method (300) of privacy protection for a passenger of an elevator system, the method comprising: identifying (302) , by a processor, a passenger arriving at a current area of an elevator system; determining (304) , by the processor, whether or not privacy protection is to be used for the identified passenger while in the current area; 33 in response to determining that the privacy protection is to be used for the identi fied passenger, instructing ( 306 ) , by the processor, at least one elevator system state information public display legible from the current area to disallow displaying destination information related to the identified passenger ; or in response to determining that the privacy protection is not to be used for the identified passenger, instructing ( 308 ) , by the processor, the at least one elevator system state information public display legible from the current area to allow displaying the destination information related to the identified passenger .

22 . A computer program product comprising program code configured to perform the following when executed on a data-processing system : identifying ( 302 ) a passenger arriving at a current area of an elevator system; determining ( 304 ) whether or not privacy protection is to be used for the identi fied passenger whi le in the current area ; in response to determining that the privacy protection i s to be used for the identi fied passenger, instructing ( 306 ) at least one elevator system state information public display legible from the current area to disallow displaying destination information related to the identified passenger ; or in response to determining that the privacy protection is not to be used for the identified passenger, instructing ( 308 ) the at least one elevator system state information public display legible from the current area to allow displaying the destination information related to the identified passenger .

23 . An elevator system ( 100 ) , comprising the apparatus ( 200 , 210 ) according to any of claims 1 -20 .