Abstract: An integrated accessory control system can efficiently set up a new media streaming session with one or more accessories. A session identifier for the new session, as well as a destination address and security parameters can be generated. A data object comprising the generated elements can be written to a resource location. Additionally, a second data object comprising the session identifier, a streaming source address, a source identifier, and additional security parameters can be read from the resource location. A third data object comprising the session identifier, a session start command, and codec parameters can then be generated. The third data object can also be written to the resource location. Further, streamed media data conforming to the codec parameters and the security parameters may be received.

Abstract: A relay service can relay messages between controllers and electronically controllable accessory devices that may be located remotely from the controllers. Relaying of messages by the relay service can be decoupled from any knowledge of the functionality of the accessory or the content of the messages. Device identification and relaying of messages can be managed using “relay aliases” that are meaningful only to the relay service and the endpoint devices (the controller and accessory). The endpoint devices can implement end-to-end security for messages transported by the relay service.

Abstract: Modifications made by multiple controller devices to an environment model describing a shared automated environment can be coordinated. One of the controller devices can be designated as a coordinator, and any controller device other than the coordinator can send an update request to the coordinator. The coordinator can determine whether to accept or reject the requested modification and can report its determination to the requesting controller device. If the coordinator accepts the request, the coordinator can instigate operations to update the environment model across all controller devices of all users. If the coordinator rejects the request, the environment model is not updated. The controller device that made the request can update its local copy of the environment model and roll back the update if the request is rejected.

Abstract: A controller and an accessory controllable by the controller can communicate using secure read and write procedures. The procedures can include encrypting identifiers of accessory characteristics targeted by a read or write operation as well as any data being read or written. The procedures can also include the accessory returning a cryptographically signed response verifying receipt and execution of the read or write instruction. In some instances, a write procedure can be implemented as a timed write in which a first instruction containing the write data is sent separately from a second instruction to execute the write operation; the accessory can disregard the write data if the second instruction is not received within a timeout period after receiving the first instruction.

Abstract: Controllers can be used to control the operation of various accessories. Controllers with access to a particular accessory (or group of accessories) can be organized into a controller network to facilitate control. The controller network can include various proxy devices including bridge and tunnel proxies that can relay messages to and from accessories, perform protocol translations, and/or provide communication security. Some proxy devices can include decision logic to enable coordinated control over one or more accessories by the controllers in the controller network.

Abstract: A relay service can relay messages between controllers and electronically controllable accessory devices that may be located remotely from the controllers. Relaying of messages by the relay service can be decoupled from any knowledge of the functionality of the accessory or the content of the messages. Device identification and relaying of messages can be managed using “relay aliases” that are meaningful only to the relay service and the endpoint devices (the controller and accessory). The endpoint devices can implement end-to-end security for messages transported by the relay service.

Abstract: Modifications made by multiple controller devices to an environment model describing a shared automated environment can be coordinated. One of the controller devices can be designated as a coordinator, and any controller device other than the coordinator can send an update request to the coordinator. The coordinator can determine whether to accept or reject the requested modification and can report its determination to the requesting controller device. If the coordinator accepts the request, the coordinator can instigate operations to update the environment model across all controller devices of all users. If the coordinator rejects the request, the environment model is not updated. The controller device that made the request can update its local copy of the environment model and roll back the update if the request is rejected.

Abstract: In some implementations, a coordinator device can prefetch images from a camera accessory in response to receiving a doorbell event notification from a doorbell accessory. For example, the coordinator device can prefetch an image in response to receiving a doorbell event notification from a doorbell accessory so that the captured image is contemporaneous with the doorbell event and to avoid making multiple subsequent requests for the same image from the camera accessory when multiple user devices request the captured image. The coordinator device can store the image received from the camera accessory and serve the image to user devices when the user devices request a snapshot image corresponding to the doorbell event.

Abstract: Modifications made by multiple controller devices to an environment model describing a shared automated environment can be coordinated. One of the controller devices can be designated as a coordinator, and any controller device other than the coordinator can send an update request to the coordinator. The coordinator can determine whether to accept or reject the requested modification and can report its determination to the requesting controller device. If the coordinator accepts the request, the coordinator can instigate operations to update the environment model across all controller devices of all users. If the coordinator rejects the request, the environment model is not updated. The controller device that made the request can update its local copy of the environment model and roll back the update if the request is rejected.

Abstract: An automated environment can include multiple controller devices capable of communicating with multiple accessory devices. The controller devices can automatically elect one of their number as a coordinator device for the environment and can automatically perform a new election if an incumbent coordinator becomes unavailable or resigns. The election processes can be transparent to any users. An elected coordinator can perform various operations to facilitate management of the automated environment, including routing of communications between controllers and accessories.

Abstract: An integrated accessory control system can integrate functionality (services) of multiple disparate accessories and provide a unified user interface for interacting with the system via a controller device. An integrated accessory control system can include one accessory that can detect an event or action and send a notification to the controller device and at least one other accessory, such as an IP camera, that can be operated in response to the notification. In response to the notification, a controller device can generate an integrated user interface for interacting with the accessories in the integrated accessory control system. The interface can include a live feed from the IP camera, which can provide a media stream responsive to instructions from the controller.

Abstract: A data transfer process can include multiple verification features usable by a “source” device to ensure that a “destination” device is authorized to receive a requested data object. The source device and destination device can communicate via a first communication channel (which can be on a wide-area network) to exchange public keys, then use the public keys to verify their identities and establish a secure session on a second communication channel (which can be a local channel). The data object can be transferred via the secure session. Prior to sending the data object, the source device can perform secondary verification operations (in addition to the key exchange) to confirm the identity of the second device and/or the locality of the connection on the second communication channel.

Abstract: An integrated accessory control system can efficiently set up a new media streaming session with one or more accessories. A session identifier for the new session, as well as a destination address and security parameters can be generated. A data object comprising the generated elements can be written to a resource location. Additionally, a second data object comprising the session identifier, a streaming source address, a source identifier, and additional security parameters can be read from the resource location. A third data object comprising the session identifier, a session start command, and codec parameters can then be generated. The third data object can also be written to the resource location. Further, streamed media data conforming to the codec parameters and the security parameters may be received.

Abstract: A relay service can relay messages between controllers and electronically controllable accessory devices that may be located remotely from the controllers. Relaying of messages by the relay service can be decoupled from any knowledge of the functionality of the accessory or the content of the messages. Device identification and relaying of messages can be managed using “relay aliases” that are meaningful only to the relay service and the endpoint devices (the controller and accessory). The endpoint devices can implement end-to-end security for messages transported by the relay service.

Abstract: A controller and an accessory controllable by the controller can communicate using secure read and write procedures. The procedures can include encrypting identifiers of accessory characteristics targeted by a read or write operation as well as any data being read or written. The procedures can also include the accessory returning a cryptographically signed response verifying receipt and execution of the read or write instruction. In some instances, a write procedure can be implemented as a timed write in which a first instruction containing the write data is sent separately from a second instruction to execute the write operation; the accessory can disregard the write data if the second instruction is not received within a timeout period after receiving the first instruction.

Abstract: A relay service can relay messages between controllers and electronically controllable accessory devices that may be located remotely from the controllers. Relaying of messages by the relay service can be decoupled from any knowledge of the functionality of the accessory or the content of the messages. Device identification and relaying of messages can be managed using “relay aliases” that are meaningful only to the relay service and the endpoint devices (the controller and accessory). The endpoint devices can implement end-to-end security for messages transported by the relay service.

Abstract: Execution of a trigger (or triggered action set) can be delegated by an owner device to a delegate device. The delegate device can assume responsibility for executing the trigger without further communication from the owner device. The owner device can monitor the status of the delegate device; if the delegate device enters a state in which it is presumed to be unavailable to execute the trigger, the owner device can resume the responsibility for executing the trigger.

Abstract: A relay service can relay messages between controllers and electronically controllable accessory devices that may be located remotely from the controllers. Relaying of messages by the relay service can be decoupled from any knowledge of the functionality of the accessory or the content of the messages. Device identification and relaying of messages can be managed using “relay aliases” that are meaningful only to the relay service and the endpoint devices (the controller and accessory). The endpoint devices can implement end-to-end security for messages transported by the relay service.

Abstract: Controllers can be used to control the operation of various accessories. A group of accessories can be organized into an accessory network that can facilitate coordinated control of multiple accessories. The accessory network can be organized according to an environment model that can include a hierarchical representation of a physical environment where accessories are present. The environment model can be synchronized across different controllers that have access to the accessories.

Abstract: Controllers can be used to control the operation of various accessories. Controllers with access to a particular accessory (or group of accessories) can be organized into a controller network to facilitate control. The controller network can include various proxy devices including bridge and tunnel proxies that can relay messages to and from accessories, perform protocol translations, and/or provide communication security. Some proxy devices can include decision logic to enable coordinated control over one or more accessories by the controllers in the controller network.