Digital engineering secure remote access

Patent metadata

Field	Value
Publication number	US-12001874-B2
Application number	US-202117374122-A
Country	US
Kind code	B2
Filing date	Jul 13, 2021
Priority date	Jul 13, 2021
Publication date	Jun 4, 2024
Grant date	Jun 4, 2024

Abstract

An industrial information hub (IIH) and an industrial development hub (IDH) serve as an industrial ecosystem platform where multiple participants can deliver repeatable and standardized services relevant to their core competencies. The IIH system is centered around the development of an ecosystem that creates and delivers value to users—including industrial enterprises, OEMs, system integrators, vendors, etc.—through the aggregation of digital content and domain expertise. The IIH system serves as a trusted information broker between the ecosystem and the OT environments of plant facilities, and provides a platform for connecting assets, contextualizing asset data and providing secure access to the ecosystem. As part of this ecosystem, the IIH system uses a secure remote access architecture to allow users to remotely access data on their plant floor assets via a virtual private network connection.

First claim

What is claimed is:

1. A system for providing secure remote access to industrial engineering services, comprising:
a memory that stores executable components; and
a processor, operatively coupled to the memory, that executes the executable components, the executable components comprising:
an image registry configured to store, on a cloud platform, virtual machine images that are configured with respective industrial engineering applications and respective secure remote access runtime services; and
a provisioning component configured to
instantiate a virtual machine image, selected from the multiple virtual machine images, on which an industrial engineering application is installed to yield a virtual machine that executes the industrial engineering application on the cloud platform, and
establish a secure virtual private network connection between a client device and the virtual machine using the secure remote access runtime service.

2. The system of claim 1 , the executable components further comprising a user interface component configured to receive, from the client device, a request to utilize the industrial engineering application, wherein the provisioning component is configured to instantiate the virtual machine image in response to receipt of the request.

3. The system of claim 2 , wherein the user interface component is configured to render a front-end interface on the client device that displays indications of a subset of the industrial engineering applications that a user of the client device is permitted to access based on an industrial enterprise with which the user is affiliated, and to receive the request as a selection of the industrial engineering application submitted via interaction with the front-end interface.

4. The system of claim 2 , wherein the user interface component is further configured to remotely visualize the industrial engineering application on the client device via the virtual private network connection and to facilitate interaction with the industrial engineering application from the client device.

5. The system of claim 1 , wherein the industrial engineering applications comprise at least one of an industrial control program development application, a human-machine interface development application, an industrial controller emulator, an industrial asset or plant simulation platform, an industrial project analysis application, an industrial data collection application, or an engineering drawing application.

6. The system of claim 1 , wherein
the system maintains segregated digital engineering spaces on the cloud platform designated to respective different industrial enterprises, and
the provisioning component is configured to deploy and execute the virtual machine on a digital engineering space, of the digital engineering spaces, corresponding to an industrial enterprise associated with a user of the client device.

7. The system of claim 6 , wherein the provisioning component is configured to tag the virtual machine with at least one of a tenant identifier that associates the virtual machine with the digital engineering space, a stock-keeping unit associated with the industrial enterprise, a version number, or a user identifier of the user.

8. The system of claim 1 , wherein
the system maintains multiple image registries on the cloud platform designated to respective different vendors of the industrial engineering applications, and
the provisioning component is configured to register a new industrial engineering application submitted to the system by a vendor, of the different vendors, in one of the multiple image registries designated to the vendor.

9. The system of claim 1 , wherein the provisioning component is further configured to record a log of transactions between the client device and the virtual machine, the log comprising at least a record indicating when the virtual machine was instantiated, an identity of a user who instantiated the virtual machine, records of when the virtual machine was started, records of when the virtual machine was stopped, records of when the virtual machine was re-imaged, or records of when the virtual machine was destroyed.

10. A method, comprising:
storing, on a cloud platform by a system comprising a processor, virtual machine images that are configured with respective industrial engineering applications and respective secure remote access runtime services;
instantiating, by the system, a virtual machine image, selected from the multiple virtual machine images, on which an industrial engineering application is installed to yield a virtual machine that executes the industrial engineering application on the cloud platform; and
establishing, by the system, a secure virtual private network connection between a client device and the virtual machine using the secure remote access runtime service.

11. The method of claim 10 , wherein the instantiating comprises:
receiving, from the client device, a request to utilize the industrial engineering application, and
instantiating the virtual machine image in response to receipt of the request.

12. The method of claim 11 , wherein the receiving the requests comprises
rendering a front-end interface on the client device that displays indications of a subset of the industrial engineering applications that a user of the client device is permitted to access based on an industrial enterprise with which the user is affiliated, and
receiving the request as a selection of the industrial engineering application submitted via interaction with the front-end interface.

13. The method of claim 10 , further comprising:
remotely visualizing, by the system, the industrial engineering application on the client device via the virtual private network connection; and
facilitating, by the system, interaction with the industrial engineering application from the client device.

14. The method of claim 10 , wherein the industrial engineering applications comprise at least one of an industrial control program development application, a human-machine interface development application, an industrial controller emulator, an industrial asset or plant simulation platform, an industrial project analysis application, an industrial data collection application, or an engineering drawing application.

15. The method of claim 10 , further comprising:
defining, by the system, segregated digital engineering spaces on the cloud platform; and
assigning, by the system, the digital engineering spaces to respective different industrial enterprises,
wherein the instantiating comprises deploying and executing the virtual machine on a digital engineering space, of the digital engineering spaces, corresponding to an industrial enterprise associated with a user of the client device.

16. The method of claim 15 , wherein the instantiating comprises tagging the virtual machine with at least one of a tenant identifier that associates the virtual machine with the digital engineering space, a stock-keeping unit associated with the industrial enterprise, a version number, or a user identifier of the user.

17. The method of claim 10 , further comprising:
defining, by the system, multiple image registries on the cloud platform;
assigning, by the system, the multiple image registries to respective different vendors of the industrial engineering applications, and
in response to receipt of a new industrial engineering application submitted to the system by a vendor, registering, by the system the new industrial engineering application in one of the multiple image registries assigned to the vendor.

Assignees

• Rockwell Automation Tech Inc
• Rockwell Automation Tech

Inventors

• Dunn Ryan P
• Sandler Nathaniel S
• Como Christopher Wayne
• Shah Chirayu S
• MOHAN Anoop

Classifications

• G06F9/45558 Primary

  Hypervisor-specific management and integration aspects · CPC title

• G06F8/63

  Image based installation; Cloning; Build to order · CPC title

• G06F2009/45562

  Creating, deleting, cloning virtual machine instances · CPC title

• G06F2009/45575

  Starting, stopping, suspending or resuming virtual machine instances · CPC title

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title