Secure remote access for cloud-based industrial automation

1 . A method for establishing a secure remote access (SRA) connection between a cloud computing system (CCS) and an industrial automation system (IAS) comprising actuators and sensors of a factory or manufacturing plant, the method comprising:

receiving, by an SRA server component of the CCS, a first SRA connection establishment message from a first SRA client of the CCS or from a second SRA client of a user device connected to the CCS;

receiving, by a connection orchestrator component of the CCS, an indication to establish the SRA connection between the CCS and the IAS;

sending, by the connection orchestrator component of the CCS and based at least in part on the indication, a machine-to-machine network protocol message to a third SRA client of the IAS comprising information for establishing the SRA connection between an industrial controller of the IAS and the CCS;

receiving, by the SRA server component of the CCS, a second SRA connection establishment message from the third SRA client of the IAS; and

establishing, via the SRA server component of the CCS, the SRA connection between the first SRA client of the CCS and the industrial controller of the IAS or between the second SRA client of the user device and the industrial controller of the IAS.

2 . The method of claim 1 , wherein receiving, by the SRA orchestrator component of the CCS, the indication to establish the SRA connection between the CCS and the IAS comprises:

receiving, via an application programming interface, the indication to establish the SRA connection from the user device connected to the CCS; or

receiving the indication to establish the SRA connection from an application software component of the CCS used by the user device connected to the CCS.

3 . The method of claim 1 , wherein the machine-to-machine network protocol message comprises an MQTT message.

4 . The method of claim 1 , wherein the SRA connection comprises a virtual private network (VPN) connection; and

wherein the first, the second and the third SRA client comprise a VPN client and wherein the SRA server component comprises a VPN server component.

5 . The method of claim 1 , wherein the SRA connection comprises a secure shell (SSH) port forwarding connection; and

wherein the first, the second and the third SRA client comprise a SSH client and wherein the SRA server component comprises a SSH server component.

6 . A cloud computing system comprising one or more hardware processors configured to execute the method of claim 1 .

7 . A non-transitory computer-readable medium containing a computer program comprising instructions which, upon being executed by one or more processors of a cloud computing system, provide for execution of the steps of claim 1 .

8 . The method of claim 1 , wherein the CCS hosts logic configured to send commands to the industrial controller of the IAS for automated and/or command-based control of the industrial controller to execute on or more specific tasks on the IAS.

9 . The method of claim 8 , wherein the CCS is configured to automatically send a command to the industrial controller in response to an event or condition reported by one of the sensors of the IAS.

10 . The method of claim 1 , wherein the connection orchestrator component of the CCS sends the machine-to-machine network protocol message to the third SRA client of the IAS via a factory connectivity service client of the IAS.

11 . The method of claim 10 , wherein the factory connectivity service client is disposed inside a demilitarized zone of the IAS.

12 . The method of claim 10 , wherein the factory connectivity service client is disposed inside an operational technology sub-network of the IAS.

13 . The method of claim 10 , wherein the machine-to-machine network protocol message is transmitted by a MQTT machine-to-machine network interface connection.

14 . The method of claim 1 , wherein the industrial controller is a robot controller.

15 . A method for configuring an industrial controller of an industrial automation system (IAS) via a cloud computing system (CCS), the method comprising:

generating a controller program and/or a controller configuration for the industrial controller;

establishing a secure remote access (SRA) connection between the CCS and the IAS by:

receiving, by an SRA server component of the CCS, a first SRA connection establishment message from a first SRA client of the CCS or from a second SRA client of a user device connected to the CCS;

receiving, by a connection orchestrator component of the CCS, an indication to establish the SRA connection between the CCS and the IAS;

sending, by the connection orchestrator component of the CCS and based at least in part on the indication, a machine-to-machine network protocol message to a third SRA client of the IAS comprising information for establishing the SRA connection between the industrial controller of the IAS and the CCS;

receiving, by the SRA server component of the CCS, a second SRA connection establishment message from the third SRA client of the IAS; and

establishing, via the SRA server component of the CCS, the SRA connection between the first SRA client of the CCS and the industrial controller of the IAS or between the second SRA client of the user device and the industrial controller of the IAS; and

sending, using the established SRA connection, the generated controller program and/or controller configuration to the industrial controller.

16 . The method of claim 15 , further comprising:

establishing a connection between a user device and an integrated development environment of the CCS; and

using the integrated development environment for generating the controller program and/or the controller configuration.