Secure command execution from a cloud monitoring system to a remote cloud agent

A method, comprising:

• transmitting, by a cloud agent device comprising a processor, industrial data associated with an industrial device to a cloud platform system over a first communication channel;
• receiving, by the cloud agent device from the cloud platform system, command data for the industrial device, wherein the command data is generated by the cloud platform system to implement a control action determined, based on analysis of the industrial data and a behavioral model, to satisfy a defined optimization criterion;
• obtaining, by the cloud agent device, a security manifest from the industrial device, wherein the security manifest comprises security validation requirements for maintaining an operating condition of the industrial device within a set of defined operating limits with respect to execution of an industrial process associated with the industrial device,
• validating, by the cloud agent device, whether the command data received from the cloud platform system satisfies the security validation requirements;
• in response to determining that the command data does not satisfy the security validation requirements, transmitting, by the cloud agent device, an alert message to the cloud platform system via a notification route defined by the security manifest;
• and
• in response to determining that the command data satisfies the security validation requirements:
• establishing, by the cloud agent device, a second communication channel between the cloud agent device and the industrial device for communication of the command data, wherein the second communication channel is distinct from the first communication channel and is encrypted, and
• initiating, by the cloud agent device, execution of the command data on the industrial device.

A non-transitory computer-readable medium having stored thereon instructions that, in response to execution, cause a system comprising a processor to perform operations, the operations comprising:

• sending industrial data associated with an industrial device to a cloud platform system located remotely from the industrial device;
• receiving, from the cloud platform system, command data directed to the industrial device, wherein the command data is generated by the cloud platform system data to implement a control action determined, based on analysis of the industrial data and a behavioral model, to satisfy a defined optimization criterion;
• retrieving, from the industrial device, a security manifest that is customized for the industrial device, the security manifest comprising a set of security requirements associated with maintaining an operating condition of the industrial device within a set of defined operating limits with respect to execution of an industrial process associated with the industrial device,
• validating whether the command data received from the cloud platform system satisfies the set of security requirements;
• in response to determining that the command data does not satisfy the set of security validation requirements, transmitting an alert message to the cloud platform system via a notification path specified by the security manifest;
• and
• in response to determining that the command data satisfies the set of security validation requirements:
• establishing an encrypted communication channel between the system and the industrial device for communication of the command data, and
• initiating execution of the command data on the industrial device.