General Electric Company

Vineet Banga

Atul Chandrakant Kshirsagar

Vipul Parmar

Ruchir Tewari

Ilya Lipkind

Sanjeev Chopra

Dariush Amiri

Leo Chu

Systems and methods for role-based access control to computing resources are presented. In an example embodiment, a request to perform a type of access of a computing resource is received via a communication network from a process executing on a client device. Using a data store storing process identifiers and associated access control information, access control information associated with the requesting process is identified based on a process identifier of the requesting process. Based on the access control information associated with the requesting process, a determination is made whether the requesting process is allowed to perform the requested type of access of the computing resource. The request is processed based on the requesting process being allowed to perform the requested type of access of the computing resource.

Role-based resource access control

In an example embodiment, a method, system, and program storage device for binding an industrial application to a plurality of services in an Industrial Internet of Things (IIoT) is provided. For each of a plurality of tenants, a service template corresponding to a group in which the corresponding tenant belongs is retrieved and an instance of the industrial application is instantiated for the corresponding tenant. Then, at runtime of an instance of the industrial application, a number of actions are taken. A request by the instance of the industrial application for a service identified by a first service name is detected. Then a credential for the service name is retrieved, with the credential identifying a location where an instance of the service identified by the first service name resides. The service identified by the first service name is then dynamically called using the location.

Method, system, and program storage device for managing tenants in an industrial internet of things

Provided are a system and method for routing messages in a multi-tenant cloud computing environment based on digital certificates. In one example, a server includes a network interface configured to receive a request and a digital certificate from a network object, where the digital certificate includes a plurality of attributes. The server also includes a processor configured to determine whether the digital certificate is valid, and in response to determining the digital certificate is valid, detect tenant information from an attribute among the plurality of attributes included in the digital certificate. For example, the detected tenant information may identify a tenant of the multi-tenant cloud computing environment. The network interface may be further configured to transmit the request to the multi-tenant cloud computing environment based on the detected tenant information.

Routing cloud messages using digital certificates

A credentials database that includes a first credentials locker with a first path defining the location of the first locker, and a second credentials locker. An application program is executed and the application program is a computer program that has direct interaction with a user. A first service program and a second service program are executed, and the first service program and the second service program do not have direct interaction with the user. The first service program is called by the application program, and the second service program is called by the first service program. The first service program uses security credentials to request and obtain data from the second service program, and the second service program. The first service program always has access to and is able to obtain the current credentials.

Apparatus and method for obtaining up-to-date security credentials

In some example embodiments, a method comprises receiving a web service request for accessing a resource of a web service, with the web service request corresponding to a user and comprising an access token, identifying a zone for the web service request, identifying a security token provider based on the access token, identifying one or more trusted token providers for the zone, comparing the security token provider to the trusted token provider(s) for the zone, generating a determination that the security token provider does not match any of the trusted token provider(s) for the zone, and denying the web service request based on the determination that the security token provider does not match any of the trusted token provider(s) for the zone.

Growing community of inventors

San Ramon, CA, United States of America

Vineet Banga