Abstract: The present disclosure envisages optimization of a time-sensitive fog network deployed in an industrial environment. The time-sensitive fog network comprises a plurality of fog nodes communicably coupled to a plurality of industrial equipments referenced as endpoints. Each fog node is embodied with a plurality of computer-based resources including computational resources, storage resources, security resources, network resources, application-specific resources, and device-specific resources. The resource constraints that warrant the endpoints to cooperate with specific fog nodes to access specific resources are manifested as a compute profile, a storage profile, a security profile, a network profile, an application-specific profile, and a device-specific profile.

Abstract: Systems and methods for security of industrial data streams are provided herein. Methods according to various embodiments include provisioning a fogNode that is communicatively coupled with a fog cloud manager through a forwarder of the fogNode and providing a fogLet within the fogNode, the fogLet communicating with a plurality of operational technology devices. Embodiments include providing fogLet identification information using hardware root of trust of the fogNode, the hardware root of trust of the fogNode being a Trusted Platform Module (TPM) of the fogNode. Embodiments further comprise communicating operational device authentication information with fogLet identification information to a third party tenant application, the third party tenant application validating industrial data streams from the operational technology devices by communicating the operational device authentication information with the fogLet identification information to a third party cloud application.

Abstract: The present disclosure envisages optimization of a time-sensitive fog network deployed in an industrial environment. The time-sensitive fog network comprises a plurality of fog nodes communicably coupled to a plurality of industrial equipments referenced as endpoints. Each fog node is embodied with a plurality of computer-based resources including computational resources, storage resources, security resources, network resources, application-specific resources, and device-specific resources. The resource constraints that warrant the endpoints to cooperate with specific fog nodes to access specific resources are manifested as a compute profile, a storage profile, a security profile, a network profile, an application-specific profile, and a device-specific profile.

Abstract: Adaptive scheduling of compute functions in a fog network is described herein. An example method includes synchronizing kernel and hypervisor scheduling of applications used to control one or more edge devices using a global schedule, wherein the global schedule comprises timeslots for applications, and adapting the timeslots in real-time or near real-time based on application-based time related feedback that is indicative of time delays.

Abstract: According to some exemplary embodiments, the present disclosure is directed to a secure edge datastream processing and distribution system comprising a trusted datastream with metadata indicating ownership and access rights added at an edge. Further embodiments include sensors, machines or robots sending sensor data attributes to a fog operating system data pipeline, the fog operating system data pipeline sending dynamic data tags to secure containers and/or the fog operating system data pipeline sending role and org assignment data to secure containers. The secure containers may send correlated edge analytics to an authorization policy engine, and/or the secure containers may send datastream identification definition data to an authorization policy engine.

Abstract: Disclosed herein are enhancements for operating an input/output (I/O) management cluster with end I/O devices. In one implementation, a method of operating an I/O cluster includes, in a first I/O management node of the I/O management cluster, executing a first application to manage data for an I/O device communicatively coupled via at least one switch to the first I/O management node. The method further provides identifying a failure in the first I/O management node related to processing the data for the I/O device and, in response to the failure, configuring the at least one switch to communicate the data for the I/O device with a second I/O management node of the I/O management cluster. The method also includes, in the second I/O management node and after configuring the at least one switch, executing a second application to manage the data for the I/O device.

Abstract: Enterprise grade security for integrating multiple computing domains with a public cloud is provided herein. An example system a forwarder that provides one-way data publishing to a public cloud and a data bus that provides domain-to-domain messaging between a plurality of domains. At least one of the plurality of domains includes operational technology infrastructure devices and operational technology virtual machines. The operational technology virtual machines are communicatively coupled to the operational technology infrastructure devices using one or more operational technology switches. The operational technology switches isolates the operational technology infrastructure devices and facilitates one-way communication and prevents bidirectional communication to the operational technology infrastructure devices from the public cloud.

Abstract: Provided herein are exemplary systems and methods for a fog computing facilitated flexible factory including establishing a physical production process as part of a work cell, establishing a sensing process as part of the work cell for the physical production process, establishing a monitoring process for the sensing process and the physical production process, establishing a managing process for the monitoring process, the sensing process and the physical production process, establishing a planning process for the managing process, the monitoring process, the sensing process and the physical production process, and establishing a fog node as part of the work cell for all of the processes.

Abstract: Systems and methods for security of industrial data streams are provided herein. Methods according to various embodiments include provisioning a fogNode that is communicatively coupled with a fog cloud manager through a forwarder of the fogNode and providing a fogLet within the fogNode, the fogLet communicating with a plurality of operational technology devices. Embodiments include providing fogLet identification information using hardware root of trust of the fogNode, the hardware root of trust of the fogNode being a Trusted Platform Module (TPM) of the fogNode. Embodiments further comprise communicating operational device authentication information with fogLet identification information to a third party tenant application, the third party tenant application validating industrial data streams from the operational technology devices by communicating the operational device authentication information with the fogLet identification information to a third party cloud application.

Abstract: Adaptive scheduling of compute functions in a fog network is described herein. An example method includes synchronizing kernel and hypervisor scheduling of applications used to control one or more edge devices using a global schedule, wherein the global schedule comprises timeslots for applications, and adapting the timeslots in real-time or near real-time based on application-based time related feedback that is indicative of time delays.

Abstract: Disclosed herein are enhancements for operating an input/output (I/O) management cluster with end I/O devices. In one implementation, a method of operating an I/O cluster includes, in a first I/O management node of the I/O management cluster, executing a first application to manage data for an I/O device communicatively coupled via at least one switch to the first I/O management node. The method further provides identifying a failure in the first I/O management node related to processing the data for the I/O device and, in response to the failure, configuring the at least one switch to communicate the data for the I/O device with a second I/O management node of the I/O management cluster. The method also includes, in the second I/O management node and after configuring the at least one switch, executing a second application to manage the data for the I/O device.

Abstract: Enterprise grade security for integrating multiple computing domains with a public cloud is provided herein. An example system a forwarder that provides one-way data publishing to a public cloud and a data bus that provides domain-to-domain messaging between a plurality of domains. At least one of the plurality of domains includes operational technology infrastructure devices and operational technology virtual machines. The operational technology virtual machines are communicatively coupled to the operational technology infrastructure devices using one or more operational technology switches. The operational technology switches isolates the operational technology infrastructure devices and facilitates one-way communication and prevents bidirectional communication to the operational technology infrastructure devices from the public cloud.

Abstract: Centrally managed time sensitive fog networks are disclosed herein. An example fog network includes a plurality of dynamic end points, a plurality of service specific nodes offering one or more services selected from compute, storage, network, security, and business critical applications and functions, one or more fog nodes providing distributed resource management for plurality of services, and one or more system managers that provide centralized control of the one or more services to the plurality of dynamic end points.

Abstract: Provided herein are exemplary systems and methods for a fog computing facilitated flexible factory including establishing a physical production process as part of a work cell, establishing a sensing process as part of the work cell for the physical production process, establishing a monitoring process for the sensing process and the physical production process, establishing a managing process for the monitoring process, the sensing process and the physical production process, establishing a planning process for the managing process, the monitoring process, the sensing process and the physical production process, and establishing a fog node as part of the work cell for all of the processes.

Abstract: In one embodiment, a network device may detect a data plane critical fault condition, while a corresponding control plane is not experiencing a critical fault condition. In response to a network device based critical fault condition, the network device may activate and advertise an increased and expensive usable metric for each network interface of the network device. On the other hand, in response to an interface based critical fault condition, the network device may activate and advertise an increased and expensive usable metric for one or more particular network interfaces of the interface based critical fault, and signals, over the control plane to a corresponding network device at an opposing end of each particular network interface of the interface based critical fault, a request to activate and advertise an increased and expensive usable metric at the opposing end of each particular network interface.

Abstract: In one embodiment, a network device may detect a data plane critical fault condition, while a corresponding control plane is not experiencing a critical fault condition. In response to a network device based critical fault condition, the network device may activate and advertise an increased and expensive usable metric for each network interface of the network device. On the other hand, in response to an interface based critical fault condition, the network device may activate and advertise an increased and expensive usable metric for one or more particular network interfaces of the interface based critical fault, and signals, over the control plane to a corresponding network device at an opposing end of each particular network interface of the interface based critical fault, a request to activate and advertise an increased and expensive usable metric at the opposing end of each particular network interface.

Abstract: In one embodiment, a network device may detect a data plane critical fault condition, while a corresponding control plane is not experiencing a critical fault condition. In response to a network device based critical fault condition, the network device may activate and advertise an increased and expensive usable metric for each network interface of the network device. On the other hand, in response to an interface based critical fault condition, the network device may activate and advertise an increased and expensive usable metric for one or more particular network interfaces of the interface based critical fault, and signals, over the control plane to a corresponding network device at an opposing end of each particular network interface of the interface based critical fault, a request to activate and advertise an increased and expensive usable metric at the opposing end of each particular network interface.