Method and system for managing access control for a plurality of digital twins interacting in a computer simulated environment over a distributed network

Abstract

The present invention provides a system (100), apparatus (110) and method (400) for method for managing access control for digital twins (104-1 to 104-N) interacting in computer simulated environment over a distributed network. The method comprises receiving, by processing unit (302) request from a user (608) for accessing digital twins (102-1 to 102-N) corresponding to one or more assets in the computer simulated environment; identifying, entities (104-1 to 104-N) corresponding to digital twins for which access is requested by user based on unique identifier token associated with one digital twins; sending, an approval request to the identified entities of the digital twins; and generating authorization token upon approval of request from the entities associated with the digital twins, wherein authorization token comprises one or more operating parameters for digital twin as identified from associated unique identifier token of digital twin.

Description

[0001] METHOD AND SYSTEM FOR MANAGING ACCESS CONTROL FOR A PLURALITY OF DIGITAL TWINS INTERACTING IN A COMPUTER SIMULATED ENVIRONMENT OVER A DISTRIBUTED NETWORK

[0002] The present invention generally relates to digital twin systems, and more specifically to a method and system for managing access control for a plurality of digital twins interacting in a computer simulated environment over a distributed network.

[0003] Industrial environments include plurality of machines or assets in an automated factory, or loT devices interacting with one another. Industrial environments thus often include multiple interconnected components in signal communication with each other, either directly or across a network. An emerging concept complementing the rapid industrial development is “the industrial metaverse”. The industrial metaverse is a next generation of fully immersive three- dimensional collaborative space that integrates multiple technical directions such as digital twin, internet of things, industrial internet, augmented reality, virtual reality, mixed reality, and the like. Metaverse is a virtual universe with shared, 3D virtual spaces where virtual assets can be owned, placed and interacted with. It also allows different users to interact with each other in the collaborative environment. These virtual assets can be simple entities like chair or table, or complex entities like industrial machinery.

[0004] For this purpose, a typical IIoT (Industrial Internet of Things) solution in a metaverse would include building a digital twin of one or more assets in the industrial environment. A digital twin can, for example, represent a real-world power plant, a car, or an aircraft and replicates the features and parameters of the same. Conventional DTs in simulation environments are for only one specific piece of processing equipment. Although, for an industrial facility, it is recognized to provide a DT having interconnected processing equipment. A plurality of different DTs is thus needed from the different equipment vendors for the various processing equipment deployed on a wide variety of infrastructures. The plurality of DTs maybe owned by several entities. Furthermore, a digital twin may be realized by receiving data via sensors and loT devices located on the real twin and subsequently transmitted to the digital twin. These sensors can be owned by different entities. For example, suppose we wish to test a new machine design consisting of components in a previously unexplored composition. These components are already being used individually in different machines. The new design can be tested by creating a digital twin from multiple sources. The live data of the components are sourced from different machines owned by different entities. It should be understood that each sensor is essentially an asset owned by an owner.

[0005] There are several challenges in order to create and operate such a digital twin in the metaverse. One of the major challenges is management of ownership of the components of the digital twin. Another major challenge is access control of the different components of the digital twins. The ownership of the components needs to be retained by the original owners and only the access needs to be provided to the requestor. Furthermore, the access control mechanism should be easily integrated with existing legacy systems. Furthermore, the current challenges in metaverse with respect to operability of digital twins are ownership transfer of a digital twin from one user to another, leasing a digital twin for a limited time period, providing access to the digital twin for a limited period of time as per some defined criteria, providing access to the digital twin to multiple users at the same time, etc. Currently there are no systems that solve the abovementioned challenges in the metaverse in a secure and seamlessly interoperable manner.

[0006] In the light of the above, there exists a need to provide a system and method for managing access control for a plurality of digital twins interacting in a computer simulated environment over a distributed network in a secure and reliable manner.

[0007] Therefore, the object of the invention is to provide a system and method for managing access control for a plurality of digital twins interacting in a computer simulated environment over a distributed network.

[0008] Throughout the present disclosure, the term “industrial environment” may refer to plurality of industrial assets connected with each other to achieve a function. The industrial environment may be comprised of industrial assets such as industrial machines, industrial devices, industrial controllers, and so forth.

[0009] Throughout the present disclosure, the term “one or more assets” as used herein refers to any device, system, instrument, or machinery manufactured or used in an industry that may be employed for performing an operation. Example of assets include any machinery in an industrial environment or technical installation / facility such as motors, gears, bearings, shafts, switchgears, rotors, circuit breakers, protection devices, remote terminal units, transformers, reactors, disconnectors, gear-drive, gradient coils, magnets, radio frequency coils etc. Exemplary technical systems include turbines, large drives, Magnetic Resonance Imaging (MRI) scanner, etc. Example facility / technical installation may be a complex industrial set-up with a plurality of assets such as a power plant, wind farm, power grid, manufacturing facility, process plants and so on.

[0010] Throughout the present disclosure, the term “computed simulated environment” as used herein refers to three-dimensional (3D) representation of a real or physical world. It can be understood as a virtual world. The computer-simulated environment is accessible by a user, i.e., it is accessible from the real / physical world. This comprises data exchange between the computer-simulated environment and the real / physical world. In particular, the computer-simulated environment can be understood as the “metaverse”. It is also possible to interact with the computer-simulated environment, i.e., to influence or use processes, components and / or functions in the computer-simulated environment. Therefore, processes in the computer-simulated environment may have direct influence on processes in the real / physical world, e.g., by modelling control processes virtually

[0011] For example, it is possible that a user can access the computer-simulated environment via an interface, e.g., a virtual reality (VR) or augmented reality (AR) interface. The counterpart of the computer-simulated environment does not necessarily have to exist but can be for example a 3D model. It is also possible that physical forces and phenomena, e.g., gravity, are represented in a different way in the computer-simulated environment than in the real world, e.g., gravitational acceleration. For the purpose of this invention, the metaverse is comprised of a plurality of digital twins corresponding to real-world one or more assets in the industrial environment.

[0012] The metaverse may comprise a plurality of computer-simulated components. The computer simulated components can for example be understood as a representation, in particular a 3D representation, of a real or physical component. A component can for example be a room, a building, an item, or an object. The computer-simulated component can have different functionalities / features, e.g., an access interface. The computer-simulated component further comprises data that are component-specific, e.g., sensor data of a virtual sensor, that can be retrieved for example via the access interface. An access to a computer-simulated component can for example comprise usage, modification, connection to other computer-simulated components, etc. The computer-simulated component can interact with the computer-simulated environment. For the purpose of this invention, the computer-simulated component may be a digital twin or a plurality of digital twins in the computer simulated collaborative environment or metaverse.

[0013] The metaverse can be realized by a hosting environment. The hosting environment can be for example be implemented as a cloud environment, an edge-cloud environment and / or on specific devices, e.g., mobile devices.

[0014] Throughout the present disclosure, the term “distributed network” as used herein refers to a network system providing decentralized control and storage of the ledger at the one or more entities (which may be considered “nodes” of the system). The number of “nodes” may be fixed or vary with time and increasing or decreasing the number of “nodes” may impact the performance and / or security of the system. The ledger copies stored and maintained at each “node” provide cross -validation with one another in the event of conflicts between ledgers, and various cryptographic and / or hashing algorithms may be utilized during the generation, updating, linking, and so on, of ledger entries such that ledger entries have increased resiliency to unauthorized tampering or modification.

[0015] Throughout the present disclosure, the term “one or more entities” as used herein refers to owners of the one or more digital twins. The one or more entities may be individuals, businesses, organization(s), institution(s), manufacturers, service providers, data managers, and so forth.

[0016] Throughout the present disclosure, the term “one or more data sources” as used herein refers to electronic devices that provide data pertaining to one or more assets in the industrial environment. Non-limiting examples of data sources include sensors, controllers, edge devices, databases, and simulators. In an example, the one or more sources may be sensors such as a temperature sensor, a velocity sensor, an acceleration sensor, a pressure sensor, and a force sensor. The output from the sensors may be in the form of temperature data, velocity data, acceleration data or pressure data. In an embodiment, the sensor data are obtained through data acquisition interfaces. In another example, the data source may be a simulation model configured to forecast one or more parameters in the assets. In another example, the data source may be a database storing data from sensors, simulation models and manual entries by the user. In yet another example, the data source is an input device that enables user to enter requirements and data available through a web-based interface.

[0017] Throughout the present disclosure, the term “digital twin” as used herein refers to digital copy of a physical item (e.g., a real machine) that is created to support data access, command and control, remote configuration, as well as simulation and analytics. A DT is commonly created simultaneously with the real devices and systems, such as processing equipment and sensors in the facility. Once created by a specific vendor for their own specific equipment, the DT can be used to represent the machine in a digital representation of a real world system. The DT is created such that it is identical in form and behavior to the corresponding machine. DTs may be supported by the vendors' own IIoT infrastructure. Thus, each DT is associated with one and only one asset. A customer deploying IIoT may thus end up having many such DTs deployed on a wide variety of infrastructures because IIoT vendors generally host their solutions on a variety of different cloud platforms (e.g. Microsoft AZURE, Amazon AWS, their own or third party data center), and may use a wide variety of open source and other components to create their digital twin solutions. Throughout the present disclosure, the term “unique identifier token” as used herein refers to a token or value that uniquely identifies an asset in the industrial environment. In an embodiment, the unique identifier token is a nonfun gible token or NFT.

[0018] Throughout the present disclosure, the term “authorization token” refers to a token or function that enables access control for one or more digital twins in the collaborative simulation environment. In an embodiment, the authorization token is JSON web based token or JWT.

[0019] Throughout the present disclosure, the term “user” as used herein refers to any person, avatar, virtual assistant, or any other device or system configured to raise request to the apparatus for managing access control for a plurality of digital twins.

[0020] The method comprises receiving, by a processing unit, a request from a user for accessing one or more digital twins corresponding to one or more assets in the computer simulated environment. Herein, each of the one or more digital twins are tokenized using a unique identifier token. Herein the request comprises one or more requirements for simulating one or more scenarios in the one or more digital twins.

[0021] According to an embodiment, the method of tokenizing the plurality of digital twins in the computer simulated environment comprises determining one or more components of each of the plurality of digital twins, wherein each component is a digital twin communicatively coupled to other components of the digital twin. The method of tokenizing the plurality of digital twins in the computer simulated environment comprises identifying an entity associated with each of the one or more components of the plurality of digital twins. The method of tokenizing the plurality of digital twins in the computer simulated environment comprises assigning a unique identifier token to each of the components of the plurality of digital twins. Herein, the unique identifier token comprises ownership information of the digital twins. According to an embodiment, the unique identifier token is a simple token associated with a single component of the digital twin. According to another embodiment, the unique identifier token is a composite token associated with a plurality of components of the digital twin, wherein the composite token comprises a plurality of simple tokens.

[0022] According to an embodiment, the one or more components of the digital twin correspond to functional components of the digital twin in the real-world, wherein the functional component is a component integral to the asset.

[0023] According to an embodiment, the one or more components of the digital twin correspond to non -functional components of the digital twin in the real-world, wherein the non-functional component is a data source for acquiring real-world behavior of the one or more assets.

[0024] The method comprises identifying, by the processing unit, one or more entities corresponding to one or more digital twins for which access is requested by the user based on the unique identifier token associated with the one or more digital twins.

[0025] According to an embodiment, the method further comprises selecting one or more digital twins from the plurality of digital twins that are required for simulating one or more scenarios based on the one or more requirements received from the user.

[0026] The method comprises sending, by the processing unit, an approval request to the identified one or more entities of the one or more digital twins.

[0027] The method comprises generating an authorization token upon approval of the request from the one or more entities associated with the one or more digital twins. Herein, the authorization token comprises one or more operating parameters for the digital twin as identified from the associated unique identifier token of the digital twin. According to an embodiment, the method of generating the authorization token for a simple token associated with the single component of the digital twin comprises initiating an authorization token creation transaction request to the identified entity of the component of the digital twin for signing the authorization token creation transaction request. The method further comprises generating the authorization token upon approval of the request from the owner of the single component of the digital twin.

[0028] According to an embodiment, the method of generating the authorization token for the composite token associated with the plurality of components of the digital twin comprises initiating an authorization token creation transaction request to each of the identified entities of the respective components of the digital twin for signing the authorization token creation transaction request. The method further comprises generating the authorization token upon approval of the request from each of the entities corresponding to the respective components of the digital twin.

[0029] According to an embodiment, the method further comprises determining a validity of the authorization token based on a ledger comprising a validity status of a plurality of authorization tokens issued by the one or more entities associated with the digital twins. Further, the method comprises providing access control to the user for accessing the digital twin based on the validity of the authorization token.

[0030] According to an embodiment, the method further comprises providing access control to the user for accessing the digital twin restricted to the one or more operating parameters specified in the authorization token.

[0031] The object of the invention is also achieved by an apparatus for managing access control for a plurality of digital twins interacting in a computer simulated environment over a distributed network. The apparatus comprises one or more processing units, memory communicatively coupled to the one or more processing units. The memory comprises a module stored in the form of machine-readable instructions executable by the one or more processing units. The module is configured to perform the aforementioned method steps. The object of the invention is also achieved by a system for managing access control for a plurality of digital twins interacting in a computer simulated environment over a distributed network. The system comprises a distributed network communicatively coupled to the computer simulated collaborative environment. Herein, the distributed network comprises one or more nodes for storing identification information of one or more entities. The system further comprises the apparatus as mentioned above. The apparatus is communicatively coupled to the distributed network and the computer simulated collaborative environment. The apparatus is configured for managing access control for a plurality of digital twins according to the aforementioned method steps.

[0032] The object of the invention is also achieved by a computer program product comprising machine readable instructions, that when executed by one or more processing units, cause the one or more processing units to perform the aforementioned method steps.

[0033] The object of the present invention is further achieved by a computer readable medium on which program code sections of a computer program are saved, the program code sections being loadable into and / or executable in a system to make the system execute the method steps described above when the program code sections are executed in the system. This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the following description. It is not intended to identify features or essential features of the claimed subject matter. Furthermore, the claimed subject matter is not limited to implementations that solve any or all disadvantages noted in any part of this invention.

[0034] The present invention is further described hereinafter with reference to illustrated embodiments shown in the accompanying drawings, in which:

[0035] FIG 1 is a block diagram of a system for managing access control for a plurality of digital twins interacting in a computer simulated environment over a distributed network, according to an embodiment of the present invention! FIG 2 is a block diagram of an exemplary distributed ledger implemented for managing access control for a plurality of digital twins interacting in a computer simulated environment over a distributed network, according to an embodiment of the present invention!

[0036] FIG 3 is a block diagram of an exemplary apparatus for managing access control for a plurality of digital twins interacting in a computer simulated environment over a distributed network, according to an embodiment of the present invention!

[0037] FIG 4 is a flowchart depicting steps of a method for managing access control for a plurality of digital twins interacting in a computer simulated environment over a distributed network, according to an embodiment of the present invention!

[0038] FIG 5 is an exemplary block diagram of simple token and composite token, according to an embodiment of the present invention! and

[0039] FIG 6 is an exemplary system workflow for managing access control for a plurality of digital twins interacting in a computer simulated environment over a distributed network, according to an embodiment of the present invention.

[0040] Hereinafter, embodiments for carrying out the present invention are described in detail. The various embodiments are described with reference to the drawings, wherein like reference numerals are used to refer to like elements throughout. In the following description, for purpose of explanation, numerous specific details are set forth in order to provide a thorough understanding of one or more embodiments. It may be evident that such embodiments may be practiced without these specific details.

[0041] FIG 1 is a block diagram of a system 100 for managing access control for a plurality of digital twins interacting in a computer simulated environment over a distributed network, according to an embodiment of the present invention. The system 100 comprises plurality of digital twins 102-1 to 102-N, one or more entities 104-1 to 104-N, and an apparatus 110 communicating over a communication network 106. In particular, the plurality of digital twins 102-1 to 102 -N corresponding to one or more assets (not shown) are collaborating with one another in the metaverse to realize an industrial digital twin. In an embodiment, the one or more digital twins 102-1 to 102 -N may constitute a part corresponding to an asset. In another embodiment, the one or more digital twins 102-1 to 102-N may constitute one or more data sources that provide input data to generate the digital twins 102-1 to 102-N. In an example, the one or more data sources may be sensing units associated with the one or more assets. In another example, the one or more data sources may be databases comprising input data for generating the digital twin. The data may be real-time data as received from the one or more data sources.

[0042] In one or more embodiments, the one or more entities 104-1 to 104-N refer to an owner of the one or more digital twins 102-1 to 102-N. In one example, the one or more entities 104-1 to 104-N may be a manufacturer(s) or organization(s) owning the one or more digital twins 102-1 to 102-N.

[0043] The one or more assets may be associated with a client device (not shown). Nonlimiting examples of client devices include, personal computers, workstations, personal digital assistants, human machine interfaces. The client device may enable an owner or operator of the one or more assets to view digital certificates, permissions, access requests etc. associated therewith.

[0044] In one embodiment, the apparatus 110 is deployed in a cloud computing environment. As used herein, “cloud computing environment” refers to a processing environment comprising configurable computing physical and logical resources, for example, networks, servers, storage, applications, services, etc., and data distributed over the network 108, for example, the internet. The cloud computing environment provides on-demand network access to a shared pool of the configurable computing physical and logical resources. The apparatus 110 may include a module for managing access control for a plurality of digital twins 102-1 to 102-N interacting in a computer simulated collaborative environment over a distributed network. Particularly, the system 100 comprises a cloud computing device configured for providing cloud services for managing access control for a plurality of digital twins 102-1 to 102-N interacting in a computer simulated collaborative environment over a distributed network. The cloud computing device comprises a cloud communication interface, a cloud computing hardware and OS, and a cloud computing platform. The cloud computing hardware and OS may include one or more servers on which an operating system (OS) is installed and includes one or more processing units, one or more storage devices for storing data, and other peripherals required for providing cloud computing functionality. The cloud computing platform is a platform which implements functionalities such as data storage, data analysis, data visualization, data communication on the cloud hardware and OS via APIs and algorithms! and delivers the aforementioned cloud services using cloud-based applications.

[0045] In an exemplary embodiment, the system 100 is implemented as a distributed ledger, wherein distributed ledger has nodes. Each node may belong to an entity and each of the nodes use the cloud computing hardware and OS to perform one or more actions in the distributed ledger. Each of the nodes comprise a computing device having a module and a database. One such exemplary embodiment is explained in further detail in conjunction with FIG 2.

[0046] FIG 2 is a block diagram of an exemplary distributed ledger 200 implemented using the system for managing access control for a plurality of digital twins 102-1 to 102 -N interacting in a computer simulated collaborative environment over a distributed network, according to an embodiment of the present invention. In particular, the one or more distributed ledgers 200 (e.g., blockchain network) may be provided across one or more entities over a network 204. Exemplary entities 202A-N may include first entity 102 and second entity 104, parties to a transaction, individual computing devices associated with one or more contractors, operators, verifying authorities, shared computing resources, smart devices (e.g., smartwatches, tablets, smartphones), and so on. The entities 202A- N may store the distributed ledgers on computing systems which may be utilized in maintaining and / or updating the distributed ledgers. Each entity 202A-N may be configured for storing a version of the distributed ledger or a portion thereof. In some examples, the distributed ledger 200 is a blockchain based ledger wherein events and transactions are verified by the network participants in a decentralized manner and recorded on all participant nodes. Every node is identified by its address which is in turn derived from its public-private key pair. All data is recorded on the blockchain and accessible to all participants. This information is immutable and hence provides accountability and audit trails. Blockchain network (achieved via distributed consensus mechanisms) ensures that no single entity can control the network and as long as majority of the participants are honest, the network will function in a fair and unbiased manner. Blockchain also supports smart contracts which allows the business logic to be encoded in the form of a deterministic computer program. This program is executed in an isolated secure environment on all nodes and verified in a distributed manner.

[0047] In some embodiments, the entities 202A-N include at least a set of computing devices 206A-N. For example, a ledger may be stored on a large number of publicly available devices, each acting as a “node” for storing a copy of the ledger (e.g., being collaboratively maintained by anonymous peers on a network). In some embodiments, the ledger is only stored and maintained on a set of trusted “nodes”, such as the computing systems of authorized users. In some embodiments, a combination and / or a “mix” of both trusted nodes and public nodes may be utilized, with the same and / or different rules being applied to activities performed at each (e.g., a different validation process may be used for untrusted nodes, or simply untrusted nodes may be unable to perform certain activities). In some embodiments, there may be different levels of nodes with differing characteristics and applied business logic.

[0048] The ledgers, ledger entries, and / or information stored on the ledger entries may be used for asset information, contract information, contractor information, operator information and so forth. Furthermore, the ledger may store digital certificates generated by the first entity and second entity, operational requirements of the assets, transactions involving different entities, automated “smart contracts” relating to control of assets and so forth. Smart contracts are computer instructions or code intended to facilitate, verify, or enforce the negotiation or performance of a contract. Further, the ledger and ledger entries may utilize encryption technology to facilitate and / or validate digital signatures, for example, facilitating multi-signature documentation, ensuring the authenticity and integrity of assets, operators, and so on.

[0049] Each of the one or more entities 202A-N may have, at various times, versions of the ledger, and the ledger may be maintained through the propagation of entries and / or updates that may be copied across ledgers. Ledger entries may contain elements of information (e.g., transaction records, document content, contract clauses, versioning information). There may be various rules and / or logic involved in activities relating to the ledger entries (e.g., creating, updating, validating), for example, a supermajority or a unanimous consent between entities may be enforced as a condition to an activity relating to an entry. In some embodiments, distributed ledgers are utilized, and the ledger entries are adapted to have various linkages to one another such that the integrity of the ledger entries can be reinforced and / or validated.

[0050] The ledger may be maintained through, for example, a “distributed network system”, the distributed network system providing decentralized control and storage of the ledger at the one or more entities (which may be considered “nodes” of the system). The number of “nodes” may be fixed or vary with time and increasing or decreasing the number of “nodes” may impact the performance and / or security of the system. The ledger copies stored and maintained at each “node” provide cross -validation with one another in the event of conflicts between ledgers, and various cryptographic and / or hashing algorithms may be utilized during the generation, updating, linking, and so on, of ledger entries such that ledger entries have increased resiliency to unauthorized tampering or modification.

[0051] For example, a distributed ledger may be distributed across entities 202 A-N and used to provide control access of an asset to other assets, operators, or other entities in a secure manner. The distributed ledger may have entries linked to one another using cryptographic asset information, contractor information, operator information, and entries in the blockchain may be ordered, time stamped, and / or associated with metadata such that the blockchain is designed for protection against “double” transfers and unauthorized modification of ledger entries, such as violation of policies.

[0052] In some embodiments, each block includes respective unique identifiers associated with one or more entities 202A-202N along with corresponding transaction data. The block also includes a timestamp indicating when the block was created. If there is more than one block in the blockchain, each block beyond a first block further includes a hash of a previous block in the blockchain.

[0053] FIG 3 is a block diagram of an exemplary apparatus 110 for improving managing access control for a plurality of digital twins 102-1 to 102-N interacting in a computer simulated collaborative environment over a distributed network, according to an embodiment of the present invention. The apparatus 110 may also be associated with different nodes in the distributed ledger to generate a decentralized network of one or more entities 104-1 to 104-N in the industrial environment. In an exemplary embodiment, the apparatus 110 is communicatively coupled to the one or more digital twins 102-1 to 102-N and corresponding one or more entities 104-1 to 104-N in the computer simulated collaborative environment. In another exemplary embodiment, specific to a blockchain network, the apparatus 110 is integrated with the computing devices 206A-N of FIG 2) associated with the nodes 202A-N.

[0054] The apparatus 110 may be a personal computer, a laptop computer, a tablet, a server, a virtual machine, and the like. The apparatus 110 includes a processing unit 302, a memory 304 comprising a module 306, a storage unit 318 comprising a database 320, an input unit 322, an output unit 324 and a bus 326.

[0055] The processing unit 302 as used herein, means any type of computational circuit, such as, but not limited to, a microprocessor, microcontroller, complex instruction set computing microprocessor, reduced instruction set computing microprocessor, very long instruction word microprocessor, explicitly parallel instruction computing microprocessor, graphics processor, digital signal processor, or any other type of processing circuit. The processing unit 302 may also include embedded controllers, such as generic or programmable logic devices or arrays, application specific integrated circuits, single-chip computers, and the like. The memory 304 may be non-transitory volatile memory and / or non-volatile memory. The memory 304 may be coupled for communication with the processing unit 302, such as being a computer-readable storage medium. The processing unit 302 may execute instructions and / or code stored in the memory 304. A variety of computer-readable instructions may be stored in and accessed from the memory 304. The memory 304 may include any suitable elements for storing data and machine-readable instructions, such as read only memory, random access memory, erasable programmable read only memory, electrically erasable programmable read only memory, a hard drive, a removable media drive for handling compact disks, digital video disks, diskettes, magnetic tape cartridges, memory cards, and the like.

[0056] In the present embodiment, the memory 304 includes the module 306 stored in the form of machine-readable instructions on any of the above-mentioned storage media and may be in communication to and executed by the processing unit 302. When the machine-readable instructions are executed by the processing unit 302, the module 306 causes the processing unit 302 to verify the ownership of the digital twin and provide access control of the digital twin as per the request upon approval from the owner of the digital twin.

[0057] The module 306 further comprises tokenization module 308, a digital twin selection module 310, ownership identification module 312, access request creation module 314, and authorization module 316.

[0058] The tokenization module 308 is configured for tokenizing the plurality of digital twins 102-1 to 102-N in the industrial environment. The tokenization module 308 is configured for determining one or more components of each of the plurality of digital twins. Each component is a digital twin communicatively coupled to other components of the digital twin. Further, the tokenization module 308 comprises identifying an entity associated with each of the one or more components of the plurality of digital twins based on ownership information stored in the distributed ledger. Further, the tokenization module 308 is configured for assigning a unique identifier token to each of the components of the plurality of digital twins. Herein, the unique identifier token comprises ownership information of the digital twins. Furthermore, the tokenization module 308 is configured to create simple tokens for a single component of the digital twin. Furthermore, the tokenization module is configured to create composite tokens for multiple components of the digital twin.

[0059] The digital twin selection module 310 receiving from a request from a user for accessing one or more digital twins corresponding to one or more assets in the computer simulated environment. The request comprises one or more requirements for simulating one or more scenarios in the one or more digital twins. It should be understood that the details of tokenization of one or more digital twins is received from the tokenization module 310. Therefore, the digital twin selection module 310 is configured for selecting one or more digital twins from the plurality of digital twins that are required for simulating one or more scenarios based on the one or more requirements received from the user.

[0060] The ownership identification module 312 is configured to determine one or more entities 104-1 to 104-N corresponding to one or more digital twins for which access is requested by the user based on the unique identifier token associated with the one or more digital twins 102-1 to 102-N. The one or more entities 104-1 to 104-N are the one or owners of the digital twins for which the access is requested by the user. The ownership identification module 312 is configured to determine a single owner in case of a simple token. Further, the ownership identification module 312 is configured to determine multiple owners in case of a composite token.

[0061] The access request creation module 314 is configured to create an approval request and sent to the one or more entities 104-1 to 104-N of the one or more digital twins 102-1 to 102-N. The approval request comprises the user information and the one or more requirements for accessing a particular digital twin.

[0062] The authorization module 316 is configured to generating an authorization token upon approval of the request from the one or more entities 104-1 to 104-N associated with the one or more digital twins 102-1 to 102-N. The authorization token comprises one or more operating parameters for the digital twin as identified from the associated unique identifier token of the digital twin. For simple token, the authorization module 316 is configured to initiate an authorization token creation transaction request to the identified entity of the component of the digital twin for signing the authorization token creation transaction request and then generate the authorization token upon approval of the request from the owner of the single component of the digital twin. For composite token, the authorization module 316 is configured to initiate an authorization token creation transaction request to each of the identified entities of the respective components of the digital twin for signing the authorization token creation transaction request and generate the authorization token upon approval of the request from each of the entities corresponding to the respective components of the digital twin.

[0063] The processing unit 302 is configured for performing all the functionality of the module 306. The processing unit 302 is configured to receive a request from a user for accessing one or more digital twins 102-1 to 102-N corresponding to one or more assets in the computer simulated environment. Herein, each of the one or more digital twins 102-1 to 102-N are tokenized using a unique identifier token. Herein, the request comprises one or more requirements for simulating one or more scenarios in the one or more digital twins 102-1 to 102-N. The processing unit 302 is configured to identify one or more entities 104-1 to 104-N corresponding to one or more digital twins 102-1 to 102-N for which access is requested by the user based on the unique identifier token associated with the one or more digital twins 102-1 to 102-N. The processing unit 302 is configured to send an approval request to the identified one or more entities 104-1 to 104-N of the one or more digital twins 102-1 to 102-N. The processing unit 302 is configured to generate an authorization token upon approval of the request from the one or more entities associated with the one or more digital twins 102-1 to 102 -N, wherein the authorization token comprises one or more operating parameters for the digital twin as identified from the associated unique identifier token of the digital twin.

[0064] The storage unit 318 comprises the database 320 for storing digital certificates, authorization request, data pertaining to operators and so forth. The storage unit 318 and / or database 320 may be provided using various types of storage technologies, such as sohd state drives, hard disk drives, flash memory, and may be stored in various formats, such as relational databases, non-relational databases, flat files, spreadsheets, and extended markup files, etc.

[0065] The input unit 322 may provide ports to receive input from input devices such as keypad, touch -sensitive display, camera (such as a camera receiving gesturebased inputs), etc. capable of receiving set of requirements for the digital twin in industrial environment. The display unit 324 may provide ports to output data via output device with a graphical user interface for displaying the plurality of digital twins in the computer simulated virtual environment. The bus 326 acts as interconnect between the processing unit 302, the memory 304, the storage unit 318, the input unit 322, and the display unit 324.

[0066] Those of ordinary skilled in the art will appreciate that the hardware depicted in FIG 3 may vary for particular implementations. For example, other peripheral devices such as an optical disk drive and the like, Local Area Network (LAN) / Wide Area Network (WAN) / Wireless (e.g., Wi-Fi) adapter, graphics adapter, disk controller, input / output (I / O) adapter also may be used in addition to or in place of the hardware depicted. The depicted example is provided for the purpose of explanation only and is not meant to imply architectural limitations with respect to the present disclosure.

[0067] FIG 4 is a flowchart depicting steps of a method 400 for managing access control for a plurality of digital twins 102-1 to 102-N interacting in a computer simulated collaborative environment over a distributed network, according to an embodiment of the present invention. The digital twins 102-1 to 102-N may correspond to real-world objects in the industrial environment such as the one or more assets including but not limited to motors, gears, bearings, shafts, switchgears, rotors, circuit breakers, protection devices, remote terminal units, transformers, reactors, disconnectors, gear-drive, gradient coils, magnet, radio frequency coils etc. Exemplary technical systems include turbines, large drives, Magnetic Resonance Imaging (MRI) scanner, etc. In an embodiment, the one or more digital twins 102-1 to 102-N are assets such as motors. In another embodiment, the one or more digital twins 102-1 to 102-N are components of an asset such as power supply, filed magnet, rotor, commutator, brushes, axle, etc. In yet another embodiment, the one or more digital twins 102-1 to 102 -N constitute a plurality of assets such as a fleet of motors in a factory floor.

[0068] In yet another embodiment, the one or more digital twins 102-1 to 102 -N constitute one or more data sources that provide data for simulating the one or more digital twins 102-1 to 102-N. Non -limiting examples of data sources include sensors, controllers, edge devices, databases, and simulators. In this particular example, the one or more digital twins may be sensors such as a temperature sensor, a velocity sensor, an acceleration sensor, a pressure sensor, and a force sensor. The output from the sensors may be in the form of temperature data, velocity data, acceleration data or pressure data. In an embodiment, the sensor data is obtained through data acquisition interfaces. In another example, the data source maybe a simulation model configured to forecast one or more parameters in the assets. In another example, the data source maybe a database storing data from sensors, simulation models and manual entries by the user. In yet another example, the data source is an input device that enables user to enter requirements and data available through a web-based interface.

[0069] The digital twin is commonly generated simultaneously with the real devices and systems, such as processing equipment and sensors in the facility. Once created by a specific vendor for their own specific equipment, the digital twin can be used to represent the assets in a digital representation of a real world system. The digital twin is created such that it is identical in form and behavior to the corresponding machine. The digital twin thus generated may be a dynamic virtual replica based on one or more of physics-based models, Computer-Aided Design (CAD) models, Computer-Aided Engineering (CAE) models, onedimensional (1D) models, two-dimensional (2D) models, three-dimensional (3D) models, finite-element (FE) models, descriptive models, metamodels, stochastic models, parametric models, reduced-order models, statistical models, heuristic models, prediction models, ageing models, machine learning models, Artificial Intelligence models, deep learning models, system models, knowledge graphs and so on.

[0070] The plurality of digital twins 102-1 to 102-N may correspond to one or more assets in the industrial environment. The plurality of digital twins 102-1 to 102- N are interacting with one another in a collaborative manner in the metaverse in order to realize a higher level digital twin. In an example, a first layer of one or more digital twins 102-1 to 102-N corresponding to one or more components of an asset are interacting with one another to generate an equipment level digital twin. In a further example, one or more equipment level digital twins 102-1 to 102 -N are interacting with one another in collaborative manner to generate a plant level digital twin. In a further example, one or more plant level digital twins 102-1 to 102-N are interacting with another to form an industrial environment level digital twin.

[0071] The plurality of digital twins 102-1 to 102-N can be visualized in the computer simulated virtual environment, for example, in the metaverse. It can be understood as a virtual world of the industrial environment wherein the plurality of digital twins 102-1 to 102-N are interacting with one another. Such digital twins 102-1 to 102-N are in particular accessible by the user, i.e. digital twins 102-1 to 102-N accessible from the real / physical world. For example, it is possible that the user can access the plurality of digital twins 102-1 to 102-N in the metaverse via an interface, e.g., a virtual reality (VR) or augmented reality (AR) interface. The counterpart of the computer-simulated environment does not necessarily have to exist but can be for example a three-dimensional model of an asset in the industrial environment.

[0072] In this invention, the metaverse comprises a plurality of digital twins 102'1 to 102-N. The digital twins 102-1 to 102-N can for example be understood as a representation, in particular a 3D representation, of a real or physical component such as one or more assets. Each component of the digital twin can have different functionalities / features, e.g., an access interface. The digital twins 102-1 to 102-N further comprise data that are asset specific, e.g., sensor data of a virtual accelerometer that can be retrieved for example via the access interface. An access to the digital twins 102-1 to 102-N can for example comprise usage, modification, connection to other digital twins 102'1 to 102-N, etc. The digital twins 102'1 to 102-N can interact with the metaverse and other components in the metaverse. At step 402, a request from a user for accessing one or more digital twins 102-1 to 102 -N in the computer simulated environment is received. The request comprises one or more requirements for simulating one or more scenarios in the one or more digital twins 102-1 to 102-N. The user maybe an avatar raising a request in the metaverse to access a single digital twin or a plurality of digital twins 102-1 to 102 -N for simulating one or more scenarios in the digital twins as per the requirements. The one or more requirements may comprise of simulation scenario type, one or more simulation parameters, one or more simulation conditions etc.

[0073] According to an embodiment, the method further comprises selecting one or more digital twins 102-1 to 102-N from the plurality of digital twins 102-1 to 102-N that are required for simulating one or more scenarios based on the one or more requirements. The one or more requirements are matched against the functionality and simulations of the plurality of digital twins 102-1 to 102-N, in order to select the one or more digital twins 102-1 to 102-N are required for simulating the one or more scenarios requested by the user or the avatar. In an example, the user or the avatar may request to simulate remaining useful life of a particular motor with a particular set of operating parameters of the motor. Then, each component of the motor along with one or more sensors are selected for further processing.

[0074] Notably, each of the one or more digital twins are tokenized using a unique identifier token. The term “tokenizing” is known in the art in blockchain technology. However, identifying each component of the digital twin and tokenizing each component of the digital twin based on ownership of the digital twin is the scope of the current invention.

[0075] In an embodiment, the unique identifier token is a non-fungible token. Throughout the present disclosure, the term “non-fungible tokens or NFTs” refers to a unit of data stored on a digital ledger, such as the blockchain, that certifies any digital file to be unique. An NFT functions like a cryptographic token, but unlike cryptocurrencies such as Bitcoin, is not mutually interchangeable, in other words, not fungible. NFTs are created when blockchains string records of cryptographic hash, a set of characters that verifies a set of data to be unique, onto previous records, therefore, creating a chain of identifiable data blocks. This cryptographic transaction process ensures the authentication of each digital file by providing a digital signature that is used to track NFT ownership. NFTs can be used to represent items such as photos, videos, audio, and other types of digital files. While copies of these digital items are available for anyone to obtain, NFTs are tracked on blockchains to provide the owner with proof of ownership that is separate from copyright.

[0076] According to an embodiment, the method of tokenizing the plurality of digital twins 102-1 to 102-N in the computer simulated environment comprises determining one or more components of each of the plurality of digital twins 102- 1 to 102 -N. Herein, each component is a digital twin communicatively coupled to other components of the digital twin. The method further comprises identifying, an entity associated with each of the one or more components of the plurality of digital twins 102'1 to 102-N. In other words, the ownership of each of the one or more components of the digital twin is identified based on details stored in the distributed ledger. The method further comprises assigning a unique identifier token to each of the components of the plurality of digital twins 102-1 to 102-N. Herein, the unique identifier token comprises ownership information of the digital twins.

[0077] According to an embodiment, the unique identifier token is a simple token associated with a single component of the digital twin. The simple token is an individual token that is assigned to a single component of the digital twin, and which corresponds to a single entity of owner. It should be understood that simple token is assigned to the digital twins corresponding to real- world parts of an asset that cannot be further broken down into another components. According to another embodiment, the unique identifier token is a composite token associated with a plurality of components of the digital twin 102-1 to 102-N. Herein, the composite token comprises a plurality of simple tokens. It should be understood that the composite token may be owned by multiple entities or owner as it is a combination of multiple simple tokens. The concept of simple tokens and composite tokens is explained further in FIG 5. Referring to FIG 5 illustrated is an exemplary block diagram 500 of simple token and composite token, according to an embodiment of the present invention. The block 502 is a composite token that corresponds to a plant digital twin token. Further, the plant digital twin token 502 further comprises of a CNC machine digital twin token 504 which is also a composite token. Further, the CNC machine digital twin token 504 is comprised of a spindle digital twin token 506, servo motor digital twin token 508, and a ball screw digital twin token 510. It is to be noted that spindle digital twin token 506, servo motor digital twin token 508, and a ball screw digital twin token 510 are also composite tokens. The spindle digital twin token 506 further comprises a first sensor token 512 A, a second sensor token 512B, a third sensor token 512C and a fourth sensor token 512D. It is to be noted that the first sensor token 512A, the second sensor token 512B, the third sensor token 512C and the fourth sensor token 512D are simple tokens. Further, the servo motor digital twin token 508 comprises a fifth sensor token 514A and a sixth sensor token 514B. It is to be noted that fifth sensor token 514A and a sixth sensor token 514B are simple tokens. Further, the ball screw digital twin token 510 further comprises a seventh sensor token 516A and an eighth sensor token 516B. It is to be noted that the seventh sensor token 516A and the eighth sensor token 516B are simple tokens. It should be understood that the different components as shown here are only for illustration purposes. The scope of the current invention is not limited to the number of digital twins, the type of assets or the number of tokens therein.

[0078] According to an embodiment, the one or more components of the digital twin 102- 1 to 102 -N correspond to functional components of the digital twin in the real- world, wherein the functional component is a component integral to the asset. The functional components of the digital twins 102-1 to 102-N are the parts of the asset that are integral part of the digital twin and are operated to have a function in the digital twin. For example, in a CNC machine digital twin, the functional components are spindle digital twin, axle digital twin, servo motor digital twin, ball screw digital twin etc. The one or more functional components may be owned by one or more entities 104-1 to 104-N. In an example, the entity is an individual digital twin owner for a particular digital twin, such as digital twin of a motor, digital twin of a turbine, digital of a CNC machine etc. In another example, the entity is an organization or an institution owning an industry that provide digital twin for various assets in the industry, such as Siemens providing digital twin for various assets on a factory floor. In another example, the entity is a manufacturer of the digital twins such as sensors installed in the industry and have a right to own and provide data to third parties. In yet another example, the entity is a service provider authorized to collect and provide data to third parties for further processing and use.

[0079] According to an embodiment, the one or more components of the digital twin 102- 1 to 102 -N correspond to non-functional components of the digital twin in the real-world. The non-functional component is a data source for acquiring real- world behavior of the one or more assets. The non-functional components are the components that may or may not be an integral part of the digital twin and provide input data pertaining to the behavior of the one or more functional components of the asset. For example, some non-functional components maybe the sensors that provide data to the digital twin pertaining to the behavior of the components of the asset. In an example, the entity is an individual data provider for a particular part of the digital twin, such as data provider for a temperature sensor. In another example, the entity is an organization or an institution owning an industry that provide data of various assets in the industry. In another example, the entity is a manufacturer of the data sources such as sensors installed in the industry and have a right to own and provide data to third parties. In yet another example, the entity is a service provider authorized to collect and provide data to third parties for further processing and use.

[0080] At step 404, one or more entities corresponding to one or more digital twins 102-1 to 102 -N are identified for which access is requested by the user based on the unique identifier token associated with the one or more digital twins 102-1 to 102-N. The one or more entities 104-1 to 104-N are owners of the digital twins 102-1 to 102-N that have ownership and control over the access and functionality of the digital twin. The one or more entities can be identified from the unique identifier token of the digital twins for which access is requested.

[0081] At step 406, an approval request is sent to the identified one or more entities 104- 1 to 104-N of the one or more digital twins 102-1 to 102-N. The approval request comprises information regarding the use and one or more requirements of the user. For a simple token, an authorization token creation request is created and is sent to the single owner of the component of the digital twin for signing the authorization token. For a composite token, an authorization token creation request is created and is sent to multiple owners of different components of the digital twin for individually signing the authorization token.

[0082] At step 408, an authorization token is generated upon approval of the request from the one or more entities 104-1 to 104-N associated with the one or more digital twins 102-1 to 102-N. Herein, the authorization token comprises one or more operating parameters for the digital twin as identified from the associated unique identifier token of the digital twin. It will be appreciated that the authorization token when generated by the owners of the digital twins 102-1 to 102 -N not only provides access control to the users but also ensures that the execution of the digital twins is within the operating parameters specified by the owner.

[0083] In an embodiment, the authorization token in a JSON web based token. It is to be understood that JSON web token or JWT is an open standard that defined a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed. JSON web tokens consist of three parts header, payload and signature. The header typically consists of two parts: the type of the token, herein JWT, and the hashing algorithm being used such as HMAC, SHA256 or RSA. The second part of the token is the payload, which contains the claims. Claims are statements about an entity (herein, the owner of the digital twin) and additional metadata. There are three types of claims: reserved, public, and private claims. The reserved claims are a set of predefined claims which are not mandatory but recommended, to provide a set of useful, interoperable claims. Some of them are: iss(issuer), exp (expiration time), sub(subject), aud(audience), and others. The public claims can be defined at will by those using JWTs. The private claims are custom claims created to share information between parties that agree on using them. The third part of the JWT is the signature. To create the signature part, one has to take the encoded header, the encoded payload, the algorithm specified in the header and sign that. The signature is used to verify that the sender of the JWT is who it says it is and to ensure that the message is not changes along the way. In particular, for the authorization of the JWT, when the user successfully logs in using their credentials, a JSON web token will be returned and must be saved locally, instead of the traditional approach of creating a session in the server. This is a stateless authorization mechanism as the user state is never saved in server memory. The server’s protected routes will check for a valid JWT in the authorization header, and if it’s present, the user will be allowed to access the protected resources. As JWTs are self-contained, all the necessary information is there, reducing the need to query the database multiple times.

[0084] According to an embodiment, the method of generating the authorization token for a simple token associated with the single component of the digital twin comprises initiating an authorization token creation transaction request to the identified entity of the component of the digital twin for signing the authorization token creation transaction request. The authorization token generation request is generated based on the one or more requirements received from the user. The authorization token request is sent to the owner of the digital twin for which access is requested as per the one or more requirements. Further, the method comprises generating the authorization token upon approval of the request from the owner of the single component of the digital twin. Notably, the authorization token is signed by the owner of the digital twin if the owner approves the access request. Furthermore, the authorization token is appended with one or more operating parameters to be executed while simulating the one or more scenarios in the digital twin.

[0085] According to an embodiment, the method of generating the authorization token for the composite token associated with the plurality of components of the digital twin 102-1 to 102-N comprises initiating an authorization token creation transaction request to each of the identified entities 104-1 to 104-N of the respective components of the digital twin for signing the authorization token creation transaction request. The authorization token generation request is generated based on the one or more requirements received from the user. The authorization token request is sent to the respective owners of the one or more components of the digital twin for which access is requested as per the one or more requirements. Further, the method comprises generating the authorization token upon approval of the request from each of the entities corresponding to the respective components of the digital twin. Notably, the authorization token is signed by the respective owners of the one or more components of the digital twin 102-1 to 102-N if the owner approves the access request. Furthermore, the authorization token is appended with one or more operating parameters to be executed while simulating the one or more scenarios in the digital twin 102'1 to 102-N.

[0086] According to an embodiment, the method further comprises providing access control to the user for accessing the digital twin restricted to the one or more operating parameters specified in the authorization token. It should be understood that each digital twin 102-1 to 102-N has operating limits or thresholds that are to be considered while accessing the digital twins. Therefore, the digital twins 102-1 to 102-N must be accessed within the permitted operating parameters only. In this case, when the access control is provided to the user, the system makes sure that the operations of the digital twin by the particular user or avatar are within the allowed operating parameters.

[0087] According to an embodiment, the method further comprises determining a validity of the authorization token based on a ledger comprising a validity status of a plurality of authorization tokens issued by the one or more entities associated with the digital twins. The method further comprises providing access control to the user for accessing the digital twin 102-1 to 102-N based on the validity of the authorization token. It should be understood that the validity of the authorization token is verified before initiating any simulation in the digital twins to ensure that no revoked accesses can continue into the system.

[0088] Referring to FIG 6, illustrated is an exemplary system workflow 600 for managing access control for a plurality of digital twins interacting in a computer simulated environment over a distributed network, according to an embodiment of the present invention. The system 600 comprises a simulator service platform 602, a computer simulated environment or metaverse 604 hosting a plurality of digital twins, a distributed network 606 having ownership information of the plurality of digital twins, and a user or an avatar 608. The simulator service platform 602 is configured to manage access control for a plurality of digital twins 102'1 to 102-N interacting in a computer simulated environment over a distributed network. The metaverse 604 hosts the plurality of digital twins with one or more components that are tokenized as simple tokens and composite tokens in the form of NFTs. The distributed network 606 comprises ownership information of the plurality of digital twins and stores such data in the distributed ledger. In an exemplary implementation, the user 608 access the simulator service platform 602 with a request to gain access control to one or more digital twins in the metaverse based on one or more requirements.

[0089] Herein, JSON web tokens or JWT are used for access control management of digital twins 102-1 to 102-N. As JWT is compatible with OAuth authorization protocol which is widely used in prevalent systems, it can be easily integrated with existing systems. The JWT token in the proposed system has the following properties:

[0090] 1. Each JWT token is linked / capturing the access control to the digital twins represented by NFT.

[0091] 2. A JWT token can be created only with the approval of the owner(s) of the corresponding NFT (who is also the owner of the asset).

[0092] 3. The purpose of an NFT is encoded inside in the form or operating parameters (e.g., the owners of a power plant DT might wish to grant access to the DT only for simulating specific non-catastrophic scenarios.)

[0093] Notably, the JWT token of a simple entity (having only a single DT) can be created by the owner of the NFT and contains the signature of the owner. However, the JWT token of a composite entity (having plurality of DTs) will carry signatures of all the owners of all the encompassing entities (which together make the composite token). This is achieved using a multi-signature or multisig transaction. (JWT / JWS inherently supports multiple signatures, creation of which is managed through the voting and bookkeeping on the distributed network). In an example, for providing approval, one of the owners creates the JWT token, signs it and propagates it across the network in a transaction. The transaction (and the JWT token) awaits the required number of signatures (this can be m-of-n or n-of-n). The JWT token with the signatures is issued to the requestor upon approval.

[0094] Notably, the issueJWTO function takes the following additional parameters: parentTokenlD - existing token ID of the NFT operatingParameters - operating parameters which can be understood by the user application (the simulator service in the exemplified scenario).

[0095] The simulator service platform 602 can use the JWT only for the specific purpose (for example, one or more operating conditions) mentioned within the specified parameters of the JWT token. The function verifies that the owner of the NFT is the caller before creating the JWT token. For JWT tokens of composite tokens, an approval request is sent to the owners of the component NFTs. A separate revocation list is maintained which lists the JWT tokens revoked by the owner(s). The user application could reference this list before starting new workflows. The user application (simulator service platform 602 in the exemplified case) uses the valid token used to interact with a digital twin and the digital twin environment enforces the limitations specified in the token.

[0096] In one example, when the simulator service platform 602 on behalf of the user 608 raises a service request (1) to access a simple toke ‘T’. Then a JWT token creation transaction (2) with all the details is sent to the owner ‘O’ for signing over the distributed network 606. On approval (3), a JWT token (4) with a list of operating parameters is created and assigned to user 608. Once the simulator service platform 602 receives the JWT token (4), a simulation task request (5) is raised with the computer simulated environment or the metaverse 604. Upon verifying the validity of the JWT token, the metaverse runs a simulation as per the one or more requirements of the user 608 and returns the simulation service platform 602 with the simulation results (6). Further the simulation results re provided (7) to the user 608 via the simulator service platform 602. The user 608 can access the assets (digital twin) with a valid token T within the limitations (encoded as parameters within the JWT token).

[0097] In another example, when the simulator service platform 602 on behalf of user

[0098] 608 requests access to a composite token T, a JWT token is created and propagated to all the owners ‘O’ of the token for signatures. If and only if all the owners ‘O’ sign, the JWT is assigned to the user 608. The user 608 can use the composite asset (composite digital twin) with the vahd token T within the parameters defined in the JWT token.

[0099] Advantageously, the present invention provides a decentrahzed, secure, and efficient system for managing access control for a plurality of digital twins 102-1 to 102 -N interacting in a computer simulated environment over a distributed network. Beneficially, the abovementioned method and system ensures digital rights management of a plurality of digital twins 102-1 to 102-N in the industrial environment. The current invention ensures that the ownership of the plurality of digital twins 102-1 to 102-N is retained with the corresponding entities 104-1 to 104-N and yet the access control is transferred to multiple users simultaneously in a collaborative environment. Beneficially, the current invention manages control access of plurality of digital twins 102-1 to 102-N to multiple users for varying periods of time. Furthermore, the present invention also enables seamless interoperability with existing systems, hence making the solution easy to integrate with existing systems. Advantageously, the present invention ensures that the users are provided secure and faster access to individual components of digital twins 102-1 to 102-N as per the requirements of the simulation even when the different components of the digital twins maybe owned by different entities. The present invention is beneficial in combining the plurality of digital twins 102-1 to 102-N for complex use cases in a decentralized manner, while ensuring digital twin ownership is retained. The present invention also helps in increasing customer value when a combined digital twin is used in a metaverse application to provide value-added services to a third-party.

[0100] Beneficially, there may be several applications of the present invention with respect to operability of digital twins in the metaverse such as ownership transfer of a digital twin from one user to another, leasing a digital twin for a limited time period, providing access to the digital twin for a limited period of time as per some defined criteria, providing access to the digital twin to multiple users at the same time, etc.

[0101] Those skilled in the art will recognize that, unless specifically indicated or required by the sequence of operations, certain steps in the processes described above may be omitted, performed concurrently or sequentially, or performed in a different order.

[0102] While the present invention has been described in detail with reference to certain embodiments, it should be appreciated that the present disclosure is not limited to those embodiments. The foregoing examples have been provided merely for the purpose of explanation and are in no way to be construed as limiting of the present invention disclosed herein. While the invention has been described with reference to various embodiments, it is understood that the words, which have been used herein, are words of description and illustration, rather than words of limitation. Further, although the invention has been described herein with reference to particular means, materials, and embodiments, the invention is not intended to be limited to the particulars disclosed herein! rather, the invention extends to all functionally equivalent structures, methods and uses, such as are within the scope of the appended claims. Those skilled in the art, having the benefit of the teachings of this specification, may effect numerous modifications thereto and changes may be made without departing from the scope of the invention in its aspects.

[0103] List of references

[0104] 100 system

[0105] 102-1 to 102-N plurality of digital twins

[0106] 104-1 to 104-N one or more entities

[0107] 106 communication network

[0108] 110 apparatus

[0109] 200 distributed ledger

[0110] 202A N one or more entities

[0111] 204 network

[0112] 206A N one or more computing devices

[0113] 302 one or more processing units

[0114] 304 memory unit

[0115] 306 module

[0116] 308 tokenization module

[0117] 310 digital twin selection module

[0118] 312 ownership identification module

[0119] 314 access request creation module

[0120] 316 authorization module

[0121] 318 storage unit

[0122] 320 database

[0123] 322 input unit

[0124] 324 output unit

[0125] 326 bus

[0126] 400 flowchart depicting steps of a method for managing access control for a plurality of digital twins interacting in a computer simulated collaborative environment over a distributed network

[0127] 500 exemplary block diagram of simple token and composite token

[0128] 600 exemplary system workflow for managing access control for a plurality of digital twins interacting in a computer simulated environment over a distributed network

Claims

CLAIMS1. A computer-implemented method (400) for managing access control for a plurality of digital twins (102-1 to 102-N) interacting in a computer simulated environment over a distributed network, the method comprising: receiving, by a processing unit (302), a request from a user (608) for accessing one or more digital twins (102-1 to 102-N) corresponding to one or more assets in the computer simulated environment, wherein each of the one or more digital twins (102-1 to 102-N) are tokenized using a unique identifier token, and wherein the request comprises one or more requirements for simulating one or more scenarios in the one or more digital twins! identifying, by the processing unit (302), one or more entities (104-1 to 104- N) corresponding to one or more digital twins (102-1 to 102-N) for which access is requested by the user based on the unique identifier token associated with the one or more digital twins! sending, by the processing unit (302), an approval request to the identified one or more entities (104-1 to 104-N) of the one or more digital twins (102-1 to 102-N); and generating, by the processing unit (302), an authorization token upon approval of the request from the one or more entities (104-1 to 104-N) associated with the one or more digital twins (102-1 to 102-N), wherein the authorization token comprises one or more operating parameters for the digital twin (102-1 to 102 -N) as identified from the associated unique identifier token of the digital twin.

2. The method (400) according to claim 1, further comprising selecting one or more digital twins from the plurality of digital twins (102-1 to 102-N) that are required for simulating one or more scenarios based on the one or more requirements received from the user (608).

3. The method (400) according to any of the claims 1 or 2, further comprises providing access control to the user (608) for accessing the digital twin (102-1 to 102 -N) restricted to the one or more operating parameters specified in the authorization token.

4. The method (400) according to any of the preceding claims, wherein tokenizing the plurahty of digital twins (102-1 to 102-N) in the computer simulated environment comprises ■ determining, by the processing unit (302), one or more components of each of the plurahty of digital twins (102-1 to 102-N), wherein each component is a digital twin communicatively coupled to other components of the digital twin! identifying, by the processing unit (302), an entity (104-1 to 104-N) associated with each of the one or more components of the plurality of digital twins (102-1 to 102-N); and assigning, by the processing unit (302), a unique identifier token to each of the components of the plurahty of digital twins (102-1 to 102-N), wherein the unique identifier token comprises ownership information of the digital twins (102-1 to 102-N).

5. The method (400) according to any of the preceding claims, wherein the unique identifier token is a simple token associated with a single component of the digital twin.

6. The method (400) according to any of the claims 1 to 4, wherein the unique identifier token is a composite token associated with a plurality of components of the digital twin, wherein the composite token comprises a plurality of simple tokens.

7. The method (400) according to any of the preceding claims, wherein the one or more components of the digital twin correspond to functional components of the digital twin in the real-world, wherein the functional component is a component integral to the asset.

8. The method (400) according to any of the preceding claims, wherein the one or more components of the digital twin correspond to non-functional components of the digital twin in the real-world, wherein the non-functional component is a data source for acquiring real-world behavior of the one or more assets.

9. The method (400) according to any of the preceding claims, wherein generating the authorization token for a simple token associated with the single component of the digital twin comprises ■ initiating, by the processing unit (302), an authorization token creation transaction request to the identified entity (104-1 to 104-N) of the component of the digital twin for signing the authorization token creation transaction request; and generating the authorization token upon approval of the request from the owner of the single component of the digital twin.

10. The method (400) according to any of the claim 1 to 8, wherein generating the authorization token for the composite token associated with the plurality of components of the digital twin (102-1 to 102-N) comprises: initiating, by the processing unit (302), an authorization token creation transaction request to each of the identified entities (104-1 to 104-N) of the respective components of the digital twin (102-1 to 102-N) for signing the authorization token creation transaction request; generating the authorization token upon approval of the request from each of the entities (104-1 to 104-N) corresponding to the respective components of the digital twin.

11. The method (400) according to any of the preceding claims, further comprising: determining a validity of the authorization token based on a ledger comprising a validity status of a plurality of authorization tokens issued by the one or more entities (104-1 to 104-N) associated with the digital twins (102-1 to 102-N); providing access control to the user for accessing the digital twin based on the validity of the authorization token.

12. The method (400) according to any of the preceding claims, wherein the unique identifier token is a non-fungible token, and the authorization token is a Jason web-based token.

13. An apparatus (110) for managing access control for a plurality of digital twins interacting in a computer simulated environment over a distributed network, the apparatus comprising: one or more processing units (302); and a memory (304) communicatively coupled to the one or more processing units (302), the memory (304) comprising a module (306) stored in the form of machine-readable instructions executable by the one or more processing units (302), wherein the module (306) is configured to perform the method (400) steps according to claims 1 to 12.

14. A system (100) for managing access control for a plurality of digital twins interacting in a computer simulated environment over a distributed network, the system comprising: a computer simulated collaborative environment hosting a plurality of digital twins (102-1 to 102-N), wherein each of the plurality of digital twins (102- 1 to 102 -N) corresponds to one or more assets in an industrial environment; a distributed network (106) communicatively coupled to the computer simulated collaborative environment, wherein the distributed network comprises one or more nodes (202A-202N) for storing identification information of one or more entities; and an apparatus (110) according to claim 7, communicatively coupled to the distributed network (106) and the computer simulated collaborative environment, wherein the apparatus (110) is configured for managing access control for a plurality of digital twins (102-1 to 102-N), according to any of the method claims 1 to 12.

15. A computer-program product, having computer-readable instructions stored therein, that when executed by a processing unit (302), cause the processing unit (302) to perform method (400) steps according to any of the claims 1 to 12.

16. A computer readable medium on which program code sections of a computer program are saved, the program code sections being loadable into and / or executable in a system to make the system (100) execute the method (400)steps according to any of the claims 1 to 12 when the program code sections are executed in the system (100).

Images