Method and system for securely configuring credentials for a bioprocess control system

Abstract

The present invention relates to a method for remotely configuring credentials for a bioprocess control system of a bioprocess system in a cloud environment, comprising steps of: requesting, from a user of the bioprocess control system, start of the bioprocess control system; launching, in the cloud environment, a custom launcher for configuring credentials for the bioprocess control system; obtaining, by the custom launcher, credential information from a secret management system; performing, by the custom launcher, configuration of the bioprocess control system with the credential information, and starting, by the custom launcher, the bioprocess control system using the configuration of the bioprocess control system.

Description

[0001] METHOD AND SYSTEM FOR SECURELY CONFIGURING CREDENTIALS FOR A

[0002] BIOPROCESS CONTROL SYSTEM

[0003] TECHNICAL FIELD

[0004] The present invention relates to a method and system for securely configuring credentials for a bioprocess control system. In particular, to securely configuring credentials in the configuration for a bioprocess control system of a bioprocess system in a cloud environment.

[0005] BACKGROUND

[0006] A bioprocess system is generally used to provide a particular system functionality, e.g. a bioprocess system may be used to produce and / or separate a desired biological target substance. Thus, bioprocess systems can be understood essentially as performing a train of process operations having inputs and delivering a biological output. A bioprocess system may include different subsystems and units to perform different bioprocess operations, such as chromatography systems, bioreactor systems and filtration systems etc..

[0007] To control these different systems for different users with different access rights, a bioprocess control system plays an important role in the whole bioprocess. The bioprocess control system may include an integrated controller and large amounts of different function modules needed to perform a wide range of applications, such as protein purifications, filtration and cell culture at different scales, from recipe setting up and running a recipe to obtain the desired products, from data extraction, analysis and evaluation to control the bioprocess etc.

[0008] To manage installations of the large amounts of different function modules of the bioprocess control system can be cumbersome and may require that the configuration for each application of the bioprocess control system needs to be updated on each of the client computers. Therefore, tools to enable convenient efficient and safe configuration of the bioprocess control system are desired, especially in the case of a virtual or cloud environment where the actual host of the software may be ephemeral requiring setup each run and where configuration may contain sensitive information that may not want to be shared with the software provider or the service provider.

[0009] Therefore, there is a need to improve the security and efficiency of configuring the credentials of the bioprocess control system.

[0010] 1

[0011] Confidential - Company Proprietary SUMMARY OF THE INVENTION

[0012] An objective of embodiments of the present invention is to provide a solution which mitigates or solves the drawbacks and problems described above.

[0013] The above and further objectives are achieved by the subject matter described herein. Further advantageous implementation forms of the invention are further defined herein.

[0014] According to a first aspect of the invention, the above mentioned and other objectives are achieved with a method for remotely configuring credentials for a bioprocess control system of a bioprocess system in a cloud environment, comprising steps of requesting, from a user of the bioprocess control system, start of the bioprocess control system; launching, in the cloud environment, a custom launcher for configuring credentials for the bioprocess control system; obtaining, by the custom launcher, credential information from a secret management system; performing, by the custom launcher, configuration of the bioprocess control system with the credential information, and starting, by the custom launcher, the bioprocess control system using the configuration of the bioprocess control system.

[0015] At least an advantage of the invention according to this embodiment is that the configuration and installation of the software needed to run the bioprocess control system are performed automatically in the cloud environment instead of on customer premises, which improves the efficiency of the configuration and installation.

[0016] Another advantage of the invention according to this embodiment is that by performing the configuration of the credential information on the custom launcher deployed in a customer- controlled compute environment in the cloud environment instead of at the service / software provider, which means the credential information is not provided to the service / software provider thus improves the security of the configuration and simplifies the maintenance of the credential information.

[0017] According to some embodiments, the method further comprises: requesting, from the user, a connection with a service provider, and returning, by the service provider, a redirect request to the user.

[0018] According to some further embodiments, the method further comprises: obtaining, at an identity provider, login data from the user of the bioprocess control system, and authenticating, at the identity provider, the login data.

[0019] 2

[0020] Confidential - Company Proprietary According to some further embodiments, the method further comprises: when the user is authenticated by the identity provider, redirecting the user, at the identity provider, to a callback URL with a token.

[0021] According to some further embodiments, the method further comprises: authenticating, at the identity provider, the token.

[0022] According to some further embodiments, the method further comprises: accessing, at the bioprocess control system, protected resources with the configuration of the bioprocess control system.

[0023] According to some further embodiments, the method further comprises: controlling, at the bioprocess control system, the bioprocess system with the protected resources.

[0024] According to some further embodiments, the credential information comprises database credentials for the user.

[0025] According to some further embodiments, the step of performing the configuration of the bioprocess control system with the credential information comprises updating the configuration of the bioprocess control system, optionally comprising creating new configuration of the bioprocess control system for the user.

[0026] According to some further embodiments, the secret management system is arranged on any one of: a remote server, a cloud server and a client computer in the customer-controlled compute environment.

[0027] According to some further embodiments, the custom launcher is arranged in a customer- controlled compute environment in the cloud environment.

[0028] According to some further embodiments, the redirect request is a SAML redirect request.

[0029] According to some further embodiments, the bioprocess system comprises any one of: a bioreactor system, a chromatography system and a filtration system

[0030] According to a second aspect of the invention, the above mentioned and other objectives are achieved with a system for remotely configuring credentials for a bioprocess control system of a bioprocess system in a cloud environment, the system comprises: a custom launcher for configuring credentials for the bioprocess control system, a secret management system for managing credential information of a user of the bioprocess control system, an identity provider for authenticating the identity of a user of the bioprocess control system, wherein the custom launcher is configured to: obtain credential information from the secret management system, perform configuration of the bioprocess control system with the credential information, and start the bioprocess control system using the configuration of the bioprocess control system.

[0031] The advantages of the second aspect are the same as for the first aspect.

[0032] According to some embodiments, the identity provider is further configured to: obtain login data from the user of the bioprocess control system, authenticate the login data, and redirect the user to a callback URL with a token.

[0033] According to some further embodiments, the system further comprises a service provider, wherein the service provider is configured to: receive a connection request from the user of the bioprocess control system and return a redirect request to the user.

[0034] According to some further embodiments, the bioprocess control system is configured to access protected resources (106) with the configuration of the bioprocess control system and to control the bioprocess system with the protected resources.

[0035] According to a third aspect of the invention, the above mentioned and other objectives are achieved with a custom launcher for remotely configuring credentials for a bioprocess control system of a bioprocess system in a cloud environment, configured to: obtain credential information from a secret management system, perform configuration of the bioprocess control system with the credential information, and start the bioprocess control system using the configuration of the bioprocess control system.

[0036] The advantages of the third aspect are the same as for the first aspect.

[0037] According to a fourth aspect of the invention, the above mentioned and other objectives are achieved with a non-transitory computer-readable storage medium comprising instructions, when the instructions are performed by a processor, the processor is configured to perform the above-mentioned method.

[0038] The advantages of the fourth aspect are the same as for the first aspect.

[0039] Further applications and advantages of embodiments of the invention will be apparent from the following detailed description.

[0040] BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Fig. 1 shows a schematic conventional environment in which the control system is configured.

[0042] 4

[0043] Confidential - Company Proprietary Fig. 2 shows a schematic environment in which the method is performed according to one or more embodiments of the present invention.

[0044] Fig. 3 shows a schematic structure of interaction between the bioprocess system and protected resources.

[0045] Fig. 4 shows a schematic structure of the system according to one or more embodiments of the present invention.

[0046] Fig. 5 shows a schematic flowchart of the method according to one or more embodiments of the present invention.

[0047] Fig. 6 shows a schematic sequence of diagram according to one or more embodiments of the present invention.

[0048] A more complete understanding of embodiments of the invention will be afforded to those skilled in the art, as well as a realization of additional advantages thereof, by a consideration of the following detailed description of one or more embodiments. It should be appreciated that like reference numerals are used to identify like elements illustrated in one or more of the figures.

[0049] DETAILED DESCRIPTION

[0050] An “or” in this description and the corresponding claims is to be understood as a mathematical OR which covers ’’and” and “or”, and is not to be understand as an XOR (exclusive OR). The indefinite article “a” in this disclosure and claims is not limited to “one” and can also be understood as “one or more”, i.e., plural.

[0051] In the present disclosure, the term “bioprocess system” includes chromatography systems, bioreactor systems and filtration systems.

[0052] In the present disclosure the term “chromatography system” or “liquid chromatography system” denotes a system performing the process of separating components of a mixture.

[0053] In the present disclosure, the term “bioreactor system” denotes a device, vessel, or system to cultivate products from plants, animals, and bacteria on the desired scale.

[0054] In the present disclosure, the term “filtration system” denotes a system for concentration, diafiltration, cell harvest, and clarification processes.

[0055] 5

[0056] Confidential - Company Proprietary Moreover, it is realized by the skilled person that the bioprocess system may comprise the necessary communication capabilities in the form of e.g., functions, means, units, elements, etc., for performing the present solution. Examples of other such means, units, elements and functions are: processors, memory, buffers, control logic, encoders, decoders, rate matchers, de-rate matchers, mapping units, multipliers, decision units, selecting units, switches, interleavers, de-interleavers, modulators, demodulators, inputs, outputs, antennas, amplifiers, receiver units, transmitter units, DSPs, MSDs, TCM encoder, TCM decoder, power supply units, power feeders, communication interfaces, communication protocols, etc. which are suitably arranged together for performing the present solution.

[0057] Especially, the processing circuitry and / or processing means of the present disclosure may comprise one or more instances of processing circuitry, processor modules and multiple processors configured to cooperate with each-other, Central Processing Unit (CPU), a processing unit, a processing circuit, a processor, an Application Specific Integrated Circuit (ASIC), a microprocessor, a Field-Programmable Gate Array (FPGA) or other processing logic that may interpret and execute instructions. The expression “processing circuitry” and / or “processing means” may thus represent a processing circuitry comprising a plurality of processing circuits, such as, e.g., any, some, or all the ones mentioned above. The processing means may further perform data processing functions for inputting, outputting, and processing of data comprising data buffering and device control functions, such as user interface control, or the like.

[0058] In the present disclosure, the terms “function modules”, “software” , “software packages” and “toolkits” may be interchangeably referred to and denote typically software modules implementing at least one function of the bioprocess control system.

[0059] In the present disclosure, the term “application of the bioprocess control system” denotes running of the bioprocess control system to control the bioprocess system, for different types of the bioprocess system, such as the chromatography systems, bioreactor systems and filtration systems, the function modules included in the bioprocess control system are different.

[0060] In the present disclosure, the term “cloud environment” denotes a environment having cloud computing capabilities and diversity.

[0061] Fig. 1 shows a schematic conventional environment in which the control system is configured. In conventional environment, the customer host and the service provider communicate through a network. The network may include at least one of a Local Area Network (LAN), Wide area networks (WAN), Metropolitan Area Network (MAN), Global System for Mobile Network (GSM), Enhanced Data GSM Environment (EDGE), Universal Mobile Telecommunications System, intranet or internet, etc., but is not limited thereto. The network communicate using wired or wireless communication techniques that may include at least one of Long term evolution, High Speed Downlink Packet Access (HSDPA), Wideband Code Division Multiple Access (W-CDMA), Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Bluetooth®, Zigbee®, Wi-Fi, Voice over Internet Protocol (VoIP), LTE Advanced, IEEE802.16m, Wireless MAN-Advanced, Evolved High-Speed Packet Access (HSPA+), 3GPP Long Term Evolution (LTE), Mobile WiMAX (IEEE 802.16e), Ultra Mobile Broadband (UMB) (formerly Evolution-Data Optimized (EV-DO) Rev. C), Fast Low-latency Access with Seamless Handoff Orthogonal Frequency Division Multiplexing (Flash-OFDM), High Capacity Spatial Division Multiple Access (iBurst®) and Mobile Broadband Wireless Access (MBWA) (IEEE 802.20) systems, High Performance Radio Metropolitan Area Network (HIPERMAN), Beam-Division Multiple Access (BDMA), World Interoperability for Microwave Access (Wi-MAX) and ultrasonic communication, etc., but is not limited thereto.

[0062] In this conventional environment, the data may either be stored on a server of the service provider or on the customer host. The configuration of the bioprocess control system and installation of the software needed to run the bioprocess control system need to be performed at the customer host every time for each run. On one hand, for different applications of the bioprocess control system and / or different users, the configuration of different function modules is cumbersome. On another hand, since some credential information is stored on the service provider side, which may be a concern for customers.

[0063] Fig. 2 shows a schematic environment in which the method is performed according to one or more embodiments of the present invention. According to some embodiments of this invention, the customer host and the service provider communicate in a cloud environment, which facilitates part of the data being stored in a storage in the cloud environment. According to some embodiments of this invention, the data may be stored in a database or a directory. According to some further embodiments of this invention, the data may include user data, environment data, configuration data, credential data etc., but not limited thereto. According to some further embodiments of this invention, it may enable the configuration of the bioprocess control system being performed at a computing device in the user-controlled computer environment in the cloud environment. As shown in Fig. 2, the customer host in this embodiment may act as an interface between the customer and the customer-controlled compute environment in the cloud environment, the configuration of the bioprocess control system and the installation of the software needed to run the bioprocess control system are actually automatically performed in the customer-controlled compute environment in the cloud environment which will be described in more details below in combination with Figs. 4-6.

[0064] Fig. 3 shows a schematic structure of interaction between the bioprocess system and protected resources. The bioprocess control system 105 may include a controller, a memory and communication interface. The bioprocess control system 105 may further comprise a plurality of function modules to implement different functions for the application of the bioprocess control system 105. The bioprocess control system 105 may communication with protected resources with the communication interface. According to this embodiment, the protected resources may include the bioprocess system 107 and / or a database 110 of the bioprocess control system 105, but are not limited thereto. The database 110 of the bioprocess control system in this embodiment is shown external to the bioprocess control system 105, however, it can also be integrated in the bioprocess control system 105.

[0065] Fig. 4 shows a schematic structure of the system according to one or more embodiments of the present invention. The system 100 comprises a service provider 101, a customer-controlled compute environment in the cloud environment and a customer host (not shown in the drawing). In some embodiments, the service provider 101 may include a supplier-controlled computer image. The supplier-controlled computer image herein defines the software or toolkits to be included in the customer-controlled compute environment in order to perform the configuration of the bioprocess control system and the installation of the software to run the bioprocess control system. According to some embodiments, the supplier-controlled computer image is located on the service provider’s Virtual Private Cloud (VPC). According to some other embodiments, the supplier-controlled computer image is located on a server maintained by the service provider and communicate with the customer-controlled compute environment through a network. According to some embodiments, the software or toolkits defined in the supplier- controlled computer image is deployed on a virtual machine in the customer-controlled compute environment in the cloud environment, such as an instantiated computer from the supplier-controlled computer image in the customer-controlled compute environment in the cloud environment. According to some embodiments, the customer-controlled compute environment in the cloud environment is a customer’s VPC. According to some embodiments, the software or toolkits included in the instantiated computer from the supplier-controlled computer image herein may be provided as software packages or one or more functional modules. According to some further embodiments, the instantiated computer from the supplier- controlled computer image may include a custom launcher 103 and the bioprocess control system 105. In the present disclosure, reference will be made interchangeably to custom launcher and utility tool, which is arranged to provide access to the bioprocess control system. In some embodiments, providing access to the bioprocess control system includes the configuration of the credential information of the bioprocess control system and the installation of the software to run the bioprocess control system.

[0066] According to some embodiments, the custom launcher 103 is configured to config credentials for the bioprocess control system of the bioprocess system. More specifically, the custom launcher 103 is configured to obtain credential information from a secret management system to perform the configuration of the bioprocess control system with the credential information and to start the bioprocess control system using the configuration of the bioprocess control system. According to some embodiments, the configuration of the bioprocess control system may include updating the configuration of the bioprocess control system. According to some further embodiments, the configuration of the bioprocess control system may further include creating new configuration of the bioprocess control system for the user. According to some embodiments, the secret management system is provided in the customer-controlled compute environment in the cloud environment. The secret management system herein may be a database, a directory or a storage storing credential information of the user for configuring and accessing the bioprocess control system. The credential information may be: for example, critical information about the customer-controlled compute environment, the password for accessing the bioprocess control system, the access rights of the user for the bioprocess control system etc., but is not limited thereto. The custom launcher 103 is arranged to receive the credential information and to perform the configuration of the bioprocess control system using the credential information. The custom launcher 103 is further arranged to install the software in the customer-controlled compute environment to run the bioprocess control system and is further arranged to start the bioprocess control system 105 thus to control the bioprocess system 107. According to some embodiments, the configuration may include at least one of the following: the password to access the bioprocess control system, the access rights of the specific user to the bioprocess control system etc., but is not limited thereto.

[0067] In the customer-controlled compute environment, an identity provider 102 may be provided for identifying the login information of the user and for providing information of how to access the secret management system to the custom launcher. According to some embodiments, the identity provider is configured to obtain login data from the user of the bioprocess control system, to authenticate the login data and to redirect the user to a callback URL with a token. When the user requests start of the bioprocess control system, the token sent from the identity provider will be included in the request, the identity provider is configured to authenticate whether the token is an authorized token.

[0068] As shown in Fig. 4, according to some embodiments, the bioprocess control system 105 may be configured to control a specific bioprocess system 107 and access protected resources 106 with authorized rights. According to some embodiments, the protected resources may be a database of the bioprocess control system and / or the bioprocess system such as the chromatography system or bioreactor system or filtration system.

[0069] The corresponding method for configuring credentials for the bioprocess control system of the bioprocess system will be described in detail below in combination with Fig. 5 and Fig.6. The methods shown in Fig. 5 and Fig. 6 in these embodiments are implemented using Amazon Web Services (AWS) for deploying cloud computing services, however, other similar services such as Active Directory, Microsoft Azure, Open Stack etc. can also be used for the deployment. The corresponding steps of authorization will change accordingly based on the difference services used for the implementation. The steps which will be changed according to specific services are marked with dotted frames in Fig. 5.

[0070] As shown in Fig. 5 and Fig. 6, when the user initiates a request of connection from the customer host to the service provider shown as 203 in Fig. 5 and 301 in Fig. 6, a redirect request will be returned from the service provider to the user shown as 205 in Fig.5 and 303 in Fig. 6, the redirect request redirects the user to the identity provider to authenticate the identity of the user. The user logs in to the identity provider with login information shown as 207 in Fig. 5 and 305 in Fig. 6, after the identify provider has authenticated the user with the login data as shown in 209 in Fig. 5, a callback URL with a token is returned to the user to redirect the user to the service provider shown as 211 in Fig. 5 and 307 in Fig. 6. The user requests start of the bioprocess control system shown as 213 in Fig. 5 and 309 in Fig. 6 and the request includes the token sent from the identity provider. Then the service provider will provide the token in the request to the identity provider to verify that the token is a valid token issued by the identity provider as shown in 311 in Fig. 6. Once the token is authenticated by the identity provider, the service provider will request start of the custom launcher shown as 215 in Fig. 5 and 313 in Fig. 6. The custom launcher now requests credentials from the secrete management system in order to perform the configuration of the bioprocess control system and to access the bioprocess control system shown as 217 in Fig. 5 and 315 in Fig. 6. After the secrete management system has returned the credentials to the custom launcher as shown in 317 in Fig. 6, the custom launcher will perform the configuration of the bioprocess control system using the credentials which is shown as 219 in Fig. 5 and 319 in Fig. 6. According to some embodiments, the configuration of the bioprocess control system may include at least one of the following: configure the password in the configuration to access the bioprocess control system, configure the access right of the specific user to the bioprocess control system etc., but is not limited thereto. After the configuration is finished, the bioprocess control system will be started as shown in 221 in Fig. 5 and 321 in Fig. 6. The bioprocess control system will have access to the protected resources with the configuration of the bioprocess control system as shown in 323 in Fig. 6. According to some embodiments, the protected resources are a database of the bioprocess control system. According to some further embodiments, the protected resources are the bioprocess system, such as the chromatography system, the bioreactor system and the filtration system.

[0071] By performing the configuration of the bioprocess control system and the installation of the software needed to run the bioprocess control system on the customer-controlled compute environment in the cloud environment, at least one advantage of improving the efficiency of configuration and installation of the bioprocess control system is achieved.

[0072] By not disclosing the credential information to the service provider, at least another advantage of improving the security of system is achieved.

[0073] It should be understood by the skilled person that, the cloud environment herein may be any type of could services, such as Infrastructure as a service (laaS), Platform as a service (PaaS), Software as a service (SaaS), Function as a service (FaaS) etc., but is not limited thereto, and the deployment of the cloud computing may include private cloud, public cloud, hybrid cloud, multi-cloud and community cloud etc., but is not limited thereto.

[0074] Finally, it should be understood that the invention is not limited to the embodiments described above, but also relates to and incorporates all embodiments within the scope of the appended independent claims.

Claims

Claims1. A method for remotely configuring credentials for a bioprocess control system of a bioprocess system in a cloud environment, comprising steps of: requesting (213,309), from a user of the bioprocess control system, start of the bioprocess control system, launching (215,313), in the cloud environment, a custom launcher for configuring credentials for the bioprocess control system, obtaining (217,315), by the custom launcher, credential information from a secret management system, performing (219,319), by the custom launcher, configuration of the bioprocess control system with the credential information, and starting (221,321), by the custom launcher, the bioprocess control system using the configuration of the bioprocess control system.

2. The method according to claim 1, further comprising: requesting (203,301), from the user, a connection with a service provider, returning (205,303), by the service provider, a redirect request to the user.

3. The method according to claim 1 or 2, further comprising: obtaining (207, 305), at an identity provider, login data from the user of the bioprocess control system, authenticating (209), at the identity provider, the login data.

4. The method according to any of the preceding claims, further comprising: when the user is authenticated by the identity provider, redirecting (211,307) the user, at the identity provider, to a callback URL with a token.

5. The method according to any of the preceding claims, further comprising: authenticating (311), at the identity provider, the token.

6. The method according to any of the preceding claims, further comprising: accessing (323), at the bioprocess control system, protected resources with the configuration of the bioprocess control system.12Confidential - Company Proprietary7. The method according to claim 6, further comprising: controlling, at the bioprocess control system, the bioprocess system with the protected resources.

8. The method according to any of preceding claims, wherein the credential information comprises database credentials for the user.

9. The method according to any of preceding claims, wherein the step of performing the configuration of the bioprocess control system with the credential information comprises updating the configuration of the bioprocess control system, optionally comprising creating new configuration of the bioprocess control system for the user.

10. The method according to any of preceding claims, wherein the secret management system is arranged on any one of: a remote server, a cloud server and a client computer in the customer-controlled compute environment.

11. The method according to any of preceding claims, wherein the custom launcher is arranged in a customer-controlled compute environment in the cloud environment.

12. The method according to claim 2, wherein the redirect request is a SAML redirect request.

13. The method according to any of preceding claims, wherein the bioprocess system comprises any one of: a bioreactor system, a chromatography system and a filtration system.

14. A system (100) for remotely configuring credentials for a bioprocess control system (105) of a bioprocess system (107) in a cloud environment, comprising: a custom launcher (103) for configuring credentials for the bioprocess control system (105), a secret management system (104) for managing credential information of a user of the bioprocess control system, an identity provider (102) for authenticating the identity of a user of the bioprocess control system, wherein the custom launcher is configured to: obtain credential information from the secret management system,perform configuration of the bioprocess control system with the credential information, and start the bioprocess control system using the configuration of the bioprocess control system.

15. The system according to claim 14, wherein the identity provider is further configured to: obtain login data from the user of the bioprocess control system, authenticate the login data, and redirect the user to a callback URL with a token.

16. The system according to claim 14 or 15, further comprising a service provider (101), wherein the service provider is configured to: receive a connection request from the user of the bioprocess control system, and return a redirect request to the user.

17. The system according to any of claims 14-16, wherein the bioprocess control system is configured to access protected resources (106) with the configuration of the bioprocess control system and to control the bioprocess system with the protected resources.

18. A custom launcher (103) for remotely configuring credentials for a bioprocess control system of a bioprocess system in a cloud environment, configured to: obtain credential information from a secret management system, perform configuration of the bioprocess control system with the credential information, and start the bioprocess control system using the configuration of the bioprocess control system.

19. A non-transitory computer-readable storage medium, comprising instructions, when the instructions are performed by a processor, the processor is configured to perform any of the methods in claims 1-13.14Confidential - Company Proprietary

Images