Abstract: In general, this disclosure describes a virtual router configured to enable multi-cloud service provider connectivity. The multi-cloud service provider connectivity may enable network function virtualization (NFV) services to be applied to network traffic such as enterprise traffic. The NFV services may be offsite, cloud-based NFV services or data center provider-hosted NFV services, for example. In one example, a system comprises at least one computing device deployed to a data center by a data center provider and configured by the data center provider to execute a virtual router, wherein the virtual router is configurable by a customer to route packet flows to one or more servers that host network function virtualization services for application of the network function virtualization services to the packet flows.

Abstract: In one example, a cloud-based services exchange comprises a plurality of interconnection assets configured to connect a customer of the cloud-based services exchange to one or more cloud service providers, the plurality of interconnection assets including a virtual circuit by which the customer accesses a cloud service from the one or more cloud service providers; and an orchestration engine configured to modify the plurality of interconnection assets.

Abstract: Techniques for virtualized network functions (VNFs) that provide for domain isolation of networks coupled to the VNF are described. A virtual network function (VNF) includes a cloud virtual domain coupling the VNF to a cloud service, a management virtual domain coupling the VNF to a management service, and an external virtual domain having a public Internet Protocol (IP) address. The external virtual domain receives an authentication request providing access credentials for a VNF customer from a cloud client device, provides the authentication request to the management service via the management virtual domain, receives an authentication response from the management service, and, in response to determining that the VNF customer access credentials are valid, initiates application of a policy that allows the cloud client device to configure the cloud virtual domain or the cloud service and disallows configuration of the external virtual domain and the management virtual domain.

Abstract: Techniques are disclosed for performing time synchronization at a plurality of computing devices in a network. In one example, a method comprising obtaining timestamp data in accordance with a synchronization operation for a timing protocol; computing a skewness estimate and an offset estimate from the timestamp data by executing a regression analysis, wherein the regression analysis is configured to train a first model to predict the offset estimate and the skewness estimate, the offset estimate comprising a clock time difference between the first clock and the second clock; computing a corrected skewness estimate and a corrected offset estimate based on a second model having parameters based on the offset estimate and the skewness estimate; and modifying a current time value of at least one of the first clock or the second clock based on at least one of the corrected offset estimate or the corrected skewness estimate.

Abstract: This disclosure describes techniques that include interpreting information about a smart contract so that the terms of the smart contract can be implemented across a diverse array of consensus networks or blockchain platforms. In one example, this disclosure describes a method that includes receiving, by a first computing device, information describing a smart contract, wherein the first computing device is included within a first plurality of computing devices, each on a first consensus network that maintains a first distributed ledger; performing, by the first computing device and in response to receiving the information describing the smart contract, operations to update the first distributed ledger; and interpreting, by at least one of the first plurality of computing devices, the information describing the smart contract to determine and perform at least one of a plurality of first smart contract operations on the first consensus network.

Abstract: In some examples, a system including a first blanking panel and a second blanking panel configured to be affixed to a cabinet. The first blanking panel includes a first spring-loaded hinge and a first connecting mechanism. The second blanking panel includes a second spring-loaded hinge and a second connecting mechanism. Each of the first and second spring-loaded hinges are configured to rotate between a non-deployed position and a deployed position. Each of the first and second connecting mechanisms are configured to connect the first blanking panel with the second blanking panel in a closed position when the spring-loaded hinges are in the non-deployed position. The first blanking panel and the second blanking panel are configured to be out of contact with each other and into respective open positions when the spring-loaded hinges are in the deployed position.

Abstract: In general, this disclosure describes a programmable network platform for dynamically programming a cloud exchange to provide a layer three (L3) routing instance as a service to customers of the cloud exchange. In one example, a cloud exchange comprises an L3 network located within a data center and configured with an L3 routing instance for an enterprise; and for the L3 routing instance, respective first and second attachment circuits for first and second cloud service provider networks co-located within the data center, wherein the L3 routing instance stores a route to a subnet of the second cloud service provider network to cause the L3 routing instance to forward packets, received from the first cloud service provider network via the first attachment circuit, to the second cloud service provider network via the second attachment circuit.

Abstract: In general, techniques are described for a hierarchical, distributed DHCP system for managing IP address assignment among distributed networks of computing devices. For example, a system may include a central DHCP server configured to manage a plurality of distributed DHCP servers, each distributed DHCP server configured to perform DHCP using IP addresses allocated from a common prefix for a tenant associated with computing devices managed by multiple DHCP servers. The central DHCP server allocates IP addresses to the distributed DHCP servers, e.g., on an on-demand basis from the common pool and may handle concurrent requests for IP addresses from distributed DHCP servers. Each of the distributed DHCP servers may store records for IP addresses and media access control (MAC) addresses for computing devices managed by that distributed DHCP server, and the DHCP servers may send these records to the central DHCP server to facilitate IP assignment coherency.

Abstract: In general, this disclosure describes an IoT access control exchange for IoT devices. Verifiable credentials can be generated and used to grant access to IoT devices definitively identified using a Decentralized Identifier (DID). DIDs for IoT devices are registered by the IoT exchange hub acting as an Identity Hub. An organization interested in obtaining data from a collection of devices, the IoT Access Customer, contacts the IoT device owner agent via their mutual agents and obtains a verifiable credential with a request for access. The access request is submitted to the IoT exchange hub. The IoT exchange hub either enforces the access request itself if the devices do not have enough resources or submits the verifiable credential with the access request to the devices for them to enforce access. The IoT access customer agent, IoT device owner agent, and IoT exchange hub similarly identify themselves and prove authentication using DIDs.

Abstract: The techniques described in this disclosure provide resilient and reactive on-demand Distributed Denial-of-Service (DDoS) mitigation services using an exchange. For example, an exchange comprises a first virtual network for switching mixed traffic (including dirty (DDoS) traffic and clean (non-DDoS) traffic)) from one or more networks to one or more DDoS scrubbing centers; and a second virtual network for switching the clean traffic from the one or more DDoS scrubbing centers to the one or more networks, wherein the exchange is configured to receive the mixed traffic from the one or more networks and switch, using the first virtual network, the mixed traffic to a selected DDoS scrubbing center of the one or more DDoS scrubbing centers, and wherein the exchange is configured to receive the clean traffic from the selected DDoS scrubbing center and switch, using the second virtual network, the clean traffic to the one or more networks.

Abstract: In general, this disclosure describes a service peering exchange for creating and managing service-to-service paths among applications. For example, a service peering exchange with network connectivity with multiple networks may receive application programming interface (API) data describing APIs for services provided, e.g., by enterprises or cloud service providers (CSPs) and accessible via the networks using service requests. Such services may include, for example, data storage, eCommerce, billing, marketing, customer relationship management (CRM), social media, digital media, financial, weather, search, and other services accessible using machine-to-machine communication over a network. An administrator or customer of the service peering exchange may configure policies that are applied by the service peering exchange to orchestrate service-to-service paths among different services accessible via the different networks.

Abstract: In general, techniques are described for network connectivity for non-colocated customers of a cloud exchange. A programmable network platform for the cloud exchange comprises processing circuitry configured to: configure a virtual network device in the data center to run a network service for a customer; receive, from the customer, a request for a remote port and network information for a network service provider connectivity service for the customer; assign, in response to receiving the request for the remote port, a remote port of the cloud exchange to the customer; and configure, in response to receiving the request for the remote port using the network information, the cloud exchange to connect the network service provider connectivity service to the virtual network device via the remote port of the cloud exchange.

Abstract: Systems and methods include techniques for recording information for tracing a timestamp to its source. The techniques can facilitate auditing of a time service by external auditors. The timestamps can be collected from all the sources and intermediate touch points like timing and network switches and can be stored in a distributed time ledger. In one example, a method includes receiving, at a collection time by a time collector, a timestamp from each of a plurality of timing devices at a collection time; aggregating the timestamp of each of the plurality of timing devices into a timestamp record, the timestamp record including the collection time and a timestamp entry for each of the timing devices, wherein the timestamp entry for a timing device includes a timing device identifier and the timestamp corresponding to the timing device providing the timestamp; and inserting the timestamp record into an immutable time ledger.

Abstract: This disclosure describes techniques for verifying virtualized network functions (VNFs) using Decentralized Identifiers (DIDs). For example, a system includes an orchestrator configured to obtain, using a Decentralized Identifier (DID) that is associated with a virtualized network function (VNF) image for a VNF, a DID document associated with the DID, verify, based on the DID document associated with the DID, the VNF image, and deploy the VNF image as a VNF instance on a Network Functions Virtualization infrastructure (NFVi). The system also includes one or more consensus networks that store the DID document associated with the VNF image in a distributed ledger.

Abstract: An example method includes receiving, from a customer system by a cloud exchange comprising processing circuitry, a request to communicatively couple a virtual gateway on network infrastructure of the cloud exchange to a network gateway communicatively coupled to a public network, the request including data indicating a public Internet Protocol (IP) address of the customer system, wherein the customer system is configured with a first connection communicatively coupling the customer system and the public network via a network service provider (NSP) that is separate from the cloud exchange; configuring, by the cloud exchange, a network route for a network gateway to the virtual gateway, the network gateway communicatively coupled to the public network; and providing, by the cloud exchange to the network gateway, routing information including the public IP address of the customer system to create a second connection communicatively coupling the customer system and the public network.

Abstract: In some examples, a method includes obtaining, by a computing device operated by a data center provider for a data center, from a first customer of the data center provider, order information comprising a set of parameters defining an interconnection within the data center between a first customer network of the first customer and a second customer network of a second customer of the data center provider, wherein the first customer network and the second customer network are co-located in the data center; sending, by the computing device to the second customer, a communication comprising a unique identifier that maps to the set of parameters; and outputting, by the computing device, an indication of authorization for the interconnection based upon an authorization directive from the second customer, the authorization directive comprising the unique identifier.

Abstract: Techniques are described for providing a hybrid compensation of chromatic dispersion in optical networks to reduce power consumption by coherent receivers. In some examples, a controller may receive a chromatic dispersion value of an optical signal from a coherent receiver integrated with a receiver optical network device. The controller may compare the chromatic dispersion value with a threshold. The controller may, in response to determining that the chromatic dispersion value satisfies the threshold, perform at least one of: configure a switch connected to a dispersion compensation module (DCM) with a state to provide access to the DCM to compensate the chromatic dispersion value of the optical signal, or adjust a phase response of a filter of a coherent transmitter to compensate the chromatic dispersion value of the optical signal.

Abstract: A data center infrastructure monitoring system and method that includes a plurality of geographically distributed data centers, each data center comprising a plurality of mechanical assets. A data center gateway system communicatively coupled to one or more data centers of the plurality of data centers is configured to determine a subset of the plurality of mechanical assets of the data center that provide cooling to equipment of a customer of the data center, and output, for display, a graphical depiction of the subset of the plurality of mechanical assets of the data center that provide cooling to equipment of the customer in the data center.

Abstract: Techniques for tenant-driven dynamic resource allocation in network functions virtualization infrastructure (NFVI). In one example, an orchestration system is operated by a data center provider for a data center and that orchestration system comprises processing circuitry coupled to a memory; logic stored in the memory and configured for execution by the processing circuitry, wherein the logic is operative to: compute an aggregate bandwidth for a plurality of flows associated with a tenant of the data center provider and processed by a virtual network function, assigned to the tenant, executing on a server of the data center; and modify, based on the aggregate bandwidth, an allocation of compute resources of the server executing the virtual network function.

Abstract: In general, this disclosure describes a multi-zone secure AI exchange. The multi-zone secure AI exchange may be implemented in a multi-cloud, multi-data center environment, where each zone may be in a different cloud or data center. The multi-zone secure AI exchange may include a data repository, a data exchange, and shared services. The data repository may be configured to store algorithms and datasets, each having a respective owning user. The data exchange may receive datasets and algorithms from the data repository, and may perform the algorithms to produce output data. Each of the data repository, data exchange, and shared services may have a different level of security. The data repository may implement the highest level of security, allowing the owner user, and only the owning user, to control how their data and algorithms move in and out of the data repository, or are changed while in the data repository.