Abstract: For a distributed storage system that has an active-active configuration for hosts and which uses an Internet small computer system interface (iSCSI) protocol, techniques are provided to identify/select a plurality of paths to a target. An active optimized path is selected for a host that is an object owner, and an active non-optimized path is selected for a host that is a component owner. The selection of the optimized path for a host is further based on whether that host has sufficient processor and memory resources to service input/output for the target. A standby path is selected for any other host that is neither an object owner or a component owner. The selected paths are provided to an initiator so as to enable the initiator to choose at least one of the paths to access the target for the input/output.

Abstract: The disclosure provides an example method for implementing a network policy in a software defined networking environment. The method generally includes receiving a manifest defining a plurality of pods, wherein: for a first pod, the manifest defines a first environment value, a first port number for a first container of the first pod, and a name for the first port number; for a second pod, the manifest defines the first environment value, a second port number for a second container of the second pod, and the name for the second port number; and the manifest defines a security policy applied to a third pod which defines a first egress policy indicating the first environment value and the name; and creating, based on the manifest indicating different port numbers, but the same name, for the different containers of the different pods, separate egress firewall rules for the first and second pods.

Abstract: Example methods and systems to support accessibility to a web page are disclosed. One example method includes examining a document to be rendered to the web page and determining whether an accessibility issue exists in the document. In response to determining that the accessibility issue exists in the document, the example method further includes determining whether a first remediation of the document corresponding to the accessibility issue exists. In response to determining that the first remediation exists, the example method further includes performing the first remediation to the document to generate a first remediated document to be rendered to the web page. After performing the first remediation, the example method includes examining the first remediated document and determining whether an additional accessibility issue exists in the first remediated document.

Abstract: Example methods and systems for decentralized network topology adaptation in a in a peer-to-peer (P2P) network are described. In one example, a first computer system may obtain first attribute information associated with the first computer system; and second attribute information associated with a second computer system. Based on the first and second attribute information, the first computer system may generate a connection confidence prediction associated with a connection between the first computer system and the second computer system. The connection confidence prediction may indicate whether the connection is a suboptimal connection associated with a suboptimal network topology. In response to determination that the connection confidence prediction satisfies a break condition, the first computer system may break the connection between the first computer system and the second computer system, but otherwise maintain the connection.

Abstract: A recommendation system reuses user interface (UI) strings in a virtualized computing environment based on semantic information. The recommendation system receives an input UI string query, and searches indexed and validated UI strings for candidate UI strings. The candidate UI strings are identified based on a relevance score and then ranked based on a semantic similarity score. The ranked UI strings are provided as a recommendation for a UI string in UI content of a user interface.

Abstract: Disclosed are various approaches for exposing peripheral component interconnect express (PCIe) configuration space implementations as Enhanced Configuration Access Mechanism (ECAM)-compatible. In some examples, a bridge device is identified on a segment corresponding to a root complex of a computing device. An endpoint device is connected to a bus downstream from the bridge device. A synthetic segment identifier is assigned to the bus once the endpoint device is identified as connected to the bus. Synthetic address data is generated for the endpoint device. The synthetic address data includes the synthetic segment identifier for the bus and sets a bus identifier of the bus to zero regardless of a hierarchical position of the bus in a standard peripheral component interconnect express (PCIe) bus hierarchy.

Abstract: The current document is directed to automated methods and systems that monitor system-call execution by operating systems in order to detect operating-system corruption. A disclosed implementation of the currently disclosed automated system-call-integrity monitor generate operational system-call fingerprints for randomly selected system calls executed by guest operating systems of randomly selected virtual machines and compares the operational system-call fingerprints to reference system-call fingerprints in order to detect operational anomalies of guest operating systems that are likely to represent guest-operating-system corruption. In disclosed implementations, a system-call fingerprint includes a system-call execution time, the number of instructions executed during execution of the system call, and a snapshot of the call stack taken during execution of the system call.

Abstract: Computer-implemented methods, media, and systems for inter-cluster automated failover and migration of containerized workloads across edges devices are disclosed. One example method includes monitoring telemetry data received from a first software defined wide area network (SD-WAN) edge device that has a workload scheduled, where the telemetry data includes at least one of a health status of the workload or multiple runtime context elements at the first SD-WAN edge device. It is determined that a failure associated with either the first SD-WAN edge device or the workload occurs. A mode of the failure is determined. A remediation process based on the determined mode of the failure and a current state of the workload is performed.

Abstract: Disclosed are various examples of intelligent provisioning management. In some examples, device configuration signatures are received for a group of client devices. A user interface shows at least one of a recommended configuration with a recommended set of hardware components, a recommended hardware specification, a recommended set of applications, and a recommended set of firmware based on a superset of firmware identified from the device configuration signatures. A request to configure a client device according to the recommendation is transmitted.

Abstract: The capability to print to a portable document format (PDF) file is provided in a virtualized computing environment that supports a virtual desktop infrastructure (VDI). Printing-related properties, of local printers coupled to a client device, are provided to a host, so that virtual printers at the host can be configured with the printing-related properties. A simulator may be provided at the host to receive the printing-related properties from the client device and to receive a query from a virtualized computing instance for the printing-related properties, instead of the query being directly sent to the client device.

Abstract: Resource watermarking and management actions on electronic resources are described. In one example, a process for resource watermarking and management actions includes receiving, from a client device, a request to perform an action on an electronic resource and a device profile for the client device. The device profile can include at least one attribute of the client device. The process also includes identifying a watermark template for the electronic resource, determining descriptive data of the watermark template based on the request to perform the action and whether the device profile complies with a compliance rule, overlaying the watermark template and the descriptive data onto the electronic resource, and determining that the client device is authorized to perform the action on the electronic resource in response to the electronic resource being united with the watermark template.

Abstract: Systems and methods are provided for optimizing and securing an enterprise voice service accessed by an external voice assistant device. An enterprise voice assistant installed on a client device acts as an enterprise voice service for an external voice assistant device. The enterprise voice assistant receives a voice query from the external voice assistant device. The voice query is processed using a machine learning model to extract an intent and at least one slot. The extracted intent and at least one slot are used to determine whether a response to the voice query can be generated using local enterprise data that was previously received and stored by the client device from a management server. The response is generated based on the determination by using the local enterprise data or by sending the extracted intent and at least one slot to and receiving the response from the management server.

Abstract: User profiles of remote desktops are managed in a crash-consistent manner. When a user logs into a remote desktop, metadata of the user profile is loaded from persistent storage while registry settings and files of the user profile are loaded asynchronously with respect to the login. During the remote desktop session, snapshots of the remote desktop image in persistent storage are generated periodically, and a change log that indicates changes to the user profile is created therefrom. The user profile stored in persistent storage is updated lazily using the change log at opportunistic times after snapshot generation. When the user logs out of the remote desktop, the user profile stored in the persistent storage is updated with any additional changes to the user profile by extracting the changes from the copy-on-write cache associated with the most recent snapshot.

Abstract: The efficiency of segment cleaning for a log-structured file system (LFS) is enhanced at least by storing additional information in a segment usage table (SUT). Live blocks (representing portions of stored objects) in an LFS are determined based at least on the SUT. Chunk identifiers associated with the live blocks are read. The live blocks are coalesced at least by writing at least a portion of the live blocks into at least one new segment. A blind update of at least a portion of the chunk identifiers in a chunk map is performed to indicate the new segment. The blind update includes writing to the chunk map without reading from the chunk map. In some examples, the objects comprise virtual machine disks (VMDKs) and the SUT changes between a list format and a bitmap format, to minimize size.

Abstract: Disclosed herein are systems and methods for dynamically switching between synchronous and asynchronous communication channels. A communication request can be received from an application, and a request identifier can be generated for the communication request. The communication request can be transmitted to an edge server application via a first communication channel. The first communication channel can be selected from a plurality of communication channels based at least in part on a policy. In an instance in which a condition specified by the policy is detected in the transmission of the communication request, a second communication channel can be selected from the plurality of communication channels. The communication request can be transmitted to the edge server application using the second communication channel.

Abstract: In an embodiment, a computer-implemented method for enabling multitenancy for service machines is disclosed. In an embodiment, the method comprises detecting a packet by a service insertion module implemented in a hypervisor. Based on metadata received along with the packet, the service insertion module determines a tenant identifier of a tenant that sent the packet. The service insertion module also determines a plurality of attributes of the packet. Based on the tenant identifier and the plurality of attributes of the packet, an action for the packet is retrieved from a rule table. Based on the action, the service insertion module determines whether at least one service is to be applied to the packet. In response to determining that at least one service is to be applied to the packet, an encapsulated packet is generated by encapsulating the packet with the tenant identifier, and the encapsulated packet is redirected to a service machine that is configured to provide the at least one service to the packet.

Abstract: Systems and methods are described for removing unused encryption key files from a computing device. In an example, a key removal tool can identify three sets of keys to preserve. For the first set, the key removal tool can append a device identifier to known key names and add the resulting key file names to a whitelist. For the second set, the key removal tool can identify keys associated with certificates on the computing device and add their corresponding file names to the whitelist. The third set can correspond to keys created after a cutoff timestamp. The key removal tool can delete all key files with key file names not on the whitelist that were created before the cutoff timestamp.

Abstract: Examples can include (1) identifying, on a network, a source node and a destination node, the source node including at least one source node virtual machine (“VM”) to be replicated as a destination node VM on the destination node, (2) performing a full synchronization by copying disks used by the source node VM in a current operational state to the destination node VM, (3) scheduling start times for multiple update synchronizations of changed data between the source node VM and the destination node VM, the start times being scheduled at different time intervals, wherein a first time interval is greater than a second time interval, and (4) performing, at a switch-over time, a shutdown of the source node VM and transmitting data changes that are pending on the disk to the destination node. Various corresponding systems, methods, and non-transitory computer-readable media are also disclosed.

Abstract: System and method for creating and managing trusted execution environments (TEEs) using different underlying hardware TEE mechanisms use a virtual secure enclave device which runs in a virtualized environment in a computer system. The device enables an enclave command transmitted to the virtual secure enclave device to be retrieved and parsed to extract an enclave operation to be executed. A TEE backend module is used to interact with a particular hardware TEE mechanism among those available in the computer system. The module ensures the enclave operation for the software process is executed by the particular hardware TEE mechanism, or the TEE scheme based on a particular hardware TEE mechanism.

Abstract: Disclosed are various embodiments for resolving conflicts between workflows in a workflow processing system. A plurality of workflows stored in a workflow queue are evaluated to identify a common dependency of the plurality of workflows. Then, a version hierarchy is created for the common dependency of the plurality of workflows, the version hierarchy identifying multiple versions of the common dependency. In response to execution of a first one of the plurality of workflows stored in the workflow queue, the version hierarchy can be evaluated to identify the most recent version of the common dependency. Then, installation of the most recent version of the common dependency can be initiated.