Abstract: Techniques are described for ensuring end-to-end fair-share resource utilization during cross-region replication. In certain embodiments, a fair-share architecture is used for communication among pipeline stages performing a cross-region replication between different cloud infrastructure regions. Cross-region replication-related jobs are distributed evenly from a pipeline stage into a temporary buffer in the fair-share architecture, and then further distributed evenly form the fair-share architecture to parallel running threads of next pipeline stage for execute. Techniques for static and dynamic resource allocations are also disclosed.

Abstract: Techniques are described for performing different types of restart operations for a file storage replication between a source file system and a target file system in different cloud infrastructure regions. In certain embodiments, the disclosed techniques perform a restart operation to terminate a current cross-region replication by synchronizing resource cleanup operations in the source file system and the target file system, respectively. In other embodiments, disclosed techniques perform a restart operation to allow a customer to reuse the source file system by identifying a restartable base snapshot in the source file system without dependency on the target file system.

Abstract: Techniques are described for efficient replication and maintaining snapshot data consistency during file storage replication between file systems in different cloud infrastructure regions. In certain embodiments, provenance IDs are used to efficiently identify a starting point (e.g., a base snapshot) for a cross-region replication process, conserve cloud resources while reducing network and IO traffic.

Abstract: Techniques are described for partitioning B-tree keys of file systems into key ranges for parallel processing in delta generation during file storage replications between file systems in different cloud infrastructure regions. In certain embodiments, a delta generation processing for cross-region replication may utilize a key-range splitting mechanism involving a recursive algorithm that partitions B-tree keys of a source file system into roughly equal-size key ranges. All the partitioned key ranges may be processed in parallel and concurrently by different processing threads, one thread per key range, to improve the performance of the delta generation and achieve scalability.

Abstract: Plugins that are independently written are executed in a collaborative manner to analysis a log. A plugin executing with respect to a particular node of a hierarchical data structure determines values for a set of keys based on information of the particular node and/or any ancestor nodes, and information stored in a shared repository. The plugin stores the values for the keys as additional information of the particular hierarchical node and/or into the shared repository. The plugin does not access information of non-ancestor nodes when executing with respect to the particular hierarchical node. Each plugin writes into and retrieves from the shared repository using the shared naming convention, thereby sharing information. The sequence of execution of the plugins is not dependent on dependencies amongst the plugins. If a dependent plugin requiring an output from a requisite plugin is first executed, the dependent plugin is flagged as pending and subsequently re-executed.

Abstract: The disclosed systems, methods and computer readable media relate to managing Non-Volatile Memory Express (NVMe) over Transmission Control Protocol (TCP) (NVMeOTCP) connections between a smart network interface card (smartNIC) and a block storage data plane (BSDP) of a cloud computing environment. A software agent (“agent”) executing at the smartNIC may manage a number of network paths (active and, in some cases, passive network paths). The agent may monitor the network traffic (e.g., input/output operations (IOPS)) through the paths (e.g., using established NVMeOTCP connections corresponding to the paths). If a condition is met relating to a performance threshold associated with the monitored paths, the agent may increase or decrease the number established NVMeOTCP connections to match real time network conditions.

Abstract: Techniques are described for maintaining data consistency when failure events occur during file storage replications between file systems in different cloud infrastructure regions. In certain embodiments, two generation numbers (or different identifications) are assigned to two groups of processed B-tree key-value pairs, one before and one after a failure event, within a key range. In some embodiments, the two generation numbers are assigned to a group of B-tree key-value pairs processed by a failed thread and another group of B-tree key-value pairs processed by a substitute thread taking over the failed thread to avoid potential data corruption.

Abstract: Novel techniques are described for maintaining file consistency between different cloud infrastructure regions during cross-region file storage replication. The novel techniques comprise upon detecting a file deletion status (i.e., a file directory entry version marked as deletion) in a source file system during a replication cycle, retrieving file name from a valid file directory entry of a prior snapshot to construct a temporary file directory entry containing necessary information for a target file system to reconstruct a duplicate file directory entry version marked as deletion. The temporary file directory entry is transferred from the source file system to the target file system during the same replication cycle.

Abstract: Techniques are described for performing different types of restart operations for a file storage replication between a source file system and a target file system in different cloud infrastructure regions. In certain embodiments, the disclosed techniques perform a restart operation to terminate a current cross-region replication by synchronizing resource cleanup operations in the source file system and the target file system, respectively. In other embodiments, disclosed techniques perform a restart operation to allow a customer to reuse the source file system by identifying a restartable base snapshot in the source file system without dependency on the target file system.

Abstract: Systems and methods for geometric based flow programming are disclosed herein. The method can include receiving at least one compiled rule at a first Network Virtualization Device (“NVD”), each of the at least one compiled rules can be applicable to a class of packets received by the first NVD for delivery to a Virtualized Network Interface Card (“VNIC”). The method can include receiving a first packet at the first NVD for delivery to a first VNIC, determining with the first NVD that a first rule of the at least one compiled rule is applicable to the first packet, and processing with the first NVD the first packet according to the first rule.

Abstract: Techniques are described for checkpointing multiple key ranges in parallel and concurrently during file storage replications between file systems in different cloud infrastructure regions. In certain embodiments, multiple range threads processing multiple key ranges, one thread per key range, create checkpoints for their respective key ranges in parallel and concurrently after processing a per-determined number of B-tree keys. In certain embodiments, each thread requests a lock from a central checkpoint record and takes turns for updating a status byte while continuing processing the B-tree keys in its responsible key range. In certain embodiments, upon encountering a failure event, either a system crash or a thread failure, each thread restarts its B-tree key processing from a B-tree key after the most recent checkpoint.

Abstract: Techniques for detecting anomalies in live marketing campaign data are disclosed, including: obtaining baseline data associated with one or more digital marketing campaigns; configuring an anomaly detection model to detect anomalies in digital marketing data, based at least on the baseline data; receiving a live stream of a set of digital marketing data associated with a particular digital marketing campaign that is currently being executed; while the particular digital marketing campaign is being executed: applying the anomaly detection model to the set of digital marketing data, to determine if the set of digital marketing data includes an anomaly relative to the baseline data; prior to completion of the particular digital marketing campaign and responsive to determining that the set of digital marketing data includes the anomaly relative to the baseline data, executing an action to address the anomaly.

Abstract: Novel techniques for end-to-end file storage replication and security between file systems in different cloud infrastructure regions are disclosed herein. In one embodiment, a file storage service generates deltas between snapshots in a source file system, and transfers the deltas and associated data through a high-throughput object storage to recreate a new snapshot in a target file system located in a different region during disaster recovery. The file storage service utilizes novel techniques to achieve scalable, reliable, and restartable end-to-end replication. Novel techniques are also described to ensure a secure transfer of information and consistency during the end-to-end replication.

Abstract: In some aspects, techniques may include monitoring a primary load of a datacenter and a reserve load of the datacenter. The primary load and reserve load can be monitored by a computing device. The primary load of the datacenter can be configured to be powered by one or more primary generator blocks having a primary capacity, and the reserve load of the datacenter can be configured to be powered by one or more reserve generator blocks having a reserve capacity. Also, the techniques may include detecting that the primary load of the datacenter exceeds the primary capacity. In addition, the techniques may include connecting the reserve generator blocks to at least one of the primary generator blocks and the primary load using a computing device switch.

Abstract: A method may include detecting a first sub-flow, by executing a local defect analysis on code starting at a sink instruction, to a load instruction performing reading a first value using a first variable. The first sub-flow may include a first label of a first defect. The method may further include detecting a second sub-flow, by executing the local defect analysis on the code starting at a store instruction, to a load instruction performing writing a second value using a second variable. The second sub-flow may include a second label of a second defect. The method may further include determining that the first variable and the second variable are potential aliases by determining that the first label matches the second label, and obtaining, based on determining that the first variable and the second variable are potential aliases, a nonlocal flow by connecting the first sub-flow and the second sub-flow.

Abstract: Techniques are describe herein for associating storage management properties with a group of files of a database referred to herein as a “file group”. In this system, storage management properties are defined at the database-level. Thus, multiple databases can be stored across a single disk group, gaining the benefits of having multiple block access devices working in parallel, but each respective database may be associated with a respective file group in a one-to-one relationship, so that each database can have different storage management properties.

Abstract: Example embodiments facilitate extending client-side software functionality to leverage server-side functionality, such as server-side business logic implementing custom actions and accessible to a specialized add-in to the client-side software, e.g., a client-side spreadsheet. An example method includes exposing one or more parameters of server-side logic in a client-side spreadsheet, wherein the server-side logic includes code for implementing one or more software actions; providing input to one or more spreadsheet fields corresponding to the one or more parameters, there by allocating one or more values to the one or more parameters; detecting user selection of a User Interface (UI) control for using the server-side logic to implement the one or more software actions; and sending the one or more values to the server-side logic via one or more web services, thereby providing the one or more values as input to the server-side logic.

Abstract: Techniques discussed herein relate to updating an edge device (e.g., a computing device distinct from and operating remotely with respect to a data center). The edge device can execute a first operating system (OS). A manifest specifying files of a second OS to be provisioned to the edge device may be obtained. The manifest may further specify a set of services to be provisioned at the edge device. One or more data files corresponding to a difference between a first set of data files associated with the first OS and a second set of data files associated with the second OS may be identified. A snapshot of the first OS may be generated, modified, and stored in memory of the edge device to configure the edge device with the second OS. The booting order of the edge device may be modified to boot utilizing the second OS.

Abstract: A model validation system is described that is configured to automatically validate model artifacts corresponding to models. For a model artifact being validated, the model validation system is configured to dynamically determine the validation checks to be performed for the model artifact, where the validation checks include various validation checks to be performed at the model artifact level and also for individual components included in the model artifact. The checks to be performed are dynamically determined based upon the attributes of the model artifact and of the components within the model artifact. The system is configured to generate a validation report that comprises information regarding the checks performed and the results generated from performing the various validation checks. The validation report may also include information suggesting actions for passing checks that result in a failed check, or for improving the scores of certain validation checks.

Abstract: A database session in an active standby server on which an active standby database resides receives a DML statement. The session is suspended while the statement is redirected over a database link to a primary database on which the statement is executed. Information associated with execution of the statement is communicated to the session in the active standby server. Redo records describing changes to the contents of the primary database are applied to the active standby database and control is returned to the session. Prior to commitment of a transaction including the statement, a query directed to data to which the statement was directed is received at the active standby server from a client and executed on the active standby database absent use of a database link based on whether information associated with a database session associated with the client matches the information associated with execution of the statement.

Abstract: Embodiments include systems and methods for performing data migration using database consolidation. Information and parameters about a plurality of source databases from a source system can be stored, the parameters including a location, a security zone, and processor information for the source databases. Each of the plurality of source databases can be classified to one of a plurality of predetermined database sizes based on the stored information and parameters, wherein the classifying is at least based on the processor information. The classified source databases can be mapped to target database hardware based on the classified sizes and the stored parameters, wherein the target database hardware is segmented into containers that are defined by one or more of the parameters. Data from the source databases can be migrated to the target database hardware based on the mappings.

Abstract: Systems, devices, and methods discussed herein provide improved decision trees (e.g., supported decision trees). A supported decision tree can be generated by generating discourse trees from various documents associated with a subject. One or more decision chains can be generated from each discourse tree, each decision chain being a sequence of elements comprising a premise and a decision connected by rhetorical relationships. A supported decision tree can be generated from the various decision chains, where the nodes of the decision tree are identified from the elements of the plurality of decision chains and ordered based on a set of predefined priority rules. Subsequent input data can be received and the supported decision tree can be traversed to classify the input data.

Abstract: In various embodiments, a data integration system is disclosed which enables incremental loads into a data warehouse by developing a data partitioning plan and selectively disabling and enabling indexes to facilitate incremental loads into fact tables.

Abstract: Techniques are disclosed for linearizing interfaces within computing applications. In some embodiments, the techniques include defining a sequence of user interface elements, where at least a subset of user interface elements in the sequence of user interface elements correspond to controls for affecting a session state. Responsive to receiving an input value through a user interface element, a linearization process adds the input value to at least one dataset for evaluating a current state for each respective user interface element subsequent to the user interface element in the sequence of user interface elements. The process further evaluates the current state for each respective user interface element subsequent to the user interface element in the sequence of user interface elements based on values within the at least one data set. The process may disable and/or enable one or more user interface elements based on the evaluation.

Abstract: A self-describing data format capable of carrying payload information, such as Tuxedo payload information, as well as filter information. The data format can allow for expression of some or all of Tuxedo Typed Buffers, including STRING, CARRAY, MBSTRING, VIEW, VIEW32, FML, and FML32. The data format is also capable of supporting nesting and error-checking. The proposal of user payload collection can allow customers to siphon off user/payload data to be used in applications, such as Business Intelligence applications, without the need for additional information to be passed with the payload data.

Abstract: For end-to-end encryption of a virtual cloud network, a VPN tunnel from a customer device is terminated at a host network headend device using encryption keys secured in hardware and managed by the customer. The network headend device can be a card in a bare-metal server with one or more network virtualization devices. The network headend device is configured to receive a first key provisioned by a customer; receive a first data packet sent from a device of the customer; and decrypt the first data packet using the first key to obtain information. A network virtualization device is configured to receive the information from the network headend device; ascertain that the information is to be sent to a virtual machine in a virtual cloud network; ascertain that data in the virtual cloud network is configured to be encrypted; and encrypt the information with a second key to generate a second data packet before routing the second data packet to the virtual machine.

Abstract: Embodiments provide a system and method for building idempotent configuration management modules for cloud infrastructure services. Idempotency of a configuration management (CM) task in a CM plan is one of the mechanisms used to achieve repeatable and reliable automations of configuration management tasks. This helps DevOps and operations personnel reliably apply and maintain configuration of their systems.

Abstract: Systems, devices, and methods discussed herein provide improved autonomous agent applications that are configured to provide explanations in response to user-submitted questions. A user query may be received and a classification (e.g., a general question, a specific question) for the user query may be determined based at least in part on a predefined rule set (or a classification model). A set of decision features (e.g., particular user data) associated with a decision generated by a machine-learning model may be identified. An explanation chain may be identified from a plurality of explanation chains based at least in part on the user query. The explanation chain may describe a logical chain of explanations associated with a decision making process related to the machine-learning model. A response to the user query may be provided based at least in part on the explanation chain and the set of decision features.

Abstract: A method for routing inter-public land mobile network (inter-PLMN) messages relating to existing subscriptions with a network function (NF) repository functions (NRFs) includes, at a security edge protection proxy (SEPP) implemented using at least one processor, automatically populating, by the SEPP, a subscription identifier to target NRF resource identification information mapping database accessible to the SEPP with mappings between subscription identifiers and target NRF resource identification information. The method further includes receiving an inter-PLMN message for modifying or deleting a subscription. The method further includes reading a subscription identifier from the message for modifying or deleting the subscription. The method further includes using the subscription identifier from the message for modifying or deleting the subscription to access the database and obtain an identifier associated with an NRF that created the subscription.

Abstract: The present disclosure relates to systems and methods for an intelligent assistant (e.g., a chatbot) that can be used to enable a user to generate a machine learning system. Techniques can be used to automatically generate a machine learning system to assist a user. In some cases, the user may not be a software developer and may have little or no experience in either machine learning techniques or software programming. In some embodiments, a user can interact with an intelligent assistant. The interaction can be aural, textual, or through a graphical user interface. The chatbot can translate natural language inputs into a structural representation of a machine learning solution using an ontology. In this way, a user can work with artificial intelligence without being a data scientist to develop, train, refine, and compile machine learning models as stand-alone executable code.

Abstract: Techniques are disclosed for generating defeating textual replies. A computer-implemented method generates a first communicative discourse tree from an utterance and as second communicative discourse tree from a candidate answer derived from a search of keywords in the utterance. The method translates the first communicative discourse tree into a first logical formula from and the second communicative discourse tree into a second logical formula. The method determines that the first logical formula is a negation of the second logical formula. The method further provides the candidate answer to a user device responsive to the determining.

Abstract: Techniques are disclosed for generating a message stream configured to indicate a source of the various messages within the message stream. In particular, the indicators identify which interface the messages were received at a terminal (e.g., of a mobile handset). The terminal receives messages on various interfaces, and separates the messages received via different interfaces with interface switch indicators within the message stream. In one embodiment, the smart card receives a message stream that includes sets of messages and interface switch indicators therein. The smart card delivers messages from the message stream to a single logical partition of the smart card up until an interface switch indicator is identified in the message stream. From that point, the smart card delivers messages from the message stream to a different logical partition of the smart card up until another interface switch indicator is identified in the message stream.

Abstract: A novel system is described for performing hierarchical named entity recognition (“HNER”) processing that includes identifying categories at different hierarchical levels for a named entity. The HNER system uses a novel architecture comprising an encoder model and a system of trained machine learning (ML) models to perform the HNER processing, where each trained model in the system of ML models corresponds to a particular hierarchical level, and each model is trained to extract one or more named entities and predict a category for each extracted named entity for the corresponding hierarchical level. Novel techniques are also described for training the various models in HNER system including an encoder model and models in the system of models.

Abstract: NUMA-aware reader-writer locks may leverage lock cohorting techniques that introduce a synthetic level into the lock hierarchy (e.g., one whose nodes do not correspond to the system topology). The synthetic level may include a global reader lock and a global writer lock. A writer thread may acquire a node-level writer lock, then the global writer lock, and then the top-level lock, after which it may access a critical section protected by the lock. The writer may release the lock (if an upper bound on consecutive writers has been met), or may pass the lock to another writer (on the same node or a different node, according to a fairness policy). A reader may acquire the global reader lock (whether or not node-level reader locks are present), and then the top-level lock. However, readers may only hold these locks long enough to increment reader counts associated with them.

Abstract: Techniques are disclosed for augmenting data sets used for training machine learning models and for generating predictions by trained machine learning models. The techniques generate synthesized data from sample data and train a machine learning model using the synthesized data to augment a sample data set. Embodiments selectively partition the sample data set and synthesized data into a training data and a validation data, which are used to generate and select machine learning models.

Abstract: The present disclosure describes an anomaly detection system that generates a resource group including a plurality of resources of a monitored environment based on a grouping property. The values of the grouping property associated with the plurality of resources satisfy a first condition. A first invariance identifying property is selected from a set of invariance identifying properties. It is determined whether values of the first invariance identifying property associated with the plurality of resources satisfy a second condition. Responsive to a successful determination, a first invariant is incorporated in a baseline, wherein the first invariant is defined by the grouping property and the first invariance identifying property. The baseline is used by the anomaly detection system for performing anomaly detection of the monitored environment.

Abstract: A universal code editor (UCE) is described that can be used for authoring and editing artifacts associated with multiple different cloud services. A single instance of the UCE and the associated user interface (UI) can be used to select and edit one or more artifacts from different cloud services. The cloud services may be provided by the same cloud service provider or by different cloud service providers. In certain embodiments, the UCE is implemented as part of a cloud-based IDE.

Abstract: Techniques are disclosed for augmenting data sets used for training machine learning models and for generating predictions by trained machine learning models. These techniques may increase a number and diversity of examples within an initial training dataset of sentences by extracting a subset of words from the existing training dataset of sentences. The techniques may conserve scarce sample data in few-shot situations by training a data generation model using general data obtained from a general data source.

Abstract: The present embodiments relate to a CI replication service that can replicate domain data from IDCS control plane to data plane and to all subscribed regions of a domain. For instance, the CI replication service can provide replication of required resources of a domain for AuthN and AuthZ from an IDCS local region to other regions for high availability (e.g., to improve latency). The CI replication service can replicate the resources from a domain's home region to all subscribed regions for local availability of data for workloads running in those regions. Further, when a new region is subscribed for a domain, then the service can bootstrap that domain's data from home region before enabling that region for the domain.

Abstract: The present disclosure relates generally to access control, and more particularly, to techniques (e.g., systems, methods, computer program products storing code or instructions executable by one or more processors) for providing for inline enrollment in multi-level and multi-factor authentication of a user allowing login on a restricted website, or on an enterprise network with single sign-on, or on various other service systems with security restrictions.

Abstract: Techniques are disclosed for automatically inferring software-defined network policies from the observed workload in a computing environment. The disclosed techniques include monitoring network traffic flow originating from network interfaces corresponding to containers that execute components of an application, recording details of a new network connection or a change in the existing network connection, obtaining information concerning the components of the application, identifying metadata for a component involved in the new network connection or the change in an existing network connection based on a comparison of the details of the new network connection or a change in the existing network connection and the information concerning the components of the application, generating a network policy for the component using at least the metadata for the component, and integrating the network policy for the component into a deployment package for the application.

Abstract: Techniques are disclosed for utilizing directed acyclic graphs for deployment instructions. A computer-implemented method can include various operations. Instructions may be executed by a computing device to perform parses of configuration data associated with deploying one or more services to various execution targets. The computing device may cause a first graph to be generated that indicates dependencies between tasks associated with deploying the service(s). A second graph may be generated that specifies dependencies between different deployments of the service(s) to the execution target(s). Services may be deployed based on traversing the first and second graph.

Abstract: A method for automatically managing a platform firewall using a network function (NF) repository function (NRF) or service communication proxy (SCP) includes receiving message relating to registering, updating, or deregistering an NF profile in an NF profiles database separate from a platform firewall. The method further includes determining that the registering, updating, or deregistering of the NF profile requires a change to a firewall rules configuration of the platform firewall. The method further includes, in response to determining that the registering, updating, or deregistering of the NF profile requires a change to the firewall rules configuration of the platform firewall, automatically updating, by the NRF or SCP, the firewall rules configuration of the platform firewall.

Abstract: Various embodiments of the present technology generally relate to systems and methods for secure customer data handling. More specifically, some embodiments relate to handling of derivative data as a provider in a manner that supports security and provides a stronger level of control over the data. The solution supports four core principles of customer data handling: no export of customer data, unless authorized; remote operations only via shell access or equivalent; temporary and task-based privileges; and diagnostic data to be ephemeral. The customer data handling system herein includes a central repository for the storage of diagnostic data, an upload tool for uploading to the central repository and automated staging on containers, a diagnostic virtual machine that enables task-based access to diagnostic data and analysis tools hosted on a dedicated container, and an application for handling requests, provisioning and staging containers, and purging.

Abstract: Techniques are disclosed for providing high performant packets processing capabilities in a virtualized cloud environment that enhance the scalability and high availability of the packets processing infrastructure. In certain embodiments disclosed herein, the VNICs functionality performed by network virtualization devices (NVDs) is offloaded from the NVDs to a fleet of computers, referred to as VNIC-as-a-Service System (or VNICaaS system). VNICaaS system is configured to provide Virtual Network Interface Cards (VNICs)-related functionality or service for multiple compute instances belonging to multiple tenants or customers of the CSPI. The VNICaaS system is capable of hosting multiple VNICs to process and transmit traffic in a distributed virtualized cloud networks environment. A single VNIC executed by the VNICaaS system can be used to process packets received from multiple compute instances.

Abstract: The present embodiments relate to a cloud shell extension framework. A cloud infrastructure (CI) service can invoke a cloud shell from a console to the CI. The service may request that context data to be added for use in a terminal session. The cloud shell extension can include a tool or script that can be used to obtain context data or sample code for preparing an environment specific to the service prior to the user interaction with the environment. The cloud shell extension can allow for a service to register an extension in the cloud shell framework, and their extension can be invoked when a client initiates the cloud shell with the service. The extension can allow for the invoked service to forward context data, such as environment variables, to be set in the terminal session for the client.

Abstract: Techniques for providing, to a resource on a private network of a service provider, access to a resource on a private network of a customer. Service to customer (S2C) resources deployed on a cloud infrastructure to facilitate the access. Whereas IP address ranges may overlap between private networks and/or private IP addresses may be used in one or more of the private networks, the S2C resources enable the data exchange between the private networks. For example, the S2C resources translate between IP addresses such that data within each private network uses IP addresses that can be properly processed by the private network.

Abstract: Example embodiments facilitate efficient comparison operations of tree structures, resulting in comparison metrics (e.g., similarity or distance metrics or scores) used enhance software systems, such as search algorithms, code optimization software, enterprise database applications, and so on. Trees to be compared are converted into sets, i.e., serialized using a novel enumeration method. Metric functions can then be efficiently applied to the sets to facilitate the comparison operations. In an illustrative embodiment, subtrees of larger trees can be compared individually, pairwise, where the comparison results of the subtree comparisons can be selectively weighted and summed to yield an aggregated comparison metric that is tailored for a specific application or comparison priority.

Abstract: Techniques are disclosed for bootstrapping a secure data center using a cross domain system with a proxying sidecar node. The cross domain system can be implemented at the secure data center to provide one-way ingress and egress channels for network traffic to the target data center. The cross domain system is connected to a host data center and can receive configuration data from the host data center to configure the proxying sidecar node. The proxying sidecar node can request bootstrapping data from the host data center on demand, receive the requested bootstrapping data, and send the bootstrapping data to nodes in the secure data center to provision one or more services in the secure data center. The received bootstrapping data passes into the secure data center via the ingress channel.

Abstract: Techniques are disclosed for bootstrapping a secure data center using a cross domain system with a static sidecar node. The cross domain system can be implemented at the secure data center to provide one-way ingress and egress channels for network traffic to the target data center. The cross domain system is connected to a host data center and can receive configuration data from the host data center to configure the static sidecar node. The static sidecar node can receive bootstrapping data from the host data center and store the bootstrapping data. The bootstrapping data can include software resources for provisioning services in the secure data center. The received bootstrapping data passes into the secure data center via the ingress channel.