Abstract: Various embodiments provide a method and apparatus for allocating resources to processes by using statistical allocation based on the determined maximum average resource demand at any time across all applications (“ ?”), and the determined maximum resource demand at any time by any application (“C”). In particular, resource allocation includes an auto-scaling scheme based on ? and C.

Abstract: Sessions, such as on-line gaming sessions, are maintained by proxy agents on behalf of users even when the users are inactive. The agents, along with other components, form a novel “always-on” architecture that greatly reduces the time it takes to initiate and carry out sessions.

Abstract: Various exemplary embodiments relate to a method for processing data packets by a first-hop switch in a data network, including: receiving a first data packet associated with a flow; determining whether the flow associated with the first data packet is found in a flow table in the first-hop switch; modifying the first data packet by replacing a packet header field with flow definition information; and transmitting the modified first data packet based upon the flow definition information.

Abstract: Apparatuses, methods and articles of manufacture for performing data leakage prevention are provided. Data leakage prevention may be performed by determining a signature of a transmitted document, the transmitted document being in transit to a location beyond a network boundary. The signature of the transmitted document is compared with one or more signatures of documents authorized to be transmitted beyond the network boundary. The transmitted document is prevented from being transmitted beyond the network boundary if the signature of the document does not correspond to a signature of a document authorized to be transmitted beyond the network boundary.

Abstract: A small contact hole having a large aspect ratio is formed by employing a stop layer with a trench formed therein. A relatively large contact hole is formed above the trench, and the small contact hole is formed below the trench, using properties of the trench and the stop layer to limit the size of the small contact hole.

Abstract: A self-align method of preparing semiconductor gates for formation of a silicide, such as a cobalt silicide (CoSi) layer, is disclosed. Deposition of silicon nitride (SiN) and low-temperature oxide (LTO) liner types, the SiN liner having an overhang structure, prevent damage to the gates while forming a self-aligned source. The undamaged gates are suitable for CoSi deposition.

Abstract: A method of forming a semiconductor structure is provided. First, a target layer and a mask layer are sequentially formed on a substrate. Thereafter, a first pattern transfer layer having a plurality of openings is formed on the mask layer. Afterwards, a second pattern transfer layer is formed in the openings of the first pattern transfer layer. The mask layer is then patterned, using the first pattern transfer layer and the second pattern transfer layer as a mask, so as to form a patterned mask layer. Further, the target layer is patterned using the patterned mask layer.

Abstract: A flow deflection capability is provided for deflecting data flows within a Software Defined Network (SDN) in order to provide security for the SDN. A flow forwarding rule is generated for a first network element of the SDN based on detection of a condition (e.g., TCAM utilization condition, CPU utilization condition, or the like) associated with the first network element. The flow forwarding rule is generated by a control element of the SDN or the first network element of the SDN. The flow forwarding rule is indicative that at least a portion of new flow requests received at the first network element are to be forwarded from the first network element to a second network element of the SDN. The flow forwarding rule may specify full flow deflection or selective flow deflection.

Abstract: A capability is provided for allocating cloud and network resources in a distributed cloud system including a plurality of data centers. A request for resources is received. The request for resources includes a request for cloud resources and an indication of an amount of cloud resources requested. The request for resources also may include a request for network resources or one or more constraints. A set of feasible resource mappings is determined based on the request for resources and information associated with the distributed cloud system. A resource mapping to use for the request for resources is selected from the set of feasible resource mappings. The selected resource mapping includes a mapping of the requested cloud resources to cloud resources of one or more of the data centers and an identification of network resources configured to support communications for the cloud resources of the one or more data centers.

Abstract: A capability is provided for representing a set of data values using data structures, including converting a binary trie data structure representing the set of data values to a shape graph data structure representing the set of data values. The shape graph data structure is generated from the binary trie data structure based on the shapes of the sub-trees rooted at the nodes of the binary trie data structure. The shape graph includes vertices representing shapes of the sub-trees of the binary trie data structure. A shape graph data structure permits operations similar to the operations that may be performed on the binary trie data structure for performing lookups for data values from the set of data values, while at the same time reducing the structural redundancy of the binary trie data structure such that the shape graph data structure provides significant improvements in memory usage over the binary trie data structure.

Abstract: A security management capability enables migration of individual security rules between storage/application locations. The migration of a security rule may include selection of a location at which the security rule is to be applied and migration of the security rule to the selected location at which the security rule is to be applied. The selection of the location at which the security rule is to be applied may be performed based on security rule policies and/or security rule location selection information. The security rule is migrated from a current location (e.g., a location at which the security rule is currently applied, a management system, or the like) to the selected location at which the security rule is to be applied. In this manner, a fluid security layer may be provided. The fluid security layer may be optimized for one or more of security level, performance, cost, or the like.

Abstract: Various exemplary embodiments relate to a method and related network node including one or more of the following: receiving, at the cloud controller, a request message including a first request for a first cloud resource; identifying a set of potential devices for providing the first cloud resource; calculating a plurality of weight values corresponding to at least a portion of the set of potential devices for providing the first cloud resource, wherein the plurality of weight values are calculated based on a plurality of delta values associated with the at least a portion of the set of potential devices; selecting a device based on the plurality of weight values to provide the first cloud resource; and updating the delta value associated with the selected device.

Abstract: A data-leakage prevention capability is presented herein. The data-leakage prevention capability prevents leakage of data, of a file set having a plurality of files, from a secure network using online fingerprint checking of data flows at a boundary of the secure network. The online fingerprint checking is performed using a set of data structures configured for the file set. The data structures for the file set are configured based on file set characteristics information of the file set and a target detection lag indicative of a maximum number of bits within which a data leakage event for the file set is to be determined. The data structure configuration is computed for a plurality of data structures configured for use in monitoring the files of the file set. The data structure configuration includes a plurality of data structure locations and data structure sizes for the respective plurality of data structures.

Abstract: Apparatuses, methods and articles of manufacture for performing data leakage prevention are provided. Data leakage prevention may be performed by determining a signature of a transmitted document, the transmitted document being in transit to a location beyond a network boundary. The signature of the transmitted document is compared with one or more signatures of documents authorized to be transmitted beyond the network boundary. The transmitted document is prevented from being transmitted beyond the network boundary if the signature of the document does not correspond to a signature of a document authorized to be transmitted beyond the network boundary.

Abstract: A data-leakage prevention capability is presented herein. The data-leakage prevention capability prevents leakage of data, of a file set having a plurality of files, from a secure network using online fingerprint checking of data flows at a boundary of the secure network. The online fingerprint checking is performed using a set of data structures configured for the file set. The data structures for the file set are configured based on file set characteristics information of the file set and a target detection lag indicative of a maximum number of bits within which a data leakage event for the file set is to be determined. The data structure configuration is computed for a plurality of data structures configured for use in monitoring the files of the file set. The data structure configuration includes a plurality of data structure locations and data structure sizes for the respective plurality of data structures.

Abstract: A method is disclosed for manufacturing a semiconductor device. The method includes providing a substrate and forming a well region in the substrate by an ion implantation. The method also includes forming, by rapid thermal oxidation and on the substrate having the well region, an oxide layer for repairing the substrate damaged by the ion implantation. Further, the method includes removing the oxide layer and forming a gate oxide layer on the repaired substrate having the well region.

Abstract: Various embodiments provide a method and apparatus of providing a load balancing configuration that adapts to the overall load and scales the power consumption with the load to improve energy efficiency and scalability. The energy efficient distributed and elastic load balancing architecture includes a collection of multi-tiered servers organized as a tree structure. The handling of incoming service requests is distributed amongst a number of the servers. Each server in the virtual load distribution tree accepts handles incoming service requests based on its own load. Once a predetermined loading on the receiving server has been reached, the receiving server passes the incoming requests to one or more of its children servers.

Abstract: A capability is provided for providing transparent cloud computing with a virtualized network infrastructure. A method for enabling use of a resource of a data center as an extension of a customer network includes receiving, at a forwarding element (FE), a packet intended for a virtual machine hosted at an edge domain of the data center, determining a VLAN ID of the VLAN for the customer network in the edge domain, updating the packet to include the VLAN ID of the VLAN for the customer network in the edge domain, and propagating the updated packet from the FE toward virtual machine. The edge domain supports a plurality of VLANs for a respective plurality of customer networks. The packet includes an identifier of the customer network and a MAC address of the virtual machine. The VLAN ID of the VLAN for the customer network in the edge domain is determined using the identifier of the customer network and the MAC address of the virtual machine.

Abstract: A manner of providing redundancy protection for a data center network that is both reliable and low-cost. In a data center network where the data traffic between numerous access nodes and a network core layer via primary aggregation nodes, an optical network device such as and OLT (optical line terminal) is provided as a backup aggregation node for one or more of the primary aggregation nodes. When a communication path through a primary aggregation node fails, traffic is routed through the optical network device. In a preferred embodiment, a communication link is formed from a plurality of access nodes to a single port of the OLT or other optical network device via an optical splitter that combines upstream transmissions and distributes downstream transmissions. The upstream transmissions from the plurality of access nodes may occur according to an allocation schedule generated when the backup aggregation node is needed.

Abstract: A method and apparatus providing improved set membership determination and group membership identification of candidate data elements using a single Bloom filter programmed to provide a plurality of non-zero f-bit binary vectors, where each of the f-bit binary vectors is associated with a respective group. The Bloom filter is programmed using one or more (but not all) of a plurality of hash filter sets.