Abstract: A communication system is disclosed in which a control node generates configuration data for each of a plurality of MMEs operating in overlay networks. The configuration data defines a type of user equipment (UE) or a type of UE traffic to be serviced by each MME. The MME configuration data is provided to a base station and used to control selection of an MME to service a request from a UE. The control node monitors network traffic within and across the overlay networks and can reconfigure one or more MMEs to service different UE traffic types. This allows for improved flexibility in load balancing with overlay networks.

Abstract: Technologies are disclosed that help developers determine server resource usage caused by client application generated events. Embodiments may be employed while an application is under development to balance the benefit of a given event with an estimated cost to process the event once the application is deployed. One aspect of the present disclosure provides a telemetry application that receives application generated events and estimates a resource cost they cause to data collection servers. The resource cost may be based on historic data captured from similar or related events, as well as data about how often the event and related events are raised by the application.

Abstract: Methods and systems for performing file transfers across different domains hosted by a virtualization server are described herein. A trusted domain (Dom 0) may indicate that one or more files, directories, and/or volumes are available to a second domain (guest domain) by updating share information stored in a key value store. The guest domain may enumerate the shared files to appear as if within its own file system structure. The guest domain intercepts calls to its file system, determines whether the requested data is actually stored in its own file system or in trusted domain, and proxies the file system call to the trusted domain when the requested data is shared by the trusted domain. Key value store information and shared data information and contents may be communicated using one or more memories shared between the trusted domain and guest domain.

Abstract: A network of routers configure resource nodes connected to the network in accordance with a configuration model including configuration objects that imply resources. A router device among the network of router devices receives, from forwarding paths in the network relative to the router device, originated at the resource nodes and that indicate resources supported by the resource nodes. The router device creates mappings of the resources as advertised to the forwarding paths. The router device receives from the network an Intent request to create a configuration object among the configuration objects, and determines whether the configuration object matches a resource in the mappings. If the configuration object matches a resource in the mappings, the router device generates a new Intent request that identifies the resource, specifically, and forwards the new Intent request along the forwarding path mapped to the resource.

Abstract: Example methods and systems for a network management entity to perform configuration change monitoring. One example method may comprise receiving a request to monitor a datapath to which a configuration change is applicable. The datapath may include multiple network elements. The method may also comprise instructing the first host to inject, at a first network element, one or more trace packets for transmission along the datapath to a second network element. The method may further comprise: obtaining state information associated with the configuration change, and detecting that an operating condition associated with the datapath is affected by the configuration change based on the state information.

Abstract: This patent application discloses a radio access network slice generation method, a radio access network, and a slice manager. The method includes: receiving, by a radio access network, a radio access network slice generation request message sent by a slice manager; and generating, by the radio access network, a radio access network slice. The radio access network slice generation request message includes information about a service type, and a protocol stack corresponding to the service type is configured for the radio access network slice. In this patent application, there is no need to repeatedly deploy different radio access networks to meet different service types, and therefore operating expenses are reduced. The radio access network slice may be quickly generated, and this facilitates rapid deployment of a new service.

Abstract: A method, system, and computer program product for providing protected remote access from a remote access client to a remote access server over a computer network through a plurality of inspections. A remote access configuration file is created for the remote access client. A digital hash of the configuration file is then generated. The digital hash is compared with a configuration file stored at a predefined web location. If the comparison results in a match between the digital hash and the stored configuration file, a digital hash comparison is performed between an encrypted remote access configuration file and an encrypted configuration file stored at the predefined web location. If the plurality of inspections are passed, the remote access client is released from a quarantine state and a virtual private network (VPN) connection to the remote access server is established.

Abstract: Various examples for performing rule processing for device management data evaluation are described. According to some examples, one or more computing devices can receive new device data from a client device indicative of a current configuration of the client device and identify a change of a device configuration value from a past device configuration value by comparing the new device data to historic device data. The computing devices can send the new device data to a rule evaluation service to identify one or more rules associated with the device configuration value a rule action service to perform an action specified in the rules. The rule action service can determine the action to perform based on the device configuration value.

Abstract: In some examples, a system creates a requirement including EPG selectors representing EPG pairs, a traffic selector, and a communication operator; determines that EPGs in distinct pairs are associated with different network contexts and, for each pair, which network context(s) contains associated policies; creates first data representing the pair, operator, and traffic selector; when only one network context contains the associated policies, creates second data representing a network model portion associated with the only network context and determines whether the first data is contained in the second data to yield a first check; when both network contexts contain the associated policies, also creates third data representing a network model portion associated with a second network context, and determines whether the first data is contained in the second and/or third data to yield a second check; and determines whether policies for the pairs comply with the requirement based on the checks.

Abstract: There is provided a method and server for retrieving data from a data storage system including a plurality of storage nodes. The method may include sending a multicast message to at least a subset of the storage nodes. The multicast message may include a request for the subset of storage nodes to send the data. The multicast message may further include a data identifier indicating the data to be retrieved. Moreover, the method may include receiving data from a first storage node of the subset of storage nodes. The data received from the first storage node may correspond to the requested data. At least the act of sending a multicast message or the act of receiving data from the first storage node may be performed on a condition that an estimated size of the data is less than a predetermined value.

Abstract: The present disclosure provides a method of exchanging on-premise network analytics and cloud-based application analytics between an enterprise network and a cloud-based application without exchanging any personally identifiable information about the end users and devices involved in a communication session conducted over the enterprise network and using the cloud-based application. In one aspect, a method includes receiving, at a controller of a network, first analytics data, the first analytics data being embedded with a watermark, the first analytics data excluding personally identifiable information associated with end points of a communication session using a cloud-based application; receiving second analytics data from one or more components of the network, the second analytics data including the watermark; correlating the first analytics data and the second analytics data using the watermark to yield correlated data; and performing network analysis and troubleshooting using the correlated data.

Abstract: This disclosure facilitates managing lost devices. In some embodiments, a system receives a first device type from a first agent on a first device, and a different second device type from a second agent on a second device. The system receives a first group associated with the first device and a different second group associated with the second device. The system determines that the first device and the second device are lost and accesses a database storing first and second configuration classes associated with the first and second devices, respectively. The system creates first and second device-dependent classes based on the first and second device types and the first and second configuration classes, respectively. The system melds the first device-dependent class into a first melded profile and the second device-dependent class into a second melded profile, using the respective groups, and applies the melded profiles to the corresponding device.

Abstract: Methods and apparatus for reconfiguring hosts in provider network environments in which hosts are evaluated to determine if steps of a full rebuild can be skipped. The hosts may implement slots of different types for virtual machines (VMs). Upon detecting that slots of a particular type are needed, a host that implements slots of another type may be selected for reconfiguration. The host may be evaluated to determine if one or more steps of a full rebuild can be skipped. The host may then be reconfigured to implement slots of the target type according to results of the evaluation. In at least some reconfigurations, at least one step of a full rebuild procedure is not performed for the respective host. Results of previous reconfigurations may be fed back into the evaluation process and used as one of the criteria for determining if steps can be skipped.

Abstract: An event processing system for distributing a continuous query, and processing events in an event stream, is disclosed. The system can synchronize timestamps across all partitions by adding a heartbeat propagator component propagating a heartbeat signal for silent partitions. The system can further include a timestamp tracker component that tracks the maximum observed timestamp across all partitions for each batch, and sends this to each partition. The system can distribute partitions of the events to the worker nodes, and instruct a heartbeat propagator component to generate a heartbeat for a first worker node corresponding to an event in a different partition. The system receives outputs from the worker nodes and combines these into a single result corresponding to a continuous query. The system can further implement a timestamp tracker to select a highest timestamp value of a previous batch, and send the value to the worker nodes.

Abstract: Computer systems and methods for constructing and using a virtual index server. The index of the virtual index server may specify locations of respective portions of data at a plurality of remote storage providers. The index may graft multiple files and folders from multiple storage providers together into a single hierarchical index tree. The virtual index server may be automatically updated to reflect changes in data content at the plurality of remote storage providers. The computer system may automatically retrieve log files from a content delivery network (CDN), normalize the log files according to a first analytics provider, and automatically provide the normalized log files to the first analytics provider.

Abstract: The present disclosure generally relates to managing network connection settings of external devices. In some embodiments, an electronic device with a display and one or more wireless antennas, while the electronic device is connected, via the one or more wireless antennas, to a first local area network, displays a first external device management interface, wherein: the first external device management interface is associated with a first external device that is not connected to the first local area network; and the first external device management interface includes a first affordance. The electronic device receives a user input corresponding to selection of the first affordance and, in response to receiving the user input corresponding to selection of the first affordance, causes the first external device to connect to the first local area network.

Abstract: Embodiments of the present invention provide for group policy object (GPO) update compliance. A method for GPO update compliance includes selecting both a compliance update and also a computing system as an endpoint targeted for receiving the compliance update, directing execution of a remediation process that applies the compliance update onto the selected endpoint and performing a re-scan of the selected endpoint subsequent to the execution of the remediation process. The method further includes executing a GPO update within a threshold period of time after the re-scan and repeating the re-scan after the GPO update and then comparing a log produced by the repeated re-scan after the GPO update with a log produced by the re-scan before the GPO update, detecting an out-of-compliance update in the comparison and responding to the out-of-compliance update by directing a repair of the out-of-compliance update using a domain login for the selected endpoint.

Abstract: A method and apparatus are disclosed for performing authenticated firmware updates of a fog or IoT device, which happens concurrent with a field update of a component coupled to the device, such as a battery.

Abstract: An imaging platform may determine whether an image file stored on a client device is a current version of the image file, and may identify, based on determining that the image file on the client device is not the current version of the image file, the current version of the image file in an image file store. The imaging platform may determine, based on identifying the current version of the image file and based on one or more properties associated with a network connection of the client device, a bandwidth allocation for transmitting the current version of the image file to the client device. The imaging platform may transmit, to the client device, a mapping table associated with the current version of the image file, and may transmit, based on the bandwidth allocation and based on the mapping table, the current version of the image file to the client device.

Abstract: Examples described herein relate to a system for orchestrating a security object, including a memory and processor configured to define a plurality of complex policies in a database, wherein the complex policies comprises one or more of EQUAL policy, ONE-OF policy, MEMBER OF policy, NULL policy, NOT-NULL policy, GREATER-THAN policy, GREATER-THAN-OR-EQUAL-TO policy, LESS-THAN policy, or LESS-THAN-OR-EQUAL-TO policy, receive the security object and at least one object attribute associated with the security object, determine acceptability of the security object based, at least in part, on the at least one object attribute and at least one of the plurality of complex policies corresponding to the at least one object attribute, and distribute the security object to at least one communication device associated with the processor when the security object is determined to be acceptable, wherein the at least one communication device establishes communication based, at least in part, on the security object.

Abstract: To measure usage of computing resources on a computer, a logging service running on the computer generates event data. The computer transmits the event data to an event processing system. With a large number of computers, each computer transmits its event data to the event processing system. The event processing system stores the event data in a storage system as a file system object, such as a stream or file, in which different data fields of the received event data are stored in a structured or semi-structured manner. The event data can be processed in parallel on different pivots using map-reduce operations. Such processing can include, but is not limited to, de-duplicating event data, aggregating event data related to a resource into measurements of usage of that resource, and grouping original data or aggregated data by user or group of user for further analysis and reporting.

Abstract: Capacity-based scaling of queue-based resources is described. Initially, a scaling system measures capacity of service processors that are instantiated at a cloud computing service system to provide a service on behalf of a service provider, and also measures a load on these processors. In contrast to conventional scaling systems—which base scalings on a number of queued messages which the instantiated service processors process to provide the service—the scaling system measures the load in terms of not only the number of messages held in a queue but also an input rate of the messages to the queue. The described scaling system then determines whether and by how much to scale the instantiated processors based on this number of messages and input rate. Given this, the scaling system instructs the cloud computing service system how to scale the instantiated service processors to provide the service.

Abstract: The disclosed technology is generally directed to embedded device updates. In one example of the technology, staging is performed for at least two priority groups, completing staging of each higher priority group before staging a lower priority group, including, for each priority group, the following actions. A list of install targets is generated for the priority group based on a list of software for installation in a memory and software present in the memory. A list of purge targets is generated for the priority group based on the list of software for installation in the memory and the software present in the memory. The install targets are downloaded to a backup partition of the memory. Updating of the software in the memory is caused based on the install targets. The purge targets are deleted from the memory. The install targets are deleted from the back-up partition.

Abstract: A novel software updating method is provided. A target file is divided into segments, where some segments are updated by patching, while other segments are updated by archiving. The segmentation of the update allows very large files such as DYLD shared caches to be patched in-place, i.e., by using free space available within the file to perform patching rather than requiring enough free space on disk to store both the new version and the old version of the file. The segmentation of the update also allows each segment to be updated individually by the most optimal update method (copy, patch, or archive) so that the size of the update file can be minimized.

Abstract: According to various embodiments, a communication method may be provided. The communication method may include: generating a hint on solving a situation in an electronic game; and transmitting the hint to a server configured to provide the hint to gamers playing the electronic game.

Abstract: Disclosed herein are methods, systems, and processes for determining a rigidity associated with a dependent application, wherein the rigidity can be a hard rigidity, a firm rigidity, or a soft rigidity, and wherein these rigidities refer to the dependency between the dependent application and a dependee application. In response to detecting a failure of the dependee application, the disclosure provides for performing an appropriate action with respect to the dependent application, wherein that action is based, at least in part, on the rigidity associated with the dependent application. In certain embodiments, the appropriate action can further be based on a locality parameter associated with the dependent application.

Abstract: In a network management system communicatively coupled to a plurality of domains, each domain has a plurality of resources including physical resources and/or virtual resources executed on corresponding computing devices, each domain provides a plurality of services including one or more of computing services, storage services, network services, and combinations thereof via the plurality of resources, systems and methods include identifying a collection of the plurality of resources and/or the plurality of services as a fusion object; managing the fusion object via a set of Application Program Interfaces (APIs) to perform management of the collection as a single manageable entity; and updating the fusion object based on one or more of network topology changes in the plurality of domains, resource changes in the plurality of domains, and service changes in the plurality of domains.

Abstract: According to one embodiment, a method comprises automatically uploading device information from a first network device in a first operating state to a second network device in response to an event, such as an initial power up. The second network device is part of the cloud, and thus, providing cloud-based services. Subsequent to the uploading of the device information, the first network device receives information controlling the operation of the first network device based on the device information.

Abstract: A method includes creating, in a secure platform, multiple securely-partitioned system sandboxes under control of at least one user associated with an industrial process control and automation system. Different system sandboxes are associated with different third parties who are not owners or operators of the industrial process control and automation system. The method also includes receiving content from the third parties in the system sandboxes. The method further includes receiving from the at least one user a selective activation of at least some of the content in the system sandboxes in order to place the at least some of the content into use by the industrial process control and automation system. The content could include equipment configurations for equipment associated with the industrial process control and automation system, and the equipment configurations could include control strategies and visualizations for the equipment.

Abstract: In some examples, a system receives input information for an application, the input information comprising a specification of a performance parameter relating to the application, and information of an arrangement of components of the application. The system generates, based on the input specification of the parameter and the information of the arrangement of components of the application, a plurality of configuration options representing respective different sets of resources, where a first set of resources of the different sets of resources includes resources of a plurality of cloud environments from different cloud providers. The system selects, based on a target goal, a configuration option of the plurality of configuration options, and output deployment information to cause deployment of the selected configuration option.

Abstract: Certain exemplary embodiments relate to entertainment systems and, more particularly, certain exemplary embodiments relate to jukebox systems that incorporate digital downloading jukebox features along with karaoke jukebox and/or photo booth features. A combined karaoke/photo booth/jukebox may enable more integrated performance-like experiences in an in-home or out-of-home location or venue. By leveraging vast audio media libraries, trusted rights-respecting network infrastructure, and on-site image/video capturing from integrated recorders and/or remote portable devices, a more sociable experience may be created for karaoke jukebox patrons, e.g., where custom content can be generated and shared in a safe and legally appropriate manner.

Abstract: Portable packages containing encodings of processes are applied to software stacks. The packages are portable and distinct from the software stacks. The packages may be in the form of declarative code for configuring the software stack and can be plugged into the software stack to allow the technology stack to play the packages, thereby configuring the stacks to be capable of automating the processes encoded by the packages. An application or software component can be provided to read a package and apply parts thereof to appropriate corresponding software stack components.

Abstract: Techniques for automatic rule based grouping of compute nodes for a global optimal cluster are disclosed. In one embodiment, a virtual infrastructure management (VIM) server may obtain a list of operating, provisioned and/or about to be provisioned compute nodes in a cluster. The VIM server may then obtain user configured and run-time network parameters of a network interface card (NIC) of each compute node in the list. Further, the VIM server may then measure round-trip times (RTTs), using a ping, between each compute node and each of remaining compute nodes in the list. Furthermore, the VIM server may then group the compute nodes in the list based on the obtained user configured and run-time network parameters and/or the measured RTTs. In addition, the VIM server may perform a high availability (HA) operation in the cluster using the grouped compute nodes.

Abstract: Sub-components assembled into a computer are selected based on sub-component power efficiency levels (for example, low, medium, high) and/or anticipated usage of the computer. Multiple units of each type of sub-component (for example, a CPU) are tested to determine a power efficiency level of each unit. Computers in which sub-component efficiency levels are desired to match an overall computer efficiency level, receive sub-component units of corresponding efficiency level. Computers anticipated to run applications that make intensive use of a given type of sub-component receive the given units having a higher efficiency level. Computers anticipated to run applications that make little use of a given type of sub-component receive a physical unit having a lower efficiency level. Computers anticipated to run a wide variety of applications of no particular usage intensity for a given type of sub-component, receive a unit having an average efficiency level.

Abstract: Systems, methods, and computer-readable media for determining a deployment model for deploying rules in a network environment in response to deployment of a contract into the network environment. In some embodiments, a method can include deploying a contract into a network environment. One or more candidate deployment configuration variables can be selected and policy configurations for deploying rules in the network environment as part of implementing policies using the contract can be determined based on the one or more candidate deployment configuration variables. Rule configuration states corresponding to the policy configuration states in the network environment can be identified based on deployment of the one or more contracts in the network environment. Subsequently, a deployment model for implementing the one or more policies in the network environment can be formed based on the policy configurations and the rule configuration states corresponding to the policy configurations.

Abstract: A storage device includes a reconfigurable logic circuit, a control logic circuit, and non-volatile memory. The reconfigurable logic circuit is changeable from a first accelerator to a second accelerator during an operation of the storage device. The control logic circuit is configured to receive, from the host, a host command including information about a function required by the host and dynamically reconfigure the reconfigurable logic circuit such that the reconfigurable logic circuit performs the function according to the received host command. The non-volatile memory is connected to the control logic circuit.

Abstract: Embodiments for automatic diagonal scaling of workloads in a distributed computing environment. For each of a plurality of resources of each of a plurality of application instances, a determination as to whether a change in allocation of at least one of the plurality of resources is required. Operations requirements are computed for each of the plurality of application instances, the computed requirements including vertical increase and decrease operations, and horizontal split and collapse operations. The vertical decrease and horizontal collapse operations are first processed, the vertical increase and horizontal split operations are ordered, and the vertical increase and horizontal split operations are subsequently processed based on the ordering, thereby optimizing application efficiency and utilization of the plurality of resources in the distributed computing environment.

Abstract: A content consumption monitor (CCM) generates intent data that identifies topics of real-time interest to users. The CCM uses the intent data to direct information to more interested audiences and reduce the information noise/overload that may prevent users from viewing information. This targeted information may increase user conversion rates for seminars, advertising, documents downloads, or any other activity associated with published information. In one example, the CCM generates the intent data from third party content. Using a wide variety of third party content enables the CCM to better identify current user interests. The CCM may aggregate the intent data for different demographics, such as for companies, job positions, age, gender, or geographic locations.

Abstract: Systems and method are provided for testing an infrastructure. The infrastructure may include one or more computers connected by a network. Moreover, each of the computers may include an agent. In one embodiment, the method includes receiving, at a controller, a test request to perform at least one of a plurality of predetermined tests, the predetermined test including one or more parameters associated with performing the predetermined test and one or more expected results from performing the predetermined test. The method further includes determining whether the predetermined test is available at one of the computers. The method also includes sending, by the controller, the predetermined test to one of the computers based on the results of the determining step, such that the agent at the computer performs the predetermined test sent by the controller. Furthermore, the method includes receiving, at the controller, one or more results of the predetermined test performed by the agent at the computer.

Abstract: Methods, systems, and computer programs, for estimating think times. One of the methods includes receiving a request to perform a test of one or more computing resources. The test of the one or more computing resources is performed by simulating an interaction of one or more simulated users with the one or more computing resources. Requests are submitted from the simulated user for execution by the one or more computing resources. Respective response times of the one or more computing resources to each of the requests are measured. An estimated think time of the simulated user is computed, wherein the estimated think time is computed based on at least one preceding response time.

Abstract: A service deployment manager may receive a service request that includes data identifying a service to be deployed in a cloud computing environment, data identifying an execution environment in which the service is to be deployed, data identifying a framework on which the service is to be deployed, and data identifying a version strategy to be applied to the service. The service deployment manager may receive data identifying a user account associated with the service request, and may determine that the user account has permission to deploy the requested service. The service deployment manager may identify a service template, based on the service, that specifies a virtual hardware configuration, and may provide, to a service deployment platform, instructions to deploy the service using the virtual hardware configuration. The instructions may include the data identifying the execution environment, the data identifying the framework, and the data identifying the version strategy.

Abstract: Techniques for analyzing, understanding, and remediating differences in configurations among many software resources are described herein. Machine learning processes are applied to determine a small feature set of parameters from among the complete set of parameters configured for each software resource. The feature set of parameters is selected to optimally cluster configuration instances for each of the software resources. Once clustered based on the values of the feature set of parameters, a graph is generated for each cluster of configuration instances that depicts the differences among the configuration instances within the cluster. An interactive visualization tool renders the graph in a user interface, and a management tool allows changes to the graph and changes to the configuration of one or more software resources.

Abstract: In one set of embodiments, methods, systems, and apparatus are provided to attach one or more service policies to resources in an enterprise by receiving a first service policy, receiving a first policy attachment that identifies one or more policy attachment attributes of resources in the enterprise, and generate a first global policy attachment that references the first policy attachment and the first service policy. The method can include receiving a request to access a resource including an attribute that matches one of the policy attachment attributes. The method can include determining that the first service policy is an effective policy for the resource based on the matching resource attribute with the policy attachment attribute. The method can include controlling access to the resource responsive to the request using the effective policy.

Abstract: Systems, methods, and other embodiments associated with modifying a computer-implemented service are described. In one embodiment, a method includes constructing pre-provisioned instances of a service within a first pool and constructing pre-orchestrated instances of the service within a second pool. In response to receiving a request to modify the service, a POM instance of the service is created with a modified version of executable code and assigned to a third pool. The pre-orchestrated instances within the second pool are then replaced using the POM instances from the third pool.

Abstract: In a computer-implemented method for automatic network configuration of a pre-configured hyper-converged computing device network configuration information is requested from another pre-configured hyper-converged computing device already configured on a network. The network configuration information is received from the another pre-configured hyper-converged computing device. The network configuration is automatically performed by the pre-configured hyper-converged computing device such that the pre-configured hyper-converged computing device is automatically configured to the network.

Abstract: A provider network may implement dynamic port bandwidth for dedicated physical connections to the provider network. A dedicated physical connection to the provider network may be established with a reserved port bandwidth according to which a client network may access resources implemented in the provider network. Utilization of the reserved port bandwidth for the dedicated physical connection may be monitored. A bandwidth modification event may be detected, and in response to detecting the bandwidth modification event, provider network routing may be modified to modify the reserved port bandwidth for the dedicated physical connection to the provider network. The resources in the provider network may then be accessed according to the adjusted reserved port bandwidth.

Abstract: Communication network architectures, systems and methods for supporting a network of mobile nodes. As a non-limiting example, various aspects of this disclosure provide communication network architectures, systems, and methods for supporting a dynamically configurable communication network comprising a complex array of both static and moving communication nodes (e.g., the Internet of moving things).

Abstract: Aspects of the present disclosure include systems and methods for injecting content into a webpage at or local to a network access gateway. For example, in an embodiment, a network access gateway is provided for accessing the internet. A user logs onto the internet through the network access gateway and request a webpage. The gateway requests the webpage from the webpage provider. Before the gateway delivers the webpage to the user, the gateway, or a content injection engine local to the gateway, injects content, such as, for example, advertisements or other useful information, into the webpage and then sends the altered webpage to the user.

Abstract: A method includes configuring worker services to operate in a stateless manner and providing support services that enable the worker services to operate in the stateless manner. The support services include (i) a management service for providing notifications of server removal and addition, (ii) a state maintenance service for maintaining state information in a central location, and (iii) a load balancer service for distributing requests among worker services. The method includes altering a number of servers allocated to at least one worker service, responsive to a notification from the management service. A private protocol is used between the worker services and load balancer service (a) to send, from the worker services to the load balancer service, a respective pointer to the state information associated with the requests, and (b) to include the respective pointer in the requests when any of the requests are forwarded to any worker service.

Abstract: Systems and methods are provided for multilayered compliance management for cloud environments. In some embodiments, the method includes providing, in a domain of a customer, an environment operations layer, the environment operations layer controlling a plurality of sensors and actuators within a cloud environment of the customer; providing a controls layer, the controls layer comprising a plurality of controls to control the sensors and actuators in accordance with one or more compliance rules; and providing a user interface in a domain outside the domain of the customer, the user interface comprising a plurality of management tools to manage the controls.