Abstract: A secret is securely maintained on a virtualized computer system by configuring a specialized virtual machine to manage and maintain the secret on behalf of an application. When the application requests access to the secret, a controlling domain, in combination with the specialized virtual machine, validates that the application is authorized to make the request and that the application has not been compromised prior to making the request. If the request is validated, the controlling domain and the specialized virtual machine fulfill the request by providing the application with access to the secret.

Abstract: Techniques for improving efficiency of data processing associated with data queries are described. For example, a computer system may access a first query result of a first time window that result may have been generated based on first transformed data stored in data partitions associated with the first time window. The computer system may access data corresponding to a time unit that falls outside of the first time window and inside a second time window. The first time window and the second time window may have overlapping time units. The computer system may generate a data partition that corresponds to the time unit and that stores second transformed data. The second transformed data may correspond to a data transformation of the data. The computer system may generate a second query result for the second time window based on the second transformed data and the first query result.

Abstract: A method for selective transmission of audio data to a speech processing server uses detection of an acoustic trigger in the audio data in determining the data to transmit. Detection of the acoustic trigger makes use of an efficient computation approach that reduces the amount of run-time computation required, or equivalently improves accuracy for a given amount of computation, by using a neural network to determine an indicator of presence of the acoustic trigger. In some example, the neural network combines a “time delay” structure in which intermediate results of computations are reused at various time delays, thereby avoiding computation of computing new results, and decomposition of certain transformations to require fewer arithmetic operations without sacrificing significant performance.

Abstract: A method and system for processing multiple frames of a video by a neural network are provided. Two frames of a video may be analyzed to determine if at least a portion of the layer-by-layer processing by a neural network can be skipped or terminated. Processing of a first frame of the video is performed by the neural network. A next frame of the video is processed by the neural network, such that processing of fewer layers (or sets of operations) of the neural network is performed if the first frame and the second frame are substantially similar.

Abstract: Failed write handling can be implemented at a memory controller for non-volatile memory. Failure of a write to a storage location in the non-volatile memory may be detected. An indication of the failure may be sent to a microcontroller for the non-volatile memory which may return an instruction to write to a different location in the non-volatile memory. Reads and writes to the storage location of the failed write may still be allowed, in some embodiments, by redirecting the reads and writes to a copy of data of the failed write stored in a copy buffer in the memory controller.

Abstract: Techniques are disclosed for mitigating against registering a domain name that is confusingly similar to a pre-existing domain name, possibly for the purpose of fooling users. In embodiments, a domain name is presented for registration. The domain name is rendered as an image, and optical character recognition is performed on the image to extract the rendered text. This extracted text is compared against a list of domain names for which confusingly similar domain names cannot be registered, and when the extracted text matches a domain name in this list of domain names, registration of the domain name is denied.

Abstract: A virtual hardware security module (“HSM”) is used to perform cryptographic operations. The virtual HSM may provision and coordinate requests between one or more HSMs within a fleet of HSMs. A set of cryptographic keys and/or digital certificates may be exchanged between a client and the virtual HSM such that the client and the virtual HSM may communicate with each other via a cryptographically protected communication session. The fleet of HSMs of a virtual HSM may be scaled up or scaled down according to various criteria. Cryptographic key material may be propagated between HSMs of the fleet using a fleet transfer key. Digital certificates may be used to demonstrate that one or more cryptographic keys were generated by a service provider and/or manufacturer.

Abstract: Methods, systems, and computer-readable media for exporting dialog-driven applications to digital communication platforms are disclosed. A launch condition is received from a user. The launch condition is caused to be registered with one or more digital communication platforms. Detection of the launch condition is to cause a natural language input to be routed from at least one of the digital communication platforms to an application management service.

Abstract: A cache or other cluster is configuration-aware such that initialization and changes to the underlying structure of the cluster can be dynamically updated for use by a client. A client may use a client driver as an intermediary that is responsible for managing the communication with the cluster. For example, a client driver may resolve an alias from a static configuration endpoint to a storage node. The client driver may request an initial configuration from the storage node and then update configuration from one or more storage nodes that store current configuration of the cluster.

Abstract: Functionality is disclosed for automated deployment of applications. A network-based deployment service provides functionality for deploying software components to physical or virtual hosts in a service provider network and/or to hosts in other types of networks external to the service provider network. A user of the deployment service creates an application revision that includes deployable content and an application specification defining how the application is to be deployed and one or more lifecycle events. The application revision is then uploaded to a storage service, source code repository, or other location. A deployment configuration is also created that defines the location of the application revision, a deployment group, and a schedule for the deployment. A deployment agent executing on hosts in the deployment group obtains the application revision from the specified location, deploys the deployable content according to the schedule, and performs the lifecycle events.

Abstract: A destination server communicates with a computer system using cryptographically protected communications utilizing a first negotiable feature. The destination server detects a triggering event and, in response to the triggering event, causes the cryptographic protected communications with the computer system to change from the first negotiable feature to a second negotiable feature. As a result of stored data indicating that the computer system fails to support the second negotiable feature, the destination server initiates a security measure.

Abstract: A method for selective transmission of audio data to a speech processing server uses detection of an acoustic trigger in the audio data in determining the data to transmit. Detection of the acoustic trigger makes use of an efficient computation approach that reduces the amount of run-time computation required, or equivalently improves accuracy for a given amount of computation, by combining a “time delay” structure in which intermediate results of computations are reused at various time delays, thereby avoiding computation of computing new results, and decomposition of certain transformations to require fewer arithmetic operations without sacrificing significant performance. For a given amount of computation capacity the combination of these two techniques provides improved accuracy as compared to current approaches.

Abstract: A network device is described that injects probes for exercising its own forwarding rules (e.g., layer 2 and layer 3). One or more probe packets can be injected into an ingress pipeline of the network device using the agent executing on a local processor. The probes are detected before or after performing at least layer 2 and layer 3 lookups. Hardware in switching logic redirects the probes to an external testing system in order to verify the actual forwarding behavior applied to the probe packet. In order to deliver the probes to the external server, the network device performs an additional layer 3 lookup and generates an encapsulated packet incorporating results of a lookup on the probe packet. In this way, the external server can analyze the lookup on the probe packet to determine whether the lookup was performed correctly.

Abstract: A packing service for packing objects into containers is disclosed. An image-capture device may capture an image of a container and the image may be used to determine the volume of the container. Contextual information associated with the container may be determined, such as objects already in the container, a destination for the container, or objects to be placed into the container, for example. The contextual information may be obtained from the image or from any of various services or systems. Items to be placed into the container are determined, based on the contextual information, for example. Recommendations to purchase items to pack into the container may be made. Recommendations of how to pack or arrange the items into the container may also be made. Additional images of the container may be captured and analyzed to determine whether the packing recommendations were followed or to determine additional recommendations.

Abstract: The present disclosure is directed to controlling, reducing, and/or altering sound generated by an aerial vehicle, such as an unmanned aerial vehicle (“UAV”), while the aerial vehicle is airborne. For example, one or more transducers, such as piezoelectric thin-film transducers, or carbon nanotube transducers may be applied or incorporated into or on the surface of propeller blades that are used to aerially navigate the aerial vehicle. As the propeller blade rotates and generates sound, the transducers may be activated to generate one or more anti-sounds that cancel, reduce, or otherwise modify the sound generated by the rotation of the propeller blade. The anti-sound combines with the sound and causes interference such that the combined, or net-effect, is an overall cancellation, reduction, or other modification of the sound.

Abstract: A key-value store is adapted to represent hierarchical structures, such as directory structures, to be associated with objects otherwise mapped to a flat keyspace. For example, one or more key-value pairs stored in the key-value store are designated to have a key indicating the name of a hierarchical structure, and an associated value that maps the structure to a namespace (e.g., of a group of objects to be associated with a directory). Inbound requests for operations related to the objects in a given namespace and defining the structure are checked against such “redirecting” key-value pairs, as well as one or more policies associated with the structure, the namespace, the key-value pairs, or some combination thereof, to determine whether the structure is related to the namespace objects and whether one or more requested actions are authorized against that structure.

Abstract: A virtual computer system service receives a request from a customer to instantiate a virtual machine instance onto a computing device. The virtual computer system service obtains a set of preferences from the request that can be used for selecting the computing device from a variety of data zones. The virtual computer system service identifies one or more data zones where virtual machine instances of the customer are operating. Based on the set of preferences and the one or more data zones where the virtual machine instances are operating, the virtual computer system service selects a data zone where the virtual machine instance can be instantiated. The virtual computer system service uses a computing device in the selected data zone to instantiate the virtual machine instance.

Abstract: A system and method for monitoring the performance associated with fulfilling resource requests are provided. One or more client computing devices obtain an original resource request and associate a record identifier with the original resource request. The one or more client computing devices also determine performance data associated with processing each embedded resource request included in a response to the original resource request. Each embedded resource request is associated with a component record identifier that is associated with, but different from, the record identifier of the original resource request. The one or more client computing devices can then transmit the determined performance data with the record identifier to another processing device.

Abstract: Apparatuses, systems, and methods for garment property determination are disclosed. One or more movable portions of a mannequin are adjusted, thereby causing the mannequin to change from a first size to a second size. Signals are received from one or more sensors of the mannequin, and pressure readings applied to at least one location on an exterior surface of the mannequin are determined from the signals. Data that correlates at least a first pressure reading with the first size of the mannequin and that correlates at least a second pressure reading with the second size of the mannequin are stored.

Abstract: According to an embodiment of the invention there may be provided a method for hybrid remote direct memory access (RDMA), the method may include: (i) receiving, by a first computer, a packet that was sent over a network from a second computer; wherein the packet may include data and metadata; (ii) determining, in response to the metadata, whether the data should be (a) directly written to a first application memory of the first computer by a first hardware accelerator of the first computer; or (b) indirectly written to the first application memory; (iii) indirectly writing the data to the first application memory if it determined that the data should be indirectly written to the first application memory; (iv) if it determined that the data should be directly written to the first application memory then: (iv.a) directly writing, by the first hardware accelerator the data to the first application memory without writing the data to any buffer of the operating system; and (iv.