Abstract: Systems and processes are described for establishing and using a secure channel. A shared secret may be used for authentication of session initiation messages as well as for generation of a private/public key pair for the session. A number of ways of agreeing on the shared secret are described and include pre-sharing the keys, reliance on a key management system, or via a token mechanism that uses a third entity such as a hub to manage authentication, for example. In some instances, the third party may also perform endpoint selection (e.g., load balancing) by providing a particular endpoint along with the token.

Abstract: A multitenant solver execution service provides managed infrastructure for defining and solving large-scale optimization problems. In embodiments, the service executes solver jobs on managed compute resources such as virtual machines or containers. The compute resources can be automatically scaled up or down based on client demand and are assigned to solver jobs in a serverless manner. Solver jobs can be initiated based on configured triggers. In embodiments, the service allows users to select from different types of solvers, mix different solvers in a solver job, and translate a model from one solver to another solver. In embodiments, the service provides developer interfaces to, for example, run solver experiments, recommend solver types or solver settings, and suggest model templates. The solver execution service relieves developers from having to manage infrastructure for running optimization solvers and allows developers to easily work with different types of solvers via a unified interface.

Abstract: Techniques are described for providing users with access to computer networks, such as to enable users to interact with a remote configurable network service in order to create and configure computer networks that are provided by the configurable network service for use by the users. Computer networks provided by the configurable network service may be configured to be private computer networks that are accessible only by the users who create them, and may each be created and configured by a client of the configurable network service to be an extension to an existing computer network of the client, such as a private computer network extension to an existing private computer network of the client. If so, secure private access between an existing computer network and new computer network extension that is being provided may be enabled using one or more VPN connections or other private access mechanisms.

Abstract: A data service implements a configurable data compressor/decompressor using a recipe generated for a particular data set type and using compression operators of a common registry (e.g., pantry) that are referenced by the recipe, wherein the recipe indicates at which nodes of a compression graph respective ones of the compression operators of the registry are to be implemented. The configurable data compressor/decompressor provides a customizable framework for compressing data sets of different types (e.g., belonging to different data domains) using a common compressor/decompressor implemented using a common set of compression operators.

Abstract: Techniques are described for providing a policy refiner application used to analyze and recommend modifications to identity and access management policies created by users of a cloud provider network (e.g., to move the policies toward least-privilege permissions). A policy refiner application receives as input a policy to analyze, and a log of events related to activity associated with one or more accounts of a cloud provider network. The policy refiner application can identify, from the log of events, actions that were permitted based on particular statements contained in the policy. Based on field values contained in the corresponding events, the policy refiner application generates an abstraction of the field values, where the abstraction of the field values may represent a more restrictive version of the field from a policy perspective. These abstractions can be presented to users as recommendations for modifying their policy to reduce the privileges granted by the policy.

Abstract: A multitenant solver execution service provides managed infrastructure for defining and solving large-scale optimization problems. In embodiments, the service executes solver jobs on managed compute resources such as virtual machines or containers. The compute resources can be automatically scaled up or down based on client demand and are assigned to solver jobs in a serverless manner. Solver jobs can be initiated based on configured triggers. In embodiments, the service allows users to select from different types of solvers, mix different solvers in a solver job, and translate a model from one solver to another solver. In embodiments, the service provides developer interfaces to, for example, run solver experiments, recommend solver types or solver settings, and suggest model templates. The solver execution service relieves developers from having to manage infrastructure for running optimization solvers and allows developers to easily work with different types of solvers via a unified interface.

Abstract: Technologies to improve wireless communications by on-body products are described. One device includes millimeter wave (mmWave) frequency front-end circuitry and a baseband processor with an Orthogonal Frequency Division Multiplexing (OFDM) physical (PHY) layer. The baseband processor determines received signal strength indicator (RSSI) value and phase value associated with a wireless channel in a mmWave frequency range. The baseband processor determines a state of motion of the device using the RSSI value and the phase value. The baseband processor sends data to the second device using a first subcarrier structure of the OFDM PHY layer, in response to the state of motion being a first state of motion. The baseband processor sends data to the second device using a second subcarrier structure of the OFDM physical layer, in response to the state motion being a second state of motion having more motion than the first state of motion.

Abstract: At a managed control plane service, constituent services and operational requirements of an application are identified. In response to an end-user request directed to the application, contents of an inter-service request are generated at a resource selected by the managed control plane service for a first constituent service, and a response to the message is generated at another resource selected for a second constituent service. Tasks to be performed for the operational requirements are initiated by the managed control plane service.

Abstract: A system configured to improve sound source localization (SSL) processing by reducing a number of direction vectors and grouping the direction vectors into direction cells is provided. The system performs clustering to generate a smaller set of direction vectors included in a delay-direction codebook, reducing a size of the codebook to the number of unique delay vectors. In addition, the system groups the direction vectors into direction cells having a regular structure (e.g., predetermined uniformity and/or symmetry), which simplifies SSL processing and results in a substantial reduction in computational cost. The system may also select between multiple codebooks and/or dynamically adjust the codebook to compensate for changes to the microphone array. For example, a device with a microphone array fixed to a display that can tilt may adjust the codebook based on a tilt angle of the display to improve accuracy.

Abstract: Working set ratio estimations of data items in a sliding time window are determined to dynamically allocate storage for the data items. A working set ratio may be determined by accessing a fixed-size array that stores respective timestamps of last accesses of data items to determine which data items are useful to determine an estimate of a working set for the application within a range of time. The working set ratio is then determined from an estimated working set and an amount of computing resources allocated to the application by the estimated working set. The amount of the computing resources allocated to the application may then be automatically scaled according to the determine working set ratio.

Abstract: Techniques for planning resources using block and route information are described. In an example, a computing system determines a demand for item transportation expected during a planning horizon. The computing system determines information about a pre-planned transportation resource available during the planning horizon and costs associated with the pre-planned transportation resource. The computing system uses an optimization model to determine a block having a time length, a tour to transport, during the block, a first portion of the demand using the pre-planned transportation resource, and a second portion of the demand to be transported using an on-demand transportation resource. The computing system indicates, to a first computing device of the pre-planned transportation resource, an assignment of the block to the pre-planned transportation resource.

Abstract: Embodiments of a contextualized visual search (CVS) system are disclosed capable of isolating target images of items that contain instances of a previously-unseen query image from a large database of target images. In embodiments, the system is used to implement an interactive query interface of an e-commerce portal, which allows the user to specify the query image (e.g. a logo) to be searched. The system converts the query image into a feature vector using a first machine learning model, and compares the feature vector to feature vectors of target images using a second machine learning model to find matching target images that contain an instance of the query image. The system then returns a query result indicating a list of items associated with matched target images. In embodiments, the query results may be ranked based on a set of personalized factors associated with the user.

Abstract: Devices and techniques are generally described for determining named entity recognition tags. In various examples, first input data representing a natural language input may be determined. In some examples, a first machine learned model may determine first data comprising a first encoded representation of the first input data. In various examples, second data representing a grouping of text of the first input data may be determined based at least in part on the first data. In some examples, first entity data may be determined by searching a memory layer using the second data. In at least some examples, the first entity data and the first data may be combined to generate third data. In various examples, output data comprising a predicted named entity recognition tag may be generated for the grouping of text based at least in part on the third data.

Abstract: An Identity and Access Management Service implements persistent source values PSVs) for assumed identities. A source value (e.g., an original identifier of an entity) is persisted across assumed identities, facilitating identification of entities (users or applications) responsible for actions taken by the assumed (e.g., alternative) identities. The Manager receives a request to assume an identity. The request includes the entities current credentials and a PSV. The current credentials are authenticated and a persistent source value policy may be relied on to determine whether and/or how to grant the assumed identity. The PSV may be copied from credentials in the request in order to be included in the credentials for the requested identity that the Manager provides in response to the request. Use of the requested credentials, including the PSV, to access services or resources may be logged, the logs including the PSV from the request to assume the identity.

Abstract: An interruption-handling setting for a category of interactions of an application is determined via a programmatic interface. A set of user-generated input is obtained while presentation to a user of a set of output of the category is in progress. A response to the set of user-generated input is prepared based at least in part on the interruption-handling setting.

Abstract: This disclosure describes, in part, techniques for establishing network-based data communications (e.g., voice calls, video calls, etc.) between a user device of a user and a remote device of another user, and transitioning the data communications to a different user device of the user based on various types of information. In some examples, the user devices may be located in one or more environments of the user, and the data communications may be transitioned between the user devices based, at least in part, on a location of the user in the environment(s) relative to the multiple devices. For instance, if a user device is performing data communications with the remote device, but it is determined that the user has moved into a closer proximity to another user device, the performance of the data communications may be transitioned to the other user device to which the user is in closer proximity.

Abstract: A device include a first camera, a second camera, and a shutter assembly. The shutter assembly includes a switch, a link coupled to the switch and having a first cover, and an arm coupled to the link and having a second cover. Actuating the switch to a first position disposes the first cover within a first field of view of the first camera and the second cover within a second field of view of the second camera. Actuating the switch to a second position disposes the first cover outside of the first field of view and the second cover outside of the second field of view.

Abstract: Techniques and systems can receive a query identifying a name linked to performance data of a computer system and a location of the performance data. The name linked to the performance data of the computer system and the location of the performance data can be communicated to a first computer-implemented system. The first computer-implemented system can include identifying data derived from the name and the location of the performance data. Identifying data derived from the name and the location of the performance data can be received from the first computer-implemented system. The identifying data derived from the name and the location of the performance data can be used to retrieve the performance data. The performance data can be hosted by a second computer-implemented system that is different than the first computer-implemented system.

Abstract: Described herein is a system for predictive feature analysis to precompute and store data required to respond to a user input in advance of receiving the user input. To determine when to precompute the data, the system uses a prediction model to predict user interactions and when to expect the user input. The system predicts that a user input is about to be received, and starts to process certain data to determine feature data and stores the data in a cache. When the user input is received, the system retrieves the data from the cache for further processing to respond to the user input.

Abstract: Techniques for performing multi-stage entity resolution (ER) processing are described. A system may determine a portion of a user input corresponding to an entity name, and may request an entity provider component to perform a search to determine one or more entities corresponding to the entity name. The preliminary search results may be sent to a skill selection component for processing, while the entity provider component performs a complete search to determine entities corresponding to the entity name. A selected skill component may request the complete search results to perform its processing, including determining an output responsive to the user input.