Abstract: Systems and methods are provided for authentication and authorizing a client device on a network. First, one or more packets are received from a computing entity indicating an authentication request from a client device requesting connection at a network. Next, identification information of the client device are extracted from a body of the packets. Credentials of the client device are verified based on the identification information. In response to verifying the credentials, a level of access of the client device at the network is determined. Based on the level of access, a VLAN is assigned to the client device. The systems concurrently transmit, in a single packet, to the computing entity, an indication of approval of the credentials and the assigned VLAN, wherein the computing entity provisions the assigned VLAN to the client device following an allocation of an IP address corresponding to the assigned VLAN to the client device.

Abstract: Example implementations relate to connecting an IoT device to a wireless network using Device Provisioning Protocol (DPP). An authentication server receives a DPP network access authorization request including a connector identifier from an Access Point (AP) in communication with the IoT device. The connector identifier is a hash of the public network access key of the IoT device. If the connector identifier is valid, the authentication server determines a configurable policy from a set of configurable policies that is applicable to the IoT device. The authentication server transmits network permissions defined in the configurable policy to the AP. The IoT device is connected to the wireless network by the AP based on the network permissions.

Abstract: Implementations of the present disclosure relate to resource allocation for clients of multiple co-hosted virtual access points (VAPs). A method comprises determining, by an access point (AP), a plurality of trigger frames for a plurality of clients connected to a plurality of VAPs of the AP based at least in part on respective workload levels of the plurality of clients. A trigger frame indicates a resource unit of one of the plurality of VAPs available for at least one corresponding client to access to the VAP. The method also comprises transmitting, by the AP, the plurality of trigger frames in parallel to the plurality of clients. By transmitting separate trigger frames for different clients in parallel, the efficiency of trigger frames can be improved and higher quality of service and lower collision will be provided.

Abstract: A dynamic BSS color feature for co-hosted virtual access points is described. An example of a storage medium includes instructions to operations including enabling, by an access point, a dynamic basic service set (BSS) color feature for operation with multiple virtual access points (VAPs) hosted by the access point; switching a parameter of the access point to indicate that no co-hosted BSS is present; assigning a different BSS color to each of the VAPs; performing access point operations, including utilizing the assigned BSS colors for transmissions relating to any of the VAPs; and disabling the dynamic BSS color feature upon occurrence of one or more conditions.

Abstract: Example implementations relate to partial file system instances. In an example, a subset of objects of a source file system instance on a source system are replicated to a target system to form a partial file system instance on the target system comprised of the subset of objects. Each of the objects of the source file system instance is identified by a signature based on content of each of the objects and the objects exhibit a hierarchical relationship to a root object in the file system instance. An unmaterialized object is dynamically added to the partial file system instance by replicating the corresponding object from the source file system instance. The target system is asynchronously updated from the source file system instance based on a comparison of the partial file system instance to the source file system instance.

Abstract: In some examples, a system creates a training data set based on features of sample workloads, the training data set comprising labels associated with the features of the sample workloads, where the labels are based on load indicators generated in a computing environment relating to load conditions of the computing environment resulting from execution of the sample workloads. The system groups selected workloads into a plurality of workload clusters based on features of the selected workloads, and computes, using a model trained based on the training data set, parameters representing contributions of respective workload clusters of the plurality of workload clusters to a load in the computing environment. The system performs workload management in the computing environment based on the computed parameters.

Abstract: Systems and methods are provided for receiving, from an access point, attributes of an Internet of Things (IoT) device connected to the access point, determining a stored device, in a database of a server, sharing a subset of the attributes of the IoT device, and generating a code bundle based on the subset of the shared attributes between the stored device and the IoT device.

Abstract: Systems and methods are provided for detecting changes in network activity that are depicted in a routing table. The routing table may be stored as a search tree data structure (e.g., Merkle Patricia Tree) to mimic a standard routing table and reduce the search time to find the desired route by allowing the router to traverse the search tree data structure more efficiently. Additionally, the metadata of the tree may be provided to an unstructured machine learning model (e.g., K-means) to identify new clusters of routes week-over-week and generate an alert with any changes. Changes are identified in near real time and dynamically at the router (not a central device) to reduce the time needed to respond to network changes.

Abstract: Example implementations relate to system and method of determining readiness of a datacenter environment for deploying a production system in a virtualized environment of the datacenter environment. The method includes receiving a parameter data of a device controller, and a first configuration data of computing devices from the device controller that manages deployment and configuration of the virtualization environment, and a second configuration data of networking switches. Further, the method includes validating the parameter data, and the first and second configuration data by comparing against a predetermined data required for deploying the production system. The method further includes performing connectivity test among the computing devices.

Abstract: Examples disclosed herein include accessing, by a host device, device information corresponding to an intermediate communication device communicatively coupled to the host device. Identifying, by the host device, a unique identifier corresponding to the intermediate communication device from the accessed device information. Query, by the host device, a public key from a remote resource, based on the identified unique identifier. Receiving, by the host device, the public key from the remote resource. Authenticating, by the host device, the intermediate communication device based on the received public key and a private key stored in the intermediate communication device.

Abstract: Embodiments described herein are generally directed to a cloud-native approach to software license enforcement in a container orchestration system. According to an example, information indicative of a number of sets of containers that are making use of one or more components of an application is received. The application is licensed by the tenant and the sets of containers are running within a namespace of the tenant within a cluster of a container orchestration system. Overuse of the application by the tenant is determined based on whether the number exceeds a licensing constraint for the application specified within an Application Programming Interface (API) object of the container orchestration system corresponding to the application. Responsive to a determination that the application is being overused by the tenant, the tenant is caused to be notified regarding the overuse.

Abstract: A system for facilitating remote reachability checks for a switch. During operation, the system can receive one or more control messages from a management platform. Here, a respective control message can include one or more type-length-value (TLV) data structures. If the system identifies a first TLV data structure associated with validation in a first control message, the system can determine a validating plane based on a value of the first TLV data structure. The system can then validate the first control message at the validating plane. Upon identifying, in a second control message, a second TLV data structure associated with a plurality of parameters for a request in the second control message, the system can determine a subset of active parameters from the plurality of parameters based on an indicator in the second TLV data structure. The system can then process the request based on the subset of active parameters.

Abstract: As a part of a networking system, a Smart Network Interface Card (NIC)/Data Processing Unit (DPU) translation agent can be implemented by a device within a Smart NIC/DPU. The Smart NIC/DPU translation agent translates operation requests associated with a vendor-neutral API method into a vendor-specific API method, e.g., to communicate with vendor-specific firmware. The agent comprises an orchestration unit for detecting an operation request from an external entity having vendor-neutral API; and translating the operation request based upon a fabric data model; a configuration service unit for generating management commands based on the modified operation request; and a proxy service unit for receiving and translating the configuration commands to communicate with vendor-specific firmware using the vendor-specific API method.

Abstract: Examples described herein relate to maintaining a reliable connection between a client device and an access point (AP). Based on the data frames exchanged between the AP and a client device of a plurality of client devices communicatively coupled to the AP after the client device is connected to the AP, the AP may determine whether a client device is experiencing performance issues with respect to a wireless communication feature. In response to determining that the client device is experiencing performance issues with respect to the wireless communication feature, the AP may disable the wireless communication feature for the client device. Further, the AP may continue to exchange data frames with the client device without offering the wireless communication feature. Further, the AP continues to offer the wireless communication feature to another client device of a plurality of client devices not facing the performance issue related to the wireless communication feature.

Abstract: Example techniques for granting permissions for performing an operation related to a backup copy are described. The backup copy corresponds to first device data and the first device data is stored in a first device. In an example, in response to receiving a request to perform the operation related to the backup copy, telemetry data received from the first device is analyzed. Based on the analysis, it is determined that security of the first device is uncompromised. Based on the determination, a permission to perform the operation related to the backup copy is granted.

Abstract: The disclosure relates to a framework for dynamic management of analytic functions such as data processors and machine learned (“ML”) models for an Internet of Things intelligent edge that addresses management of the lifecycle of the analytic functions from creation to execution, in production. The end user will be seamlessly able to check in an analytic function, version it, deploy it, evaluate model performance and deploy refined versions into the data flows at the edge or core dynamically for existing and new end points. The framework comprises a hypergraph-based model as a foundation, and may use a microservices architecture with the ML infrastructure and models deployed as containerized microservices.

Abstract: Predictive big data capacity planning is described. An example includes instructions for receiving workload data and computing operation data related to workload processing for a customer in a computing infrastructure, the computing infrastructure including one or more clusters, the one or more clusters including one or more data nodes; analyzing the received data to identify relationship information between the workload data and the computing operation data; performing predictive analytics to identify a significant value that relates to performance variations in workload performance or usage pattern characteristics for data growth scale factors in the computing infrastructure; generating a knowledge base based at least in part on the predictive analytics; training a machine learning model based at least in part on the knowledge base; and utilizing the trained machine learning model to generate a computing infrastructure configuration recommendation for the customer.

Abstract: Systems and methods are provided for compressing a time-series dataset from a monitored device into a compressed dataset representation. Using an unsupervised machine learning model, the system may group a contiguous set of datapoints of the time-series dataset and group, using a distance algorithm, the first cluster to a first motif. Many motifs can be generated to identify different data signatures in the time-series dataset. The plurality of motifs can be used to generate a data definition, motif sequence graph, directed graph, or other combinations of datapoints. These datapoints can be combined through a summation process with other datapoints generated by a second machine learning model. The output of the summation process can be used to forecast device usage of a monitored device in a data center.

Abstract: The present disclosure describes dynamic intrusion detection and prevention in computer networks. The method includes generation of clusters of network sites based on a plurality of parameters related to operational features and network threats associated with the network sites. Data models are trained upon the clusters developed through the clustering. The data models are executed to predict a threat frequency of each network threat for each cluster. A difference between the predicted threat frequency of each network threat and corresponding baseline frequencies is determined. Dynamic rulesets are configured, based on the difference between the predicted threat frequency of each network threat and the corresponding baseline frequencies, for each cluster by integrating rules applicable to prevent each network threat.

Abstract: Examples described herein provide ranging by a network device during a beacon interval. Examples described herein may discover, by a network device during a first beacon interval, a plurality of APs in a network that are capable of ranging and a received signal measurement of each of the plurality of APs. Examples described herein may select, by the network device, an AP with a strongest received signal measurement among the plurality of APs, determine, by the network device, whether the selected AP is available for ranging, and based on a determination that the selected AP is available for ranging, initiate, by the network device during a second beacon interval, ranging measurements with the selected AP to generate a ranging result. Examples described herein may, based on the ranging result, resolve locations of the plurality of APs.