Abstract: The current document is directed a resource-exchange system that facilitates resource exchange and sharing among computing facilities. The currently disclosed methods and systems employ efficient, distributed-search methods and subsystems within distributed computer systems that include large numbers of geographically distributed data centers to locate resource-provider computing facilities that match the resource needs of resource-consumer computing-facilities based on attribute values associated with the needed resources, the resource providers, and the resource consumers. The resource-exchange system monitors and controls resource exchanges on behalf of participants in the resource-exchange system in order to optimize resource usage within participant data centers and computing facilities.

Abstract: Example methods and systems for a network management entity to perform topology-aware control information dissemination in a software-defined networking (SDN) environment. The method may comprise obtaining group topology information specifying a network group, and a network configuration object that references the network group. The method may also comprise: processing the group topology information to identify, from multiple members of the network group, a first member that is relevant to a first host; and processing the group topology information to identify, from the multiple members, a second member that is irrelevant to the first host. The method may further comprise: generating and sending, to the first host, control information associated with a subset of the network group. The subset may include the first member but exclude the second member.

Abstract: Some embodiments provide a novel method for deploying different virtual networks over several public cloud datacenters for different entities. For each entity, the method (1) identifies a set of public cloud datacenters of one or more public cloud providers to connect a set of machines of the entity, (2) deploys managed forwarding nodes (MFNs) for the entity in the identified set of public cloud datacenters, and then (3) configures the MFNs to implement a virtual network that connects the entity's set of machines across its identified set of public cloud datacenters. In some embodiments, the method identifies the set of public cloud datacenters for an entity by receiving input from the entity's network administrator. In some embodiments, this input specifies the public cloud providers to use and/or the public cloud regions in which the virtual network should be defined. Conjunctively, or alternatively, this input in some embodiments specifies actual public cloud datacenters to use.

Abstract: An example method of determining operational health of a virtualized computing system includes: monitoring, at a service executing in the virtualized computing system, a current configuration of a software-defined data center (SDDC) with respect to a desired state, the desired state including: a host cluster having hosts executing a virtualization layer thereon; a software-defined (SD) network deployed in the host cluster; shared storage accessible by the host cluster; a virtual infrastructure (VI) control plane managing the host cluster, the SD network, and the shared storage; and an orchestration control plane integrated with the virtualization layer and the VI control plane; determining a configuration status for the current configuration of the SDDC; monitoring, at the service, operational status of an application management system executing on the SDDC having the current configuration; and determining at least one measure of the operational health in response to the configuration status and the operation

Abstract: The method of some embodiments allocates a secondary network interface for a pod, which has a primary network interface, in a container network operating on an underlying logical network. The method receives an ND that designates a network segment. The method receives the pod, wherein the pod includes an identifier of the ND. The method then creates a secondary network interface for the pod and connects the secondary network interface to the network segment. In some embodiments, the pods include multiple ND identifiers that each identify a network segment. The method of such embodiments creates multiple secondary network interfaces and attaches the multiple network segments to the multiple secondary network interfaces.

Abstract: Some embodiments of the invention provide a method for providing flow processing offload (FPO) for a host computer at a physical network interface card (pNIC) connected to the host computer. A set of compute nodes executing on the host computer are each associated with a set of interfaces that are each assigned a locally-unique virtual port identifier (VPID) by a flow processing and action generator. The pNIC includes a set of interfaces that are assigned physical port identifiers (PPIDs) by the pNIC. The method includes receiving a data message at an interface of the pNIC and matching the data message to a stored flow entry that specifies a destination using a VPID. The method also includes identifying, using the VPID, a PPID as a destination of the received data message by performing a lookup in a mapping table storing a set of VPIDs and a corresponding set of PPIDs and forwarding the data message to an interface of the pNIC associated with the identified PPID.

Abstract: In a computer-implemented method for configuring an appliance in a virtualization infrastructure via a graphical user-interface a list of hosts and a centralized management tool of the virtualization infrastructure is displayed via the graphical user-interface. The hosts are for hosting one or more virtual machines. The centralized management tool is for centrally managing the virtualization infrastructure. In response to selecting one of the hosts, displaying host configuration properties associated with the selected hosts via the graphical user-interface. The host configuration properties are associated with a displayed user input field.

Abstract: Disclosed are various examples of an action framework for configuring a gateway to perform actions on the gateway itself or in conjunction with connected IoT devices. In some examples, a command is transmitted from a management service to a gateway device to permit a gateway client application to execute on the gateway device. A command to register an action in association with the gateway client application is also transmitted. The management service then commands the gateway device to perform the action, and receives an action results message with information about the action.

Abstract: Examples of cloud-based removable drive encryption policy enforcement and recovery key management are described. In some examples, a removable drive encryption policy is received from a cloud-based management service. A removable drive is recognized by an operating system of a client device. An encryption command causes the operating system to request user password creation and encrypt the removable drive. A recovery key is identified from a write-output of the operating system. The recovery key is transmitted to the cloud-based management service for storage in a cloud-based removable drive recovery key escrow.

Abstract: Disclosed are various aspects of voice skill session lifetime management. In some examples, an inaudible sonic check-in announcement is detected. An inaudible sonic request for check-in authentication is emitted by a voice-activated device. An inaudible sonic authentication is detected. The inaudible sonic authentication includes a service provider identifier. The inaudible sonic check-in announcement is identified as authentic based on task data retrieved based on the service provider identifier. An inaudible sonic approval to perform a task specified in the task data is emitted by the voice-activated device.

Abstract: Some embodiments provide a method for updating a core allocation among processes of a gateway datapath executing on a gateway computing device having multiple cores. The gateway datapath processes include a first set of data message processing processes to which a first set of the cores are allocated and a second set of processes to which a second set of the cores are allocated in a first core allocation. Based on data regarding usage of the cores, the method determines a second core allocation that allocates a third set of the cores to the first set of processes and a fourth set of the cores to the second set of processes. The method updates a load balancing operation to load balance received data messages over the third set of cores rather than the first set of cores. The method reallocates the cores from the first allocation to the second allocation.

Abstract: The disclosure provides an approach for in-place conversion of a virtual switch on a host. Techniques are provided for in-place conversion of a virtual switch from a first type of virtual switch to a destination type of virtual switch. A method includes rekeying, by a second manager agent, one or more uplink ports associated with one or more logical switches implemented by the virtual on the host with the unique identifier. The rekeying includes updating one or more existing uplink port identifiers assigned to the one or more uplink ports with the unique identifier associated with a first manager agent. The method includes removing, by the first manager agent, an association of the one or more uplink ports with the opaque network; and informing the first manager and the second manager that the virtual switch is of the destination type of virtual switch.

Abstract: Disclosed are various approaches for retrieving contacts from a plurality of federated services. In one example, an authentication notification is received from an identity manager. The authentication notification can include an identifier for a user account and a single sign-on token for the user account. A federated service to authenticate on behalf of the user account is identified. The single sign-on token is transmitted to the federated service for authentication. An authentication token and a refresh token are received from the federated service. The authentication token is determined to expire within a threshold time period. A determination is made that the refresh token has not expired. The refresh token is transmitted to the federated service for a replacement authentication token.

Abstract: Some embodiments provide a novel method for assessing the suitability of network links for connecting compute nodes located at different geographic sites. The method of some embodiments identifies and analyzes sample packets from a set of flows exchanged between first and second compute sites that are connected through a first network link in order to identify attributes of the sampled packets. The method also computes attributes of predicted packets between the identified samples in order to identify attributes of each flow in the set of flows. The method then uses the identified and computed attributes of each flow in the set of flows to emulate the set of flows passing between the two compute sites through the second network link in order to assess whether a second network link should be used for future flows (e.g., future flows exchanged between the first and second compute sites).

Abstract: The disclosure herein describes tracking changes to a stale component using a synchronization bitmap. A first component of a plurality of mirrored components of the distributed data object becomes available from an unavailable state, and a stale log sequence number (LSN) and a last committed LSN are identified. A synchronization bitmap of the first component associated with a range of LSNs (e.g., from the stale LSN to the last committed LSN) is created and configured to track changes to data blocks of the first component. A second component is identified based on the second component including a tracking bitmap associated with an LSN that matches the stale LSN of the first component. The first component is synchronized with data from the second component based on, wherein the synchronizing includes updating the synchronization bitmap to track changes made to data blocks of the first component.

Abstract: Methods and apparatus for task processing in a distributed environment are disclosed and described. An example apparatus includes a task manager and a task dispatcher. The example task manager is to receive a task and create an execution context for the task, the execution context to associate the task with a routine for task execution. The example task dispatcher is to receive a report of task execution progress and provide an update regarding task execution progress, the task dispatcher, upon initiation of task execution, to facilitate blocking of interaction with a resource involved in the task execution. The example task dispatcher is to trigger an indication of task execution progress and, upon task finish, facilitate unblocking of the resource involved in the task execution.

Abstract: Some embodiments provide a method for network management and control system that manages one or more logical networks. From a first user, the method receives a definition of one or more security zones for a logical network. Each security zone definition includes a set of security rules for data compute nodes (DCNs) assigned to the security zone. From a second user, the method receives a definition of an application to be deployed in the logical network. The application definition specifies a set of requirements. Based on the specified set of requirements, the method assigns DCNs implementing the application to one or more of the security zones for the logical network.

Abstract: Reducing file write latency includes receiving incoming data, from a data source, for storage in a file and a target storage location for the incoming data, and determining whether the target storage location corresponds to a cache entry. Based on at least the target storage location not corresponding to a cache entry, the incoming data is written to a block pre-allocated for cache misses and the writing of the incoming data to the pre-allocated block is journaled. The writing of the incoming data is acknowledged to the data source. A process executing in parallel with the above commits the incoming data in the pre-allocated block with the file. Using this parallel process to commit the incoming data in the file removes high-latency operations (e.g., reading pointer blocks from the storage media) from a critical input/output path and results in more rapid write acknowledgement.

Abstract: Data that includes user data and application data that is generated during a remote desktop session to a cloud computing system is stored in cloud storage according to a risk level of the remote desktop session. The storage device has provisioned therein a plurality of storage containers, including first and second storage containers, where the first storage container stores less percentage of the user data than the second storage container. The first storage container is selected for storing the user data if the determined risk level of the remote desktop session is at a first level and the second storage container is selected for storing the user data if the determined risk level of the remote desktop session is at a second level that is lower than the first level.

Abstract: User profiles of applications installed in a user environment, which may be compromised by malware, are managed to protect against such malware gaining access to sensitive data that may be contained in the user profiles. The method includes the steps of detecting, by a management agent of a user environment, a launch of an application within the user environment, verifying, by a filter driver, an identity of the application against a stored profile of the application, and responsive to determining that the identity of the application matches the stored profile of the application, importing, by the management agent, an encrypted user profile from a remote storage to local storage, decrypting, by the filter driver, the encrypted user profile, and providing the decrypted user profile to the application.