Abstract: Methods and apparatus to publish internal commands as a programming interface in a cloud infrastructure are provided. An example apparatus includes a first virtual appliance including a management endpoint to coordinate task execution in a computing platform. The example apparatus includes a computing infrastructure interface including a programming interface, the programming interface to expose a subset of commands for the computing platform and to hide a remainder of the commands of the computing platform from a requester, the requester to execute a first command from the subset of commands via the programming interface. The management endpoint is to parse a first execution task generated from selection of the first command via the programming interface to determine a component of the computing platform to execute the first command associated with the first execution task and to route the first command from the first execution task to the component for execution.

Abstract: Methods, systems, and apparatus, including computer programs encoded on computer storage media, for enforcing a decay policy for a data object. One of the methods includes receiving a request to store a data object in a storage device; obtaining a user policy identifying a lifetime of the data object; determining, using the lifetime of the data object, a voltage policy for a plurality of memory cells of the storage device, wherein: each of the plurality of memory cells will store one or more bits of the data object; the voltage policy identifies a voltage to provide each memory cell; and an expected time at which raw bit errors of the data object will cause the data object to decay is equal to a time point identified by the lifetime of the data object; and storing the data object in the storage device according to the determined voltage policy.

Abstract: The present disclosure provides techniques for deallocating previously allocated storage blocks. The techniques include obtaining a list of chunk IDs to analyze, choosing a chunk ID, and determining the storage blocks spanned by the chunk corresponding to the chosen chunk ID. The technique further includes determining whether any file references any storage blocks spanned by the chunk. The determining may be performed by comparing an internal reference count to a total reference count, where the internal reference count is the number of reference to the storage block by a chunk ID data structure. If no files reference any of the storage blocks spanned by the chunk, then all the storage blocks of the chunk can be deallocated.

Abstract: Techniques for orchestrating and prioritizing the rebuild of storage object components in a hyper-converged infrastructure (HCI) deployment comprising a cluster of host systems are provided. In one set of embodiments, a computer system can identify a list of storage object components impacted by a maintenance event or failure of a host system in the cluster. The computer system can further determine a priority class for each storage object component in the list, where the determined priority class is based on a virtual machine (VM)-level priority class assigned to a VM to which the storage object component belongs.

Abstract: Examples of creating a device identifier that are based upon hardware components of a client device are discussed. An inaudible or high frequency reference audio sample is played. Audio capture is initiated using the microphone system. A sensor-based device identifier can be generated from the captured audio due the manufacturing variances in the hardware components used for the speaker and microphone systems.

Abstract: Disclosed are various approaches for signing documents using mobile devices. A request is sent to a certificate authority for a signing certificate. The signing certificate is then received from the certificate authority. The signing certificate is then stored in the memory. Next, a file is received from a client application executed by the processor of the computing device. Then, the file is signed with the signing certificate to create a signed file. The signed file is then returned to the client application.

Abstract: A computer-implemented method of executing a policy-based operation on a shared computer infrastructure includes storing in a computer memory a dynamically extensible metadata system that is in communication with a processor that executes policy-based operations, where the dynamically extensible metadata system includes a data structure, a collection method, a policy processing method, and a policy condition. The collection method is then executed to collect data from a first computer resource in the shared computer infrastructure using a first data structure and from a second computer resource in the shared computer infrastructure using a second data structure, where the first data structure and the second data structure are different data structures. The collected data is then processed with the policy processing method to determine if the collected data meets the policy condition.

Abstract: The disclosure provides an approach for remediating false positives for a network security monitoring component. Embodiments include receiving an alert related to network security for a virtual computing instance (VCI). Embodiments include collecting, in response to receiving the alert, context information from the VCI. Embodiments include providing a notification to a management plane based on the alert and the context information. Embodiments include receiving, from the management plane, in response to the notification, an indication of whether the alert is a false positive. Embodiments include training a model based on the alert, the context information, and the indication to determine whether a given alert is a false positive.

Abstract: Example methods for a network device to perform address resolution handling. The method may comprise: in response to a first distributed router (DR) port of a first DR instance detecting an address resolution request from a second DR port of a second DR instance, generating a modified address resolution request that is addressed from a first address associated with the first DR port instead of a second address associated with the second DR port. The modified address resolution request may be broadcasted within a logical network that is connected to the first DR instance through network extension. The method may also comprise: in response to detecting an address resolution response that includes protocol-to-hardware address mapping information associated with an endpoint located on the logical network, generating and sending a modified address resolution response towards the second DR port of the second DR instance.

Abstract: Various examples are disclosed for performing dynamic chains of action for Internet-of-Things (IoT) devices. In some aspects, IoT event data is received from an IoT device. An IoT dependency graph is identified based on an initial IoT event specified by the IoT dependency graph. An IoT event subsequent to the initial IoT event is identified according to the IoT dependency graph. A command is transmitted to an IoT device to perform the IoT event.

Abstract: Example methods relating to maintain a quality of service of a cloud application are described. One example method includes monitoring a workload metric of a virtual machines which is running the cloud application, creating additional one or more virtual machines, isolating the additional one or more virtual machines, and determining whether the workload metric exceeds a threshold. In response to determining that the workload metric exceeds the threshold, the method includes deisolating the additional one or more virtual machines to support the cloud application. Otherwise, the method includes maintaining one or more virtual machines being isolated.

Abstract: Systems and methods are described for encrypting a swap file in a computer system. The swap file can be encrypted by a background process executing on the computer system. Processing of paging swapping operations occurs independently and separately of the background encryption of the swap file. Processing a page swapping operation can include decrypting or encrypting data to be swapped involved in the paging operation depending on the paging operation and whether or not the data to be swapped is encrypted or not.

Abstract: Scheduling optimizations for services are described. In one example, a priority category, such as a high, low, or other priority category, can be determined for a service of an application executing on a computing device. If the application is running as a background application on the computing device, an exception to the start of the service can be returned by the operating system of the device, due to background execution limits on the device. In that case, the start of the service can be managed by a service manager of the application based on the priority category for the service. If the priority category for the service is high, the background application can call a foreground service. The call for the foreground service can bring the application to the foreground, and the service manager can again call for the start of the service after the foreground service is running.

Abstract: Techniques for improving the read performance of an LFS-based storage system that supports COW snapshotting are provided. In one set of embodiments, the storage system can implement an intermediate map for each storage object in the system that is keyed by a composite key consisting of snapshot identifier (major key) and LBA (minor key). With this approach, contiguous logical block addresses (LBAs) of a storage object or its snapshots will map to contiguous <Snapshot ID, LBA>-to-PBA mappings in the storage object's intermediate map, resulting in good spatial locality for those LBAs and robust read performance.

Abstract: Examples herein describe systems and methods for impact assessment in a Telco network. An impact assessment engine can receive a scenario that species a symptom for a network resource. The scenario can be specified on an administrative console. The impact assessment engine can construct failure signatures in a codebook matrix. The codebook matrix correlates problems at impacted network resources to network symptoms. Based on the scenario, the impact assessment engine can generate synthetic failure signatures and isolate a subset based on which of the synthetic failure signatures are most common. Then, the system can identify tenants and services in the Telco network impacted by the subset. This can allow administrators or an automated process to identify potential impacts before a scenario occurs.

Abstract: Some embodiments provide a method of replicating messages for a logical network. At a particular tunnel endpoint in a particular datacenter, the method receives a message to be replicated to members of a replication group. The method replicates the message to a set of tunnel endpoints of the replication group located in a same segment of the particular datacenter as the particular tunnel endpoint. The method replicates the message to a first set of proxy endpoints of the replication group, each of which is located in a different segment of the particular datacenter and for replicating the message to tunnel endpoints located in its respective segment of the particular datacenter. The method replicates the message to a second set of proxy endpoints of the replication group, each of which is located in a different datacenter and for replicating the message to tunnel endpoints located in its respective datacenter.

Abstract: A computer-based method is provided for selectively providing notifications based on social relevance to a user. The notification is first parsed to determine a sender, a proposed recipient, and at least one topic addressed in the notification. The parsed notification is then evaluated against a social graph of the proposed recipient. A relevance score is assessed based on linkages traversed in the social graph to a predetermined degree of separation from the proposed recipient. The score is increased for linkages that match or relate to the at least one topic. The notification is released to the proposed recipient if the relevance score exceeds a predetermined threshold.

Abstract: Various examples are disclosed for exchanging and acting on detected security events using permissioned blockchain. A unique identifier for a client device is obtained in response to a detected security event being identified. Security event data associated with the detected security event is sent to a plurality of nodes of a blockchain service, where the nodes are associated with a respective one of a plurality of computer security services and are configured to validate the security event data and endorse the security event data in response to predetermined criteria being satisfied. In response to the security event data being validated by the nodes, the security event data is published into the blockchain service as a block that is broadcasted to the nodes, where individual ones of the nodes are configured to store the security event data of the block in a local ledger.

Abstract: System and methods are provided for improved directory enumeration and data copy with shared client directories in virtual desktops by quickly and efficiently retrieving shared directory entries from the client device over a separate fast channel and caching them on the virtual desktop, where the directory entries can be available locally to applications in the virtual desktop for performing directory enumeration. The fast channel can further be utilized for efficiently transferring data in data copy operations between the client device and the virtual desktop.

Abstract: Disclosed are various approaches for implementing a navigation system that facilitates navigation through hierarchically-related views within a user interface using multiple independent entry points. The user interface can include multiple navigation components that each independently provide a user access to available views in the user interface. Upon a user selection for a view through interaction with one of the navigation components, a request for data used to build the view can be sent to a server. If the view is valid, an instance of the view is dynamically generated and displayed in the user interface and each navigation component is updated to be consistent with the selected view. If the view is invalid, updated navigation data is used to rebuild the navigation hierarchy and the navigation components are updated according to the updated navigation hierarchy.