Abstract: Methods, systems, and computer-readable media for centralized management of remote endpoint devices are disclosed. Instances of agent software are installed on endpoint devices that are external to a multi-tenant provider network. The agent software is communicatively coupled to a centralized management service of the multi-tenant provider network. A software package is selected from a marketplace service of the multi-tenant provider network. The marketplace service comprises product offerings for a plurality of software packages. The centralized management service sends information indicative of a configuration associated with the software package to the agent software of one or more of the endpoint devices that are associated with the software package. The centralized management service receives, from the agent software, an indication that the configuration has been deployed on the one or more of the endpoint devices.

Abstract: A system that implements a data storage service may store data on behalf of clients in multiple replicas on respective computing nodes. The system may employ an external service to select a master replica for a replica group. The master replica may service consistent read operations and/or write operations that are directed to the replica group (or to a data partition stored by the replica group). The master replica may employ a quorum based mechanism for performing replicated write operations, and a local lease mechanism for determining the replica authorized to perform consistent reads, even when the external service is unavailable. The master replica may propagate local leases to replica group members as replicated writes. If another replica assumes mastership for the replica group, it may not begin servicing consistent read operations that are directed to the replica group until the lease period for a current local lease expires.

Abstract: Systems and methods are disclosed to implement a request routing layer of a service provider system, where the request routers are aware of different versions of a service implemented by the servers of the system. In embodiments, the request routers may discover the different versions of the service via periodic health messages or request responses from the servers. Requests are routed to the servers according to a routing policy that specifies the relative proportions of requests that are to be routed to each version. Version metrics generated from the requests may be captured and provided to a version change manager, which may update the routing policy based on the metrics, either increasing or decreasing the proportion of requests for the different versions. In embodiments, the request router may implement additional rules that control their routing behavior in response to detected error conditions.

Abstract: Updates to a hierarchical data structure may be selectively replicated to other replicas of the hierarchical data structure. An update for a hierarchical data structure may be received and committed to the hierarchical data structure. A determination as to whether any other replicas of the hierarchical data structure have permission to receive the update may be made. For those replicas of the hierarchical data structure with permission to receive the update, the update may be provided to the replicas and committed to the replicas. Different types of replication techniques may be implemented, such as pull-based replication techniques or push-based replication techniques. Replication permissions for objects of the hierarchical data structure may be individually defined, in some embodiments.

Abstract: Techniques for private network mirroring are described. Users can select one or more existing private networks to be mirrored in the same or different network area. Any network configuration changes made in the selected private network (e.g., “master” private network) can be propagated automatically to the mirror private network. This enables users to utilize resources in another network area for disaster recovery, ensuring that the network configuration of the mirror private network is consistent with the master private network through real-time updates. Additionally, users managing infrastructure that includes multiple private networks can select one master private network and propagate configuration changes to other private networks, reducing management overhead incurred by these multi-private network installations.

Abstract: Using a method of operating a system that includes remote servers, multiple electronic devices, and a wireless portable, the portable wireless device receives notification of an incoming call. The system uses the remote servers and other parts of the system to determine that one of the electronic devices can wirelessly communicate with the portable wireless device, and establishes a wireless connection between the portable wireless device and that device. The system determines whether the user is also located with the portable wireless device and wirelessly connected device and if so, routes incoming call audio to that device. If the system determines that the user is located with a different device, incoming call audio is routed from the portable wireless device to the device near the portable wireless device, and then the call audio is bridged to the device near the user.

Abstract: Media inputs, such as serial digital interface (SDI) inputs, can be concurrently monitored and ingested. An ingest process can be configured to concurrently monitor each of a set of SDI inputs. A transcoding job requiring content from one of the inputs can send a request over shared memory to the ingest process, which can copy the data to the media transcoding pipeline over shared memory while concurrently monitoring the SDI inputs. In at least some embodiments, multiple processes can concurrently ingest from a single SDI input.

Abstract: A system capable of identifying and locking resources (e.g., items, tickets, etc.) may map resources to a bit vector and use bit vectors to efficiently identify and lock the resources. For example, tickets to a concert may be mapped to a bit vector and the system may generate an availability bit vector indicating an availability of the seat locations. Thus, the tickets may be reserved by changing a binary value for bits corresponding to individual tickets. In addition, the system may generate bit vectors corresponding to metadata associated with the seat locations (e.g., aisle seat, handicap accessible, first ten rows, back ten rows, etc.), allowing the system to easily identify available seat locations that satisfy the search request. As the bit vectors are relatively small and can be processed easily, the system may improve a latency and reduce an error rate associated with searching for and reserving seat locations.

Abstract: Approaches are described for managing the processing of images or video on a computing device. A portable computing device can include one or more dedicated components, such as an application-specific integrated circuit (ASIC) or other dedicated processor component, to be integrated into the computing device to perform at least a portion of the imaging processing of captured images or video. For example, the dedicated processor component can enable the offloading of basic image signal processing, as well as higher level or “machine vision” processing from the device processor of the device. In this way, the dedicated processor component can perform signal processing for which the input is an image (or video), and where image or video data can be analyzed, interpreted and/or manipulated to generate an output, the output of image processing being either an image or a set of characteristics or parameters related to the image. The output can be provided to a device processor for further processing.

Abstract: Approaches presented herein can provide for end-to-end auditing of cross-account roles. A user associated with a first account might request some degree of access to resources associated with a second account. A role can be assumed by that user that delegates access to those resources, and the user can be issued temporary credentials to obtain the access. In order to provide for full auditing of these cross-account roles, calls that assume a role in one account can be linked to resource-related calls under a different account, which can include a third party account. Information can be obtained from both accounts that can be linked using an identifier provided to each environment as part of the role assumption. The linking can provide a full audit chain from end user to resource access across the separate accounts.

Abstract: Systems and methods for establishing a communications system between multiple electronic devices are described herein. In some embodiments, audio data representing a first utterance may be received from a first electronic device. A user account may be associated with the electronic device, and intent data may be determined from the audio data. Based on the intent data, it may be determined that the utterance includes an intent to communicate with a contact. A list of potential contacts may then be generated. Based on the intent data, a condition may be determined. The condition may represent a particular circumstance in which the utterance was received by the first electronic device, and based on the condition, a plurality of interaction ranks may be determined. A contact name having the highest interaction rank may be determined from the plurality of contacts, and a communications session between the first electronic device and an electronic device belonging to the contact may be established.

Abstract: Time-of-flight cameras may be synchronized where the fields of view of the time-of-flight cameras overlap. The time-of-flight cameras may be programmed within intervals of time for illuminating their respective fields of view that do not conflict with one another. When a first time-of-flight camera illuminates a first field of view that overlaps with a second field of view of a second time-of-flight camera, and the second time-of-flight camera detects reflected light from the illumination, the second time-of-flight camera may determine a time to illuminate the second field of view based on the reflected light. In this manner, any number of time-of-flight cameras may be synchronized with one another without requiring a direct connection between the time-of-flight cameras.

Abstract: A head-mounted wearable device incorporates a transducer into a nosepiece. Vibrations from the user's speech are transferred through the bridge of the nose and are detected by the transducer to produce an audio signal. In one implementation, a nose plate with a pair of attached nosepieces is mounted to a transducer, such as an accelerometer. The nose plate may be affixed to a front frame of the head-mounted wearable device using a motion limiter mechanism.

Abstract: Systems and methods are described to facilitate generation of access policies for a network-accessible service. An authorization service may use access policies to control whether requests to access a service are authorized. A user may submit to the authorization service a request to implement a “shadow” policy, to be compared to a currently in-force policy for a service during a specified period of time. During that period, the authorization service can evaluate requests to access the service under both the currently in-force policy for the service and the shadow policy. The user can then be notified of any requests for which different authorization results are given under the currently in-force policy and the shadow policy, thus enabling the user to verify that differences between the currently in-force policy and the shadow policy are intentional rather than the result of errors within the shadow policy or currently in-force policy.

Abstract: Systems, methods, and computer-readable media are disclosed for systems and methods for intelligent content rating determination. Example methods include determining presence of a first feature in a first frame of a video using an object recognition algorithm, determining presence of a second feature in an audio file associated with the video using an audio processing algorithm, and determining presence of a third feature in a text file associated with the video using a natural language processing algorithm. Certain embodiments may include generating a predicted content rating for the video using a machine learning model, where the predicted content rating is based at least in part on the first feature, the second feature, and the third feature, and using feedback data for the predicted content rating to retrain the machine learning model.

Abstract: Systems and methods for proactively deleting applications and/or deactivating permissions granted thereto are described. A system determines a user's usage pattern of an application. The system also determines a standard usage pattern associated with the application. The standard usage pattern may be determined from application usage patterns of multiple users of the system. When the user's usage pattern deviates from the standard usage pattern, the system may cause the application to be deleted from one or more of the user's devices. The system may also deactivate user permissions associated with the application when the user's usage pattern deviates from the standard usage pattern. The system also outputs an indication to the user soliciting whether the system to re-download the application and/or reactivate the permissions.

Abstract: A video display hub is mounted in a common household area such as a kitchen or family room. During times that have been designated as being available for communications, devices in first and second households exchange and display blurred video, allowing users in each household to see vague shapes and movements of the other household. Upon noticing activity, a user in the first household may initiate a video conversation, causing the video from the first household to be unblurred and causing unobscured voice to be transmitted to the second household. A user in the second household may respond by allowing the video conversation to be fully enabled, allowing the video from the second household to be unblurred and unobscured voice to be transmitted back to the first household.

Abstract: A doorbell switch includes a user input device configured to receive a user command to activate a doorbell sound output device, and activation circuitry configured to generate an activation signal in response to the user input device receiving the user command to activate the doorbell sound output device. A doorbell sound output device controller includes a switching device configured to control flow of electrical current between the doorbell sound output device controller and the doorbell sound output device, and control circuitry configured to control the switching device to enable flow of electrical current between the doorbell sound output device controller and the doorbell sound output device in response to receiving the activation signal from the doorbell switch.

Abstract: Techniques are described for employing a queue service as an intermediary to communicate messages between separate networks. A first proxy service may access a request generated by a client device operating in a first network, the request initially indicating a destination that is a server device operating in a second network. The request may be an application level protocol request. The first proxy service may modify the request to include, as a destination, a queue maintained by a queue service that is accessible from the first and second networks. The first proxy service may enqueue the modified request in the queue. A second proxy service operating in the second network may retrieve the enqueued request and communicate the request to the server device. One or more responses generated by the server device may be enqueued in a queue by the second proxy service for delivery to the client device.

Abstract: A head-mounted wearable device incorporates a channel inset into a front frame. A flexible printed circuit (FPC) is arranged within the channel and allows communication between a left side of the front frame to a right side. Using the FPC, electronics in a left temple attached to the front frame are connected to the electronics in a right temple attached to the front frame. A retention piece is used to maintain the FPC within the channel, provide protection from an external environment, and so forth. The retention piece may comprise an overmold of silicone plastic.

Abstract: Techniques described herein include a system and methods for implementing fast motion planning of collision detection. In some embodiments, an area voxel map is generated with respect to a three-dimensional space within which a repositioning event is to occur. A number of movement voxel maps are then identified as being related to potential repositioning options. The area voxel map is then compared to each of the movement voxel maps to identify collisions that may occur with respect to the repositioning options. In some embodiments, each voxel map includes a number of bits which each represent voxels in a volume of space. The comparison between the area voxel map and each of the movement voxel maps may include a logical conjunction (e.g., an AND operation). Movement voxel maps for which the comparisons result includes a value of 1 are then removed from a set of valid repositioning options.

Abstract: Disclosed are various embodiments of systems, methods, and computer programs that generate filters that can be used to filter offerings in a user interface. The effectiveness of filters can be evaluated to generate an effectiveness metric. The effectiveness metric can be used to weight the filters. The effectiveness metric can be based on a probability analysis of filters that are based on the probability that a filter was active when a transaction in the transaction history occurred.

Abstract: A packet processor may implement programmable tunnel creation. A network packet may be received at a packet processor. A tunneling protocol may be identified for the network packet. The packet processor may access one or more memories to obtain tunnel header data that includes a tunnel header and field identifiers which indicate respective fields in the tunnel header that are determined based on data in the network packet. The tunnel header data may have been stored in the one or more memories prior to receiving the network packet. The network packet may be modified to insert the tunnel header into the network packet including the respective fields indicated by the field identifiers. The modified packet may then be transmitted.

Abstract: Aerial vehicles may be equipped with propellers having pivotable blades that are configured to rotate or fold when the propellers are not rotating under power. A pivotable blade may rotate about an axis of a propeller with respect to a hub in the presence of wind flow until the pivotable blade is coaligned with a fixed blade, in a direction opposite to the wind flow. A pivotable blade may also fold over a hub of a propeller in the presence of wind flow, with the pivotable blade and a fixed blade being oriented in directions opposite to the wind flow. A center of mass of the pivotable blade may be caused to be on the same side of an axis as a center of mass of a fixed blade, even where the axis is not normal to the wind flow, thereby reducing an amount of drag generated by the propeller.

Abstract: This disclosure describes techniques for detecting and recovering from faults in computing devices. The faults being detected may consume amounts of power within normal consumption parameters of the device, such as under upper-current protection limits of a power adapter. The power adapter may include components which prevent power from being supplied to the device if the current drawn by the device is not periodically reduced to less than a threshold amount of current. The device may include logic which causes the device to periodically reduce the current drawn from the power adapter to less than the threshold amount of current to reset a timer of the components of the power adapter. Thus, the device may periodically reduce the current drawn when the device is operating normally, but fail to reduce the current drawn when experiencing a fault, which results in the power adapter shutting off power to the faulted device.

Abstract: Systems, methods, and computer-readable media are disclosed for identifying a set of images of child variants of a parent item, identifying a set of colors in the set of images, categorizing the set of colors into color subgroups, identifying a set of representative color(s) for the color subgroups, generating a color value distribution representation for an image of a child variant that indicates a respective number of pixels in the child variant image corresponding to each of one or more representative colors, identifying a color cluster in the color value distribution representation, scoring the color cluster, and selecting a particular color from the color cluster for inclusion in a sample image of the child variant if the color cluster score meets or exceeds a threshold value.

Abstract: A merchant management system including an order management application to manage customer orders for bespoke or made-to-order goods and determine a suitable allocation of order volume to respective available merchants. The order management application collects, determines, and considers “online” activity data and “offline” activity data in generating a suitability score for each available merchant as it relates to allocation of an existing order volume or a projected order volume.

Abstract: A resource allocation service can provide for the limited redelivery of events for processing using a set of virtual resources. A customer can provide code for execution, and the service can allocate resource instances configured to execute the code in response to various events. The processing for an event may not be completed by a single resource instance. When a resource instance is to end processing, the instance can capture state information to be returned as checkpoint data for the event. When the processing result is received, the service determines whether checkpoint data was included, which functions as a request for further processing. The service can then place the event data back in an event queue for redelivery and additional processing. A customer can specify a time limit or a retry limit such that an event can only undergo up to a maximum amount of processing before the event is failed.

Abstract: One or more programs of instruction configure networking-enabled electronic devices to communicate in a ring communication network with a network controller. One or more startup files in one or more devices are configured to enable IP Forwarding, local system monitoring, and signal transmission processes on device startup. Data packets are sent from the network controller to each device coupled to the ring network, where each device processes a separate data packet to configure itself for ring network communication using IP Forwarding. Monitoring devices over a ring network includes using receipt of signals to determine if one or more devices have dropped from the network, modifying IP Forwarding by one or more devices on the network to compensate for a device dropping out, receiving data associated with one or more device parameters, launching one or more read-only interfaces providing device data, and updating various device elements over the network.

Abstract: Systems and methods for voice-enabled configurations for audio-output devices are disclosed. User accounts may be associated with one or more voice-enabled devices. Those voice-enabled devices may include audio-output functionality, while other voice-enabled devices do not include audio-output functionality. For devices without audio-output functionality, sending and/or receiving calls and/or messages may depend on whether the device is connected to an auxiliary device with audio-output functionality, via wired and/or wireless connection. Notifications of whether calling and/or messaging is enabled may be sent to the sending and/or receiving devices.

Abstract: One or more clients of a service may obtain access to resources of the service using one or more roles. A role may be used to delegate access to resources that a client normally would not otherwise have access to. A system of the service may be used to detect the occurrence of an event associated with a principal that has assumed a role to obtain a token that enables access to a computing resource. The system may prevent one or more principals from use of the token for future access to the resource, and may update permissions associated with the role to prevent one or more principals from assuming the role.

Abstract: Methods and devices for sampling applications using a touch input are described herein. In some embodiments, an electronic device detects a touch input, which may cause the electronic device to send identifiers to a backend system. The backend system may then determine an application and sample audio request associated with the received identifiers. The backend system may then receive text data representing the sample audio request and text data representing a response to the sample audio request. The backend system may generate audio data representing the received text data and send the audio data to the electronic device. If, the touch input is still occurring, the backend system may find and send more sample audio requests and the responses thereof. If the touch input stops occurring during the sample, the backend system may send instructions to the electronic device to stop outputting the sample.

Abstract: Technology for indoor location estimation of wireless stations is described. In one embodiment, a processing device identifies a plurality of wireless stations that support a signal round-trip-time measurement protocol. The processing device associates the plurality of wireless stations with one another to form a logical grouping of the plurality of wireless stations and provides an indication of the plurality of wireless stations in the logical grouping to each of the plurality of wireless stations. The processing device receives a first round-trip-time measurement value for a signal transmitted between a first wireless station and a second wireless station of the logical grouping and a second round-trip-time measurement value for a signal transmitted between the first wireless station and a third wireless station of the logical grouping. These round-trip-time measurement values indicate a distance between the wireless stations, respectively.

Abstract: A ticketing system allows a ticket purchaser to encumber one or more tickets and, without purchasing the tickets, swap the encumbered tickets for other encumbered tickets. The ticketing system encumbers one or more tickets, and in response to an exchange request, searches for other encumbered tickets and facilitates an exchange. The shopping carts of the respective ticket holders can be updated to reflect the exchange. The encumbered ticket exchange may be between two parties, or may be a complex exchange between multiple holders of encumbered tickets prior to ticket purchase.

Abstract: An aerial vehicle and system for automatically detecting an object (e.g., human, pet, or other animal) approaching the aerial vehicle is described. When an approaching object is detected by an object detection component, a safety profile may be executed to reduce or avoid any potential harm to the object and/or the aerial vehicle. For example, if the object is detected entering a safety perimeter of the aerial vehicle, the rotation of a propeller closest to the object may be stopped to avoid harming the object and rotations of remaining propellers may be modified to maintain control and flight of the aerial vehicle.

Abstract: Methods, systems, and computer-readable media for proactive seeding of build artifacts are disclosed. A dependency graph is determined that represents dependency relationships among a plurality of build artifacts. Using the dependency graph, a repository manager determines a first set of one or more build artifacts. The first set of build artifacts are stored in one or more repositories. The first set of build artifacts are sent from a repository manager to a client over a network. The first set of build artifacts are used by the client in generating a software build.

Abstract: Techniques for efficiently identifying objects of interest in an environment and, thereafter, determining the location and/or orientation of those objects. As described below, a system may analyze images captured by a camera to identify objects that may be represented by the images. These objects may be identified in the images based on their size, color, and/or other physical attributes. After identifying these potential objects, the system may define a region around each object for further inspection. Thereafter, portions of a depth map of the environment corresponding to these regions may be analyzed to determine whether any of the objects identified from the images are “objects of interest”—or objects that the system has previously been instructed to track. These objects of interest may include portable projection surfaces, a user's hand, or any other physical object. The techniques identify these objects with reference to the respective depth signatures of these objects.

Abstract: An actuator system for fabricating a cavity within thermoplastic material includes a plurality of actuators arranged in an array. When dimensions of an item are determined, the actuator system may be programmed with data regarding such dimensions to fabricate a cavity for the item. A subset of the actuators, and distances by which each of the actuators is to be extended, may be selected based on dimensions of the item, in order to fabricate a cavity within the thermoplastic material that may accommodate the item therein. Additionally, the actuators and the distances may be selected based on intrinsic or extrinsic data regarding the item, and a cavity fabricated within the thermoplastic material may include one or more buffer zones or protective regions that are specifically formed with respect to aspects of the item.

Abstract: A request is received by a provider network from a requestor for data associated with a customer of the provider network. The data is not stored at the provider network, and the request includes a first encryption key. The provider network verifies that the requestor is authorized to request data from the customer of the multi provider network. The provider network sends information pertaining to the requested data to the customer. The provider network also sends the identity of the requestor and the first encryption key. The provider network sends, to the requestor, data that is encrypted, and a decryption key for decrypting the encrypted data.

Abstract: A first service submits a request to a second service on behalf of a customer of a service provider. The request may have been triggered by a request of the customer to the first service. To process the request, the second service evaluates one or more policies to determine whether fulfillment of the request is allowed by policy associated with the customer. The one or more policies may state one or more conditions on one or more services that played a role in submission of the request. If determined that the policy allows fulfillment of the request, the second service fulfills the request.

Abstract: Techniques for executing commands associated with system stacks using parallel workflows are described herein. A dependency representation based at least in part on a stack description is created. The stack description describes stack resource instance and dependencies between those resource instances. The dependency representation is then analyzed to determine sub-workflows each of which may be executed in parallel. The sub-workflows may be altered based on one or more runtime interdependencies and the stack command may be executed by performing the sub-workflows in a determined order.

Abstract: Provided are systems and methods for reliable, out-of-order receipt of packets. In some implementations, provided is an apparatus configured to communicate with a network and a host device. The apparatus may receive packets over the network at a receive queue. The packets may originate from a source on the network, and may be received out of order. The apparatus may further, for each received packet, identify a transport context associated with the source and a destination of the packet, and determine whether the packet can be accepted. Upon determining that the packet can be accepted, the apparatus may further identify the one receive queue at which the packet was received; determine a user application to receive the packet, transfer the packet from the one receive queue to a buffer in host memory, and identify an order in which the packet was received with respect to other packets.

Abstract: Described herein is a system and universal access control device that may be installed in proximity to, or within, an access control system to enable a user to use a user device to gain access to a secure area or resource. In some embodiments, a user may submit a request for access to a remote server and may be provided with an access token. The user may relay the received access token to the universal access device via a wireless transmission means on his or her user device. The universal access device may verify the authenticity of the access token by relaying the access token information to the remote server. Once the access token has been authenticated, the universal access control device may retrieve a credential stored in memory and provide that credential to the access control system to enable the user to gain entry to a secure area.

Abstract: Techniques for graph-based generation of dependency-adherent execution plans for data center migration are described. One or more agents and/or connectors can be deployed to a first network to collect data that can be used, by a server migration service, to identify resources operating in the first network and dependencies between the resources. A graph of the resources can be constructed and processed to remove any bi-dependencies and cycles from the graph that may exist. The resulting graph can be topologically sorted and used to automatically generate a migration plan for the resources that preserves dependencies between resources so that upon each resource being migrated, its inter-resource dependencies are satisfied.

Abstract: This application describes fabric storage totes, as well as techniques for use of fabric totes in an infrastructure that uses mechanical systems to transport the fabric totes and/or access inventory items in the fabric totes. The fabric totes may include a fabric base and side walls, with a hardened material support structure. Additionally, the fabric totes may include two handles made of a substantially hard material. The fabric totes may be accessed and transported, manually and/or mechanically, via interaction with the handles.

Abstract: Disclosed are various embodiments that facilitate execution of applications through remotely emulated computing devices. An application is executed in a hosted environment. A video signal of the application is encoded into a media stream, which is sent to a client computing device. In various embodiments, access to data that is locally available to the client computing device is facilitated. In various embodiments, data related to the operation of the application is recorded.

Abstract: A remote data storage service may operate one or more storage servers configured to maintain logical volumes on behalf of customers of the remote data storage service. Historical data associated with customer interaction with the logical volumes may be obtained by the remote data storage service. One or more probability models may be generated to evaluate various different configurations of the storage servers. The various configurations of the storage servers may be simulated using the one or more probability models and an optimal configuration may be determined.

Abstract: Described is a system for counting stacked items using image analysis. In one implementation, an image of an inventory location with stacked items is obtained and processed to determine the number of items stacked at the inventory location. In some instances, the item closest to the camera that obtains the image may be the only item viewable in the image. Using image analysis, such as depth mapping or Histogram of Oriented Gradients (HOG) algorithms, the distance of the item from the camera and the shelf of the inventory location can be determined. Using this information, and known dimension information for the item, a count of the number of items stacked at an inventory location may be determined.

Abstract: A hub device of a network receives a data model that includes a secure portion that is encrypted and one or more unsecure portions. The hub device deploys the one or more unsecure portions of the data model to respective edge devices of the network. The hub device decrypts the secure portion of the data model. The edge devices collect data (e.g., from sensors) and process the data using the unsecure portions of the data model. The edge devices send the processed data to the hub device. The hub device performs operations on the received processed data using the decrypted secure portion of the data model in a secure execution environment (e.g., a TPM or other secure module). The secure portion of the data model generates a result, which is then transmitted to an endpoint.

Abstract: Methods, systems, and computer-readable media for edge processing in a distributed time-series database are disclosed. A first set of time-series data is generated by one or more client devices and is associated with one or more time series. A local time-series database stores the first set of time-series data into a local storage tier. The local time-series database generates a second set of time-series data derived from the first set of time-series data. A remote time-series database receives the second set of time-series data from the local time-series database via a network. The remote time-series database stores the second set of time-series data into one or more remote storage tiers.