Abstract: The present concepts may automate and optimize deployment to a cloud computing fleet. Artificial intelligence and/or optimization algorithms may be used to find optimal deployment parameters (e.g., deployment order of computers in the fleet) that minimize deployment time and minimize deployment risk. For example, machine-learning prediction models may be used to generate a shortest path graph problem models a deployment planning problem. Then, optimization algorithms may be used to efficiently find approximations of Pareto-optimal solutions to the shortest path graph problem. Depending on the preferred level of time and risk, one of the solutions may be used to run the deployment.

Abstract: The present concepts may automate and optimize deployment to a cloud computing fleet. Artificial intelligence and/or optimization algorithms may be used to find optimal deployment parameters (e.g., deployment order of computers in the fleet) that minimize deployment time and minimize deployment risk. For example, machine-learning prediction models may be used to generate a shortest path graph problem models a deployment planning problem. Then, optimization algorithms may be used to efficiently find approximations of Pareto-optimal solutions to the shortest path graph problem. Depending on the preferred level of time and risk, one of the solutions may be used to run the deployment.

Abstract: Embodiments of system upgrade management in a cloud computing system are disclosed therein. In one embodiment, a computing device is configured to transmit, to a server in the cloud computing system, data representing an available upgrade applicable to a component of the server on which a virtual machine is executed to provide a corresponding cloud computing service to a tenant. The computing device is also configured to receive, from the server, a message containing a preferred time by the tenant to apply the available upgrade to the component of the server and in response to receiving the message, determine a time for applying the available upgrade to the component of the server in view of the preferred time by the tenant included in the received message and instruct the server to apply the upgrade to the component of the server according to the determined time.

Abstract: In one embodiment, to determine what tasks may be offloaded to a peripheral hardware device (e.g., to be performed in hardware on the peripheral device, rather than on the CPU(s) of the host computer), an indication from the at least one peripheral hardware device may be provided, without the peripheral hardware device first being queried to determine the task offload capabilities provided by the peripheral hardware device. In one embodiment, a large packet that includes a plurality of extension headers may be offloaded to the peripheral hardware device for segmentation. An indication of the offset where the extension headers end may be provided in connection with the large packet. In another embodiment, a packet with extension headers that come before an encryption header in the packet are not offloaded to peripheral hardware device for encryption, while packets with no extension headers before the encryption header may be offloaded.

Abstract: In one embodiment, to determine what tasks may be offloaded to a peripheral hardware device (e.g., to be performed in hardware on the peripheral device, rather than on the CPU(s) of the host computer), an indication from the at least one peripheral hardware device may be provided, without the peripheral hardware device first being queried to determine the task offload capabilities provided by the peripheral hardware device. The peripheral hardware device may be capable of handling multiple task offloads on the same packet. For example, the peripheral device may be capable of performing large packet segmentation and encryption on the same packet. The peripheral device may also be capable of performing encryption and checksum calculation on the same packet.

Abstract: A method of communicating using IPSec security protocol. Security associations are provided for a connection based on session information that may include user information and/or information related to an application running on the device. One or more filters determine whether or not to accept a connection based on session information.

Abstract: The invention provides mechanisms for transferring processor control of secure Internet Protocol (IPSec) security association (SA) functions between a host and a target processing devices of a computerized system, such as processors in a host CPU and a NIC. In one aspect of the invention, the computation associated with authentication and/or encryption is offloaded while the host maintains control of when SA functions are offloaded, uploaded, invalidated, and re-keyed. The devices coordinate to maintain metrics for the SA, including support for both soft and hard limits on SA expiration. Timer requirements are minimized for the target. The offloaded SA function may be embedded in other offloaded state objects of intermediate software layers of a network stack.