Abstract: Methods and systems for managing endpoint devices are disclosed. The endpoint devices may be managed by verifying blueprints prior to use. To verify the blueprints, the blueprints may be normalized to reduce variability in blueprint content. Once normalized, static content may be identified. Signatures from the blueprints may be used to attempt to verify the integrity of the static content. If successfully verified, then both the static and dynamic content from the blueprints may be used to update the operation of the endpoint devices.

Abstract: Methods and systems for managing an edge compute environment comprising endpoint devices and an orchestrator are provided. An internal peer-to-peer file sharing infrastructure exclusive to the edge compute environment is established using the endpoint devices and the orchestrator. The internal peer-to-peer file sharing infrastructure exclusive to the edge compute environment is used by the endpoint devices to download configuration data from one another using a sandboxed virtual network segment that connects the endpoint devices to one another. The sandboxed virtual network segment may be a Virtual extensible Local-Area Network (VXLAN), and may be used by the endpoint devices to implement a reverse torrent protocol for downloading the configuration data.

Abstract: Techniques are provided for resource scheduling of multiple application types in a heterogeneous endpoint device. One method comprises monitoring an execution of applications on a heterogeneous endpoint device, wherein the applications are of different application types and the heterogeneous endpoint device comprises multiple application runtime systems each supporting a different one of the different application types; and initiating an adjustment of an allocation of resources, provided by the heterogeneous endpoint device, assigned to at least one of the applications based on: (i) a current resource utilization of one or more of the applications, (ii) a priority assigned to one or more of the applications and/or (iii) a resource threshold value assigned to one or more of the applications. A global scheduling engine may: (i) monitor multiple endpoint devices and/or (ii) deploy one or more applications to at least one endpoint device based on resource consumption information from the endpoint devices.

Abstract: Methods and systems for managing endpoint devices are disclosed. The endpoint devices may be managed by verifying blueprints and authors of blueprints prior to use. To verify the blueprints, the blueprints may be normalized to reduce variability in blueprint content. Once normalized, static content may be identified. Signatures from the blueprints may be used to attempt to verify the integrity of the static content. If successfully verified, then both the static and dynamic content from the blueprints may be trusted. The authority of authors of the blueprints may be verified by attempt to establish chains of delegation of authority to the authors. If successfully verified, then the blueprints may be used to update operation of the endpoint devices.

Abstract: Methods and systems for managing an edge compute environment comprising endpoint devices and an orchestrator are disclosed. In particular, an internal peer-to-peer file sharing infrastructure exclusive to the edge compute environment is established using the endpoint devices and the orchestrator. The internal peer-to-peer file sharing infrastructure exclusive to the edge compute environment may then be used by the endpoint devices to download configuration data from one another using a sandboxed virtual network segment that connects the endpoint devices to one another. The sandboxed virtual network segment may be a Virtual extensible Local-Area Network (VXLAN), and may be used by the endpoint devices to implement a reverse torrent protocol for downloading the configuration data from one another.

Abstract: Methods and systems for managing an edge compute environment comprising endpoint devices and an orchestrator are disclosed. In particular, an internal peer-to-peer file sharing infrastructure exclusive to the edge compute environment is established using the endpoint devices and the orchestrator. The internal peer-to-peer file sharing infrastructure exclusive to the edge compute environment may then be used to retrieve and distribute data used for configuring one or more of the endpoint devices to allow the endpoint devices to provide one or more computer-implemented services to one or more users associated with the edge compute environment. For security of the endpoint devices, only the orchestrator is able to communicate with data processing systems external to the edge compute environment.

Abstract: A disclosed method for providing a non-credentialed user (NCU) with secure access to a remote endpoint of an edge computing platform, generates a support voucher for the NCU wherein the support voucher comprises a temporary ownership voucher including one or more digital signatures establishing a chain of trust from a root of trust to the NCU. The method provides a private key associated with the support voucher to the NCU. Responsive to detecting the NCU, using the private key to log into an edge platform resource and determining that the support voucher is recognized by the edge platform resource, the NCU is authenticated and the support voucher is validated to establish the NCU as a designated owner of the remote endpoint. Responsive to establishing the NCU as a designated owner, the NCU may access the edge platform resource and from there access the platform endpoint.

Abstract: Methods and systems for managing endpoint devices are disclosed. The endpoint devices may be managed by verifying portions of customized blueprints prior to use. To verify the portions of the customized blueprints, the portions of the customized blueprints may be normalized to reduce variability in blueprint content. Once normalized, static content may be identified. Signatures from the portions of the customized blueprints may be used to attempt to verify the integrity of integrity data for the static content. If successfully verified, then the integrity may be used to attempt to verify the integrity of the static content. If the integrity of the static content is verified, then both the static and dynamic content from the portion of the blueprints may be used to update the operation of the endpoint devices.

Abstract: Methods and systems for managing endpoint devices are disclosed. The endpoint devices may be managed by verifying portions of customized blueprints prior to use. To verify the portions of the customized blueprints, the portions of the customized blueprints may be normalized to reduce variability in blueprint content. Once normalized, static content may be identified. Signatures from the portions of the customized blueprints may be used to attempt to verify the integrity of integrity data for the static content. If successfully verified, then the integrity may be used to attempt to verify the integrity of the static content. If the integrity of the static content is verified, then both the static and dynamic content from the portion of the blueprints may be used to update the operation of the endpoint devices.

Abstract: Methods and systems for managing endpoint devices are disclosed. The endpoint devices may be managed by verifying blueprints and authors of blueprints prior to use. To verify the blueprints, the blueprints may be normalized to reduce variability in blueprint content. Once normalized, static content may be identified. Signatures from the blueprints may be used to attempt to verify the integrity of the static content. If successfully verified, then both the static and dynamic content from the blueprints may be trusted. The authority of authors of the blueprints may be verified by attempt to establish chains of delegation of authority to the authors. If successfully verified, then the blueprints may be used to update operation of the endpoint devices.

Abstract: Methods and systems for managing endpoint devices are disclosed. The endpoint devices may be managed by verifying blueprints prior to use. To verify the blueprints, the blueprints may be normalized to reduce variability in blueprint content. Once normalized, static content may be identified. Signatures from the blueprints may be used to attempt to verify the integrity of the static content. If successfully verified, then both the static and dynamic content from the blueprints may be used to update the operation of the endpoint devices.

Abstract: Methods and systems for managing data are disclosed. The data may be managed by creating and requiring use of both backups and verification data for the backups. The verification data may allow the authenticity of the backups to be verified. If verified, the backups may be used to restore the state and/or other characteristics of various entities. The verification data may include information usable to verify integrity of the backups and authority for generating the backups.

Abstract: Methods and systems for managing data are disclosed. The data may be managed by creating and requiring use of both backups and verification data for the backups. The verification data may allow the authenticity of the backups to be verified. If verified, the backups may be used to restore the state and/or other characteristics of various entities. The verification data may include information usable to verify integrity of the backups and authority for generating the backups.

Abstract: Methods and systems for managing endpoint devices are disclosed. The endpoint devices may be managed by onboarding them. Once onboarded, authority over the endpoint devices may be delegated to other entities. To establish the delegations, owners of the endpoint devices may issue various cryptographically verifiable data structures. These data structures may extend certificate chains established during onboarding of the endpoint devices.

Abstract: An apparatus comprises a processing device comprising a processor coupled to a memory. The processing device is configured to receive, over a first communication channel from an orchestrator entity, at least one command specifying one or more actions to take involving an endpoint device, the one or more actions comprising at least one of writing data to a tag of a tag bridge device and reading data from the tag of the tag bridge device. The processing device is further configured to relay the at least one command to the tag of the tag bridge device over a second communication channel, the second communication channel being established between a tag interface of the processing device and the tag bridge device, wherein the tag bridge device, when plugged in to a port of the endpoint device, relays the at least one command from the tag to the endpoint device.

Abstract: Techniques are provided for deploying virtual machines to a virtualization management environment using an agent component to obtain remote virtual machine templates. One method comprises receiving, by an agent component executing in a virtualization management server, a request to deploy a virtual machine and a storage location of a template for the virtual machine; obtaining the template for the virtual machine from one or more of an orchestration engine and a remote data source identified by the storage location; and replicating the obtained template for the virtual machine to create the virtual machine. The request to deploy the virtual machine may also comprise deployment information used to configure the virtual machine. The agent component may monitor an execution of the created virtual machine and evaluate one or more policies provided by the orchestration engine with respect to security controls and/or network requirements associated with the created virtual machine.

Abstract: An apparatus comprises a processing device comprising a processor coupled to a memory. The processing device is configured to receive, over a first communication channel from an orchestrator entity, at least one command specifying one or more actions to take involving an endpoint device, the one or more actions comprising at least one of writing data to a tag of a tag bridge device and reading data from the tag of the tag bridge device. The processing device is further configured to relay the at least one command to the tag of the tag bridge device over a second communication channel, the second communication channel being established between a tag interface of the processing device and the tag bridge device, wherein the tag bridge device, 10 when plugged in to a port of the endpoint device, relays the at least one command from the tag to the endpoint device.

Abstract: A voucher management system receives, from a computing device manufacturer system, an ownership voucher that transfers ownership of a computing device from the computing device manufacturer system to the voucher management system, and a hardware attestation certificate for the computing device, and associates them with the computing device in a voucher management database. When the voucher management system determines that the ownership of the computing device should be transferred to an end user system, it automatically generates second ownership transfer data by signing an end user system public key with a voucher management system private key, provides the second ownership transfer data in the ownership voucher in order to transfer ownership of the computing device from the voucher management system to the end user system, and provides the ownership voucher and the hardware attestation certificate to the end user system.

Abstract: Methods and systems for managing distributed systems are disclosed. The distributed systems may include endpoint devices that provide computer implemented services. The configuration of the endpoint devices may impact the provided computer implemented services. To manage the configuration of the endpoint devices, a communication architecture may be used that includes tags used to relay commands between orchestration and endpoint devices, and data from the endpoint devices to the orchestration devices and/or other devices.

Abstract: A method, computer program product, and computer system for dividing a physical Ethernet port is provided. The method may include dividing, by a computing device, a first physical Ethernet port of a plurality of physical Ethernet ports into a plurality of partitions. A first partition of the plurality of partitions for the first Ethernet port may be assigned to a N-virtual distributed switch. A second partition of the plurality of partitions for the first Ethernet port may be assigned with a plurality of functions. Ethernet packets may be switched between the plurality of functions in the second partition.