Abstract: In general, this disclosure describes a cloud exchange (or “cloud exchange”) that offers a cloud-to-cloud interface (CCI) for interconnecting cloud services to tenants within public clouds. As described herein, the cloud exchange may be configured with a cloud-to-cloud interface that enables tenant applications of a public cloud to subscribe to and communicate with cloud services, using an end-to-end layer 3 path, in some cases without requiring a separate routing protocol session with a public edge device for the public cloud. In some examples, the public cloud provides a virtual layer 2 connection from a tenant within a public cloud to a routing instance of the cloud exchange, and the cloud exchange uses the routing instance to route service traffic between the tenant and the cloud services.

Abstract: In general, techniques are described for an encryption key namespace of a kernel, executed by a host computing device, the encryption key namespace having a configuration file that stores an association of a key identifier and a container identifier by which the host computing device can obtain a data encryption key to use for decrypting/encrypting data for the container identified by the container identifier. In this way, a user may associate a container (or container image) with a unique key identifier. By configuring this association in the encryption key namespace for the container, the container may be identified and automatically associated with a key identifier for the appropriate key for decrypting/encrypting data for the container. The host computing device may then obtain, from a key management service, the key using the key identifier.

Abstract: Techniques for a secure device registration and software update using Decentralized Identifiers (DIDs). For example, a method includes sending, by a device and to a data store, a request for a software update published by a software publisher, wherein the request includes a verifiable credential for the device including a DID of the device; receiving, by the device and from the data store, a verifiable credential for the software update, wherein the verifiable credential includes a DID of the software publisher; determining, by the device, whether the software update is newer than software on the device; obtaining, by the device, the software update from the software publisher from a location specified by the verifiable credential; verifying, by the device, the software update based on the verifiable credential; and in response to verifying the software update based on the verifiable credential, installing, by the device, the software update.

Abstract: In general, techniques are described for using zero-knowledge proofs and digital signatures to verify the authenticity of log records generated by multiple parties, at least in some cases without exposing personally identifiable information for the parties.

Abstract: In general, techniques are described for proxying, with a locally-deployed computing device, service requests from one or more with customer devices to a remote data encryption and key management service and assuming, by the local computing device, the service functions of the remote service in the event of a remote service failure. For example, customer devices at a location may be configured to communicate service requests to the local computing device rather than to a remote service. The local computing device obtains one or more encryption keys or other security objects and stores the security objects to local storage. In response to determining a disruption in the remote service due to, e.g., network connectivity failure, the local computing device may assume the functionality of the remote service for a limited time by performing data encryption operations, responsive to requests received at the local computing device from the customer devices.

Abstract: This disclosure describes techniques that include use of a distributed ledger to arrange for and/or initiate provisioning of network services, and also to validate payment for such network services. In one example, this disclosure describes a method that includes modifying, by a computing system, a distributed ledger maintained by a consensus network to implement a smart contract that is configured to generate, in response to receiving a request for network services, a provisioning request; receiving the provisioning request, by the computing system and from a computing device on the consensus network that is executing the smart contract, wherein the provisioning request includes information describing requested network services; and provisioning, by the computing system and based on the information describing the requested network services, network services.

Abstract: In one example, a method includes receiving, by a first network device via a routing protocol peering session with a peer router in a first autonomous system, a plurality of routing protocol routes to destination addresses, each routing protocol route specifying a network address prefix and an identifier of the autonomous system that originated the routing protocol route; receiving network address prefix ownership information from a distributed ledger storing a plurality of associations between respective network address prefixes and respective autonomous system identifiers of autonomous systems confirmed to own the respective network address prefixes; determining, based at least on the prefix ownership information, whether any of the plurality of routing protocol routes specifies an autonomous system identifier different than specified by the associations; and in response to determining that one of the routes specifies an autonomous system identifier different than specified by the plurality of associations,

Abstract: Techniques are described for a centralized, neutral system for Internet of Things (IoT) device activation and automatic onboarding on an end-to-end basis, and for establishing secure communication between IoT devices and the IoT platforms. For example, a method includes receiving an activation request message from an IoT device to activate the IoT device on an IoT core network of a plurality of IoT core networks, wherein the plurality of IoT core networks and a plurality of IoT edge devices are co-located within the co-location facilities, and wherein the plurality of IoT edge devices are connected to one or more IoT platforms; authenticating the IoT device for connection to the IoT core network; and in response to authenticating the IoT device, provisioning a connection between the IoT core network and the plurality of IoT edge devices to provide the IoT device access to the one or more IoT platforms.

Abstract: This disclosure describes techniques for securely, efficiently, and/or effectively providing cryptographic operations and key management services. Systems in accordance with one or more aspects of the present disclosure may provide secure management of cryptographic keys as service to a plurality of data center users or customers that contract for services provided by a data center. In one example, this disclosure describes a data center comprising a plurality of cloud service provider ports, a plurality of customer ports, network infrastructure coupling the plurality of cloud service provider ports to the plurality of customer ports, and a computing system including at least one hardware security module.