Abstract: Some embodiments provide a method for managing logical network policy at a network management service that manages one or more logical networks, each of which is defined across one or more datacenters. From a first user that controls a first portion of a logical network, the method receives (i) a definition of a policy configuration object for the logical network and (ii) sharing of the policy configuration object with a second user that controls a second portion of the logical network. From the second user, the method receives definition of a service rule that uses the policy configuration object. The method distributes the service rule to a set of network element elements that implement the logical network at the one or more datacenters for the set of network elements to enforce the service rule.

Abstract: Some embodiments provide a method for deploying network management services for a plurality of tenants. The method is performed at a multi-tenant service executing in a container cluster implemented in a public cloud. For a first tenant, the method deploys a first set of network management services in the container cluster for managing a first group of datacenters of the first tenant. For a second tenant, the method deploys a second set of network management services in the container cluster for managing a second group of datacenters of the second tenant.

Abstract: Some embodiments provide a method of managing policy for a logical network spanning multiple datacenters, including at least first and second datacenters. The method is performed by a network management service operating in a public cloud to manage the datacenters. The method receives (i) a first policy configuration specifying logical network policy at the first datacenter from a first local network manager at the first datacenter and (ii) a second policy configuration specifying logical network policy at the second datacenter from a second local network manager at the second datacenter. The method consolidates the first and second policy configurations into a global policy configuration that also includes policy configuration defined at the network management service. The method uses the global policy configuration to manage the policy configurations for the logical network.

Abstract: Example methods are provided for network management entity to perform group-based network event notification in a network environment that includes the network management entity and a notification consumer. The method may comprise: in response to detection of a first network event associated with a group, withholding notification of the first network event to the notification consumer; and in response to detection of a second network event associated with the group, withholding notification of the second network event to the notification consumer. The method may further comprise generating a group notification associated with the group, wherein the group notification is an aggregate notification to report the detection of at least the first network event and second network event; and sending the group notification to the notification consumer.

Abstract: Some embodiments provide a method for network management and control system that manages one or more logical networks. From a first user, the method receives a definition of one or more security zones for a logical network. Each security zone definition includes a set of security rules for data compute nodes (DCNs) assigned to the security zone. From a second user, the method receives a definition of an application to be deployed in the logical network. The application definition specifies a set of requirements. Based on the specified set of requirements, the method assigns DCNs implementing the application to one or more of the security zones for the logical network.

Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a set of datacenters. Based on input from a top-level user of the virtual infrastructure, the method deploys a first logical network within the virtual infrastructure and defines one or more second-level users of the virtual infrastructure. The method receives input from a second-level user of the virtual infrastructure to define a second logical network and connect the second logical network to the first logical network. The first and second logical networks use a same data model and the second-level users are restricted from viewing configuration of the first logical network.

Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a plurality of sites. The method receives a definition of an application to be deployed in the virtual infrastructure. The application definition specifying a first set of the sites at which to deploy the application. Based on the definition of the application, the method assigns the application to a set of security zones defined for the virtual infrastructure. Each respective security zone is restricted to a respective set of the sites. The method deploys the application in a second set of sites based on the first set of sites and the sets of sites to which the set of security zones are restricted.

Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a plurality of sites. The method receives a definition of an application to be deployed in the virtual infrastructure. The application definition specifying a first set of the sites at which to deploy the application. Based on the definition of the application, the method assigns the application to a set of security zones defined for the virtual infrastructure. Each respective security zone is restricted to a respective set of the sites. The method deploys the application in a second set of sites based on the first set of sites and the sets of sites to which the set of security zones are restricted.

Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a set of datacenters. The method receives a definition of an application to be deployed in the virtual infrastructure. The application definition specifies (i) a set of tiers of the application and (ii) a set of requirements for deploying the application. Based on the application definition, the method automatically defines a logical network architecture for connecting data compute nodes (DCNs) that implement the application tiers in the set of datacenters. The method configures a set of forwarding elements in the set of datacenters to implement the logical network architecture.

Abstract: Some embodiments provide a method for a network management and control system that manages a virtual infrastructure deployed across a set of datacenters. Based on input from a top-level user of the virtual infrastructure, the method deploys a first logical network within the virtual infrastructure and defines one or more second-level users of the virtual infrastructure. The method receives input from a second-level user of the virtual infrastructure to define a second logical network and connect the second logical network to the first logical network. The first and second logical networks use a same data model and the second-level users are restricted from viewing configuration of the first logical network.

Abstract: In one example, workload attributes associated with workloads running in a virtualized computing environment may be retrieved. A distance analysis may be performed using the retrieved workload attributes to generate a distance matrix that identifies a distance between each workload and each other workload. Further, a cluster analysis may be performed on the workloads based on the distance matrix to generate clusters, where each cluster may include identical workloads. Furthermore, the identical workloads in each cluster may be associated with at least one security policy to provide security services in the virtualized computing environment.

Abstract: Example methods are provided for a computer system to perform role-based access control with feature-level granularity in a network environment. The method may include detecting a request for a user operating the client device to access one or more features of a web application, identifying a role assigned to the user and identifying one or more feature-level permissions associated with the role. A first feature of the web application may associate the role with a first feature-level permission, and a second feature of the web application may associate the role with a different second feature-level permission. The method may also include controlling access to the one or more features based on the one or more feature-level permissions.

Abstract: Example methods are provided for network management entity to perform group-based network event notification in a network environment that includes the network management entity and a notification consumer. The method may comprise: in response to detection of a first network event associated with a group, withholding notification of the first network event to the notification consumer; and in response to detection of a second network event associated with the group, withholding notification of the second network event to the notification consumer. The method may further comprise generating a group notification associated with the group, wherein the group notification is an aggregate notification to report the detection of at least the first network event and second network event; and sending the group notification to the notification consumer.

Abstract: Techniques for managing one or more buildings, including collecting historical building data, real-time building data, historical exogenous data, and real-time exogenous data and receiving the collected data at an adaptive stochastic controller. The adaptive stochastic controller can generate at least one predicted condition with a predictive model. The adaptive stochastic controller can generate one or more executable recommendations based on at least the predicted conditions and one or more performance measurements corresponding to the executable recommendations.

Abstract: A computer-implemented method includes receiving a source data set and a target data set. Differences between the target data set and the source data set are identified by dividing the target data set into a set of target data blocks. At least one duplicate block that is identical to a first portion of the source data set is identified among the target data blocks. At least one modified block for which contents of the modified block are not duplicated within the source data set is identified among the target data blocks. Different portions and identical portions between the modified block and the source data set are also identified.

Abstract: Systems and methods for enabling user access and update of personal health records stored in a health data store via voice inputs are provided. The system may include a computer program having a recognizer module configured to process structured word data of a user voice input received from a voice platform, to produce a set of tagged structured word data based on a healthcare-specific glossary. The computer program may further include a health data store interface configured to apply a rule set to the tagged structured word data to produce a query to the health data store and receive a response from the health data store based on the query, and a grammar generator configured to generate a reply sentence based on the response received from the health data store and pass the reply sentence to the voice platform to be played as a voice reply to the user.

Abstract: In accordance with embodiments of the present invention, systems and methods for providing targeted advertising content to a user in an automobile based on location are provided. More specifically, a computing device within the automobile receives advertising content from endpoints at various locations. The advertising content received may be an audio advertisement, a displayed advertisement presented on a display device associated with the computer, etc. Further, the advertising content may be from an entity associated with the endpoint, or may be from an entity not associated with the endpoint, that has dealt directly with the other entity in providing advertising content to the user.

Abstract: A computer-implemented method includes receiving a source data set and a target data set. Differences between the target data set and the source data set are identified by dividing the target data set into a set of target data blocks. At least one duplicate block that is identical to a first portion of the source data set is identified among the target data blocks. At least one modified block for which contents of the modified block are not duplicated within the source data set is identified among the target data blocks. Different portions and identical portions between the modified block and the source data set are also identified.

Abstract: A computer readable storage medium stores instructions to receive a source data set and a target data set. Instructions to identify differences between the target data set and the source data set are also stored. These instructions include dividing the target data set into a set of target data blocks. Among the target data blocks at least one duplicate block in which an unbroken copy is fully duplicated within the source data set is identified. At least one modified block among the target data blocks in which an unbroken copy is not fully duplicated within the source data set is also identified. Differences between the modified block and the source data set are then determined.