Abstract: Methods, systems, and devices for providing computer implemented services using managed systems are disclosed. To provide the computer implemented services, the managed systems may need to operate in a predetermined manner conducive to, for example, execution of applications that provide the computer implemented services. Similarly, the managed system may need access to certain hardware resources (e.g., and also software resources such as drivers, firmware, etc.) to provide the desired computer implemented services. To improve the likelihood of the computer implemented services being provided, the managed devices may be managed using a dynamic reporting model. The dynamic reporting model may facilitate reduction and increasing in computing resources used for reporting dynamically as the operation of the managed system change. The dynamic reporting model may be used to limit overhead for reporting.

Abstract: A switch that can report unavailability in a label-switched network is provided. During operation, the switch can determine that a label-switched path is unavailable for forwarding a packet. The switch can then generate a notification message for collecting unavailability information at a respective upstream hop of the label-switched path. The notification message includes a depth indicator indicating the depth of collected unavailability information and an ingress label of the packet at the switch. If the switch is an intermediate switch on the label-switched path, the switch can forward the notification message to an upstream switch on the label-switched path, thereby allowing the upstream switch to collect further unavailability information in the notification message.

Abstract: A computer-implemented method can include receiving an indication of a template package to be imported in a sites cloud service and further determining whether there is a potential conflict in connection with the template package to be imported in the sites cloud service. The method can also include issuing a notification concerning the potential conflict in connection with the template package to be imported in the sites cloud service responsive to an indication that there is a potential conflict in connection with the template package to be imported in the sites cloud service.

Abstract: Some implementations involve analyzing audio packets received during a time interval that corresponds with a conversation analysis segment to determine network jitter dynamics data and conversational interactivity data. The network jitter dynamics data may provide an indication of jitter in a network that relays the audio data packets. The conversational interactivity data may provide an indication of interactivity between participants of a conversation represented by the audio data. A jitter buffer size may be controlled according to the network jitter dynamics data and the conversational interactivity data. The time interval may include a plurality of talkspurts.

Abstract: A processing apparatus (10) processes received input data and outputs output data that is to be transferred to a synchronization target apparatus using a predetermined bandwidth. The processing apparatus (10) measures the generation rate of the output data that is to be output by the processing unit (122). Based on the measurement result, the processing apparatus (10) controls the input of input data such that a condition set in advance for the corresponding type of input data is satisfied and the generation rate of the output data rate is below the transmission rate of the band.

Abstract: Disclosed are systems and methods for centralized monitoring of connected devices within a network. The system includes multiple dashboard graphical user interfaces (“Dashboards”) that aggregate multiple monitoring platforms into a single interface. The Dashboards display a wide variety of critical system network monitoring metrics. The Dashboards are generated utilizing network monitoring data and metrics received from a virtual service engine platform deployed within a monitored network. The virtual service engine platform itself incorporates a multitude of monitoring software platforms and applications that capture a wide range of useful network monitoring metrics and data from the digital resources that comprise a monitored information technology network.

Abstract: A lateral movement identification tool analyzes communications sent and received from a local host to identify potential instances of lateral movement. When the host-based lateral movement identification tool identifies a host to host connection, the tool processes one or more artificial intelligence algorithms to analyze information from local network resources including a directory service, a local network system such as a network basic input/output system, a domain name system, and event logs. The lateral movement identification tool correlates the aggregated information with identified host to host messaging and sends alerts when lateral movement is suspected. Alerts may be either presented locally or provided to a central console based on configuration information.

Abstract: A method implemented by a network element (NE) in a network, comprising receiving, by the NE, preferred path route (PPR) information describing a PPR graph, the PPR graph representing a plurality of PPRs between an ingress NE and an egress NE in the network, and updating, by the NE, a forwarding database to include a forwarding entry for the egress NE in response to identifying the NE in the plurality of PPR-PDEs, the forwarding entry indicating a next hop by which to forward a data packet comprising the PPR-ID.

Abstract: The system disclosed herein implements an improved end-to-end network performance for data transmissions that span multiple networks operated by different organizations. The improvements are achieved as a result of exchanging routing information. For instance, the exchanged routing information can be representative of network performance factors. When different operators of different networks agree to exchange routing information, an optimal end-to-end path between two endpoint devices can be identified and selected for data transmission. This benefits both network operators as the users served by the networks are more likely to be satisfied with the user experience (e.g., faster download and upload of data).

Abstract: A node mesh contains an originating node coupled to one or more nodes, each node having an communications interface input and a communications interface output. Each node has a route table with an association between a header amplitude and an output interface, such that a header having a particular amplitude causes the input node which received the message to couple the message to an associated communications interface output of the node. When the originating node outputs a message with a header amplitude, each node of the node mesh in turn directs the message to an output interface as directed by the node local route table to a terminating node of the node mesh, where the terminating node may be a training processor or inference processor for machine learning applications.

Abstract: An ingress network device may receive a core domain network segment identifier associated with a core domain network of the multi-domain network. The ingress network device may receive location data of an egress network device associated with a second leaf domain network of the multi-domain network, wherein the location data may include data identifying the core domain network segment identifier, a second leaf domain network segment identifier associated with the second leaf domain network, and an egress network device segment identifier associated with the egress network device. The ingress network device may store the core domain network segment identifier and the location data, and may utilize the core domain segment identifier and the location data to route traffic to the egress network device.

Abstract: Systems, devices, and methods are provided for transmitting and retransmitting data. A first message transmitted by a sender computing entity to a receiver computing entity over a first port may exercise a first network path whereas a second message transmitted over a second port may exercise a second network path. A system (e.g., sender computing entity) may determine network reliability metrics for a plurality of network paths. If a system detects data loss (e.g., packet loss) on a first port, a second port may be selected based on network reliability metrics for retransmission of the lost data. A port may for example, be selected for retransmission based on the following criteria: (1) the port has the longest consecutive duration without packet loss and (2) the port has received an acknowledgement for a packet that was sent more recently than the initial transmission of the lost packet.

Abstract: In one embodiment, a device obtains metadata for routing decisions made by a predictive routing service for a plurality of network deployments. The device identifies a network topology for a network deployment that does not use the predictive routing service. The device estimates, based on the metadata for routing decisions made by the predictive routing service, performance metrics for the predictive routing service were it to be used to make routing decisions for the network topology. The device sends, to a user interface, report data indicative of the performance metrics estimated for the predictive routing service were it to be used to make routing decisions for the network topology.

Abstract: A system and method for managing access congestion in a computer network, the system and method including: determining a plurality of channels within the computer network via a subscriber channel module; determining a set of subscribers for each of the channels of the plurality of channels via the subscriber channel module; determining a congestion level of each of the channels of the plurality of channels via an analysis module; determining each subscriber's impact on the respective channel based on each subscriber's network usage via the analysis module; and determining a reallocation of the subscribers to balance the channels, based on the congestion level and each subscriber's network usage, via a distribution module.

Abstract: A resource management system and a resource management method are provided. The resource management method is applicable to a plurality of worker nodes and master nodes that are communicatively connected with one another, and the worker nodes and the master node each include a resource pool, a resource monitor, a collector agent module, a traffic steering inference module, and a request processing module. The master node further includes a data collector, an artificial intelligence computing module, and a load balancer. The resource management method includes performing internal resource management processes and external resource management processes for the worker nodes and the master node, to mix and apply a centralized resource management mechanism and a distributed resource management mechanism.

Abstract: A method may include determining whether the topology of a network includes a direct path between a first endpoint and a second endpoint in the network. A direct path may be used to send a first type of traffic from the first endpoint to the second endpoint whereas any currently available path may be used to send a second type of traffic from the first endpoint to the second endpoint. If the topology of the network does not include a direct path, the first type of traffic may be buffered at the first endpoint until the topology of the network is reconfigured to include the direct path. The topology of the network may be reconfigured when at least one switch in the network reconfigures, for example, by switching from one interconnection to another interconnection pattern. Related systems and articles of manufacture are also provided.

Abstract: A storage unit configured to store information regarding flow characteristics indicating whether a flow constituted by a packet is a flow having a tendency to have a large number of short packets or a flow having a tendency to have a large number of long packets in association with destination information of the packet, a determination unit configured to, in a case where an input port receives a packet, determine flow characteristics of a flow constituted by the packet on the basis of the storage unit, and an output unit configured to output the packet received by the input port to a packet transfer apparatus in a load state indicating that a load due to the flow of the flow characteristics is light among a plurality of packet transfer apparatuses according to the flow characteristics determined by the determination unit are provided.

Abstract: Some embodiments provide a method for a forwarding element that receives a packet. The method determines whether the packet matches any flow entries in a first cache that uses a first type of algorithm to identify matching flow entries for packets. When the packet does not match any flow entries in the first cache, the method determines whether the packet matches any flow entries in a second cache that uses a second, different type of algorithm to identify matching flow entries for packets. The method executes a set of actions specified by a flow entry matched by the packet in one of the first and second caches.

Abstract: A system for implementing for implementing a distributed data flow framework. A controller creates a flow configuration file for at least one runtime. A distributed data flow deployment subsystem deploys one or more nodes and one or more interconnecting wires of the at least one runtime. A flow neighbour identification subsystem identifies one or more flow neighbours associated with the at least one runtime, determines a publisher and subscriber service information for each of the one or more flow neighbours. A bridge wire identification subsystem identifies one or more socket roles and a unique identification number corresponding to each of the one or more flow neighbours, enables the at least one runtime to establish a transmission control protocol connection with each of the one or more flow neighbours directly, implements one or more bridge wires with the at least one runtime and the one or more flow neighbours.

Abstract: A first node and a second node transmit packets to a third node via a switch. The packets are buffered in a Tx buffer in the switch and then transmitted to the third node. When the third node detects a sign of congestion at the Tx buffer based on the reception frequency of the packets, it is recognized, from transmitter addresses included in the received packets, that the nodes transmitting the packets to the third node are the first node and the second node, and a control packet for a transmission stop request is transmitted to the first node and the second node. On receiving the control packet for a transmission stop request, the first node stops transmission of only packets addressed to the third node. On receiving the control packet for a transmission stop request, the second node stops transmission of only packets addressed to the third node.

Abstract: A communication apparatus determines whether to delete a packet yet to be transmitted that is stored in a transmission queue from the transmission queue when new data to be transmitted to another communication apparatus is generated. In a case where the packet yet to be transmitted is determined to be deleted, the communication apparatus deletes the packet yet to be transmitted that is stored in the transmission queue while maintaining the communication connection with the another communication apparatus, and transmits a packet to be transmitted corresponding to the new data to the another apparatus.

Abstract: One example discloses a multi-radio device, including: a controller configured to be coupled to a radio; wherein the controller is configured to receive a request to communicate a signal with an initial communication priority from the radio; wherein the controller includes a priority offset module configured to, adjust the initial communication priority by a first offset; and wherein the controller includes a priority escalator module configured to, adjust the initial communication priority by a second offset.

Abstract: Techniques for sending Compute Express Link (CXL) packets over Ethernet (CXL-E) in a composable data center that may include disaggregated, composable servers. The techniques may include receiving, from a first server device, a request to bind the first server device with a multiple logical device (MLD) appliance. Based at least in part on the request, a first CXL-E connection may be established for the first server device to export a computing resource to the MLD appliance. The techniques may also include receiving, from the MLD appliance, an indication that the computing resource is available, and receiving, from a second server device, a second request for the computing resource. Based at least in part on the second request, a second CXL-E connection may be established for the second server device to consume or otherwise utilize the computing resource of the first server device via the MLD appliance.

Abstract: Described herein are systems, methods, and software to manage resources in a gateway shared by multiple tenants. In one example, a system may monitor usage of resources by a tenant of the gateway and compare the usage with usage limits associated with the resources. The system may further determine when the usage of a resource exceeds a usage limit associated with the resource and, when the usage of the resource exceeds the usage limit, identify an operation associated with causing the usage limit to be exceeded and blocking the operation.

Abstract: Resource provider specifications, characterizing computing resources of computing resource providers, are received. The reachability of each IP address included in the received specification is determined. An agent is deployed that is operable to determine the value of each of a set of metrics in the environment of the host at which the agent is deployed. The agent determines the value of each metric of the set of metrics in the environment of the relevant host, and communicates the determined values to one or more computing devices that validate whether the resources characterized by the communicated values are sufficient to provide the performance characterized by the received specification and that each ISP router complies with a predetermined policy. For each computing resource provider validated and determined to comprise an ISP router compliant with policy, the specified computing resources are added to a pool of resources for cloud computing.

Abstract: Embodiments described herein provide a method for providing a compatible backplane operation mechanism for 2.5-gigabit Ethernet. A first input of data including a first sequence-ordered set in compliance with a first interface protocol is received from a medium access control (MAC) layer. The first input of data is encoded into four outputs of encoded data including a second sequence-ordered set in compliance with a second interface protocol. The first sequence-ordered set in a first form of a sequence code followed by three bytes of data is mapped to the second sequence-ordered set in a second form of consecutive units of the sequence code followed by an encoded data byte. The four parallel outputs of encoded data are serialized into a serial output. The serial output to a linking partner is transmitted on a physical layer of an Ethernet link at a speed specified in the second interface protocol.

Abstract: An approach is disclosed that provides personalized two-way communication with a uniquely identified object and an AI agent. Information about the object in a context associated with a requestor is received to access to an object knowledge base. The information is analyzed to determine a unique reference for the object. A selected set of the received information and the object categorization may be sent to an object knowledge base populated with AI configuration parameters tied to uniquely identified objects. The object knowledge base is searched for the unique reference to determine a registration assessment. The registration assessment is one of registered and not registered. When the registration assessment is determined to be not registered, the object is added to the object knowledge base. After receiving an AI connection from the object knowledge base, the context associated with the requestor is sent to the AI connection.

Abstract: A messenger application for a second account related to at least one account in an instant messaging service receives, from a server, a list of at least one first account for which a video is registered and recommends a first account using a list view that shows the list of the at least one first account distinguished from a list of the at least one account.

Abstract: A method and system for communicating with wireless messaging enabled door locks is disclosed. The method includes advertising availability of the door lock via wireless messaging for a first period of time; triggering a message send event; determining a destination node; connecting to the destination node via Bluetooth; sending the message to the destination node; and entering a low power state for a second period of time, wherein the second period of time is longer than the first period of time; wherein the destination node is chosen from a second door lock or a computing system.

Abstract: Disclosed are media attachment systems to enable a user to embed a first media item with a link to a second media item, and distribute the first media item in a message to one or more recipient client devices. For example, the first media item may include a picture or video captured by a user at a client device. The user may generate a message that includes the first media item. In response, a media attachment system may cause display of an interface at the client device that includes an option to attach an address to a second media item to the message. For example, the second media item may include a web page, social media post, picture, or video identified by an address such as a Uniform Resource Locator (URL).

Abstract: Systems and methods to prevent or diminish message thread explosion are disclosed. Message data sent between members of a communal profile and/or between members of multiple communal profiles may be consolidated into a single message thread, which may be displayed on devices associated with the members associated with of the communal profile(s). Consolidation of the message data into a communal message thread may allow users to more intuitively view conversations between members of their communal profile and/or between members of their communal profile and other communal profiles without viewing individual message threads between members of the communal profile(s).

Abstract: A device, such as a head-mounted wearable device (HMWD), provides audible notifications to a user with a voice user interface (VUI). A filtered subset of notifications addressed to the user, such as notifications from contacts associated with specified applications, are processed by a text to speech system that generates audio output for presentation to the user. The audio output may be presented using the HMWD. For example, the audio output generated from a text message received from a contact may be played on the device. The user may provide an input to play the notification again, initiate a reply, or take another action. The input may comprise a gesture on a touch sensor, activation of a button, verbal input acquired by a microphone, and so forth.

Abstract: Systems herein supply hero cards that display contextual information and actions based on backend systems. The information and actions are related to a trigger content item in an application that does not have access to the backend systems. A hero agent running a user device can communicate the trigger content to a hero server. The hero server can determine which connectors to backend systems relate to the user device, and then can retrieve result information from one or more of the backend systems. The result information populates the hero card, which the hero agent displays within the application. Action buttons on the hero card cause the hero agent to contact one or more of the backend systems to cause an action to take place there.

Abstract: A method for a user/an employee in a system to acquire an email account is disclosed in the present invention, including: relating a role-nature email account to a role according to work content of the role in the system, wherein during the same period, one role can only be related to one role-nature email account, and one role-nature email account can only be related to one role; said role is an independent individual not a group/a class, and during the same period, one role can only be related to a unique user, while one user is related to one or more roles; and creating a relation between a user and a role, wherein for any user, a role-nature email accounts related to all roles related to said user are used as role-nature email accounts of the user and/or an employee corresponding to the user.

Abstract: Embodiments provide a social networking platform offering various services, such as, facilitating aggregation and management of a user's interaction on one or more social networking platforms, offering enhanced control over the level of privacy associated with the flow of user data, offering tools to customize the user's exposure to advertisement-related content on the social networking platform(s), integrating features to control aspects of how data/content is presented to and visualized by the user, empowering the user to multicast direct messages to other users without the other users having to meet certain constraints, empowering the user to create and/or join a group based on messaging threads, and the like. One or more of these enhanced services/features are associated with a powerful framework of authentication/permission model for access control.

Abstract: A method and apparatus for managing sharing of a message of a first type through a communication network. The method includes, following selection of a sharing command from an interface for reproducing the first message of the first type, integrating content of the first message of the first type into a second message of a second type to be transmitted through the communication network, the second type being distinct from the first type. Thus, a message of a first type can be shared by using a messaging of a distinct type, for example an email can be shared by SMS, MMS, instant messages, Tweet (registered trademark), etc.

Abstract: A notification service may act as an intermediary between sources of text-based communications (e.g., message channels within a communication and collaboration platform) and the intended recipients of action items contained in messages posted to these sources. The notification service may store, for each action item, an instance of a universal actionable notification data structure specifying, among other things, response options for the action items, and may, for a specific user, aggregate action items intended for that user across multiple sources, aggregate and send notification messages generated from the respective instances of the universal actionable notification data structures to a central notification inbox accessible by the user, and upon receipt of a response from the user, generate and post a response message to the source from which the action item originated.

Abstract: According to examples, an apparatus may include a processor and a memory on which is stored machine readable instructions that may cause the processor to determine whether a request is stored in a message queue, in which the apparatus may be inside of a domain and the message queue may be outside of the domain. Based on a determination that a request is stored in the message queue, the processor may pull the request from the message queue through a domain boundary, fulfill the request to cause a response to the request to be generated, and forward the response to the message queue through the domain boundary.

Abstract: Systems and methods of the present invention provide for one or more server computers communicatively coupled to a network, running a DNS server, and configured to: receive, from a client computer, an electronic message encoding a DNS request; access, within a database, at least one DNS record comprising: a designation of the DNS server as an authoritative DNS server for the DNS request; and a resource record designating a secondary authoritative server running on a second server computer; transmit, to the client computer, a DNS result according to the first resource record; transmit, to the secondary authoritative server, a second electronic message encoding a DNS query according to the second resource record; receive, from the secondary authoritative server, a DNS query result; store the DNS query result within a cache stored within the server computer; and transmit, to the client computer, the DNS query result.

Abstract: A disclosed method is performed at a first boundary node bordering a BIER domain. The method includes receiving a message associated with a source and group for multicast from outside the BIER domain. The method further includes generating an encapsulated message based on the message, a metric, and a first proxy address of the first boundary node. The method also includes forwarding the encapsulated message through the BIER domain to at least one second boundary node bordering the BIER domain and connectable to the first boundary node. The first boundary node additionally triggers the at least one second boundary node to decapsulate the encapsulated message for forwarding out of the first domain and store a record including the source, the group, the metric representing the cost of the first boundary node to the source, and the first proxy address on the at least one second boundary node.

Abstract: Systems and methods are provided for compliance management across multiple cloud environments. In some embodiments, the method includes receiving a rule, the rule using one or more statelets, wherein at least one of the statelets represents information procurable from a second cloud environment, wherein the second cloud environment is external to the first cloud environment; procuring the information from the second cloud environment; and executing the rule within the first cloud environment.

Abstract: Among other things, this document describes systems, methods and devices for providing a cloud proxy auto-config (PAC) function for clients connected to a private network, such as an enterprise network. The teachings hereof are of particular use with cloud hosted proxy services provided by server deployments outside of the private network (e.g., external to the enterprise or other organizational network). This document also describes systems, methods and devices for providing a proxy auto-config (PAC) function for clients connected to a third party network, such as when the client moves outside of the enterprise network.

Abstract: Electronic publications are increasingly replacing physical media but to date standards have evolved to mimic these physical media. Accordingly it is beneficial to provide electronic publication software systems and/or software applications to enable new paradigms that provide consumers, authors, publishers, retailers, and others with new models for releasing digital content from editorial and authorship viewpoints; new models for providing digital rights management with licensing, re-assignable rights and the ability to issue sub-rights or issue partial licenses with predetermined validity; new models for publishers to release revised editions, errata, new additions, etc; engaging social network type collaborative behavior within work and private environments with associated content (annotations) to the original release content; and supporting discussion and information dissemination within a wide variety of environments from education to business to book clubs etc.

Abstract: A system and method for homomorphic encryption in a healthcare network environment is provided and includes receiving digital data over the healthcare network at a data custodian server in a plurality of formats from various data sources, encrypting the data according to a homomorphic encryption scheme, receiving a query at the data custodian server from a data consumer device concerning a portion of the encrypted data, initiating a secure homomorphic work session between the data custodian server and the data consumer device, generating a homomorphic work space associated with the homomorphic work session, compiling, by the data custodian server, a results set satisfying the query, loading the results set into the homomorphic work space, and building an application programming interface (API) compatible with the results set, the API facilitating encrypted analysis on the results set in the homomorphic work space.

Abstract: A first communication device for transmitting data to a second communication device comprises a storage device for storing instructions and a processing circuit coupled to the storage device. The processing circuit is configured to execute the instructions stored in the storage device. The instructions comprise compressing a first packet to a first compressed packet according to a compressor instance, wherein the first packet is associated to a flow identity (ID); generating a first Protocol Data Unit (PDU) comprising the flow ID and the first compressed packet; associating a first sequence number (SN) to the first PDU; encrypting the first PDU to a first encrypted packet; generating a first Packet Data Convergence Protocol (PDCP) PDU comprising the first SN and the first encrypted packet; and transmitting the first PDCP PDU via a first logical channel (LC) to the second communication device.

Abstract: An exemplary access control system controls access to a computing system such as a data storage system. For example, the exemplary access control system includes a cloud storage platform that authorizes a user to access the cloud storage platform. After access to the cloud storage platform is authorized, the cloud storage platform receives, from the user, a request to access, through the cloud storage platform, an application executing on a remote storage device. The cloud storage platform obtains an access token in response to receiving the request from the user. The cloud storage platform transmits the access token to the storage device for use by the storage device to validate the user and grant the user access, through the cloud storage platform, to the application executing on the storage device.

Abstract: A computer system to establish a connection between a client device and a server device is provided. The computer system includes a gateway device that receives a message from the client device. The message includes a connection request and authentication information. The gateway device extracts the authentication information and the connection request from the message. The gateway device authenticates the client device, based on the authentication information. Subsequently, the gateway device transmits the connection request to the server device. Thereafter, the gateway device acts as a transparent proxy between the client and server devices, while the client and server devices engage in a handshake process to establish the connection between the client and server devices.

Abstract: Systems and methods for using JavaScript Object Notation (JSON) Web Tokens for information security for a particular software-controlled application are disclosed. Exemplary implementations may: store information electronically, including different types of client-provided information, hardware information, key information, and permission information; provide individual JWTs that include individual expiration dates to individual users; receive a user request for continued access and/or use of the particular software-controlled application; perform different types of (automated) verification based on the client-provided information in the user request; and, responsive to particular results from the different types of verification, perform some combination of transferring a response to the user request and accepting or denying continued access and/or use of the particular software-controlled application.

Abstract: Systems and methods are provided for authenticating image files when network connections should not or cannot be used to transfer image files. A user device application may capture an image at a user device, generate an image file, and generate a hash file based on the image file. Instead of sending the image file to an authentication server for authentication, the application may send the hash file. If desired, the application may transfer the image file when a desirable network connection is available. Any alteration to the image file in the meantime will result in a different hash file for the altered image file, thus allowing detection of altered image files. This approach offers decreases the amount of data that is required to be transmitted in low or undesirable signal conditions, while maintaining an ability to detect alterations to image files that may have been made in the meantime.

Abstract: A controller may be used to create and process an assertion, in some cases, to implement single-sign on (SSO) in a computer network. In some examples, the controller includes processing circuitry coupled to a storage device. The processing circuitry is configured to create the assertion, where the assertion includes information indicative of a set of attributes and parse the assertion to determine the set of attributes. Additionally, the processing circuitry is configured to determine if each attribute of the set of attributes maps to a plurality of primary user groups stored in the storage device. Based on determining that an attribute of the set of attributes does not map to at least one primary user group of the plurality of primary user groups, the processing circuitry is configured to create a set of secondary user groups and a set of secondary user group names corresponding to the attribute.