Abstract: The invention relates to a method for classifying V2X messages and to a vehicle arranged to receive V2X messages and using the method to classify the received V2X messages. A method according to the invention for processing a message in a vehicle (100) comprises the steps of: receiving a signal (920) containing the message by means of a first antenna (111) and a second antenna (112); determining a relevance of the message (930) on the basis of signal characteristics and on the basis of navigation information of the vehicle (100); and processing the message with a ranking (940) corresponding to the determined relevance, wherein an attenuation map (300) assigns attenuation values to the vehicle environment on the basis of static objects (210) and dynamic objects (220) section by section. A vehicle according to the invention is arranged to use the relevance-based method for processing a message.

Abstract: Techniques for optimizing technologies related to network path tracing and network delay measurements are described herein. Some of the techniques may include using an IPv6 header option and/or segment identifier field of a segment list or a TLV of a segment routing header as a telemetry data carrier. The techniques may also include using an SRv6 micro-segment (uSID) instruction to indicate to a node of a network that the node is to perform one or more path tracing actions and encapsulating the packet and forward. Additionally, the techniques may include using short interface identifiers corresponding to node interfaces to trace a packet path through a network. Further, the techniques may include using short timestamps to determine delay measurements associated with sending a packet through a network. In various examples, the techniques described above and herein may be used with each other to optimize network path tracing and delay measurement techniques.

Abstract: A system includes a plurality of SIP servers that are configured and arranged to provide services for a respective set of endpoints. A monitor server having at least one processor circuit receives connectivity status of the respective set of endpoint devices based on registration status provided by the endpoints to the SIP servers. Based upon the received connectivity status, endpoints having connectivity problems are identified, and potential problem sources for the connectivity problems of the parsed endpoints are identified. A monitor device having at LAN interface circuit connected to the LAN and at least one processor circuit receives the command from the monitor server and performs a diagnostic test on the LAN. Results from the at least one diagnostic test are provided to the monitor server.

Abstract: The present disclosure relates to a method, apparatus and system for determining reliability information for a network component (240) of a telecommunications network. The disclosed method comprises: obtaining (310) a plurality of samples of an operating parameter of the network component (240) acquired over a period of time; determining (320) a value of an acceleration factor based on the plurality of samples, the acceleration factor corresponding to an effect of the operating parameter over time on the network component (240); and determining (330) the reliability information based on the determined value of the acceleration factor.

Abstract: Systems and methods for a flow-based data processing can begin with receiving a selection of a plurality of data processor blocks and a configuration mapping corresponding to the inputs and outputs of each data processor block. At a first compute node associated with a selected data source, an automated data flow can be initiated, wherein the automated data flow is generated from the configuration mapping and comprises a continuous sequence of one or more of the selected plurality of data processor blocks. Data from the selected data source is ingested into the automated data flow and is transformed by the continuous sequence of data processor blocks. The transformed ingested data is transmitted from the automated data flow to a second compute node associated with a selected data destination, via a data accelerator.

Abstract: In order to maintain performance during wireless communication, a transmitting electronic device may selectively perform a remedial action based on a monitored throughput. In particular, the transmitting electronic device may monitor communication with one or more receiving electronic devices, and may calculate a throughput metric based on the monitored communication. For example, the transmitting electronic device may monitor data rates, may receive feedback about the communication from at least one of the receiving electronic devices, and may determine an observed distribution of the data rates. Then, the transmitting electronic device may compare the throughput metric to a threshold value. If the throughput metric is less than the threshold value, the transmitting electronic device may perform the remedial action.

Abstract: A per-hop postcard technique is disclosed. The per-hop postcard technique is implemented to improve Postcard-based Telemetry (PBT). A per-section postcard technique is also disclosed. The per-section postcard technique is implemented to improve In-situ OAM (IOAM). By utilizing these techniques, suitable on-path telemetry may be obtained for multicast traffic. In addition, these techniques may be used to reconstruct and visualize a multicast tree, to conduct performance monitoring, and to perform trouble shooting.

Abstract: This disclosure describes techniques for monitoring expected behavior of devices in a computing network. Behavior of network devices may include performing various functions associated with transferring data packets through the computing network. Monitoring expected behavior may include sending a probe packet into the computing network, and determining whether network devices behave as expected with respect to the probe packet. In some examples, behaviors such as replicating, forwarding, eliminating, ordering, and/or other functions regarding data packets may be validated using the present techniques. As computing networks and/or operations become more complex, assuring the expected behavior of network devices may become more important for the continued efficient, smooth, successful, and/or timely flow of data traffic.

Abstract: This disclosure is directed to systems and methods for generating correlated load test scripts for use in load testing by receiving an archive of transaction records, each transaction record including a request and a response, organizing the archive of transaction records, determining a collection of transaction records, generating a plain load test script, and correlating the plain load test script to generate a correlated load test script.

Abstract: A network device may receive topology data identifying a spine and leaf topology of network devices, and may set link metrics to a common value to generate modified topology data. The network device may remove data identifying connections from leaf network devices to any devices outside the topology from the modified topology data to generate further modified topology data, and may process the further modified topology data, with a model, to determine path data identifying paths to destinations. The network device may determine particular path data identifying shorter paths and longer paths to corresponding destinations, and may determine hop counts associated with the paths. The network device may determine whether the hop counts are all odd values, all even values, or odd and even values, and may perform actions based on whether the hop counts are all odd values, all even values, or odd and even values.

Abstract: A method is performed at a provider edge node configured to communicate with remote provider edge nodes over an Ethernet virtual private network. The method includes receiving, from the remote provider edge nodes, route advertisements for a common subnet hosted on the remote provider edge nodes. The route advertisements include distinct remote route distinguishers, a common IP prefix for the common subnet, and remote paths for the common subnet. The method further includes determining whether there are at least a predetermined number of the remote paths preferred over a local path for the common subnet hosted on the provider edge node based on the remote route distinguishers and a local route distinguisher for the local path. The method includes, when there are at least the predetermined number of the remote paths preferred over the local path, suppressing sending of a route advertisement for the local path for the common subnet.

Abstract: A system accesses a set of devices transferring a data element from a source device to a destination device. The system determines a transformation type implemented on the data element at each device. The system generates an array that uniquely defines the data element at each device. The array comprises the transformation type and an identifier of the device. The system generates a transformation dependency map that represents a set of transformation types implemented on the data element at different devices. The system determines a set of data transfer paths for the data element from the source device to the destination device based on the transformation dependency map. The system selects the shortest data transfer path for the data element that corresponds to the least number of hops between devices. The system communicates the data element from the source device to the destination device using the shortest data transfer path.

Abstract: In one embodiment, a method includes determining, by a first router, service level agreement (SLA) requirements for an application and generating, by the first router, first SLA characteristics for the first router. The first router is in an active mode within a network. The method also includes comparing, by the first router, the first SLA characteristics for the first router to the SLA requirements and determining, by the first router, second SLA characteristics for a second router. The second router is in a standby mode within the network. The method further includes comparing, by the first router, the second SLA characteristics for the second router to the SLA requirements and determining, by the first router, whether to lower a first hop redundancy protocol (FHRP) priority of the first router.

Abstract: A system and method are disclosed for enabling interoperability between asymmetric and symmetric Integrated Routing and Bridging (IRB) modes. A system is configured to receive a route advertisement, examine the label fields of the route advertisement, and determine whether Layer 2 or Layer 3 information is conveyed. The system is further configured to build a route advertisement to advertise to a second device based on whether Layer 2 or Layer 3 information is conveyed in the first route advertisement.

Abstract: Disclosed is a system and method of providing a segment routing as a service application. The method includes receiving a configuration of an internet protocol environment. The configuration can be a layer 3 configuration of a single cloud environment or even across multiple cloud environments. The configuration defines routing, forwarding, and paths in the environment between different entities such as virtual machines. The method includes receiving a parameter associated with a workload of a tenant. The parameter can be a service level agreement (i.e., a best bandwidth available), a pathway requirement, a parameter associated with specific workload, and so forth. Based on the configuration and the parameter, the method includes generating tenant-defined layer 3 overlay segment routing rules that define how the workload of the tenant will route data in the internet protocol environment using segment routing.

Abstract: Methods, systems, and computer readable media for selecting a software defined wide area network (SD-WAN) link using network slice information are disclosed. One method occurs at an SD-WAN controller implemented using at least one processor, the method comprises: receiving a packet containing packet header information including at least one internet protocol (IP) address; determining, using the packet header information, a link selection rule for selecting an SD-WAN link for transmission, wherein the link selection rule uses transmission characteristics associated with the packet, wherein the transmission characteristics are discerned using network slice information associated with the packet; selecting, using the link selection rule, the SD-WAN link; and transmitting the packet via the SD-WAN link.

Abstract: Techniques for group-based classification and policy enforcement at a network fabric edge for traffic that is being sent to external network destinations are disclosed herein. The techniques may include receiving, at a control plane of a network and from an edge node of the network, a request to provide mapping data associated with sending a packet to a destination. Based at least in part on an address prefix value associated with the destination, the control plane may determine that the destination is located in an external network. Additionally, a group identifier that is associated with the destination may be determined. In this way, an indication of the group identifier may be sent to the edge node such that the edge node may determine, based at least in part on the group identifier, a policy decision for routing the packet to the external network.

Abstract: A method and system may provide virtual port communications. A data frame, containing a destination identifier in a destination field and payload, may be modified by inserting a first virtual machine tag therein.

Abstract: Some embodiments provide a method for performing deep packet inspection (DPI) for an SD-WAN (software defined, wide area network) established for an entity by a plurality of edge nodes and a set of one or more cloud gateways. At a particular edge node, the method uses local and remote deep packet inspectors to perform DPI for a packet flow. Specifically, the method initially uses the local deep packet inspector to perform a first DPI operation on a set of packets of a first packet flow to generate a set of DPI parameters for the first packet flow. The method then forwards a copy of the set of packets to the remote deep packet inspector to perform a second DPI operation to generate a second set of DPI parameters. In some embodiments, the remote deep packet inspector is accessible by a controller cluster that configures the edge nodes and the gateways.

Abstract: Systems, methods, and computer-readable media for orchestrating data center resources and user access to data. In some examples, a system can determine, at a first time, that a user will need, at a second time, access to data stored at a first location, from a second location. The system can identify a node which is capable of storing the data and accessible by a device from the second location. The system can also determine a first service parameter associated with a network connection between the device and the first location and a second service parameter associated with a network connection between the device and the node. When the second service parameter has a higher quality than the first service parameter, the system can migrate the data from the first location to the node so the device has access to the data from the second location through the node.

Abstract: Various embodiments of the present disclosure are directed to a group-based communication apparatus that is configured to enable end-users (e.g., non-admin users) to initiate, by way of client devices, generation of a shareable resource associated with a group-based communication resource identifier to efficiently authorize communication between client devices associated with different organization identifiers in group-based communication interfaces associated with a shared group-based communication resource identifier.

Abstract: Embodiments of the invention are directed to systems, methods, and computer program products for dynamic linking of resource data structures across distributed networks. The system is structured for enhancing data security by evaluating and determining iterations of data transformations associated with resource data structures across networks and establishing deletion and usage modification mechanisms for stored unauthorized downstream iterations. The system is structured to link a first front end resource data structure and a downstream transformation comprising a first entity resource data structure. The system is structured to construct a real-time interactive technology resource interface such that the technology resource interface is structured to present graphical interface objects associated with the link between the first front end resource data structure and the first entity resource data structure.

Abstract: A method of multicasting packets by a forwarding element that includes several packet replicators and several egress pipelines. Each packet replicator receives a data structure associated with a multicast packet that identifies a multicast group. Each packet replicator identifies a first physical egress port of a first egress pipeline for sending the multicast packet to a member of the multicast group. The first physical egress port is a member of LAG. Each packet replicator determines that the first physical egress port is not operational and identifies a second physical port in the LAG for sending the multicast packet to the member of the multicast group. When a packet replicator is connected to the same egress pipeline as the second physical egress, the packet replicator provides the identification of the second physical egress port to the egress pipeline to send the packet to the multicast member. Otherwise the packet replicator drops the packet.

Abstract: System and method for supporting scalable representation of switch port status in a high performance computing environment. In accordance with an embodiment, a scalable representation of switch port status can be provided. By adding a scalable representation of switch port status at each switch (both physical and virtual)—instead of getting all switch port changes individually, the scalable representation of switch port status can combine a number of ports that can scale by just using a few bits of information for each port's status.

Abstract: Methods and systems for supporting efficient load balancing among a plurality of switches and a plurality of end nodes arranged in a tree topology in a network environment. The methods and systems can sort the plurality of end nodes, wherein the plurality of end nodes are sorted in a decreasing order of a receive weight. The method and system may further route, in the decreasing order of receive weights, the plurality of end nodes, wherein the routing comprises selecting at least one down-going port and at least one up-going port. Further, the method and system can increase an accumulated downward weight on each selected down-going port by the receive weight of the routed end node, and increase an accumulated upward weight on each selected up-going port by the receive weight of the routed end node.

Abstract: Systems and methods for packet payload mapping for robust transmission of data are described. For example, methods may include receiving, using a network interface, packets that each respectively include a primary frame and one or more preceding frames from the sequence of frames of data that are separated from the primary frame in the sequence of frames by a respective multiple of a stride parameter; storing the frames of the packets in a buffer with entries that each hold the primary frame and the one or more preceding frames of a packet; reading a first frame from the buffer as the primary frame from one of the entries; determining that a packet with a primary frame that is a next frame in the sequence has been lost; and, responsive to the determination, reading the next frame from the buffer as a preceding frame from one of the entries.

Abstract: A system and method are disclosed to generate, transmit, and automate communications with end user systems. Embodiments comprise an automation platform comprising a processor and memory. Embodiments generate a communication based, at least in part, on input from a rules engine and one or more communication templates. Embodiments modify the content of the generated communication and revise the one or more communication templates to include the modifications made to the communication content. Embodiments transmit, using one or more communication channels, the modified communication to one or more end user systems, and automate the generation and transmission of one or more subsequent communications to the one or more end user systems based, at least in part, on the revised one or more communication templates.

Abstract: The present disclosure relates generally to facilitating routing of communications. More specifically, techniques are provided to dynamically transfer messaging between a network device and a terminal device to a type of bot based on intents identified from the messaging. Further, techniques are provided to track performance of the selected type of bot during automation.

Abstract: An illustrative communication provider system presents, to a first user, a communication interface that displays a representation of a shared virtual space that the first user shares with a second user. The communication provider system determines a virtual location status and an availability status for the second user. The virtual location status is representative of a virtual location of the second user within the shared virtual space. The availability status is representative of a particular availability mode included in a plurality of selectable availability modes. The communication provider system displays, within the communication interface presented to the first user, a profile icon for the second user. The profile icon indicates both the virtual location status and the availability status of the second user to the first user. Corresponding methods and systems are also disclosed.

Abstract: An information processing apparatus includes a processor configured to: acquire user data posted in a chat room participated by multiple users; and with multiple display forms changed, display association information that associates at least one piece of information of the user data or response information responsive to the user data with a user having posted the user data and posting time of the user data.

Abstract: An information interaction method and apparatus, a server, a system and a storage medium are provided. The method includes: receiving a group creating request message including an identification of a group member and create a discussion group including the group member based on the group creating request message, where the group creating request message is sent by a mail server; and send a group creating notification message to an IM client device of the group member, to display the discussion group on the IM client device based on the group creating notification message. Information intercommunication and fusion in different servers can be realized by means of the cooperative working of an IM server and a mail server, thereby improving the information processing efficiency and satisfying office requirements of a user.

Abstract: The disclosed embodiments disclose techniques for optimizing the display of videos. During operation, a computing device receives a video stream to be displayed. The computing device determines a preferred orientation for the video stream, determines a present orientation for the computing device, and determines a mismatch between the preferred orientation and the present orientation. The computing device adjusts the video stream while displaying the video stream on the display. As the video stream plays, the computing device detects any rotation of the computing device, and if so, re-adjusts how the video stream is displayed.

Abstract: Systems and methods are provided for sending serialized data for an interactive message comprising a first session data item to a second computing device to render the interactive message using the first session data item and display the rendered interactive message comprising a first media content item associated with a first interactive object and receiving, from the second computing device, a second media content item associated with a second interactive object of the interactive message. The systems and methods further provided for generating a second session data item for the second interactive object of the interactive message, adding the second session data item to the serialized data, and sending the serialized data to a third computing device to render the interactive message using the serialized data and display the rendered interactive message comprising the first media content item and the second media content item.

Abstract: A system that can coordinate user interface formats having customized threads comprising messages from a common thread. Each client device can be managed by a data structure that defines thread containers, where individual thread containers define threads and topics for each thread. Each thread can also be associated with unique groups of messages. The data structure can cause each client computer to display different user interface formats, with each format showing different threads for each user. Users engaged in a chat on a parent thread can split the parent thread into multiple child threads, that can each be associated with unique topics. The system can then associate individual messages of the parent thread with each child thread. The system provides more granular control of user interface formats to allow users to separate messages of high-priority topics.

Abstract: A different combination of multiple portions of a content item is selected for display to each of multiple sets of users of an online messaging application. The different combination of portions of the content item is sent for display to the corresponding set of users within a user interface of the online messaging application in association with information identifying a set of message threads in which each user is participating. A request to view the entire content of the content item is then received from a subset of each of the sets of users and a performance metric associated with each combination of portions of the content item is tracked based on the received request. Based on the performance metric, a performance of each portion of the content item is evaluated and used to select an optimal combination of the portions of the content item.

Abstract: Systems and methods are provided for sending a combined read and reaction message. The systems and methods perform operations comprising: receiving, from a server, a set of messages and one or more reactions exchanged between a plurality of users; determining that a given message has been presented on the client device to a first user of the plurality of users; determining that a given reaction of the one or more reactions has been presented on the client device to the first user; and transmitting, to the server by the one or more processors of the client device, a communication indicating that both the given message and the given reaction have been presented by the client device to the first user.

Abstract: The present disclosure is directed systems and methods for control embedding data packets for ARP queries, the methods including the steps of receiving a data plane packet from a first user device, the data plane packet requesting a hardware address associated with a second user device; generating a northbound control plane packet for transmission to a control plane node, the northbound control plane packet for requesting from the control plane node the hardware address associated with the second user device; embedding the data plane packet in the northbound control plane packet; and forwarding the northbound control plane packet with the data plane packet to the control plane node for respective processing of the northbound control plane packet and the data plane packet.

Abstract: A computerized method for increasing throughput of encapsulated data over a network is described. First, a determination, at a first network device, of a number of available processing resources located at a second network device is conducted. Thereafter, a plurality of connections are generated between the first network device and the second device. The plurality of connections corresponding in number to the number of available processing resources. Data received by the first network device is associated with a first connection of the plurality of tunneling connections. Thereafter, translation data unique to a tunneling session associated with the first connection is generated and the received data is encapsulated with the translation data to generate the encapsulated data for transmission to the second network device.

Abstract: Domain name system (DNS) configuration during virtual private network (VPN) connection includes, by a VPN entry server, receiving from a client device, via a VPN tunnel between the entry server and the client device, a first request for first content that identifies a first external source for the first content, receiving, from an operative DNS server configured for the tunnel, an Internet Protocol (IP) address of a first VPN system exit server, in response to determining that the first content is unavailable via the first system exit server, identifying a second DNS server, such that a second VPN system exit server for obtaining the first content is available using the second DNS server, obtaining, from the second system exit server, the first content, wherein the second system exit server obtained the first content from the first external source, and transmitting, to the client device, via the tunnel, the first content.

Abstract: Embodiments describing methods performed by a system comprising Network functions including at least a Session Management Function and a User Plane Function for performing a UPF re-anchoring for an application triggered at a User Equipment over an established Packet Data Unit (PDU) Session, where when the system receives the initial trigger for a service triggered by the application (e.g., a DNS request or an application level request), a determination is made by the system based on the information related to the application that re-anchoring of the UPF for that application into a local UPF closer to the UE is required. When re-anchoring of the UPF is successful, the initial trigger is discarded, and the UE is instructed to establish a new PDU session over the local UPF for that application.

Abstract: Techniques are described for creating isolated pools of external, failover, and/or floating IP addresses. In one example, this disclosure describes a method including creating a plurality of virtual networks, creating a plurality of pools of external IP addresses, detecting a request to instantiate an object that identifies a specific pool from the plurality of pools of external IP addresses; and instantiating the object and configuring the object with an external IP address drawn from the specific pool. The pools of external IP addresses may be created and isolated on a per-namespace, per-service, or per-ingress basis.

Abstract: A universal resource locator (URL) collider processes a click event referencing a URL and directs a browser to a page at the URL. While the page is being rendered by the browser with page data from a web server, the URL collider intercepts the page data including events associated with rendering the page, determines microfeatures of the page such as Document Object Model objects and any URLs referenced by the page, applies detection rules, tags as evidence any detected bad microfeature, bad URL, or suspicious sequence of events, and stores the evidence in an evidence database. Based on the evidence, a judge module dynamically determines whether to condemn the URL before or just in time as the page at the URL is fully rendered by the browser. If so, the browser is directed to a safe location or a notification page.

Abstract: Aspects of the disclosed technology comprise generating firewall rules based on traffic, outputting the generated firewall rules to an output file, and using the output file to set firewall rules in a network. The firewall rules may be generated without a priori knowledge of the network; alternatively no firewall rules are required. Generated rules may be tuned for user preferences to adjust for the number of generated firewall rules, and their over or under inclusiveness to non-historic traffic data.

Abstract: The present invention is a system and method for machine-to-machine communication in a Zero Trust environment, through the use of repeated, dynamic, and automated transformation and manipulation of strings of printable or typeable characters that are commonly used for passwords, PINs, keys, tokens, keys, encryption, and filenames forming a class of printable strings. The system and method described makes use of secured password “Hopping” to maximize data security and user's ease of implementation. “Hopping” refers to a method of automated random-password construction and serial substitution. The instant invention uses a protocol to create an immutable interdependence between a machine identity credential and a key credential as each is rotated from session to session.

Abstract: Methods, systems, and computer readable media for implementing bandwidth limitations on specific application traffic at a proxy element are disclosed. One exemplary method includes receiving, at a proxy element, a packet flow from at least one source client, identifying encrypted packets associated with a specific application traffic type from among the packet flow, and directing the identified encrypted packets to a bandwidth limiter in the proxy element. The method further includes applying a bandwidth limitation operation to the identified encrypted packets and decrypting the identified encrypted packets if an accumulated amount of payload bytes of the identified encrypted packets complies with the parameters of the bandwidth limitation operation.

Abstract: Described embodiments provide systems and apparatuses for enhanced quality of service, steering and policy enforcement for https traffic via intelligent in-line path discovery of a TLS terminating node. The system may include a first network device having a secure connection traversing through the first network device, and in communication with a second network device. The first network device and the second network device may be intermediary to a client device and a server. The first network device may determine that the second network device terminates the secure connection. The first network device may receive key generation information of the secure connection from the second network device following determining the second network device terminates the secure connection.

Abstract: Disclosed herein are systems and methods that allow for secure access to websites and web-based applications and other resources available through the browser. Also described are systems and methods for secure use and retention of user credentials, as well as methods for dynamic authentication of users and integrity checking of service providers in online environments. Thus, described in the present specification are systems and methods for constructing and destroying private, secure, browsing environments (a secure disposable browser), insulating the user from the threats associated with being online for the purposes of providing secure, policy-based interaction with online services.

Abstract: A kiosk device is shared by many users of an organization in a sequential manner. The kiosk is provisioned so that each of the appropriate users of the organization may use it, and so that each such user may be provided with a federated identity by an external identity provider (IdP) system. The federated identity may be used to automatically provide the user with access to the user's different resources (e.g., the user's accounts on various third-party applications). An authenticator component of the kiosk device communicates with the external IdP system so as to securely and transparently provide the users with a federated identity. In order to provide additional security, the authenticator component and/or the IdP system may take into account organization-specific details when authenticating a user, such as whether a particular user is expected to be on duty with the organization at the current time.

Abstract: An electronic component includes a processor and a memory. The electronic component has a secure platform capable of storing at least one dual key pair and a corresponding digital signature. There is also a system including a host machine and an electronic component capable of being operated by the host machine. The electronic component has a processor, a memory, and a secure platform capable of storing at least one dual key pair and a corresponding digital signature. Another aspect describes a method, which includes reading a public key from an electronic component by a host machine, verifying the public key against a stored key in the host machine, digitally signing data using a private key from the electronic component, verifying the signed data against the stored key, and using the electronic component by the host machine only if the signed data and the public key are verified.

Abstract: Techniques are disclosed for dynamically generating a digital certificate for a customer server. A customer server creates a certificate profile and receives an associated profile identifier from a certificate authority (CA). The customer server installs an agent application received from the CA. The agent application generates a public/private key pair and an identifier associated with the customer server. The agent application sends a signed request to the CA that includes the profile identifier, server identifier, and the public key corresponding to the key pair. Upon receiving the credentials, the CA generates a dynamically updatable certificate. Thereafter, if the customer changes information associated with the certificate (or if external conditions require a change to the certificate, such as a key compromise or change in security standards), the CA may generate an updated certificate based on the certificate profile changes and the public key.