Abstract: Described herein are systems, methods, and software to enhance the management of inter-process communications (IPCs) for containers according to an implementation. In one implementation, a container management service executing on a host with a plurality of containers may identify an IPC object generation with a first identifier from one of the containers. Responsive to the request, the service may translate the first identifier into a second identifier, and store the IPC object in a memory system using the second identifier. Once stored, requests may be made from applications in approved containers for the object using the first identifier, and the service may retrieve the IPC object using the second identifier.

Abstract: A content delivery network has at least a first tier of servers. A content delivery method includes at a first server in the first tier of servers, obtaining a request from a client for a resource. If the resource is available at the first server or at a peer of the first server, then the resource is served to the client from the first server. Otherwise, it is determined whether the resource is popular, and if the resource is determined to be popular, then the first server obtains the resource and the first server serves the resource to the client. If the resource is determined not to be popular, the server contacts a second server to obtain the resource, not in the first tier of servers, and the second server provides the resource to the first server. The first server is instructed not to cache the unpopular content.

Abstract: Systems, methods, and computer-readable storage media for routing event data from cloud-based sources to various service providers without using a permanently dedicated server (or similar solution). The solution disclosed herein is source agnostic, meaning that the data being received can be from any provider of cloud-based data, with the data received being in a format specific to the given provider. The system can normalize the data from the respective sources into a common format based on properties on the data and, based on the normalized data, identify what type of analysis, process, or other service should be executed on data received. The system can then forward the data to respective service providers for the execution of those services.

Abstract: Embodiments of this application provide a method, an apparatus, and a system for managing a network slice instance. The method includes: receiving, by a first network device, a network slice instance creation request from a transmit end device, to request to create a target network slice instance; sending, by the first network device, network function configuration indication information to a second network device based on the description information, to instruct the second network device to configure a network function of the target network slice instance; receiving, by the first network device, network function configuration response information sent by the second network device, to indicate that the configuration of the network function of the target network slice instance is completed; and sending, by the first network device, network slice instance creation response information to the transmit end device.

Abstract: A dynamic ownership model is utilized for Internet protocol (IP) address allocation and management. Dynamic ownership is determined on a first-come, first-serve basis. According to an embodiment, IP address ownership can be coordinated through a lock coordinator on a per-node basis via a communication channel that is independent of the IP network being assigned. A per-node IP manager can request for a lock for a specific IP address, and if granted, the per-node IP manager can create an IP resource object, apply the IP resource object data to an interface on the node, set up the interface to receive traffic, and continuously issue checks to ensure that the node is allowed to own this IP resource object. Since each node participates in IP address ownership based on its own network status, overheads associated with synchronizing node state to a central IP address coordinator can be significantly reduced.

Abstract: A method of constructing a workflow is described. The method is carried out by a programmed processor and a memory of a computing apparatus using a workflow processing language. One or more hooks are provided in the workflow processing language. Each hook is adapted to provide a programming interface to one of one or more applications. An input stream is received and converted into an input object that can be processed by the workflow processing language. A workflow with hooks to one or more applications is then used. The one or more hooked applications are used through the programming interface provided by the respective hook to prepare and provide an output stream. The computer apparatus adapted to construct and perform such workflows is also described.

Abstract: A load-balancing server having at least one memory comprising instructions, at least one processing device configured for executing the instructions and a load-balancing module, coupled to the at least one memory, the at least one processing device, and at least one data transformation module, and configured for determining a first amount of computing resources for allocating to the at least one data transformation module using a load-balancing technique, the at least one data transformation module coupled to the at least one memory, the at least one processing device, and the load-balancing module.

Abstract: A method includes transmitting first data to a first cloud from a first device. The first data first data instructs the first cloud that a first item stored in the first cloud be made accessible to a second device via a second cloud that is coupled to the first cloud. The method further includes receiving second data from the first cloud at the first device. The second data is associated with a digital rights management restriction corresponding to a third item of the first cloud or the second cloud.

Abstract: A parallel processing apparatus includes a memory and a processor. The memory stores a program and the processor is coupled to the memory. The processor calculates, based on a number of nodes to be used in execution of respective jobs that are waiting to be executed and a scheduled execution time period for execution of the respective jobs, an execution scale of the respective jobs and allocates the respective jobs to an area in which a number of problem nodes that have a high failure possibility is small from among a plurality of areas into which a region in which a plurality of nodes are disposed is partitioned and divided. The allocation of the jobs is performed in descending order of the execution scale beginning with the job whose execution scale is the largest.

Abstract: Techniques are presented herein for determining equal cost multi-path (ECMP) performance health in a network. In accordance with an example embodiment, a method is provided that involves obtaining information indicating ECMP paths in a network, the network comprises of a plurality of nodes that includes at least one branch node. The method includes configuring the branch node to obtain ECMP performance metrics, and obtaining the ECMP performance metrics from the branch node. The method further includes analyzing the ECMP performance metrics to determine ECMP performance health of the branch node.

Abstract: A system and protocol for integrating a plurality of service providers across a plurality of domains with an application using a hosted platform have been described. The system involves registration of metadata corresponding to the service providers, their services, their types and their set of parameters. When a new integrating application is provided, then it also includes a wrapper protocol. The wrapper protocol includes six predefined methods. The hosted platform in turn can execute the request of the “integrating application” by internally connecting with the plurality of service providers across a plurality of domains and provide the output in a standard format. Since the wrapper protocol standardizes the format of communication (input & output), hence it reduces effort substantially at the end of the integrating application. The ability of the platform to increase the list of service providers is augmented as it relies on metadata for request generation and invocation.

Abstract: The present disclosure relates to the technical field of communications. Provided are a resource allocation method, apparatus and system applicable to an access network device. The method includes: acquiring J types of configuration information, each type of configuration information including information of a resource block to be allocated, where J?1; and providing notification of the J types of configuration information.

Abstract: A resource reservation system includes an information processing apparatus configured to manage reservation information regarding reservation of a resource, and a first information processing terminal configured to display the reservation information obtained from the information processing apparatus. The first information processing terminal includes first circuitry configured to: obtain resource setting information regarding setting of a second information processing terminal from the information processing apparatus; and implement a function of an in-terminal server that communicates as a server with the second information processing terminal.

Abstract: A method and system for configuring an Information Technology (IT) system in a manner that decreases a complexity of the IT system. At least part of IT assets of the IT system is mapped onto respective one or more target platforms of a plurality of target platforms by verifying characteristics and/or relations of the IT assets, in decreasing order of the affinity level of corresponding affinity criteria of a plurality of affinity criteria, against one or more hosting constraints of the target platforms, in increasing order of a complexity level of the corresponding target platforms. The IT system is configured, including hosting each mapped IT asset on the respective one or more target platform, which aggregates IT assets that have a higher affinity level on target platforms that have a lower complexity level so as to decrease the complexity of the IT system.

Abstract: A system for migrating a non-tenant-aware local application to a tenant-aware cloud application environment is disclosed to migrate individual modules of the application to instances of the cloud by grouping the modules via common characteristics in partition groups. By grouping modules together by partition group before migrating the modules to cloud instances, modules that share resources can be placed in closer logical proximity to one another in the cloud to optimize performance.

Abstract: A method of allocating execution resources, by a virtualized-resources manager entity, for an execution of an application service and of at least one network service. The execution of the application service depends on the concurrent execution of the at least one network service. the method includes: a first request to allocate execution resources by a manager entity of the at least one network service to the virtualized-resources manager entity; a second request to allocate execution resources by a manager entity of the application service to the virtualized-resources manager entity; and, prior to the requests, a notification, by the manager entity of the application service, of consumption forecast by the application service of at least one network service provided by the network services manager entity, to the services-managing network entity.

Abstract: Embodiments presented herein techniques for balancing a multidimensional set of resources of different types within a distributed resources system. Each host computer providing the resources publishes a status on current resource usage by guest clients. Upon identifying a local imbalance, the host computer determines a source workload to migrate to or from the resources container to minimize the variance in resource usage. Additionally, when placing a new resource workload, the host computer selects a resources container that minimizes the variance to further balance resource usage.

Abstract: A computing device may include a memory and a processor cooperating with the memory and configured to access a plurality of connection lease templates corresponding to published resources stored in a shared memory. The processor may further be configured to provision connection leases for respective client devices using a connection lease issuing appliance based upon the stored connection lease templates. The connection leases may be provisioned on demand responsive to selection of the published resources by the client devices, and the connection leases may provide instructions for connecting the client devices to virtual computing sessions corresponding to the published resources.

Abstract: Embodiments for a memory efficient perfect hashing for large records. A container ID set is divided into multiple fixed range sizes. These ranges are then mapped into perfect hash buckets until each bucket is filled to uniformly distribute the container IDs across different perfect hash buckets so that the number of CIDs in every perfect hash bucket is the same or nearly the same. Individual perfect hash functions are created for each perfect hash bucket. With container IDs as keys, the process maps n keys to n positions to reduce any extra memory overhead. The perfect hash function is implemented using a compress, hash, displace (CHD) algorithm using two levels of hash functions. The level 1 hash functions divides the keys into multiple internal buckets with a defined average number of keys per bucket. The CHD algorithm iteratively tries different level 2 hash variables to achieve collision-free mapping.

Abstract: A container orchestration server stores pairing keys in association with container profiles. A container orchestration agent executing on an operating system instance instantiates a new container according to a particular container profile in response to an instruction from the container orchestration server and stores the pairing key as metadata associated with the container. An enforcement module detects the instantiation of the container and obtains the corresponding pairing key from the container orchestration agent. The enforcement module transmits the pairing key to a segmentation server for validation. If the segmentation server validates the key, the segmentation server determines a label set corresponding to the container profile associated with the pairing key and generates management instructions for the container based on the label set.

Abstract: A distributed scheduler for a virtualized computer system has a hierarchical structure and includes a root scheduler as the root node, one or more branch schedulers as intermediate nodes, and a plurality of hosts as leaf nodes. A request to place a virtual computing instance is propagated down the hierarchical structure to the hosts that satisfy placement constraints of the request. Each host that receives the request responds with a score indicating resource availability on that host, and the scores are propagated back up the hierarchical structure. Branch schedulers that receive such scores compare the received scores and further propagate a “winning” score, such as the highest or lowest score, up the hierarchical structure, until the root scheduler is reached. The root scheduler makes a similar comparison of received scores to select the best candidate among the hosts to place the virtual computing instance.

Abstract: Usage metering software for metering usage of a single application, where portions of the application run on at least two different platforms. The usage metric values are aggregated for the purposes of planning, billing the client or the like. In some embodiments, at least one platform of the multiple platforms is a cloud platform and at least one platform of the multiple platforms is a non-cloud platform.

Abstract: A data synchronization method includes checking first to-be-checked information stored in an active area of a first board to obtain a first check result and second to-be-checked information stored in an active area of a second board to obtain a second check result before data synchronization, where the first board and the second board are include in an out-of-band management device, determining an active board and a standby board from the first board and the second board according to the first check result and the second check result, and synchronizing data in an active area of the active board to a standby area of the standby board. Hence, the method can be implemented to ensure validity of data synchronization.

Abstract: A host device comprises a processor coupled to a memory. The host device is configured, for each of a plurality of initiators of the host device from which write operations are sent to a storage system for processing, to repeatedly send to the storage system a command to obtain from the storage system write pressure information maintained by the storage system for that initiator, and responsive to the write pressure information obtained from the storage system for a corresponding one of the initiators indicating that the corresponding initiator is associated with a write pressure condition, to at least temporarily reduce a rate at which the write operations are sent from the corresponding initiator to the storage system. The operations of repeatedly sending the command, and at least temporarily reducing the rate, are illustratively performed by at least one multi-path input-output driver of a multi-path layer of the host device.

Abstract: An aggregated link flow control system includes a first networking device having a plurality of peer ports and a second networking device that includes a first port having a first flow control configuration. The first port is coupled to the first networking device via a first peer port of the plurality of peer ports. The second networking device includes a second port having a second flow control configuration. The second port is coupled to the first networking device via a second peer port of the plurality of peer ports. The second networking device groups the first port and the second port as an aggregated link interface. The second networking device determines that the first flow control configuration of the first port is compatible with a third flow control configuration of the first peer port and, in response, provides a data flow for the aggregated link interface through the first port.

Abstract: A computing device may include a memory and a processor cooperating with the memory and configured to generate connection leases for published resources selected by client devices. The connection leases may provide instructions for connecting the client devices to virtual computing sessions corresponding to the published resources. Each connection lease may include a published resource lease component unique to the selected published resource, and a common lease component shared by a plurality of different published resources.

Abstract: An electronic device and method are disclosed herein. The electronic device includes a biometric sensor and at least one processor. The processor implements the method, including receiving biometric information through a biometric sensor electrically coupled with the electronic device, when the received biometric information is authenticated, detecting by a processor at least one content that correlates with the received biometric information, and outputting the detected at least one content that correlates with the biometric information.

Abstract: Preventing certain types of service disruptions in a computing system involves receiving a lease request at a server of a cloud-based computing system, where the lease request originates from one of a plurality of cloud-hosted service computing systems (CSCS). The lease request will specify at least one suitable connector of a plurality of remote computing machines, where such connectors comprise an availability set at a computing resources location. In response to receiving the request, the server determines whether at least one of the connectors has pending maintenance operations. Based on such determination, the server will selectively grant the lease request by generating at least one electronic message directed to the CSCS which originated the lease request.

Abstract: For a plurality of hosts, observe first time-varying characteristics including network throughput, central processing unit (CPU) usage, and/or memory usage; second time-varying characteristics including software configuration; and time-invariant characteristics including hardware configuration, at a plurality of timestamps. Construct a restricted HMM configured to predict actual host states, wherein the first time-varying characteristics include observed variables. The current observed variables depend on current values of the hidden variables and prior timestamp distribution of the observed variables. The former in turn depend on prior timestamp values of the hidden variables, the time-invariant characteristics of the hosts. and current timestamp values of the second time-varying characteristics.

Abstract: Embodiments provide login functionality to a user using a third party identity provider for a multi-tenant identity cloud service. Embodiments receive declarative metadata that includes an identity of a token endpoint corresponding to the third party identity provider and corresponding parameter values. Embodiments store the declarative metadata in a database and receive a request for a login using the third party identity provider. Embodiments retrieve the metadata and build an authorization request and send the authorization request to the third party identity provider, and in response receive an authorization code. Embodiments retrieve the metadata and build a token request using the authorization code and send the token request to the third party identity provider, and in response receive an access token.

Abstract: Disclosed aspects manage a shared pool of configurable computing resources. A resource demand value is identified for a target host. Resource supply values of dynamically-assigned resources are computed for donor hosts. Using the resource demand value and the resource supply values, dynamically-assigned resources are reclaimed from the donor hosts and distributed to the target host.

Abstract: A workload/Converged Infrastructure (CI) asset allocation system includes a CI system having a plurality of CI assets that include compute devices and storage arrays. A CI/workload management system is coupled to the CI system and receives a workload that includes workload requirements. The CI/workload management system then determines a first storage array that is included in the CI assets and that satisfies at least one storage requirement included in the workload requirements, and a first subset of the compute devices included in the CI assets that each include a path to the first storage array and that satisfy at least one compute requirement included in the workload requirements. The CI/workload management system then identifies the first subset of the compute devices, and configures the first subset of the compute devices and the first storage array to provide the workload.

Abstract: A method and system for improving shared hardware and software resource system is provided. The method includes detecting and registering an Internet of things (IOT) device connected to a network. Hardware/software resources and sensors associated with hardware and software operations executed by the IOT device are identified and all available data and associated metadata associated with the hardware/software resources and the sensors are stored in a database. Additional available hardware/software resources and sensors associated with a plurality of IOT devices connected to the network are displayed and a command signal for assigning a specified hardware/software resource or sensor to the IOT device is executed. A network identification code associated with a location of the specified hardware/software resource or sensor is retrieved and enabled with respect to said IOT device.

Abstract: A message handling system comprising connection handler circuitry, message parser circuitry, message modification circuitry, message processing circuitry, and content caching circuitry, wherein the message parser circuitry is operable to extract header(s) and/or content of a received message. The message modification circuitry is operable to generate a modified message by inserting, into the message, an HTML tag comprising a first unique uniform resource locator (URL). The connection handler circuitry is operable to send the modified message to a device that handles messages for the recipient. The message processing circuitry is operable to analyze the one or more headers and/or content. The message processing circuitry is operable to determine which image of a plurality of images to serve in response to a request containing the first unique URL, wherein the determination is based on the analysis of the one or more headers and/or content.

Abstract: Aurora Service broker for Cloud Foundry platform wherein the Aurora Service broker comprise an hardware and software arrangement to form an interface between the Cloud Foundry platform and Amazon Web Service (AWS) allowing the AWS Service available to applications through Cloud Foundry platform.

Abstract: Dynamic advertisement routing is disclosed. For example, a plurality of internet protocol (“IP”) addresses associated with respective plurality of target nodes is stored in a routing pool. Each IP address in the routing pool is pinged through each of first and second load balancer network interfaces. Network routes associated with target nodes are updated based on a first plurality of ping responses. Communications sessions are established with target nodes through respective network routes. IP addresses are pinged and respective latencies in a latency cache are updated based on a second plurality of ping responses. A first request directed to the plurality of target nodes is received and is determined to be sent to a first target node based on the latency cache forwarded to the first target node via the first network route.

Abstract: The invention relates to an electronic arrangement for dynamically and automatically controlling the usage of software components in connection with a network function virtualization (NFV) platform in a communications network comprising a mobile network, the arrangement comprising at least one data interface for transferring data, at least one processing unit for processing instructions and other data, and memory for storing the instructions and other data, said at least one processing unit being configured, in accordance with the stored instructions, to cause: obtaining first information indicative of instantiated virtualized network functions (VNF) and licences associated therewith, and second information indicative of a VNF licence that is available for allocation to an instance of a related VNF in accordance with terms and conditions as stipulated by the VNF licence; determining, based on the obtained first and second information, whether a licence currently allocated to an existing instance of a VNF, or

Abstract: A computing resource service provider may provide computing resources for execution of a program on behalf of a customer. The program's resource requirements may grow over time and horizontal scaling of the programs execution may be a laborious task as the portion of the program's the in-memory state may not be replicated. The program may include a set of modules which may be split and distributed to one or more computer systems of the service provider for execution. A factoring plan may be used to determine a set of partitions, where each partitions contains a subset of the modules of the program. Performance data associated with the one or more computer systems executing the partitions may be used to determine the factoring plan.

Abstract: A geo-analytical program is integrated into a customer relationship management (CRM) solution. Via the geo-analytical program, users are able to define layer configuration settings for a layer for plotting on a map-based GUI. Layer configuration settings for a respective layer comprise an indication of a data object type serving as a base object type for the respective layer. A method involves receiving from a user user-defined configuration settings for a first layer, electronically receiving, at a geospatial computer system, geospatial data for a plurality of connected devices; electronically receiving, at the geo-analytical program from the geospatial computer system, real-time geospatial data for the plurality of connected devices; and utilizing, by the geo-analytical program, the user-defined layer configuration settings for the first layer to plot the first layer on the map-based GUI based on the received real-time geospatial data for the plurality of connected devices.

Abstract: A method, computer program product, and computer system for creating, by a computing device, a logical unit number (LUN) on a storage array node of a storage system. An identifier of the LUN of the storage array node may be provided to a computing system, wherein the computing system includes one of a host, a server, and the storage array node. An access control list (ACL) of the computing system may be created. The ACL of the computing system may be applied to the LUN based upon, at least in part, the identifier. The LUN may be discovered and mapped at the computing system. It may be determined that the computing system has failed. The ACL of the computing system that has failed may be removed from the LUN to prevent the computing system that has failed from accessing the LUN.

Abstract: An apparatus in one embodiment comprises a host device configured to communicate over a network with a storage system. The host device comprises a plurality of nodes each comprising a plurality of processing devices and at least one communication adapter. The host device further comprises a multi-path input-output (MPIO) driver that is configured to obtain an input-output (IO) operation that targets a given logical volume and to identify a source node for the IO operation. The MPIO driver identifies a plurality of paths between the source node and the given logical volume via the communication adapters of the plurality of nodes and determines locality information for each identified path. The MPIO driver is further configured to select a target path from the identified paths based at least in part on the determined locality information and to deliver the obtained IO operation to the given logical volume via the selected target path.

Abstract: Methods, apparatus and articles of manufacture for dynamically extending a cloud management system by adding endpoint adapter types are disclosed. An example cloud management system includes: an interface to communicate with an external device; a host to manage requests and allocate resources through one or more virtual machines; and an endpoint registry to include an endpoint adapter and metadata defining the endpoint adapter, the endpoint adapter to specify communication between at least one of the host or the external device and an endpoint. In the example cloud management system, the host is to at least enable, via the interface, the external device to access the endpoint registry a) to register an endpoint adapter configuration with the endpoint registry and b) to retrieve the endpoint adapter configuration from the endpoint registry.

Abstract: Techniques and solutions are described for facilitating deploying tenants to, and managing tenants in, a cloud computing environment. In determining where a tenant should be deployed, cloud-based software applications, or at least cloud-based software applications of a particular type, used by the tenant are considered. Computing resources needed by the tenant are determined. The tenant is deployed to a computing infrastructure that has instances of the cloud-based software applications used by the tenant and has computing resources sufficient to satisfy the needs of the tenant. If the tenant is to access another software application, the data for such application is deployed to that computing infrastructure. If the tenant's computing resource needs exceed the available resources of the infrastructure, resources are added to the infrastructure or the tenant's data for all of the cloud-based software applications are moved to another computing infrastructure.

Abstract: A network function virtualization (NFV) platform can support hybrid and elastic scaling and recovery services. In one example, a system can deploy a cloud virtual network function manager (VNFM) and one or more cloud virtual network functions (VNFs) on a cloud. The system can monitor, via the cloud VNFM, a local VNFM on a local network, the cloud VNFM, and/or the one or more cloud VNFs. Based on the monitoring, the system can determine, via the cloud VNFM, a respective status of the local VNFM, the cloud VNFM, and/or the one or more cloud VNFs. Based on the respective status of the local VNFM, the cloud VNFM, and/or the one or more cloud VNFs, the system can then scale, via the cloud VNFM, the local VNFM, the cloud VNFM, and/or the one or more cloud VNFs.

Abstract: The present invention relates to a mobile device and a control method therefor. A mobile device according to an embodiment of the present invention comprises: a memory which stores a first application and a second application; a user interface module which receives specific time information and specific location information according to the first application stored in the memory; a display module which displays a schedule including the received specific time information and specific location information; and a controller which controls the memory, the user interface module, and the display module, wherein the controller performs control so as to execute the second application stored in the memory, receive additional information on the specific location according to the executed second application, and change the schedule on the basis of the received additional information.

Abstract: A code segment executing on a compute instance may be identified as suspicious based on runtime behavior or similar behavioral analysis or the like. In order to ensure the identification and use of the most up-to-date identification and remediation tools, the compute instance may defer various remediation steps for an interval, during which the compute instance may wait for data updates from a threat management system. After the interval has passed, the compute instance may use any updated data or tools in order to address the code segment that triggered the initial malware detection.

Abstract: Some embodiments establish for an entity a virtual network over several public clouds of several public cloud providers and/or in several regions. In some embodiments, the virtual network is an overlay network that spans across several public clouds to interconnect one or more private networks (e.g., networks within branches, divisions, departments of the entity or their associated datacenters), mobile users, and SaaS (Software as a Service) provider machines, and other web applications of the entity. The virtual network in some embodiments can be configured to optimize the routing of the entity's data messages to their destinations for best end-to-end performance, reliability and security, while trying to minimize the routing of this traffic through the Internet. Also, the virtual network in some embodiments can be configured to optimize the layer 4 processing of the data message flows passing through the network.

Abstract: One embodiment provides a method for monitoring context-dependent quality of service in a shared computing environment that includes detecting, by a processor, a change in context. Context includes user context and external context, and user context comprises physical activity, mood, engagement levels and type of events. Prior assigned service classes are updated to updated service classes based on the change in context. Service level agreement (SLA) statistics for each assigned service class are aggregated and collected. Each assigned service class includes at least one SLA based on aggregate services received by individual users in that assigned service class, and aggregating SLA statistics is based on a statistical function.

Abstract: Disclosed herein are system, method, and device embodiments for executing an application program interface (API) plugin for use in conjunction with a vector editing design tool. For example, a method may include: retrieving contextual information related to a plurality of features of a design tool upon initialization of the design tool, the contextual information being stored on a remote server from one or more computing devices; detecting a placement of a first feature from among the plurality of features in a design environment of the design tool; and displaying the contextual information in the design environment in response to detecting the placement of the first feature.

Abstract: Systems and methods of rate limiting are disclosed herein. In some example embodiments, a rate limiter service receives a request from an online application to access an online resource, and the rate limiter service transmits an indication of the request to a back end system, and an enforcement decision corresponding to the online resource is received from the back end system, with the enforcement decision comprising an instruction to either permit or deny access to the online resource, and the receiving of the enforcement decision from the back end system being performed asynchronously with the receiving of the request and the transmitting of the indication. In some example embodiments, the enforcement decision received from the back end system is stored, the stored enforcement decision is accessed in response to the receiving of the request, and the request is responded to using the accessed enforcement decision.