Abstract: A computing system and method to implement a three-dimensional virtual reality world having user created virtual objects. During the creation of a virtual object, a user of the virtual reality world identifies components and/or resources of the virtual object, such as a mesh model defining the shape of the virtual object, an image specifying the appearance of the virtual object, and a script defining the run time behavior of the virtual object. The computer system examines the components and/or resources duration the creation process of the virtual object to detect and/or address security threats and/or performance hurdles. Before the approval of the publication of the virtual object in the virtual world, the computer system performs a simulation of the rendering of the virtual object to detect security threats and evaluate performance impacts.

Abstract: A method includes determining, by a field instrument in an industrial process and control system, a Highway Addressable Remote Transducer (HART) mode of the field instrument. The method also includes, upon a determination, by the field instrument, that the HART mode is a HART On Demand mode, listening for a HART data signal from a HART master device; when the HART data signal is detected, communicating with the HART master device according to a HART protocol; and when the HART data signal is not detected, diverting a current supply allocated for HART communication to a BLUETOOTH Low Energy (BLE) transceiver for use in BLE communication, and communicating according to a BLE protocol.

Abstract: Systems and methods to manage and regulate the requests of multiple proxy clients are disclosed. In one aspect, the system and methods disclosed herein aids in configuring proxy server(s) with a rate-limit functionality. Configuration of the rate-limit functionality may be realized by, but not limited to, installing configuration file(s) and/or software application(s) on the proxy server(s). The configuration provides information about the list of restricted and unrestricted domains and their respective request limit specification in a given time frame. Therefore, each time before a proxy server forwards the clients' requests to a target domain, the proxy server checks and ensures that the request count to the particular target domain is well within the limit specified in the request limit specification. Thus, the embodiments described herein aid in preventing the IP addresses of proxy service providers from being blocked or denied from the target websites.

Abstract: Various embodiments of the present invention disclose a method and device for an electronic device to provide a multimedia service in an IMS network environment.

Abstract: In certain embodiments, a method includes starting an application as a first process within a user space of an operating system. The application instantiates a key-value store library associated with the operating system. The method also includes managing, by a block device service running within the user space, one or more first data blocks of a persistent storage device allocated to the key-value store library. In addition, the method includes receiving, by a kernel of the operating system, a system call request comprising an access request generated by the key-value store library. The method further includes granting, by the block device service, and in response to the access request, the key-value store library access to the one or more first data blocks through an inter process communication channel between the application and the block device service via the kernel.

Abstract: A control system is for controlling safety-critical processes, non-safety-critical processes, and/or installation components. The control system includes: at least one control unit configured to control non-safety-critical processes and/or non-safety-critical installation components, at least one safety control unit for controlling safety-critical processes and/or safety-critical installation components, and at least one input/output unit connected to the first control unit via an internal input/output bus. The control system is configured to act as communication master or as communication minion or as both in a pool having other devices that is connected via field bus, and to that end, the control system includes a master communication coupler and a minion communication coupler. The control system is modularly configurable. At least the safety control unit includes respective subunits with master functionality and subunits with minion functionalities.

Abstract: System and method for efficiently implementing scalable, highly efficient decentralized proxy services through proxy infrastructures situated in different geo-locations. In one aspect, the systems and methods enable users from any geographical location to send requests to the geographically closest proxy infrastructure. One exemplary method described allows proxy infrastructures to gather, classify, and store metadata of exit nodes in its internal database. In another aspect, systems and methods described herein enable proxy infrastructures to select metadata of exit nodes from its internal database and forward requests from a user device to respective proxy servers or proxy supernodes to which the selected exit nodes are connected.

Abstract: Certain aspects of the present disclosure provide techniques for establishing a web session between a computing device and a web-based integrated development environment to create and/or update files (e.g., content files and/or resource files). In the web session, content file(s) can be evaluated in real-time with one or more resource files. Further, in the web session, a set of validation rules of a resource file can be updated by the computing device. To stablish the web session, a first communication connection is established between the computing device and the web-based integrated development environment. With the first communication established, a second communication connection is established for real-time, bi-directional communication between the computing device and a language server instance of the web-based integrated development environment.

Abstract: An information processing method, a server, a mobile terminal, and a storage medium, to trigger value transfer through chat information, and improve a conversion rate of a social platform are discussed. An embodiment provides an information processing method. The method may include receiving, by a server, a value packet transmitting instruction, the value packet transmitting instruction being transmitted after a key word extracted from chat information by a first mobile terminal is matched with a key word library. The method may further include transmitting, by the server, value packet transfer information to a second mobile terminal.

Abstract: In various example embodiments, a system and method for a proactive customer support system are provided. In some example embodiments, outgoing communications from an application server to a client device are monitored for error messages, outgoing error messages are detected, an error type for an error message is determined, an issue ticket including the error message and the error type is generated, and instructions are transmitted that cause a customer service device to display the issue ticket. In some example embodiments, the system additionally assigns a priority score and ranks open error tickets based on their respective error messages. In some example embodiments, the system provides a help message to the client device based on the error message, receives an information request from the client device, determines a reply message based on the information request, and transmits instructions to the client device to display the reply message.

Abstract: A method, apparatus and communication system for registering address information of a network anchor point to a network server, the method including receiving, by a packet data network gateway, a request message from a mobility management entity, determining, by the packet data network gateway in response to the request message, to register identity information of the packet data network gateway to a home subscriber server, and registering, to the home subscriber server, by the packet data network gateway in response to the determining to register the identity information, the identity information of the packet data network gateway and an access point name corresponding to the packet data network gateway.

Abstract: A method for carrying out data integrity protection on a communication network. According to an implementation, a wireless communication device indicates, to a wireless network, the maximum data rate up to which integrity protection is supported for user plane data. A network node (e.g., a node of the core network, such as an SMF) receives this information and determines whether or not to enable integrity protection for user plane data based on the information (possibly in conjunction with other information such as the minimum data rate to be supported, etc.). The network node then communicates the decision to enable or disable integrity protection to a RAN node (e.g., a wireless base station).

Abstract: A first compute server of a distributed cloud computing network receives a request from a first client device for an object to be handled by an object worker that includes a single instantiation of a piece of code that solely controls reading and writing access to the first object. A determination is made that the object worker is instantiated for the object and is currently running in the first compute server, and the piece of code processes the first request. The first compute server receives a message to be processed by the first object worker from a second compute server. The message includes a second request for the object from a second client device connected to the second compute server. The piece of code processes the message and transmits a reply to the second compute server.

Abstract: Modern day user applications leverages new communication technologies such as WebRTC, WebEx, and Jabber allow devices to connect and exchange media content including audio streams, video streams, and data stream/channels. The present disclosure describes mechanisms for a Port Control Protocol (PCP) server to provide feedback to PCP clients to enforce certain policies on the transport of such media content for a network. A policy may include a traffic handling policy for enforcing differentiated quality of service characteristics for different types of media streams. Another policy may include a security policy ensuring a data files being transmitted over a data channel from one endpoint travels to a security application via a relay element before the packets reaches another endpoint. The mechanisms are transparent to the endpoints, and advantageously preserve the user experience for these user applications.

Abstract: A method, computer-readable medium, and apparatus for supporting services for customer traffic using edge clouds are disclosed. For example, a processing system may receive an indication of a set of customer devices of a customer of a network provider and an indication of a service of an edge cloud to be applied to customer traffic of the customer devices, support configuration of a network of the network provider to support a customer segment for the customer including configuration of a gateway of the network and a switch of the network that is associated with the edge cloud, support configuration of a virtual network between the switch and an edge cloud element supporting the service, and support configuration of the switch to support an association of the customer segment and the virtual network for supporting routing of the customer traffic to the service via the virtual network.

Abstract: A method, system, and computer-usable medium are disclosed for, responsive to communication of a client handshake to a server for establishing communications between the client and server, managing handshake messages between the client and server until an application layer message is communicated from the client, such that a connection between the client and the server appears to be established, and responsive to communication of the application layer message from the client, rendering a policy decision with respect to a connection between the client and the server based on a payload of the application layer message, the policy decision defining a selected path between the client and the server and including a chosen target device from a plurality of potential target devices, wherein the chosen target device is within the selected path and establishing the selected path for communication between the client and the server in accordance with the policy decision.

Abstract: A quality of service management system includes a rules engine that receives information associated with a communication path having an assigned quality of service (QoS) to be provided for a customer communication device, and identifies one or more network elements assigned to provide the communication path. Each network element having a plurality of queues configured to provide varying QoS levels relative to one another. For each of the network elements, the rules engine determines at least one queue that is configured to provide the communication path at the assigned quality of service, and transmits queue information associated with the determined queue to its respective network element, the network element conveying the communication path through the determined queue.

Abstract: Techniques and systems for recovering a communication session from a dedicated bearer failure are disclosed. For example, a P-CSCF node can determine that a dedicated bearer associated with a communication session has failed, and, in response, send a SIP message to a UE associated with the communication session, the SIP message causing the UE to refrain from sending SIP requests using a SIP INVITE method. The process may further include identifying a first network node associated with an identifier of the UE, the first network node comprising one of a PGW or a SMF, and sending an instruction to the first network node to dissociate the dedicated bearer from the communication session. This causes a new attach procedure to be performed by the UE to recover the session without session failure.

Abstract: A network manager configures a first node to participate in a node cluster that spans at least a first cloud service provider and the second cloud service provider. The network manager configures a second node to participate in the node cluster. The network manager configures a third node to participate in the node cluster. The network manager initiates the first node as a virtual machine. The network manager initiates the second node as a containerized program. The network manager initiates the third node as a containerized program. The network manager sends messages into the first cloud serves and into the second cloud service to cause the containerized program of the second node and the containerized program of the third node to synchronize data such that the containerized program of the second node and the containerized program of the first node perform the same network security actions.

Abstract: A smart network access point (SNAP) device is disclosed. In embodiments, the SNAP device includes trunk ports for accepting a network trunk cable (e.g., fiber optic trunk) and thereby connecting the SNAP device to an aircraft-based network of SNAP devices. The SNAP device includes switch ports for incorporating physical connections to mission systems (MS) or air vehicle systems (AVS) components and devices, providing a local smart point of presence (SPoP) throughout a physical subdivision (e.g., network district) of an aircraft. The SNAP device is configured for monitoring data exchanges between local MS/AVS components and the aircraft network. The SNAP device includes a cybersecurity module for connecting to local security components (e.g., data guards and multiple levels of security (MLS) encryption/decryption) or for providing built-in data guard and encryption/decryption services. The SNAP device includes power control components for managing power distribution to the connected local network components.

Abstract: Replicated instances in a distributed computing environment provide for automatic failover and recovery. A component monitors the status of event processors in a set or bucket and handles the failure of an event processor. For a large number of instances, the data environment can be partitioned such that each monitoring component is assigned a partition of the workload. At intervals, each event processor sends a “heartbeat” message to the event processors in the bucket covering the same workload partition, to inform the other event processors of the status of the event processor sending the heartbeat. If it is determined that a heartbeat is received from each event processor in the bucket, a current process can continue. In the event of monitoring component failure, the instances can be repartitioned, and the remaining monitoring components can be assigned to the new partitions to substantially evenly distribute the workload.

Abstract: Systems, methods, and other embodiments associated with branch prediction in workflows are described. In one embodiment, a method includes inputting a workflow and serially progressing through the workflow in a flow sequence and in response to the flow sequence encountering a first decision element in the workflow that includes a plurality of branch paths: (i) executing a prediction that predicts a resulting path of the first decision element to predict a first user interface from the plurality of user interfaces that may be encountered subsequently in the flow sequence as part of a first terminal element; and (ii) pre-building the first user interface that is predicted prior to encountering the first terminal element. In response to the flow sequence reaching the first terminal element, displaying the pre-built first user interface on a display device.

Abstract: A method for collaborative instantiation of remote session objects and interactive video-based modification thereof includes receiving a uniform resource locator (URL) via a first graphical user interface (GUI). A request is generated based on the URL, and is sent to a remote server. In response to the request, a data object including product data is returned, and the product data is modified, so as to generate normalized product data. A host server causes playback of a video within a second GUI that is associated with a mobile device of a user. A product selection is received at the host server during playback of the video and in response to a user interaction with the video. Normalized product data associated with the product selection is identified, and a message including the identified normalized product data is sent to the remote server to cause instantiation of a software shopping cart.

Abstract: A node may be an active node associated with a high-availability service and may route session traffic communicated via a first route path between a first endpoint and a second endpoint. The node may determine a first measurement of a traffic metric of the first route path and may receive, from another node associated with the high-availability service, a second measurement of the traffic metric of a second route path. The node may compare the first measurement and the second measurement and determine that the traffic metric is enhanced on the second route path relative to the first route path. The node may cause, via a high-availability link between the node and the other node, the other node to become the active node for routing the session traffic between the first endpoint and the second endpoint.

Abstract: A server selection devices includes: an acquisition unit for acquiring, regarding each of a plurality of servers having the same content, a list of quality information corresponding to communication environment information regarding a source of request for download of the content; and a selection unit for selecting one of the plurality of servers based on the list of the quality information regarding each of the plurality of servers and a cost associated with download of the content. Thus, a destination of a content download request can be selected while giving consideration to not only quality but also cost.

Abstract: Methods and systems for rapid deployment of virtual computing resources are described. One method includes receiving a text file defining a collection of desired virtual computing resources, the text file including a plurality of text fields defining a project name, a virtual local area network (VLAN) and a plurality of virtual servers to be provisioned within the VLAN, an IP address to be assigned, a processing capability, and a definition of disks associated with the corresponding virtual server. The method also includes executing a scheduled job to deploy a plurality of virtual computing resources according to the text file. The scheduled job parses the text file, issues commands to a provisioning interface to provision virtual computing resources, and validates provisioning of the plurality of virtual computing resources based on status messages received from the provisioning interface indicating a result of provisioning in response to each command.

Abstract: Content items queued for synchronization between a client device and a content management system can be automatically prioritized to improve the sharing process. That is, the content items can be prioritized based on whether a share link has been created to the content item. A share link can enable a user to access the shared content item from a content management system. Content items that have been shared using a share link can be given higher priority to be synchronized prior to content items that have not been shared. The queued content items can be synchronized in the synchronization order resulting from the prioritization. Further, multiple shared content items queued for synchronization can be sub-prioritized based on one or more sub-prioritization criteria.

Abstract: Disclosed are a digital device and method of processing data therein. The present invention includes a communication interface unit communicating with one or more peripheral devices, a display unit, and a controller configured to form a connectivity manager including information on one or more connectible peripheral devices and display the connectivity manager on a screen. If the information on at least one peripheral device on the displayed connectivity manager is selected, the controller connects to a first peripheral device by sending a first control signal, receives first data from the connected first peripheral device, and displays the received first data on the screen. If the connectivity manager is called and information on a second peripheral device is selected, the controller connects to the second peripheral device by sending a second control signal and transmits the first data to the connected second peripheral device.

Abstract: A method for providing a user agent (UA) with service identification data. The method includes an application server (AS) transmitting Session Initiation Protocol (SIP) data. The SIP data comprises an identifier of the AS and a service identifier for at least one service supported by the AS. The method further includes the UA receiving the SIP data.

Abstract: A mechanism for adaptively performing in-band network telemetry (INT) by a network controller is disclosed. The mechanism includes receiving one or more congestion indicators from a collector. An adjusted sampling rate is generated. The adjusted sampling rate is a specified rate of insertion of instruction headers for INT and is generated based on the congestion indicators. The adjusted sampling rate is transmitted to a head node, which is configured to perform INT via instruction header insertion into user packets.

Abstract: The present disclosure relates generally to techniques for extending or customizing base skills (e.g., chatbots). According to certain embodiments, a bot extension infrastructure is provided to facilitate customization and/or extension of base skills, separately tracking different versions of the base skills and the extensions, applying an extension to different versions of a base skill, or applying different versions of extensions to a same base skill. The extensions to the base skills include JSON extensions indicating modifications to metadata of the base skills. A base skill (e.g., downloaded from a skills store) can be extended or customized by applying a JSON extension that describes the changes to be made to the metadata of the base skill.

Abstract: The present disclosure relates to a communication method and system for converging a 5th-Generation (5G) communication system for supporting higher data rates beyond a 4th-Generation (4G) system with a technology for Internet of Things (IoT). The present disclosure may be applied to intelligent services based on the 5G communication technology and the IoT-related technology, such as smart home, smart building, smart city, smart car, connected car, health care, digital education, smart retail, security and safety services. A method performed by a source edge enabler server for selecting a target edge application server in an edge computing system for a user equipment (UE) is provided.

Abstract: The present disclosure involves systems, software, and computer implemented methods for access control for object instances. A method includes receiving, at a cloud application, a user request associated with a user. The user request corresponds to an instance of a first application artifact type. Role assignments for the user are retrieved from a cloud platform and a determination is made that the role assignments grant permission to the first application artifact type to the user. A determination is made that a first instance-based access policy exists for the first application artifact type. A determination is made regarding whether the first instance-based access policy grants permission for the user to access the instance. The user request is serviced in response to determining that the first instance-based access policy grants permission for the user to access the instance.

Abstract: Once participants participate in a video conference the state of information during that video conference is retained for those participants. At a future time, when those participants again meet in a video conference the state of information that was retained is retrieved and presented for them again in the subsequent video conference based upon their identifiers. Information such as the whiteboard, the chat window, shared files, camera settings, images, background, video recording, etc. are retrieved and automatically presented in the new video conference. Alternatively, a participant may be asked if the state of information from a previous video conference should be retrieved. When a participant joins a conference, the current participants grant permission or not for the current contents to be viewed by the new participant. When a participant leaves the conference, or when they all leave, a triggering condition saves the state.

Abstract: According to an example aspect of the present invention, there is provided A controllable loudspeaker, the loudspeaker comprising a speaker element and a digital signal processor comprising at least one processing core and at least one memory including computer program code, the at least one memory and the computer program code being configured to receive a multicasted control signal, alter the behavior of the loudspeaker in response to the said control signal, wherein the altering of the behavior comprises applying settings stored in the memory of the digital signal processor of the loudspeaker.

Abstract: A virtual delivery appliance may include a memory and a processor configured to cooperate with the memory to connect client computing devices with virtual computing sessions provided by a host computing device(s) based upon respective connection leases each including an ordered list of virtual delivery appliances, with at least some of the client computing devices having different ordered lists of virtual delivery appliances. Each client computing device may be configured to request a new session from the virtual delivery appliances in the ordered list in descending order until receiving a connection with a new virtual computing session. The processor may be further configured to re-direct new session requests received from the client computing devices to lower virtual delivery appliances in the ordered list when existing virtual computing sessions for the client computing devices are already active with the host computing device(s) associated with the lower virtual delivery appliances.

Abstract: A method is provided that provides information exchange between mobile devices that are near each other. Upon determining that a first mobile device is located near a second mobile device, information is exchanged between a first virtual personal assistant associated with the first mobile device and a second virtual personal assistant associated with the second mobile device. The information is compared to identify an overlapping topic in the information. If there is overlapping information, the users of the mobile devices are alerted to the overlapping topic.

Abstract: A method for measuring available bandwidth includes a transmit end that sends a first probe sequence to a receive end, and receives a first available bandwidth measurement result from the receive end, the transmit end determines a second probe sequence based on the first available bandwidth measurement result, where the second probe sequence includes a group of probe packets with increasing sending rates, a range of the sending rates of the second probe sequence is the same as a range of the sending rates of the first probe sequence, the transmit end sends the second probe sequence to the receive end, and receives the second available bandwidth measurement result from the receive end, and the transmit end obtains the available bandwidth based on the second available bandwidth measurement result.

Abstract: A scalable cloud-based platform for computer services includes a service router configured to receive a connection request to one or more services from each of one or more clients. Upon establishing the connection via appropriate handshake protocol, the connection remains persistent until the requested service is completed. The system further includes a container manager configured to load and process each service of a plurality of services in a separate container and a resource connection manager configured to provide mapping of one or more resources to the loaded services.

Abstract: An edge system receives requests from user devices to retrieves files from an origin server. Instead of retrieving the files as fast as possible, the edge system throttles the retrieval of files to a rate that just exceeds the speed at which the file is played by a browser or media player. The edge system determines an appropriate retrieval rate based on the contents of the file itself. For example, a manifest file associated with the file can indicate a time it takes to play back content and a bitrate of the content. Thus, the edge server can use this information to retrieve a file from an origin server at a rate that is just fast enough to minimize playback interruption. The retrieval rate determined by the edge server therefore does not rely on how fast or slow the user device retrieves the file from the edge server.

Abstract: A digital data processing system includes a server digital data processor that maintains (i) one or more tables, each comprising records or other structured data (collectively, “records”), (ii) a schema for each of the remote app and of one or more of the tables dedicated to or associated with the app, where each schema comprises a collection of metadata for the respective app or table. A client digital data processor is at least intermittently connected for communications with the server, and a remote app executes on that client digital data processor. The app includes instructions to cause that digital data processor request a record from one of the tables, to update data in that record and to request storage of the update back to that table. The remote app utilizes the schemas to prefetch data from the one or more tables dedicated to or associated with the app.

Abstract: Embodiments of the present invention provide a network resource management method, an apparatus, and a system. The method includes: receiving, by a first management unit, a service request message, where the service request message is used to manage a target service, and the service request message carries target-service requirement information; determining, based on the service request message, a network resource that meets the target-service requirement information; or determining based on the service request message, network resource requirement information corresponding to the target-service requirement information, and sending, by the first management unit, a resource request message to a second management unit, where the resource request message is used to request the network resource, and the resource request message carries the network resource requirement information.

Abstract: A system and method are provided for executing a notification service. The method includes accessing, via a communications module, a first repository of event data stored by an event monitoring layer connected to at least one entity in an enterprise, the first repository of event data being asynchronously updated by the event monitoring layer on an ongoing basis by the at least one entity communicating with the event monitoring layer. The method also includes detecting, by accessing the first repository of event data via the communications module, an actionable item requiring a notification. The method also includes accessing, via the communications module, a second repository comprising at least one of rules, hierarchies and thresholds, to determine at least one parameter for the notification. The method also includes sending the notification via the communications module to at least one client device user according to the at least one parameter.

Abstract: Embodiments are directed to stateless communication using a stateful protocol. One or more NTMAs may establish a connection with a client computer based on data exchanged with a the client computer using the stateful protocol. The exchanged data may include validation information provided by the one or more NTMAs. The exchanged data and other information associated with the connection may be discarded from one or more memories of the one or more NTMAs. A network packet communicated over the network using the stateful protocol may be obtained. Verification information and candidate validation information may be generated based on one or more characteristics of the network packet. The network packet may be validated based on a comparison of the verification information and the candidate validation information. A reply that adheres to the stateful protocol may be provided to the client computer based on the validated network packet.

Abstract: A system designed for increasing network communication speed for users, while lowering network congestion for content owners and ISPs. The system employs network elements including an acceleration server, clients, agents, and peers, where communication requests generated by applications are intercepted by the client on the same machine. The IP address of the server in the communication request is transmitted to the acceleration server, which provides a list of agents to use for this IP address. The communication request is sent to the agents. One or more of the agents respond with a list of peers that have previously seen some or all of the content which is the response to this request (after checking whether this data is still valid).

Abstract: Systems and methods are described for connecting to a wireless network. In an aspect, when a wireless device is brought to an area in which two wireless networks are accessible, for example a public network and a private network, the device can reject a connection to the public network and connect to the private network based on an association between the device and the user.

Abstract: The present technology pertains to receiving a tag associating at least one routing domain in an on-premises site with at least one virtual network in a cloud environment associated with a cloud service provider. The present technology also pertains to the automation of populating route and propagation tables with the cloud service provider.

Abstract: Alarm issue management for a building automation system comprising a decentralized ledger as well as first, second, and third systems. The decentralized ledger has immutable transaction records validated and secured by a network of peer-to-peer nodes, and the ledger utilizes proof of work to synchronize the nodes. The first, second, and third systems access the transaction records of the ledger relating to a remediation type of a building automation system. The first system provides a first transaction record to the ledger relating to the remediation type. The second system reads the first transaction record of the ledger and provides a second transaction record to the ledger relating to the remediation type based on the first transaction record. The third system reads the first and second transaction records of the ledger and performs an audit of the first and second transaction records of the ledger relating to the remediation type.

Abstract: A rich communication services (RCS) system may receive a message associated with content. The message may be transmitted by a first user device and destined for a second user device and associated with content. The RCS system may receive subscription data associated with a user of the first user device and including information indicating whether content filtering is enabled for the user. The RCS system may determine whether content filtering is enabled for the user based on the subscription data, and may process the content, when the content filtering is enabled for the user and with a machine learning model, to determine whether to filter the content. The RCS system may perform one or more actions based on whether the content is to be filtered.

Abstract: Various methods and systems are provided for providing on-demand emergency management. On-demand emergency management includes emergency management operations (e.g., certificate update operations or managed-secrets rollover operations) for accelerated deployment and expedited installation of certificates or secrets. In operation, a host secret manager on a host machine communicates with client secret managers on virtual machines running the host machine, to provide expedited installation of secrets on the virtual machines. During the certificate update operations, the host secret manager communicates the certificate update secret package having a new secret state to a client secret manager that installs the new certificate state on the virtual machine.