Abstract: According to one embodiment, an Information Handling System (IHS) includes at least one storage unit that conforms to an NVMe specification and first and second BMCs. The BMCs are in communication with the storage unit and each configured with computer-executable instructions to negotiate with the second BMC, whether first or second BMC is to be an active BMC such that the other of the first or second BMCs becomes a passive BMC. When the first BMC is the active BMC, allow shared commands to be issued to a storage unit conforming to a Non-Volatile Memory Express (NVMe) specification; otherwise, inhibit the shared commands from being issued to the storage unit.

Abstract: A vendor of virtual machine images accesses a virtual computer system service to upload a digitally signed virtual machine image to a data store usable by customers of the virtual computer system service to select an image for creating a virtual machine instance. If a digital certificate is uploaded along with the virtual machine image, the virtual computer system service may determine whether the digital certificate has been trusted for use. If the digital certificate has been trusted for use, the virtual computer system service may use a public cryptographic key to decrypt a hash signature included with the image to obtain a first hash value. The service may additionally apply a hash function to the image itself to obtain a second hash value. If the two hash values match, then the virtual machine image may be deemed to be authentic.

Abstract: A processing system comprising a first sub-circuit configured to be powered by a first supply voltage and a second sub-circuit configured to be powered by a second supply voltage. The first sub-circuit comprises a general-purpose input/output register. The second sub-circuit comprises: a storage circuit configured to selectively store configuration data from the general-purpose input/output register; an input/output interface, at least one peripheral and a selection circuits to exchange signals of the peripherals, and the stored configuration data with the input/output interface. A power management circuit is configured to manage a normal operating mode, and a low-power mode during which the configuration data are maintained stored and the first sub-circuit is switched off. The power management circuit activates the low-power mode in response to receiving a commands, and resumes the normal operating mode in response to a wake-up events.

Abstract: A recording medium stores a program for causing a computer to execute processing including: acquiring a first process execution time and energy consumption of a first processor core in the execution time when a process executed by the first processor core is switched from a first process to a second process; specifying one or more processes of a first process group to which the first process belongs, from among process groups each of which is a group of processes and calculating an index that indicates the energy consumption per unit time involved in execution of the first process group based on the execution time and the energy consumption acquired for the specified one or more processes; and controlling an operation of a processor core to which the process is allocated according to comparison between the index calculated for the first process group with a threshold.

Abstract: A computing device includes a read cache file to store a network driver, and a processor to execute the read cache file to run the network driver to connect the computing device to a communications network. A streamed base disk image is received from a server via the communications network that is used to boot the computing device.

Abstract: It is an object of the present disclosure to improve robustness against an unintended alteration in data in a volatile memory. An information processing apparatus has a storage unit storing two or more boot programs; a determination unit configured to determine the validity of each of the boot programs; an information generation unit configured to generate volatile information; and a selection unit configured to extract the volatile information at random, selects one of the boot programs on a basis of the extracted volatile information, and in a case where the determination unit determines that the selected boot program is not valid and that another one of the boot programs is valid, perform a process of overwriting the selected boot program with the another boot program.

Abstract: Techniques are disclosed relating to securing computing devices during boot. In various embodiments, a secure circuit of a computing device generates for a public key pair and signs, using a private key of the public key pair, configuration settings for an operating system of the computing device. A bootloader of the computing device receives a certificate for the public key pair from a certificate authority and initiates a boot sequence to load the operating system. The boot sequence includes the bootloader verifying the signed configuration settings using a public key included in the certificate and the public key pair. In some embodiments, the secure circuit cryptographically protects the private key based on a passcode of a user, the passcode being usable by the user to authenticate to the computing device.

Abstract: A system and method for detecting an anomaly based on user interaction with a mobile computing device is disclosed. The method includes activating, on the mobile computing device, an application, which is configured to store the machine learning model and the behavioral profile generated by the machine learning model in the memory of the mobile computing device; receive, track, and store in the memory of the mobile computing device an input pattern including navigation information and identification information inputted from the user during the user interaction with the mobile computing device; detect anomaly based on the user interaction with the mobile computing device by comparing the stored behavioral profile with the stored input pattern; and prohibit user to have further access to the financial application including user accounts in response to detection of the anomaly.

Abstract: A method for configuring a peripheral bus of an information handling system performs, as part of a boot sequence, an initial configuration of a chipset setting pertaining to the bus based on a descriptor stored in a nonvolatile storage resource. After an operating system is loaded, a controller detects a peripheral device connecting to the bus and responds by performing a runtime configuration of the chipset setting based on capability information obtained from the peripheral device. The peripheral bus may comprise a USB pipe and a USB-C type connector, wherein the peripheral device is detected by a USB power delivery (PD) controller based on configuration channel (CC) pins of the USB-C connector. The PD controller may signal the chipset and send the device’s capability information to the chipset. The PD controller may assert a PMCALERT# signal of the chipset’s and send the capability information via a system management link (SMLink1).

Abstract: A method for setting a printer performs initial setup of the printer by using a setting image displayed on a terminal device. The method includes displaying, in a chat style in the setting image, a plurality of information logs regarding the initial setup of the printer, an instruction information log regarding instruction information including an instruction for a user who operates the printer, and a response log regarding a user response input by the user in response to the instruction information.

Abstract: A basic input/output system (BIOS) may load an embedded operating system (EOS), and the light-weight EOS may operate as a single captive portal for all pre-boot operations. With a single captive portal, the EOS may provide a multi-task environment to facilitate quicker execution of multiple pre-boot tasks within a single environment to reduce a number of reboots. In some embodiments, power consumption by performing the tasks within the EOS may be reduced by executing operations using a low-power core of an information handling system, such as a “little” core of a system on chip (SoC) having multiple “big” and “little” cores or a hybrid core of an information handling system. More generically, the EOS may execute on one or both of a first processor core and second processor core of an information handling system, in which the first and second processor cores are configured differently.

Abstract: Techniques for peer node recovery can include: receiving a notification regarding an occurrence of a trigger condition which indicates to perform recovery processing for a first storage device of a first node, wherein the first storage device is used as a boot device for the first node; and responsive to receiving the notification of the trigger condition, performing recovery processing for the first storage device of the first node comprising: performing a network boot of the first node over an internal network connection using a preboot execution (PXE) server of the second node; reimaging the first storage device of the first node using content from a second storage device of the second node, wherein the content includes a bootable partition comprising an operating system; and using the bootable partition of the first storage device of the first node, booting the first node to load and run the operating system.

Abstract: A cluster of computer systems, each of which is configured with a virtualization software layer to support execution of virtual computing instances, includes a first computer system in which a first virtual computing instance is executing, the first computer system including a first local storage unit in which a first log file is stored to capture write operations to a virtual disk of the first virtual computing instance. The cluster also includes a second computer system, networked to the first computer system, in which a second virtual computing instance is executing, the second computer system including a second local storage unit in which a second log file is stored to capture write operations to a virtual disk of the second virtual computing instance and in which a replica of the first log file is stored.

Abstract: A system manages access to an asset using a separate physical cryptographically-secure key device. A memory stores a public key as an unalterable record. An access configuration controller reads the public key from the memory to control the access to the asset. The public key is cryptographically paired with a private key securely recorded in the separate physical cryptographically-secure key device. The access configuration controller receives an access control change instruction signed by the private key and verifies a valid signing of the access control change instruction by the private key using the public key read from the memory. A storage system secured by the access configuration controller stores access authorization records managing access to the asset. The access configuration controller alters access authorization records according to the access control change instruction, responsive to verification of the valid signing of the access control change instruction.

Abstract: An electronic device and a code patching method are provided. The electronic device includes a processor, a read-only memory (ROM), and a one-time programmable (OTP) memory. The ROM stores a boot code, and the boot code includes at least one checkpoint code segment. The OTP memory stores at least one patch code. The processor executes the boot code and queries whether there is a corresponding patch code in the OTP memory when the checkpoint code segment is executed, and if yes, executes the corresponding patch code.

Abstract: Process flow graphs are generated from system trace data by obtaining raw distributed trace data for a system, aggregating the raw distributed trace data into aggregated distributed trace data, generating a plurality of process flow graphs from the aggregated distributed trace data, and storing the plurality of process flow graphs in a graphical store. A first critical path can be determined from the plurality of process flow graphs based on an infrastructure design for the system and a process flow graph corresponding to the first critical path provided for graphical display. Certain examples can determine a second critical path involving a selected element of the first critical path and provide the process flow graph for the second critical path for display. Some examples pre-process the aggregated distributed trace data to repair incorrect traces. Other examples merge included process flow graphs into longer graphs.

Abstract: Techniques in electronic systems, such as in systems including a processing chip and one or more external memory chips, provide improvements in one or more of system security (such as intrusion and/or virus/malware prevention), performance, cost, and efficiency. For example, the processing chip includes at least one CPU and circuitry enabling the at least one CPU to securely boot from an external, non-volatile memory chip containing encrypted, executable code. The circuitry comprises immutable hardware to copy the executable code from the non-volatile memory to another external memory from which the at least one CPU is able to access it. The encryption uses a key created at a manufacturing time of and unique to the processing chip that is never CPU-accessible, forming a secure hardware association between the processing chip and the non-volatile memory chip.

Abstract: A method includes receiving, by a processing device of a client device from an external storage device, an operating system image, the operating system image to provide a testing environment for the client device; loading the operating system image into memory of the client device; and providing, by the processor of the client device, testing information via the testing environment.

Abstract: A system and method for scanning of virtual machine images. The method includes creating a virtual machine instance of a virtual machine based on a virtual machine image of the virtual machine and an application programming interface (API) of an environment in which the virtual machine is to be deployed, wherein the virtual machine image has an entry point such that the virtual machine instance executes the entry point; and replacing the entry point of the virtual machine instance with a lightweight script, wherein the lightweight script is configured to retrieve a static scanner executable, to execute the static scanner executable, and to send results of the scanning.

Abstract: Systems and methods are disclosed to implement an application that can automatically download new digital certificates to verify signed code updates received by the application. In embodiments, under normal circumstances, the application uses a pinned certificate in the application's executable code to verify received updates signed using the certificate. However, if the code signing certificate changes, the application will automatically retrieve the new certificate from a certificate publishing service. Accordingly, the new certificate does not have to be included as part of the code update package, and the retrieval of the new certificate can be managed more robustly by the application updater. In embodiments, downloads from the certificate publishing service may be secured using a nonce and a shared secret that is known to the service and also pinned to the application. In this way, the download process can be protected from hijacking attacks.

Abstract: A vehicular device includes a CPU. The CPU is set in a rated state in which the CPU operates at a rated operating clock and a high speed state in which the CPU operates at an operating clock higher than the rated operating clock. The high speed state is changeable in the operating clock and the rated state is not changeable in the rated operating clock.

Abstract: In an example, a computing device includes a non-volatile storage device to store a basic input/output system (BIOS) variable. Further, the computing device includes a BIOS. During a boot process of the computing devices, the BIOS may read the BIOS variable from the non-volatile storage device. Further, the BIOS may detect that an application is to be deployed in the computing device based on the BIOS variable. Furthermore, the BIOS may load an application package from the non-volatile storage device into a volatile storage device and build an advanced configuration and power interface (ACPI) data structure with the application package loaded in the volatile storage device. Further, the BIOS may deploy the application using the ACPI data structure.

Abstract: An information handling system may include a processor and a basic input/output system configured to identify, test, and/or initialize information handling resources of the information handling system, and further configured to predict a volume of incoming telemetry data collected by a preboot driver of the basic input/output system and based on the volume predicted, manage storage of the telemetry data among memory associated with the basic input/output system.

Abstract: A method, a computing device, and a non-transitory machine-readable medium for booting a virtual machine. In response to a launch or initialization of a virtual machine, the virtual machine may attach a boot volume within a cloud-associated storage system. The boot volume contains a boot program. The boot program is loaded to the virtual machine from the boot volume. The virtual machine uses the boot program to acquire a boot configuration that includes a set of parameters and one or more commands for interfacing with a networked storage system and attaching a root volume within the networked storage system using a network-based storage interface protocol. The virtual machine boots its operating system from the root volume within the networked storage system.

Abstract: Disclosed are systems and methods for securing a network including one or more network nodes connecting a plurality of network connected devices of the network. A method may include: receiving and temporarily storing a plurality of data packets in a shared buffer of a network node; receiving requests from a first processing engine and a second processing engine to access a temporarily stored data packet; generating a first pointer and a second pointer to the temporarily stored data packet, the second pointer being different from the first pointer while pointing to the same temporarily stored data packet; and enabling the first processing engine to use the generated first pointer to access the temporarily stored data packet and the second processing engine to use the generated second pointer to access the temporarily stored data packet.

Abstract: Technologies for providing efficient pooling for a system that includes a hyper converged infrastructure. A sled of the system includes a network interface controller that includes a first bridge logic unit to communicatively couple to a network of bridge logic units. The first bridge logic unit is further to obtain, from a requestor device, a request to access a requested device, determine whether the requested device is on the present sled or on a remote sled different from the present sled, selectively power on, in response to a determination that the requested device is located on the present sled, the requested device, communicate, in response to a determination that the requested device is on the remote sled, with a second bridge logic unit of the remote sled, and provide, to the requestor device through the first bridge logic unit, access to the requested device.

Abstract: An electronic circuit includes a data bus, a first module, and a second module. The first module is coupled to the data bus and corresponds to a first address. The first module performs a first function and includes a first storage location for first configuration data for the first function and first error checking data. The first module also includes a first local configuration checker having a first identification code. The first error checking data is based on the first configuration data and the first identification code. The second module is coupled to the data bus and corresponds to a second address. The second module performs a second function and includes a second storage location for second configuration data and second error checking data. The second module also includes a second local configuration checker having a second identification code that is distinct from the first identification code.

Abstract: A system to facilitate operating system (OS) installation is described. The system includes a server and rack controller, including one or more processors to generate an imaging service comprising an OS image container, transmit data via a first network to initiate a boot up process at a server and download an OS image included in the OS image container via a second network, wherein the second network is separate from the first network.

Abstract: A server is provided. The server includes a Basic Input/Output System (BIOS) memory, a storage device, and a processing unit. The BIOS memory stores a BIOS code, and the BIOS code provides a BIOS setup menu and a saving option in the BIOS setup menu for setting information of a plurality of BIOS setup items. The processing unit is coupled to the BIOS memory and the storage device. The processing unit executes the BIOS code during a power-on self-test (POST) process of the server. When executing the saving option, the processing unit stores the setting information of the plurality of BIOS setup items into the BIOS memory and the storage device, and the processing unit also stores a designated file name into the storage device, the designated file name corresponding to the setting information of the plurality of BIOS setup items that is stored into the storage device.

Abstract: A system, method and program product for handling potentially problematic events in an enterprise computing platform. A method is disclosed that includes: determining whether a received event includes a feature driven folder processing event; in response to a determination that the event is not a feature driven folder processing event, process the event and determine whether a file count for a folder is impacted; in response to the file count being impacted, evaluate the file count relative to a set of processing thresholds to determine which feature driven folder processing events are enabled for the folder, and to update associated metadata for the folder; and in response to a determination that the event is a feature driven folder processing event, using the computing device to check the metadata for an associated folder to determine whether a requested feature is enabled.

Abstract: The present disclosure generally relates to reducing boot latency of memory devices in a dual boot system. The boot code is loaded to the data storage device controller in a flexible manner by being able to receive chunks of the boot code from two separate locations, the host memory buffer (HMB) and the memory device, which may be a NAND device. Part of the boot code may be received from the HMB and another part of the boot code may be received from the memory device. If either the HMB or the memory device can deliver the chunks faster than the other, then the controller can receive the chunks from the faster location and periodically confirm the speed of delivery to ensure the boot code latency is optimized.

Abstract: The disclosed technology relates to solutions for improving a firmware update mechanism and in particular, for improving a firmware update mechanism of a power distribution board by utilizing different boot procedures. A process of the disclosed technology can include steps for receiving, at a microcontroller, a firmware update, wherein the firmware update is transmitted by a computer powered by a power distribution board associated with the microcontroller, initiating, by the microcontroller, a warm boot procedure using the firmware update, and marking the warm boot procedure as successful if a message received from the computer indicates that the firmware update is successful. In some aspects, the process can further include steps for determining a power reset of the computer, initiating, by the microcontroller, a cold boot procedure using the firmware update, and marking the firmware update as proven if the message from the computer indicates that the firmware update is successful.

Abstract: There is provided a secured computer system, comprising a processing and memory unit (PMU) operatively connected to an input peripheral and an output peripheral. The PMU comprises a system memory comprising a protected memory and a shared memory, and a processor operatively coupled to the system memory, the processor including a set of instructions for enabling secure data storage and execution via the protected memory. The PMU further comprises an operating system and a group of modules executable by the operating system, each module in the group of modules having a designated secure region to be executed within the protected memory, the group of modules is configured to create authentication and share the input data securely via the shared memory accessible thereto using a composite key, the composite key generated within the group using data sharing mechanism between the designated secure regions enabled by the set of instructions.

Abstract: A configuration template management system for a building includes one or more memory devices configured to store instructions thereon. When executed by one or more processors, the instructions cause the one or more processors to monitor a location of a device having a plurality of configurable settings within an environment. The environment has a first geofenced zone associated with a first configuration template and a second geofenced zone associated with a second configuration template. The instructions further cause the one or more processors to detect that the device is within the first geofenced zone based on the monitored location of the device. The instructions further cause the one or more processors to cause the device to adopt the first configuration template based on the detection that the device is within the first geofenced zone.

Abstract: A control apparatus includes a processor, a storage controller, and a boot loader memory. The processor executes a control process using data stored in a main memory. The storage controller includes a storage device, stores stored data in an encrypted state if an encryption function is enabled, and stores the stored data in the storage device in a non-encrypted state if the encryption function is disabled. The stored data includes a memory image related to a state of the main memory after completion of an activation process of an operating system. The boot loader memory is configured to store instructions that cause the processor to (a) activate the operating system using the memory image in response to a determination that the encryption function is disabled and (b) activate the operating system without using the memory image in response to a determination that the encryption function is enabled.

Abstract: Systems and methods for advanced data and program protection are provided. Some embodiments extend the data-at-rest protection naturally provided by some self-encrypting drives in order to provide additional assurances to data-in-motion and data-in-use in the host computer to which the attached storage device is attached. In some embodiments, this protection is available even if only intermittently attached, and it requires no software to be installed on the host machines because the software run on the host is run in the host off the attached storage drive itself.

Abstract: In a threat management platform, a number of endpoints log events in an event data recorder. A local agent filters this data and feeds a filtered data stream to a central threat management facility. The central threat management facility can locally or globally tune filtering by local agents based on the current data stream, and can query local event data recorders for additional information where necessary or helpful in threat detection or forensic analysis. The central threat management facility also stores and deploys a number of security tools such as a web-based user interface supported by machine learning models to identify potential threats requiring human intervention and other models to provide human-readable context for evaluating potential threats.

Abstract: The present disclosure provides systems and methods for timed unlocking and locking of hardware intellectual properties obfuscation. One such method includes determining whether received key inputs match a functional key sequence of an integrated circuit or a test key sequence of the integrated circuit; permanently enabling operation of the integrated circuit responsive to the received key inputs being determined to be a functional key sequence for permanently enabling operation of the integrated circuit; temporarily enabling operation of the integrated circuit responsive to the received key inputs being determined to be the test key sequence for temporarily enabling operation of the integrated circuit to perform testing of the functionality and disable thereafter; and locking sequential logic and combinational logic of the integrated circuit if the received key inputs are determined to not be either the functional key sequence or the test key sequence. Other systems and methods are also provided.

Abstract: Described is a system where memory can be allocated for use by an adapter pre-boot and preserved for use post-boot. A BIOS can allocate for pre-boot hardware operations (e.g., graphics drivers, framebuffers, etc.) and mark this allocated memory as preserved. An indication of the allocated memory can be provided for an OS, such that post-boot, the OS can reclaim and reallocate this memory.

Abstract: A processing device sets a first flag that indicates whether a first critical security parameter (CSP) file exists. The first CSP file includes a first set of CSPs for a memory device. The processing device sets a second flag that indicates whether the first CSP file is valid. The processing device sets a third flag that indicates whether a second CSP file exists. The second CSP file includes a second set of CSPs for the memory device. The processing device sets a fourth flag that indicates whether the second critical security parameter file is valid. The processing device selects one of the first or second CSP file as an active CSP file based on an evaluation of the first, second, third, and fourth flags.

Abstract: A system includes a memory and a processor, where the processor is in communication with the memory. The processor is configured to receive a request to create a tenant schema within a database, where the database includes one or more tenant schemas associated with one or more tenants. The tenant schema associated with a tenant of the one or more tenants is created, where the tenant schema is empty. It is determined whether the database includes a template schema. Upon determining the template schema exists, command is sent to the database to copy the template schema to the tenant schema associated with the tenant.

Abstract: In a method for configuring a Software Defined Radio (SDR) capable user equipment, the SDR capable user equipment wirelessly loads an SDR program from a radio access network. The SDR capable user equipment executes the loaded SDR program, the SDR program on execution configuring the SDR capable user equipment to support a desired wireless communication technology. The SDR capable user equipment loads the SDR program using a dedicated SDR configuration channel, the dedicated SDR configuration channel being disjoint with any communication channel defined by the desired wireless communication technology. The SDR capable user equipment scans a predetermined frequency spectrum searching a broadcasted beacon. The SDR capable user equipment receives the broadcasted beacon and tunes to the dedicated SDR configuration channel or a subchannel thereof pointed to by a pointer for loading the SDR program.

Abstract: A management apparatus, a management method, and a storage medium that can appropriately deny an application intended not to change a software configuration of a device are provided. The management apparatus includes: an acceptance unit that accepts, from an applicant, an application intended not to change a software configuration of a device; and a processing unit that denies the application based on the number of times of applications accepted by the acceptance unit.

Abstract: Disclosed herein are techniques for forming a thin-film circuit layer on an array of light-emitting diodes (LEDs). LEDs in the array of LEDs can be singulated by various processes, such as etching and ion implantation. Singulating LEDs can be performed before or after forming the thin-film circuit layer on the array of LEDs. The array of LEDs can be bonded to a transparent or non-transparent substrate.

Abstract: A method and a computer readable medium comprising instructions for upgrading a firmware of a peripheral device connected to a host device via a Peripheral Component Interconnect Express (PCIe) bus from the operating system (OS) of the host device is disclosed. In one embodiment, the method and computer readable medium instructions includes halting host device access to the peripheral device after detecting the peripheral device has completed a shutdown sequence, and resetting the peripheral device after a predetermined time period after completion of the shutdown sequence. The method and computer readable medium instructions further includes initializing the firmware stored in a persistent storage location of the peripheral device, and re-establishing a connection between the peripheral device and the host device. In one embodiment, the predetermined time period is greater than a time it takes for the host device to detect the peripheral device has completed the shutdown sequence.

Abstract: A system and device for expanding accessible memory of a processor is provided. An interposer is coupled to the processor and a memory module. The interposer is coupled to a first connection and a second connection. The interposer includes a memory controller circuit. The memory controller circuit receives signals from the processor, using the first connection, and transmits the received signals to the memory module, using the second connection. The interposer expands memory access without an unnecessary second processor.

Abstract: A solution is disclosed for computer hardware replacement using performance analytics that selects replacement computer hardware based on actual user needs and enterprise priorities. Key performance data is collected and compared with various baselines, thereby identifying hardware that is performing below acceptable levels. Enterprise data and collected data are received from an instrumented operating system on a computing device. The collected data includes boot performance, application performance, and hardware performance. Based at least on the collected data, a usability score is determined by performing a weighted calculation on the collected data. Based at least on the usability score and the enterprise data, it is determined whether a score improvement is required. Based at least on the enterprise data, a score improvement selection is determined. The score improvement selection is reported based at least on determining that a score improvement is required.

Abstract: Various aspects of the present disclosure generally relate to wireless communication. In some aspects, a user equipment (UE) may monitor a wakeup signal search space (WUS-SS) set for a physical downlink shared channel (PDCCH) wakeup signal (WUS). The UE may detect the PDCCH WUS in the WUS-SS set based at least in part on monitoring the WUS-SS set. Numerous other aspects are provided.

Abstract: An apparatus comprises a processing device configured to receive a request to boot a given computing device to a primary environment and, responsive to receiving the request, to obtain first inventory information for components of the given computing device utilizing a preinstallation environment of the given computing device. The processing device is also configured to analyze the first inventory information and second inventory information to determine whether there any changes in the components of the given computing device prior to booting the given computing device to the primary environment, the second inventory information being previously stored in a support environment of the given computing device. The processing device is further configured to generate notifications based at least in part on determining that there are one or more changes in the components of the given computing device, and to provide the notifications at a user interface of the given computing device.

Abstract: Database systems and related customization methods are provided. One exemplary method of modifying a database to support a new functionality involves receiving user input indicative of the new functionality from a client device coupled to a network, identifying existing customizations associated with a user of the client device in the database, determining a plurality of different solutions for implementing the new functionality based at least in part on the existing customizations associated with the user, providing a graphical user interface display at the client device including graphical indicia of the plurality of different solutions for implementing the new functionality, and in response to receiving indication of a selected solution of the plurality of different solutions from the client device, automatically instantiating a new customization corresponding to the selected solution in the database.