International Business Machines Corporation

Cisco Technology, Inc.

Etai Lev-Ran

Idan Zach

Daniel Kaminsky

Zvi Cahana

Israel Zvi Ben-Shaul

Itzhack Goldberg

Israel Cidon

Leonid Vasetsky

Shriram Rajagopalan

Shahar Glixman

Maxim S Martynov

Hamid R Amirazizi

Boaz Jaschek

Examples of techniques for selectively providing mTLS using alternative server names are described herein. An example system includes a processor to generate an alternative server name in response to detecting a legacy indicator. The processor is to also associate the alternative server name with an address of a pod. The processor is to further configure a proxy associated with the pod to selectively provide mutual transport layer security (mTLS) based on the alternative server name.

Selectively providing mutual transport layer security using alternative server names

In an example computer-implemented method, a trusted root certificate for an application running in a container is dynamically generated. The generated trusted root certificate is injected at runtime. The generated certificate is dynamically added to a list of trusted root certificates. A proxy associated with the application instance is authenticated based on the generated root trust certificate.

Dynamically generating and injecting trusted root certificates

An example system and method includes a processor to receive an image ID corresponding to a container image of a container to be run. The processor is to also send the image ID to a registry. The processor is also to receive an image metadata corresponding to the image ID from the registry. The processor is to store the image metadata on a local file system. The processor is to generate a container comprising an application. The processor is to execute the application using the image metadata.

Container application execution using image metadata

In some examples, a system for managing distributed data can include a processor to detect an update notification from a client device to update a managing server, the update notification indicating that a remote server node is unavailable. The processor can also generate a comparison value by comparing a first time stamp to a second time stamp, wherein the first time stamp corresponds to a time at which the system receives the update notification from the client device and the second time stamp corresponds to a time the remote server node transmits a set of renewal data. Furthermore, the processor can determine that the comparison value indicates the remote server node is unavailable and remove the remote server node from the managing server.

Distributed data management

Embodiments of the present invention may provide techniques by which missed interactions with display advertising may be reduced or recovered. For example, in an embodiment of the present invention, a computer-implemented method for processing computer input may comprise displaying on a display screen at least one background application and a foreground item frame, removing display of the foreground item frame, and after removing display of the foreground item frame, detecting user input in the location where the foreground item frame was displayed.

Recovering missed display advertising

An example system includes a plurality of containers associated with a plurality of tenants. The plurality of containers are to execute code in isolation for the associated plurality of tenants. The system also include a container daemon communicatively coupled to the plurality of containers via an internal proxy. The container daemon is to provide a service to the plurality of containers. The internal proxy is to receive a daemon access policy. The internal proxy is to further intercept a daemon command from a container. The internal proxy is to detect that the container is allowed access to the container daemon based on the daemon access policy. The internal proxy is to also generate a modified daemon command and forward the modified daemon command to the container daemon.

Providing containers access to container daemon in multi-tenant environment

One embodiment comprises an apparatus for automatic proxy registration and discovery in a multi-proxy communication system. The apparatus executes a proxy server that is configured to provide optimized connections to remote proxy servers that are communicatively connected to the proxy server over a Wide Area Network (WAN). A file server, which is communicatively connected to the proxy server over a Local Area Network (LAN), is automatically discovered. An association record corresponding to the file server is created, where the association record identifies the file server and the proxy server and indicates that the proxy server is configured to provide the remote proxy servers with optimized connections to the file server. The association record is registered with a centralized database server, where the remote proxy servers are communicatively connected to the centralized database server over the WAN.

Automatic proxy registration and discovery in a multi-proxy communication system

Approaches are disclosed for lock optimization and lock prediction for reducing the number of client-server messages involved in working with server-based resources. First one or more lock requests for first one or more locks on a remote data resource that is linked by a slow communication link are received. Based on the first one or more lock requests, a sequence of lock requests for locks on the remote data resource is determined. A first message that includes the sequence of lock requests is sent. A second message is received. The second message includes second one or more locks on the remote data resource, where the second one or more locks correspond to second one or more lock requests of the sequence of lock requests. A particular lock of the second one or more locks is granted in response to receiving a particular lock request for the particular lock on the remote data resource.

Lock optimization and lock prediction approaches for reducing client-server messages

A method and apparatus is disclosed for balancing throughput and compression in a network communication system. A message is received. A first compression mechanism is applied to the message to generate a first compressed message, where applying the first compression mechanism comprises gathering compression information. Based on the compression information, a compression metric associated with the first compressed message is computed. The compression metric is compared to a threshold value. A second compression mechanism is applied to the first compressed message to generate a second compressed message only when the compression metric does not exceed the threshold value. The second compressed message is then transmitted.

Techniques for balancing throughput and compression in a network communication system

A method is disclosed for reducing network traffic. At a sender, a data chunk is identified for transmission to a receiver, which is connected to the sender over a communication link. The sender computes a signature of the data chunk and determines whether the data chunk has been previously transmitted by looking up the signature in a sender index table. The sender index table associates the signatures of previously transmitted data chunks with unique index values. A message is transmitted to the receiver, where if the data chunk has previously been transmitted then the message includes an index value from the sender index table that is associated with the signature of the data chunk. At the receiver, the data chunk is located in a receiver cache that stores the previously transmitted data chunks by looking up the index value included in the message in a receiver index table. The receiver index table associates the unique index values with the locations in the receiver cache of the previously transmitted data chunks.

Method and apparatus for reducing network traffic over low bandwidth links

A method and apparatus is disclosed for local access authorization of cached resources. A first request to perform an operation on a first object that is stored in a cache is received. An entity identifier associated with the entity that sent the first request, an operation identifier associated with the operation, and an Access Control List (ACL) associated with the first object are determined based on the first request. A record that includes at least the operation identifier, the ACL, and an authorization indicator is accessed. The authorization indicator indicates whether the entity has previously successfully performed the operation on any object in the cache that is associated with the ACL. Based on the authorization indicator included in the record, a determination is made whether to authorize the entity to perform the operation on the first object.

Method and apparatus for local access authorization of cached resources

A method is disclosed for accessing information based on Distributed File System (DFS) paths and for automatically and transparently modifying the DFS target server set with additional servers that are preferable to a client. A request to resolve a path to a file is sent to a DFS root node. A response is received from the DFS root node. The response includes one or more first DFS referrals. Each of the one or more first DFS referrals identifies a network entity and a directory that is exported by the network entity, where the file is stored in the directory. A second DFS referral is added to the response. The second DFS referral identifies a particular network entity and a particular directory that is exported by the particular network entity. The response is sent to the client.

Growing community of inventors

Nofit, Israel

Etai Lev-Ran