Microsoft Technology Licensing, LLC

Landon Prentice Cox

Paramvir Bahl

Alastair Wolman

Stefan Saroiu

Yongguang Zhang

Bozidar Radunovic

Ganesh Ananthanarayanan

Xenofon Foukas

Yu Yan

Sharad Agarwal

Manikanta Kotaru

Varun Gandhi

Shadi Abdollahian Noghabi

Eduardo A Cuervo Laffaye

Lixiang Ao

Sandeep Maurice Dsouza

The system disclosed herein is composed of a network API gateway that is configured to assign credentials to a call to an operator network. The call is initiated based on a request received from an application. The credentials are used by an operator API to authenticate the call. The network API gateway creates and uses a connectivity representation as a basis for assigning the credentials to the call. The credentials are generated by the application making the request and the credentials are passed to the network API gateway as part of a translation session (e.g., five minute time interval) during which the network API gateway translates requests for the application. Consequently, each request sent by the application to the network API gateway during the translation session no longer needs its own credentials, and thus, the developer is released from the requirement of managing credentials for each request.

Network API credentials within a translation session

Systems and methods are provided for performing privacy transformation of data to protect privacy in data analytics under the multi-access edge computing environment. In particular, a policy receiver in an edge server receives privacy instructions. Inference determiner in the edge server in a data analytics pipeline receives data from an IoT device and evaluates the data to recognize data associated with personally identifiable information. Privacy data transformer transforms the received data with inference for protecting data privacy by preventing exposure of private information from the edge server. In particular, the privacy data transformer dynamically selects a technique among techniques for removing information that is subject to privacy protection and transforms the received data using the technique. The techniques includes reducing resolution of image data such that inference enables object recognition without sufficient details to prevent other servers in the data analytics pipeline to determine identifies of the object deeper inferences.

Privacy transformations in data analytics

A method for improving efficiency of routing edge compute traffic from a user equipment (UE) to an edge compute server at a far edge of a cellular network includes provisioning a near edge control unit (CU) and a near edge user plane function (UPF) at a near edge of the cellular network. The method also includes provisioning a far edge CU, a far edge UPF, and an edge compute workload at the far edge. The method also includes receiving UE traffic at one or more distributed units located at the far edge. The UE traffic includes the edge compute traffic and non-edge compute traffic. The method also includes identifying the edge compute traffic among the UE traffic, routing the edge compute traffic to the edge compute workload at the far edge, and routing the non-edge compute traffic to the near edge UPF at the near edge.

Efficiency of routing traffic to an edge compute server at the far edge of a cellular network

A health ticket minting process operates in a secure enclave on a computing device to ensure liveness of the enclave should a maliciously-compromised operating system deny service to starve the enclave. Cryptographically-secured health tickets provided by the minting process reset an authenticated watchdog timer (AWDT) that reboots the device from a hardware-protected recovery operating system if the timer expires. The health tickets are written to a secure channel using a symmetric key that is provisioned by repurposing an existing Intel SGX (Software Guard Extension) Versioning Support protocol that enables migration of secrets between enclaves that have the same author. In the event that the enclave fails to make forward progress and health tickets are not minted, then the AWDT expires and forces the reboot and re-imaging to a known good state to evict the malware from the computing device.

Liveness guarantees in secure enclaves using health tickets

Cryptographically-secured deferral tickets provided by a minting process that runs in a secure enclave on a computing device reset an authenticated watchdog timer that reboots the device from a hardware-protected recovery operating system to re-image the device into a known good state if the timer expires. The deferral tickets are written to a secure channel using a symmetric key that is provisioned by repurposing an existing Intel SGX (Software Guard Extension) Versioning Support protocol that enables migration of secrets between enclaves that have the same author. In an illustrative embodiment, the deferral ticket minting process and authenticated watchdog timer execute locally to enable automated recovery of the computing device when utilized in far edge infrastructure of a fifth generation (5G) network such as a distributed unit (DU) of a radio access network (RAN).

Automated recovery of far edge computing infrastructure in a 5G network

A method for adjusting discontinuous reception (DRX) behavior of a user equipment (UE) to conserve energy use includes exposing a DRX application programming interface (API) that enables DRX parameters to be changed and defining a conflict resolution policy that controls when requests to change the DRX parameters should be granted. The method also includes receiving, via the DRX API, a request from an application to change a DRX parameter for the UE. The UE is in wireless communication with a base station, and the application is configured to send data to the UE via a mobile network that comprises the base station. The method also includes determining, based at least in part on the conflict resolution policy, that the request should be granted and sending a command to the base station that causes the base station to communicate a new value of the DRX parameter to the UE.

Adjusting discontinuous reception behavior of a user equipment to conserve energy use

In a 5G network, a profiler component of a network slice controller is arranged to dynamically observe behaviors of pre-defined types of network slices when handling current traffic. The profiler employs the observed behaviors to generate profiles of the pre-defined slice types in terms of throughput, reliability, or other suitable metrics. In response to a request from an application for admission to the 5G network for which an ID of an appropriate pre-defined network slice type is unknown, the application request and traffic is handled on a slice which is temporarily utilized while the profiler dynamically observes application behaviors to generate an application profile. The profiler identifies a pre-defined slice type having a profile that is the closest match to the generated application profile. The application may then be moved from the temporary slice to a slice of the identified pre-defined type so that optimal slice characteristics are provided for the application's traffic.

Automated matching of applications to predefined slice types in 5G networks

A method for data stream prioritization by a session controller is described. Usage data associated with a video communication session is received for one or more client devices of the video communication session. The usage data is based on content within data streams of the video communication session. A first client device of the one or more client devices is identified as having a higher priority level during the video communication session based on the usage data. Instructions are sent to the first client device during the video communication session causing the first client device to improve a quality of a first data stream generated by the first client device for the video communication session.

Data stream prioritization for communication session

A method for communication session management by a session controller is described. Usage data associated with a video communication session is received for data stream handlers of a first network topology, which handle data streams of the video communication session at a first time. The first network topology includes a plurality of client devices and at least a first media server. A second network topology is determined based on the usage data to handle the data streams when a network parameter and/or an application parameter reaches a corresponding update threshold. Data stream handlers of the second network topology include at least a second media server. The data stream handlers of the second network topology are configured to handle the data streams at a second time, including instructing the first media server to offload at least some of the data streams to the second media server.

Media server management for communication session

A thin-cloud system for distributing content, for example, live streaming video content, from a broadcaster to a viewer is provided herein. The computing devices of the broadcaster can provide the multi-bitrate transcoding, of the two or more bitstreams, sent to a file server, which alleviates the need for the file server to encode the streams for a viewer. These multiple streams are received by a file server for provision to one or more viewers. The viewers can receive the streams at one of the two or more bitrates. If the viewer receives the content at a lower bitrate, the viewers can employ a machine learning (ML) co-processor that can operate as an accelerator to improve the inbound content, if that content is provided at a lower bitrate, and thus, a lower resolution. The file server can train and provide the ML models used for the acceleration.

Thin-cloud system for live streaming content

Generally discussed herein are devices, systems, and methods for privacy-preserving video. A method can include identifying which classes of objects are present in video data, for each class of the classes identified in the video data, generating respective video streams that include objects of the class and exclude objects not of the class, and providing each of the respective video streams to a content distribution network.

Privacy-preserving video analytics

Methods and devices for encoding and decoding data streams are disclosed. In some aspects, the data streams are multimedia data streams. One method disclosed includes obtaining, by a client device, a first multimedia data stream and a second multimedia data stream, the second multimedia data stream being a lower fidelity version of the first multimedia data stream, generating, by the client device, a third multimedia data stream based on differences between the first and second multimedia data streams, compressing, by the client device, the second multimedia data stream to generate a first compressed multimedia data stream, compressing, by the client device, the third multimedia data stream to generate a second compressed multimedia data stream; and transmitting, by the client device, the first and second compressed multimedia data steams to the server.

Growing community of inventors

Seattle, WA, United States of America

Landon Prentice Cox