Red Hat, Inc.

Leigh Griffin

Stephen Coady

Pierre-Yves Chibon

Luigi Zuccarelli

Paolo Antinori

Andrea Cosentino

Cathal O'Connor

Sanja Bonic

Janos Bonic

Leonardo Rossetti

Ali Ok

Srinivasa Bharath Kanta

Veera Raghava Beri Reddy

Maja Massarini

Pierre-Yves Chiben

Anne Mulhern

Luigi Mario Zuccarelli

Sherine Khoury

Rachel Elizabeth Sibley

Florence Renaud

Julia Bley

Christopher Foley

Anthony Carroll

Aoife Moloney

Laura Fitzgerald

David Ffrench

Eric Curtin

Brendan O'Farrell

Access requests for policy-based access control systems can be managed according to some examples. In one example, a system can receive, from a client device, a first access request for accessing a particular resource. The system can determine a first response approving or denying the first access request based on an access control policy. The system can store a data entry indicating the first response to the first access request. The system can set a flag to indicate that a future access request for the particular resource is to be handled using the data entry. Subsequent to setting the flag, the system can receive a second access request from the client device for accessing the particular resource. Based on determining that the flag is set, the system can determine a second response to the second access request based on the data entry rather than the access control policy.

Managing access requests for policy-based access control systems in computer networks

Embodiments of the present disclosure include a processing device that determines that a first node device of a plurality of node devices in a network is non-compliant with a network policy, identifies a first subset of the plurality of node devices that are not associated with the first node device, and transmits a communication to the first subset of the plurality of node devices that instructs respective ones of the first subset of the plurality of node devices to perform an alteration of a state of a communication path of the first subset of the plurality of node devices to be incompatible with the first node device.

Zoned mesh network isolation

Embodiments of the present disclosure relate to systems and methods for using unikernels to protect critical safety applications from interference events. For each of a set of applications identified as critical to the functioning of a computing environment, a corresponding unikernel may be generated, the unikernel including code of the application and kernel functionality. In response to determining that an interference event is affecting a first application of the set of applications, it is determined whether the interference event is unsustainable. In response to determining that the interference event is unsustainable, the unikernel corresponding to the first application is initiated and a failover from the first application to the unikernel corresponding to the first application is performed.

On-demand unikernel for application protection

Correcting quantum errors based on quantum error correction caches (QECCs) is disclosed herein. In one example, a processor device of a quantum computing device is to receive an indication of an occurrence of a quantum error that affects a qubit. The processor device identifies a QECC entry within a plurality of QECC entries of a first QECC of the quantum computing device, wherein the QECC entry corresponds to a previous occurrence of the quantum error. The processor device obtains metadata associated with the previous occurrence of the first quantum error from the QECC entry, and determines a corrective action based on the metadata. The processor device performs the corrective action to remedy the quantum error.

Correcting quantum errors based on quantum error correction caches (QECCs)

A communication packet is received from a service. It is determined, based on network configuration data associated with the service, to communicate at least a portion of the communication packet over a quantum network with a superdense protocol in lieu of a default communication protocol. The portion is encoded according to the superdense protocol using a first qubit entangled with a second qubit accessible by the recipient interface. The first qubit is transmitted over the quantum network to the recipient interface.

Superdense failover for specific services on a quantum channel

Access protection for shared qubits is disclosed herein. In one example, a processor device first determines that a first quantum process associated with one or more qubits is scheduled for execution (e.g., based on metadata obtained from the quantum process manager.) The processor device next identifies a second quantum process that is active and that is also associated with the one or more qubits. The processor device then prevents the first quantum process (i.e., the quantum process that is scheduled to execute) from accessing the one or more qubits. In some examples, the processor device may prevent access to the one or more qubits by causing the first quantum process to be placed in a blocked state pending release of the one or more qubits by the second quantum process (i.e., the currently active quantum process).

Access protection for shared qubits

Embodiments of the present disclosure provide techniques for performing a quantum computing-based diamond dependency analysis. A classical diamond dependency service may analyze a service and determine a set of dependencies that the service requires to execute. The classical DDS may then generate a quantum assembly language (QASM) file comprising a diamond dependency algorithm (DDA) and a mapping of a configuration file of the service and a configuration file of each of the set of dependencies to a respective qubit among a plurality of qubits. The classical DDS may interface with one or more quantum DDSs (QDDSs) that are each part of a respective quantum environment in order to determine qubits that are available to be mapped to the configuration files of the service and its dependencies. The classical DDS may execute the QASM file using the one or more QDDSs to detect one or more diamond dependencies.

Qubit mapped diamond dependency recommendation service

A quantum computing system receives, from a requestor, a first access request that identifies a subject, an action, and a resource. A mapping structure that identifies a plurality of qubits that are in superposition and encoded with a plurality of rules that govern access to the resource is accessed. Based on the mapping structure it is determined that a set of qubits of the plurality of qubits applies to the access request. Data encoded in the set of qubits or a reference to each qubit in the set of qubits is provided to the requestor.

Qubit-implemented role-based access control

A quantum isolation zone (QIZ) controller executing on a quantum computing system, makes a determination to initiate, for a first QIZ of a plurality of different QIZs, a first local service instance of a global service instance that is executing on the quantum computing system, the first QIZ having a first set of qubits associated therewith. The first local service instance is caused to be initiated, and the QIZ controller modifies a local service data structure to indicate that the first local service instance is associated with the first QIZ.

Local services in quantum isolation zones

A gateway device receives a request from a client device, the gateway to provide access to a plurality of services provided by a plurality of compute nodes. A manifest is created based on metadata associated with the request and characteristics of the plurality of services, the manifest identifying a logical view of a subset of the plurality of services provided by a subset of the plurality of compute nodes. The request is routed to one of the subset of the plurality of services based on the manifest.

Dynamic API gateway routing based on request metadata

Iterative workload processing having a mandatory processing task and a preferred processing task. A processor device iteratively performs a processing workload that comprises a mandatory processing task and a preferred processing task. The mandatory processing task includes accessing a plurality of input messages that have not yet been processed, and the preferred processing task has a target timeframe within which to be performed. For each iteration, a maximum preferred processing task amount of time to perform the preferred processing task is determined based on a moving average of mandatory processing task times of previous iterations and based on the target timeframe. The preferred processing task is performed for a period of time no greater than the maximum preferred processing task amount of time.

Iterative workload processing having a mandatory processing task and a preferred processing task

A system and method of Byzantine fault prevention in mesh networks. The method includes detecting a consensus operation among a plurality of node devices of a network for a blockchain operation of a blockchain within the network, wherein each consensus operation includes a vote transmission associated with the blockchain within the network, wherein detecting the consensus operation includes examining an approval status of a particular vote transmission associated with a particular consensus operation. The method includes controlling, by a processing device responsive to detecting the consensus operation, content of a proxy vote transmission provided by a proxy device corresponding to at least one node device of the plurality of node devices by setting the content of the proxy vote transmission based on the approval status of the particular vote transmission. The method includes causing the proxy device to transmit the proxy vote transmission.

Byzantine fault prevention in mesh networks

A system and method of a distributed and partitioned state machine for mesh devices. The method includes obtaining a first capability dataset indicating capabilities of a first mesh node of a first mesh network system to provide a first service for a first object. The method includes obtaining a second capability dataset indicating capabilities of a second mesh node of a second mesh network system to provide a second service to a second object. The method includes generating a set of NFSM models for the first object and the second object, each NFSM model to provide the first service for the first object or the second object. The method includes providing the set of NFSM models and a partition dataset to cause a first gateway device and a second gateway device to use a single NFSM model to provide the first service to the second object.

Distributed and partitioned state machine based rule engine for mesh devices and edge devices

Systems and methods include storing, in a first base boot partition, an image of a first base operating system; storing, in a first overlay boot partition, a first overlay file system comprising a first encrypted file; configuring the first overlay boot partition to boot the image of the first base operating system from the first base boot partition and install the first overlay filesystem; and responsive to detecting an attempt to access the first encrypted file, designating the first base boot partition as an active boot partition.

Dynamic booting of operating system by designating first base boot partition as active boot partition responsive to detecting unauthorized attempt to access first encrypted file

Processing logic may provide a first container having a first software version. Processing logic may create a second container having a second software version within the first container. Processing logic may replace the first container with the second container, in response to testing of the second container satisfying one or more criteria.

Growing community of inventors

Waterford, Ireland

Leigh Griffin