Red Hat, Inc.

Paolo Antinori

Andrea Cosentino

Eric Philip Wittmann

Edoardo Vacchi

Leigh Griffin

Luca Burgazzoli

Alessio Soldano

Carles Arnal Castello

Andrea Tarocchi

Nicola Ferraro

Sergio Fernando Ocon Cardenas

Brian T Fitzpatrick

Marco Rizzi

Alexandre Briani Kieling

Lars Heinemann

Vittorio Rigamonti

Christoph R Deppisch

Systems and methods for cloud-based vehicle control are generally described. In some examples, first vehicle identifier data identifying a first vehicle may be received. In some cases, first state data representing a first software version of a first system associated with the first vehicle identifier data may be received. In some examples, a first condition associated with the first system may be determined based at least in part on the first state data. In further examples, first control data may be sent to a first computing device of a first vehicle based at least in part on the first condition. In various examples, the first control data may be effective to control operation of at least one component of the first vehicle.

Vehicle control using serverless functions

A method includes: receiving, by a server node, a first notification indicating that a first message received by a first node of a cluster of nodes is not a redundant message and cannot be stored by a data store of the nodes, wherein the nodes are managed by the server node; determining to invoke a compression process used to compress message identifiers stored in the first node; receiving a first public key associated with the first node; generating a compression key; generating a first encrypted compression key by encrypting the compression key with the first public key; sending, to the first node, the first encrypted compression key; and receiving, from the first node, a second notification of storing, in a compressed form using a key decrypted from the first encrypted compression key, at least one message identifier in a data store of the first node.

Adaptive asymmetric-key compression for idempotent data stores in computer messaging

A method of managing applications of a first vehicle includes establishing, by the first vehicle, a network with a second vehicle in proximity to the first vehicle, receiving, by the first vehicle from the second vehicle over the network, application metadata associated with a plurality of applications executing on the second vehicle, based on the application metadata, transmitting a list to the second vehicle over the network, wherein the list identifies one or more application updates associated with the plurality of applications, and receiving the one or more application updates from the second vehicle over the network.

Intra-vehicle over-the-air updates

Systems and methods for adaptive compression for idempotent data stores in computer messaging are generally described. In some examples, a first node may receive a first message that includes a first message identifier and first payload data. In some examples, the first node may determine that a respective available amount of storage of each node of a plurality of nodes is below a first threshold available amount of storage. In some cases, the plurality of nodes may include the first node. The first node may receive a compression key from a primary node of a cluster including the plurality of nodes. The first node may compress a second message identifier stored in a data structure of the first node using the compression key.

Adaptive compression for idempotent data stores in computer messaging

A rules engine that is running a rules-based application executing on a computing device comprising a processor device receives a first transaction that includes a plurality of data fields, at least some of the data fields including data to be evaluated by a plurality of rules identified in the rules-based application, the first transaction including encrypted data in a first encrypted data field of the plurality of data fields that has been encrypted with a symmetric key in accordance with a structured encrypted algorithm. The rules engine queries the encrypted data using a first query token generated using the symmetric key to determine if the encrypted data includes a value used in a first condition identified in the plurality of rules. The rules engine takes an action based at least in part on querying the encrypted data.

Structured encryption rules engine

Systems and methods for securing label metadata. One aspect presented herein includes a container orchestration system comprising a plurality of worker nodes, able to run application containers; an orchestrator node to orchestrate application container deployment on the plurality of worker nodes via a virtual network layer, wherein the plurality of worker nodes and the orchestrator node form a cluster, the orchestrator node comprising an API server that serves as an entry point to the cluster; an encryption layer run on the master node comprising a processor and a computer readable medium storing instructions executable by the processor to: receive a deployment file via the API server; associate an encryption key with the sensitive metadata; receive a request for data, via the virtual network layer, from at least one worker node, wherein the request for data includes the sensitive metadata; provide the sensitive metadata to the at least one worker node.

Label filtering and encryption

An access control process executing in a declarative container orchestration system receives a notification that the declarative container orchestration system has received a configuration file that identifies a desired future state that includes a creation of an object. Prior to allowing the declarative container orchestration system to create the object, the configuration file is analyzed. Based on the analysis, it is determined that the configuration file includes a key/value pair that is to be associated with the object. The access control process determines that a user associated with the configuration file lacks authorization to request the key/value pair. In response to determining that the user associated with the configuration file lacks authorization to request the key/value pair, the declarative container orchestration system is prevented from creating the desired future state identified in the configuration file.

Key/value pair metadata authentication for declarative process orchestration environments

Events associated with a virtual machine can be used to adjust an amount of resource objects that may be allocated from a resource pool for the virtual machine. For example, a system can receive a notification including event data indicating an event related to the virtual machine, wherein the virtual machine is configured to rely on resource objects in a resource pool for performing one or more computing operations. The system can determine that the event is a particular type of event. Based on determining that the event is the particular type of event, the system can select a scaling policy corresponding to the particular type of event. The system can then apply the scaling policy to the event data to determine a scaling strategy for adjusting the amount of resource objects.

Adjusting the size of a resource pool for a virtual machine based on events associated with the virtual machine

In one example described herein, a processing device can receive computing metrics from nodes within a mesh network. The processing device can use those computing metrics to derive a maximum message size based on the capabilities of the nodes within the mesh network. The processing device can then transmit the maximum message size to nodes within the mesh network so that the nodes can generate messages that do not exceed the maximum message size.

Managing message sizes in a mesh network

Systems and methods for cloud-based keyless entry are generally described. In some examples, a first number is received from a vehicle. A first computing device of the vehicle may be configured to control an electronic door lock. A first unlock code may be generated using the first number. In some examples, a notification is sent to a remote entry device associated with the vehicle. A response to the notification may be received from the remote entry device. In some examples, the first number may be retrieved from a messaging service based at least in part on the receiving the response to the notification. A second unlock code may be generated using the first number. A determination may be made that the first unlock code matches the second unlock code. An instruction may be sent to the first computing device, the instruction effective to cause unlock of the electronic door lock.

K-anonymous vulnerability detection is disclosed. Data descriptive of a container image including at least one container layer having a layer identifier is received. The layer identifier is encoded to produce an encoded layer identifier. A first portion of the layer identifier is transmitted to a vulnerability registry server. One or more vulnerability identifiers are received from the vulnerability server. The vulnerability identifiers are associated with the first portion of the encoded layer identifier. It is determined that the layer identifier matches a matching vulnerability identifier of the one or more vulnerability identifiers.

K-anonymous vulnerability detection

A cross-domain data access service enables data access across two or more computing domains, such as, for example, transient access by a public device to data held in a private cloud. In particular, the cross-domain data access service can identify a data subset from within a secure datastore of a first computing domain. The cross-domain data access service can replicate the data subset within a transient datastore that is segregated from the secured datastore. The cross-domain data access service can implement a data access policy so as to enable a client device from a second domain to access the transient datastore.

Cross-domain data access

A computing device receives data related to operation of a cloud computing environment having an application comprising several services. The data related to operation of the cloud computing environment can include time-based data related to computing resource use in the cloud computing environment, such as I/O rate, processor utilization, and others. In some implementations the services that compose the application can be orchestrated through an orchestrator, and in those implementations data regarding the orchestration can also be provided to the computing device. The computing device can also request service-related information from the cloud computing environment, where the service-related information can include financial related information for operations in the cloud. The computing device can take as input the data related to operation of the application and services the orchestration, and the service and thereafter provide a recommendation of an on-premises computing infrastructure adequate to replace the cloud computing environment.

Sizing service for cloud migration away from only cloud storage and back to on-site computing strategy

Systems and techniques for application profiling to resize and reconfigure compute instances are generally described. In some examples, a first application executing in a user space of a first compute instance may be determined. A Berkeley Packet Filter (BPF) process may be executed in the user space of the first compute instance. The BPF process monitors resource consumption of a first resource of the first compute instance. First consumption data for the first resource may be determined. The first consumption data may be associated with a first process of the first application over a first period of time. The first consumption data may be evaluated using first criteria. A configuration of a second compute instance may be determined based on evaluation of the first consumption data using the first criteria. The second compute instance may be deployed according to the configuration.

Growing community of inventors

Milan, Italy

Paolo Antinori