Example implementations can involve a system, which can involve a server configured to distribute role decision condition expressions created based on user input to one or more storage devices; and the one or more storage devices, which can involve a processor, configured to, for receipt of a request, determine user identification information, request source environment information and requested contents from the request; determine a role from the role decision condition expressions based on the user identification information and request source environment information; and determine whether or not the request can be executed based on the role.

In one embodiment, a system for managing a virtualization environment includes a set of host machines, each of which includes a hypervisor, virtual machines, and a virtual machine controller, and a data migration system configured to identify one or more existing storage items stored at one or more existing File Server Virtual Machines (FSVMs) of an existing virtualized file server (VFS). For each of the existing storage items, the data migration system is configured to identify a new FSVMs of a new VFS based on the existing FSVM, send a representation of the storage item from the existing FSVM to the new FSVM, such that representations of storage items are sent between different pairs of FSVMs in parallel, and store a new storage item at the new FSVM, such that the new storage item is based on the representation of the existing storage item received by the new FSVM.

In one embodiment, a system for managing a virtualization environment includes a set of host machines, each of which includes a hypervisor, virtual machines, and a virtual machine controller, and a data migration system configured to identify one or more existing storage items stored at one or more existing File Server Virtual Machines (FSVMs) of an existing virtualized file server (VFS). For each of the existing storage items, the data migration system is configured to identify a new FSVMs of a new VFS based on the existing FSVM, send a representation of the storage item from the existing FSVM to the new FSVM, such that representations of storage items are sent between different pairs of FSVMs in parallel, and store a new storage item at the new FSVM, such that the new storage item is based on the representation of the existing storage item received by the new FSVM.

In one embodiment, a processor includes a memory hierarchy and a core coupled to the memory hierarchy. The memory hierarchy stores encrypted data, and the core includes circuitry to access the encrypted data stored in the memory hierarchy, decrypt the encrypted data to yield decrypted data, perform an entropy test on the decrypted data, and update a processor state based on a result of the entropy test. The entropy test may include determining a number of data entities in the decrypted data whose values are equal to one another, determining a number of adjacent data entities in the decrypted data whose values are equal to one another, determining a number of data entities in the decrypted data whose values are equal to at least one special value from a set of special values, or determining a sum of n highest data entity value frequencies.

A vehicular control apparatus is used in an onboard system provided with a plurality of information processors mutually connected via a communication bus, and includes a storage section for storing information, and an arithmetic section for executing a process based on the information stored in the storage section. The information contains first management information relating to a security abnormality as a communication data abnormality owing to security attack from outside the onboard system, and second management information relating to a safety abnormality as a communication data abnormality owing to an abnormality in the onboard system. The first management information contains first limit condition information indicating a first limit condition for executing a security coping with the security abnormality. The second management information contains second limit condition information indicating a second limit condition for executing a safety coping with the safety abnormality. Upon detection of the communication data abnormality in the onboard system, the arithmetic section determines a coping content to the detected communication data abnormality based on the first management information and the second management information.

A security solution having a system, a method, or a computer program for protecting contents in a target storage device that is arranged to be removable from a storage system having a unique combination of a system complex key (SCK) and a system identification (SID). The solution includes receiving a request to remove the target storage device from the storage system, where the storage system may have a plurality of storage devices each containing the identical combination of system complex key (SCK) and system identification (SID), and receiving a system complex key password (SCKP). The solution includes comparing the system complex key password (SCKP) to the system complex key (SCK) in the storage system, determining whether the system complex key password (SCKP) matches the system complex key (SCK) in the storage system, and suspending all read or write operations to the target storage device when the system complex key password (SCKP) matches the system complex key (SCK) in the storage system.

Methods and systems for assessing internet exposure of a cloud-based workload are disclosed. A method comprises accessing at least one cloud provider API to determine a plurality of entities capable of routing traffic in a virtual cloud environment associated with a target account containing the workload, querying the at least one cloud provider API to determine at least one networking configuration of the entities, building a graph connecting the plurality of entities based on the networking configuration, accessing a data structure identifying services publicly accessible via the Internet and capable of serving as an internet proxy; integrating the identified services into the graph; traversing the graph to identify at least one source originating via the Internet and reaching the workload, and outputting a risk notification associated with the workload. Systems and computer-readable media implementing the above method are also disclosed.

Some embodiments provide a non-transitory machine-readable medium that stores a program. The program receives a request to execute a task for re-encrypting a set of data associated with an application that has been encrypted with a first encryption key. The task is for re-encrypting the set of data using a second encryption key. The program further determines an amount of work to complete the task. The program also divides the task into a set of subtasks based on the amount of work. The program further assigns each subtask in the set of subtasks to a node in a plurality of nodes for execution of the subtask. The plurality of nodes are configured to implement the application.

Some embodiments provide a non-transitory machine-readable medium that stores a program. The program receives a request to execute a task for re-encrypting a set of data associated with an application that has been encrypted with a first encryption key. The task is for re-encrypting the set of data using a second encryption key. The program further determines an amount of work to complete the task. The program also divides the task into a set of subtasks based on the amount of work. The program further assigns each subtask in the set of subtasks to a node in a plurality of nodes for execution of the subtask. The plurality of nodes are configured to implement the application.

A security verification system performs security verification of a circuit design. The security verification system simplifies formal security verification of the circuit design by replacing circuit blocks of the circuit with black box circuit blocks. The security verification system instruments the circuit design so that black-boxing can be performed for security verification without changing the security decision over the data paths. The security verification system uses dependence information of the inputs and outputs of the black box to connect inputs of the circuit block with outputs of the circuit block. The black-box circuit block keeps the logic inside the cone of influence of clocks and resets. The system performs security verification of the circuit design by proving a non-interference property of the instrumented circuit design.