Encrypted Capabilities in Global Memory for Secure Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In rack scale systems with global shared memory, capabilities are propagated uncontrolledly, lacking trust guarantees among nodes, which complicates secure access and management of large memory resources.
Innovation Solution
Implementing a capability protection system that encrypts capabilities in global memory using attribute-based or identity-based encryption, ensuring access is granted only upon satisfaction of specific conditions, such as presenting a trusted operating system identity or hash, thereby controlling propagation and enforcing customizable policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If capabilities are stored in global shared memory for efficient access, then productivity is improved, but security and control over capability propagation deteriorates
Solution Approach 1:
The patent applies preliminary action by encrypting capabilities with policy conditions before they are stored in global shared memory. The capability protection system pre-processes capabilities by attaching encryption policies that specify under what conditions the capability can be decrypted and used. This ensures that security controls are in place before the capability is propagated, allowing efficient access while maintaining trust guarantees.
2Reliability
If capabilities are encrypted with policy conditions, then security is improved, but device complexity increases
Solution Approach 1:
The patent applies self-service by enabling the capability protection system to automatically manage encryption and decryption operations based on policy conditions. When a node requests a capability, the system automatically evaluates the policy conditions, decrypts the capability if conditions are met, and manages the entire process without manual intervention. This automation reduces the operational complexity of managing encrypted capabilities.
3Productivity
If explicit copying of capabilities is avoided, then productivity is improved, but control over capability propagation deteriorates
Solution Approach 1:
The patent introduces an intermediary - the capability protection system with policy-based encryption - that mediates between the need for efficient capability sharing and the need for propagation control. Instead of explicit copying or manual management, the system uses encrypted capabilities stored in global memory that are automatically decrypted based on policy conditions, serving as an intermediary layer that provides both efficiency and control.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Example implementations relate to encrypted capabilities stored in global memory. For example, in an implementation, a capability protection system may store an encrypted capability into global memory, where the encrypted capability is encrypted based on a condition. The capability protection system may receive, from a node in communication with the global memory, a request to access the encrypted capability stored in the global memory. The capability protection system may provide to the node a decrypted form of the encrypted capability upon satisfaction of the condition by the node.