Linear Capability Transfer for Confidential Computing

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current operating systems and hypervisor architectures rely on hierarchical trust models, where each layer has access to the memory of the next layer up, compromising confidentiality and integrity if the hypervisor or OS is compromised, and lack mechanisms for mutual distrust and flexible memory access control between modules.

Innovation Solution

The system employs physical, hardware-enforced linear capabilities that allow capabilities to be passed between software modules without retention, and sharded capabilities that can be divided and recombined, enabling flexible isolation and access control, allowing for mutual distrust and secure memory sharing between modules.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If hierarchical trust model is used where OS and hypervisor can access all memory, then system simplicity and ease of operation are maintained, but confidentiality and integrity are compromised

Engineering Contradiction:

Improvememory access simplicityVSAvoidconfidentiality and integrity

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The patent segments memory access rights by introducing capabilities that divide the address space into isolated regions. Each software module receives capabilities granting access only to specific memory regions, preventing unrestricted access while maintaining operational simplicity through automated capability-based isolation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces capabilities as intermediary tokens that mediate between software modules and memory. These capabilities act as trusted intermediaries that automatically enforce isolation policies, eliminating the need for hierarchical trust while preserving simple memory access operations through capability validation.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If capabilities are used to restrict memory access, then confidentiality and integrity are improved, but device complexity increases

Engineering Contradiction:

Improveconfidentiality and integrityVSAvoidcapability system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent implements self-service capability validation where the hardware automatically checks capabilities during memory access without requiring complex software intervention. The capability validation is performed autonomously by the memory management unit, reducing system complexity despite the enhanced security model.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent replaces complex software-based access control mechanisms with hardware-enforced capability validation. By substituting software-based permission checking with hardware-level capability verification, the system achieves stronger security without proportionally increasing overall system complexity.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Reliability

If physical address space is used for capabilities, then isolation between software modules is strengthened, but adaptability for flexible memory sharing is reduced

Engineering Contradiction:

Improveisolation between modulesVSAvoidflexible memory sharing

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent introduces dynamic capability manipulation operations that allow capabilities to be transferred, shared, and revoked at runtime. This dynamic behavior enables flexible memory sharing between software modules while maintaining strong isolation, as capabilities can be adaptively managed without compromising the underlying physical address space isolation.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The patent enables flexible memory sharing by allowing capability parameters to be modified dynamically. Capabilities can be shared with multiple parties, revoked, or transferred, providing adaptability for various memory access scenarios while preserving the isolation guarantees of the physical address space through capability-based control.

Inventive Principle:

Principle #35Parameter changes

4Reliability

If capabilities must be stored in specific memory regions, then capability protection is improved, but ease of operation for capability management is reduced

Engineering Contradiction:

Improvecapability protectionVSAvoidcapability storage and management

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent implements self-service capability management where the system automatically handles capability validation and protection without requiring manual intervention. The hardware automatically ensures capabilities are stored in protected regions and validates their use, eliminating complex user-side management while maintaining strong capability protection.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS12013794B2Confidential computing mechanism

Publication Date: 2024.06.18 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

According to a first aspect, execution logic is configured to perform a linear capability transfer operation which transfers a physical capability from a partition of a first software modules to a partition of a second of software module without retaining it in the partition of the first. According to a second, alternative or additional aspect, the execution logic is configured to perform a sharding operation whereby a physical capability is divided into at least two instances, which may later be combined.