Sealed Capability Handling for Trust-Based Memory Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern systems face challenges in supporting sealed capabilities due to constrained metadata bits and the need for unsealing keys, making it difficult to manage and secure access to memory addresses.
Innovation Solution
Implementing a mechanism that associates a capability level of trust with individual capabilities, allowing sealed capabilities to be handled based on both the current mode level of trust and the capability level of trust, without the need for unsealing keys or additional metadata bits.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sealed capabilities are supported using traditional multi-bit object type fields and unsealing keys, then capability security and immutability are improved, but device complexity and metadata storage requirements increase
Solution Approach 1:
The patent extracts the sealing mechanism from traditional capability metadata structures. Instead of using multi-bit object type fields and separate unsealing keys, the invention uses a dedicated seal bit in the capability word and a separate seal value stored in a security-sensitive location. This separation reduces metadata complexity within the capability structure itself while maintaining security through the external seal value reference.
Solution Approach 2:
The patent moves the sealing state from within-capability metadata to an external dimension by storing seal values in separate security-sensitive memory locations. The seal bit in the capability word acts as a reference to this external state, effectively adding a spatial dimension to the sealing mechanism that reduces intra-capability metadata requirements.
2Stability of the object's composition
If sealed capabilities are implemented with unsealing keys, then capability immutability is improved, but ease of operation deteriorates due to the cumbersome key management
Solution Approach 1:
The patent implements self-service sealing by allowing code at appropriate trust levels to set the seal bit and store seal values without requiring external key management infrastructure. The capability system itself manages the sealing state through the seal bit and seal value mechanism, eliminating the need for separate key management operations while maintaining immutability guarantees.
3Adaptability or versatility
If capability metadata includes detailed object type information, then capability functionality is improved, but the number of available metadata bits is consumed, making sealed capability support difficult
Solution Approach 1:
The patent extracts the sealing state information from the capability's object type field, using instead a dedicated seal bit and external seal value storage. This extraction preserves the object type field for its primary functionality while providing sealed capability support through a separate, more space-efficient mechanism that doesn't consume object type bits.
Data Source
AI summary
An apparatus and method are described for handling sealed capabilities. The apparatus has processing circuitry to perform processing operations during which access requests to memory are generated, wherein the processing circuitry is arranged to generate memory addresses for the access requests using capabilities that identify constraining information. Checking circuitry then determines whether a given access request whose memory address is generated using a given capability is permitted based on the constraining information identified by that given capability, and based on a level of trust associated with the given access request. Each capability has a capability level of trust associated therewith, and the level of trust associated with the given access request is dependent on both a current mode level of trust associated with a current mode of operation of the processing circuitry, and the capability level of trust of the given capability. At least one of the capabilities is settable as a sealed capability, and the apparatus further comprises sealed capability handling circuitry to prevent the processing circuitry performing at least one processing operation using a given sealed capability when the current mode level of trust is a lower level of trust than the capability level of trust of the given sealed capability.