Verifying Persisted Capabilities in Shared Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Capabilities stored in globally shared memory are vulnerable to tampering and forging since they are not under the active control of a kernel and lack verification for integrity and authenticity.
Innovation Solution
A system that verifies cryptographic evidence accompanying persisted capabilities stored in globally shared memory to decide whether to trust and load them, using cryptographic techniques such as digital signatures or HMACs to ensure authenticity and integrity before access is granted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If capabilities are stored in globally shared memory for persistence across reboots and sharing, then adaptability and productivity are improved, but reliability deteriorates due to vulnerability to tampering and forging
Solution Approach 1:
The system performs preliminary cryptographic verification of capabilities before loading them into the capability system. The kernel verifies cryptographic evidence (such as digital signatures or HMACs) associated with each persisted capability stored in globally shared memory before granting access, ensuring integrity is checked in advance rather than after potential tampering occurs.
Solution Approach 2:
Cryptographic evidence acts as an intermediary between the persisted capability and the verification process. The capability is stored with associated cryptographic evidence (digital signature or HMAC), and the kernel uses this intermediary to verify authenticity and integrity without directly trusting the capability itself, thus mediating the trust relationship.
2Reliability
If cryptographic verification is implemented for persisted capabilities, then reliability is improved, but device complexity increases due to additional verification mechanisms
Solution Approach 1:
The verification logic is extracted as a distinct step in the capability loading process. The kernel separates the verification of cryptographic evidence from the capability execution, creating a dedicated verification path that checks cryptographic evidence before allowing the capability to be loaded into the capability system, thus managing complexity through functional separation.
Solution Approach 2:
The system uses cryptographic copies (digital signatures or HMACs) of the capability data as verification evidence. These cryptographic representations serve as compact, verifiable copies that prove authenticity without requiring complex verification of the entire capability structure, simplifying the verification process.
Data Source
AI summary
Example implementations relate to cryptographic evidence of persisted capabilities. In an example implementation, in response to a request to access a persisted capability stored in a globally shared memory, a system may decide whether to trust the persisted capability by verification of cryptographic evidence accompanying the persisted capability. The system may load the persisted capability upon a decision to trust the persisted capability based on successful verification.