Encrypted capabilities stored in global memory
AssigneeHewlett Packard Enterprise Development LP
InventorsChris I. Dalton, Dejan S. Milojicic
Life of this patent
Estimating the term…
Abstract
Example implementations relate to encrypted capabilities stored in global memory. For example, in an implementation, a capability protection system may store an encrypted capability into global memory, where the encrypted capability is encrypted based on a condition. The capability protection system may receive, from a node in communication with the global memory, a request to access the encrypted capability stored in the global memory. The capability protection system may provide to the node a decrypted form of the encrypted capability upon satisfaction of the condition by the node.
Claims19
A system comprising:
- a global memory;
- a plurality of nodes in communication with the global memory;
- a capability protection system to:
- store an encrypted capability into the global memory, where the encrypted capability is encrypted based on a condition to maintain propagation control over sharing of the encrypted capability in the global memory, wherein the condition includes a platform configuration register (PCR) value representing a trusted state,
- receive, from a node of the plurality of nodes, a request to access the encrypted capability stored in the global memory, and
- provide to the node a decrypted form of the encrypted capability upon satisfaction of the condition by the node, wherein the node has a capability-supporting architecture and uses privileged capability instructions with the decrypted form of the encrypted capability to access system resources controlled by the encrypted capability;
- and
- a trusted platform module to generate a PCR value representing a state of the node, wherein satisfaction of the condition includes the node presenting the PCR value representing the state of the node matching the PCR value representing the trusted state.
A method comprising:
- storing, by a capability protection system, an encrypted capability into a global memory, where the encrypted capability is encrypted based on a condition using attribute-based encryption or identity-based encryption to maintain propagation control over sharing of the encrypted capability in the global memory, wherein the condition includes a platform configuration register (PCR) value representing a trusted state;
- receiving, by the capability protection system and from a node of a plurality of nodes in communication with the global memory, a request to access the encrypted capability stored in the global memory;
- decrypting, by the capability protection system, the encrypted capability in response to the received request and upon satisfaction of the condition by the node to generate a decrypted capability, wherein satisfaction of the decryption condition includes the node presenting a trusted platform module-generated PCR value that matches the PCR value representing the trusted state;
- and
- providing, by the capability protection system, the decrypted capability to the node, wherein the node has a capability-supporting architecture and uses privileged capability instructions with the decrypted form of the encrypted capability to access system resources controlled by the encrypted capability.
A non-transitory machine readable medium storing instructions executable by a processing resource of a capability protection system, the non-transitory machine readable medium comprising:
- instructions to store an encrypted capability into a global memory, where the encrypted capability is encrypted based on a condition using attribute-based encryption or identity-based encryption to maintain propagation control over sharing of the encrypted capability in the global memory, wherein the condition includes a platform configuration register (PCR) value representing a trusted state;
- instructions to receive, from a node of a plurality of nodes in communication with the global memory, a request to access the encrypted capability stored in the global memory;
- instructions to decrypt the encrypted capability in response to the received request and upon satisfaction of the condition by the node to generate a decrypted capability, satisfaction of the decryption condition including the node presenting a trusted platform module-generated PCR value that matches the PCR value representing the trusted state;
- and
- instructions to provide the decrypted capability to the node, wherein the node has a capability-supporting architecture and uses privileged capability instructions with the decrypted form of the encrypted capability to access system resources controlled by the encrypted capability.
Dependencies are inferred from the claim text.