# US 10,372,897 B2 · Encrypted capabilities stored in global memory > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,372,897 B2 - Document ID: US10372897B2 - Status: Granted - Kind: B2 - Application number: 15/298,494 - Filed: 2016-10-20 - Published: 2018-04-26 - Granted: 2019-08-06 - Earliest claimed: 2016-10-20 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Chris I. Dalton; Dejan S. Milojicic - Web page: https://patentgrep.com/patent/US10372897B2 ## CPC - H04W 12/08: Access security - G06F 12/1408: {by using cryptography (for digital transmission H04L9/00)} - G06F 21/44: Program or device authentication - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 2212/1052: Security improvement - G06F 2212/402: Encrypted data - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Example implementations relate to encrypted capabilities stored in global memory. For example, in an implementation, a capability protection system may store an encrypted capability into global memory, where the encrypted capability is encrypted based on a condition. The capability protection system may receive, from a node in communication with the global memory, a request to access the encrypted capability stored in the global memory. The capability protection system may provide to the node a decrypted form of the encrypted capability upon satisfaction of the condition by the node. ## Claims ### Claim 1 A system comprising: a global memory; a plurality of nodes in communication with the global memory; a capability protection system to: store an encrypted capability into the global memory, where the encrypted capability is encrypted based on a condition to maintain propagation control over sharing of the encrypted capability in the global memory, wherein the condition includes a platform configuration register (PCR) value representing a trusted state, receive, from a node of the plurality of nodes, a request to access the encrypted capability stored in the global memory, and provide to the node a decrypted form of the encrypted capability upon satisfaction of the condition by the node, wherein the node has a capability-supporting architecture and uses privileged capability instructions with the decrypted form of the encrypted capability to access system resources controlled by the encrypted capability; and a trusted platform module to generate a PCR value representing a state of the node, wherein satisfaction of the condition includes the node presenting the PCR value representing the state of the node matching the PCR value representing the trusted state. ### Claim 2 (depends on 1) The system of claim 1, wherein the capability protection system is to: receive an unencrypted capability from the plurality of nodes, and encrypt the received unencrypted capability to generate the encrypted capability by attribute-based encryption or identity-based encryption and based on the condition. ### Claim 3 (depends on 1) The system of claim 1, wherein the encrypted capability is received by the capability protection system from an out-of-band interface to prepopulate the global memory with a global capability. ### Claim 4 (depends on 1) The system of claim 1, wherein the capability protection system is distributed among fabric interconnects that couple respective ones of the plurality of nodes to the global memory. ### Claim 5 (depends on 1) The system of claim 1, wherein the capability protection system stores into the global memory another encrypted capability that is encrypted based on a time range within which decryption is permitted, and the capability protection system provides to the node a decrypted form of the another encrypted capability in response to a request from the node for access to the another encrypted capability that includes a time stamp within the time range. ### Claim 6 (depends on 1) The system of claim 1, wherein the capability protection system stores into the global memory another encrypted capability that is encrypted based on an operating system identity, and the capability protection system provides to the node a decrypted form of the another encrypted capability in response to a request from the node for access to the another encrypted capability that presents the operating system identity. ### Claim 7 (depends on 1) The system of claim 1, wherein the capability protection system stores into the global memory another encrypted capability that is encrypted based on a signature of an operating system image, and the capability protection system provides to the node a decrypted form of the another encrypted capability in response to a request from the node for access to the another encrypted capability that presents the signature. ### Claim 8 (depends on 1) The system of claim 1, wherein the global memory stores a plurality of encrypted capabilities with different respective encryption conditions, and the different respective encryption conditions establish different trust domains. ### Claim 9 (depends on 1) The system of claim 1, wherein the plurality of nodes and the global memory form part of a rack scale system and the capabilities provide access to regions of the global memory. ### Claim 10 A method comprising: storing, by a capability protection system, an encrypted capability into a global memory, where the encrypted capability is encrypted based on a condition using attribute-based encryption or identity-based encryption to maintain propagation control over sharing of the encrypted capability in the global memory, wherein the condition includes a platform configuration register (PCR) value representing a trusted state; receiving, by the capability protection system and from a node of a plurality of nodes in communication with the global memory, a request to access the encrypted capability stored in the global memory; decrypting, by the capability protection system, the encrypted capability in response to the received request and upon satisfaction of the condition by the node to generate a decrypted capability, wherein satisfaction of the decryption condition includes the node presenting a trusted platform module-generated PCR value that matches the PCR value representing the trusted state; and providing, by the capability protection system, the decrypted capability to the node, wherein the node has a capability-supporting architecture and uses privileged capability instructions with the decrypted form of the encrypted capability to access system resources controlled by the encrypted capability. ### Claim 11 (depends on 10) The method of claim 10, further comprising: receiving, by the capability protection system, an unencrypted capability from the plurality of nodes, and encrypting, by the capability protection system, the received unencrypted capability based on the condition using attribute-based encryption or identity-based encryption to generate the encrypted capability. ### Claim 12 (depends on 10) The method of claim 10, further comprising: receiving, by the capability protection system, a capability from an out-of-band interface to prepopulate the global memory with a global capability; if the received capability is encrypted, storing the received capability as the encrypted capability into the global memory; and if the received capability is unencrypted, encrypting the received capability based on the condition using attribute-based encryption or identity-based encryption to generate the encrypted capability. ### Claim 13 (depends on 10) The method of claim 10, wherein the capability protection system is distributed among fabric interconnects that couple respective ones of the plurality of nodes to the global memory. ### Claim 14 (depends on 10) The method of claim 10, comprising: storing, by the capability encryption system and into the global memory, another encrypted capability that is encrypted based on a time range within which decryption is permitted; and decrypting, by the capability protection system, the another encrypted capability in response to a request from the node for access to the another encrypted capability that includes a time stamp within the time range. ### Claim 15 (depends on 10) The method of claim 10, comprising: storing, by the capability encryption system and into the global memory, another encrypted capability that is encrypted based on an operating system identity or a signature of an operating system image, and decrypting, by the capability protection system, the another encrypted capability in response to a request from the node for access to the another encrypted capability that presents the operating system identity or the signature, respectively. ### Claim 16 A non-transitory machine readable medium storing instructions executable by a processing resource of a capability protection system, the non-transitory machine readable medium comprising: instructions to store an encrypted capability into a global memory, where the encrypted capability is encrypted based on a condition using attribute-based encryption or identity-based encryption to maintain propagation control over sharing of the encrypted capability in the global memory, wherein the condition includes a platform configuration register (PCR) value representing a trusted state; instructions to receive, from a node of a plurality of nodes in communication with the global memory, a request to access the encrypted capability stored in the global memory; instructions to decrypt the encrypted capability in response to the received request and upon satisfaction of the condition by the node to generate a decrypted capability, satisfaction of the decryption condition including the node presenting a trusted platform module-generated PCR value that matches the PCR value representing the trusted state; and instructions to provide the decrypted capability to the node, wherein the node has a capability-supporting architecture and uses privileged capability instructions with the decrypted form of the encrypted capability to access system resources controlled by the encrypted capability. ### Claim 17 (depends on 16) The non-transitory machine readable medium of claim 16, further comprising: instructions to receive an unencrypted capability from the plurality of nodes, and instructions to encrypt the received unencrypted capability based on the condition using attribute-based encryption or identity-based encryption to generate the encrypted capability. ### Claim 18 (depends on 16) The non-transitory machine readable medium of claim 16, further comprising: instructions to generate another encrypted capability by encrypting an unencrypted capability based on a time range within which decryption is permitted; and instructions to decrypt the another encrypted capability in response to a request from the node for access to the another encrypted capability that includes a time stamp within the time range. ### Claim 19 (depends on 16) The non-transitory machine readable medium of claim 16, further comprising: instructions to generate another encrypted capability by encrypting an unencrypted capability based on an operating system identity or a signature of an operating system image; and instructions to decrypt the another encrypted capability in response to a request from the node for access to the another encrypted capability that includes the operating system identity or the signature.