VMware, Inc.
Decentralized sparse capability system with secure enclaves

Abstract:

The present disclosure provides an approach for granting access to a resource located on a first server, the granting being done by a second server to a third server. The method results in a decentralized granting of access to a resource, preventing a bottleneck in the first server that could develop if the first server were to grant each access to each of its resources. The access is provided in the form of an encrypted capability, and transmitted through a secure channel. The code on the second server for granting access is located within an encrypted memory region, such that unauthorized processes cannot access the code or the data within the encrypted memory region.