Security protection method for file system of linux system, medium and equipment

Abstract

The invention discloses a safety protection method for a file system of a linux system, a medium and equipment, and the method comprises the steps: carrying out the block segmentation of an initramfs / initrd file according to the encryption block length, and forming a block sequence La; and confusing and arranging the initramfs / initrd blocks in the block sequence La through a sorting algorithm to obtain a block sequence Lb, and sequentially carrying out AES (Advanced Encryption Standard) encryption on the initramfs / initrd blocks. The method comprises the following steps of: opening an encrypted file initramfs / initrdencrypt, writing in a 64-byte memheader, and then sequentially writing in all encrypted initramfs / initrd blocks in a block sequence Lb, so as to obtain an encrypted initramfs / initrd file. According to the method and the device, the initramfs / initrd is encrypted, and meanwhile, a decrypted kernel uses a code, so that any person is prevented from obtaining internal contents through a general decompression means under the condition that the initramfs / initrd contains a core code, and the initramfs / initrd security under a linux system is effectively improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of data security, and in particular relates to a security protection method, medium and equipment for a file system of a Linux system. Background Art

[0002] In the Linux system, initrd and initramfs are products of different stages of kernel development. Initrd is the format of the initialization memory disk; initramfs has a more standardized process in kernel booting, but its functions are consistent. initramfs is the format of the initialization memory file system, and the product can be a cpio archive (optionally compressed). The kernel decompresses the archive into a special instance of tmpfs, making the instance the initial root file system. The content of initramfs described below in the present invention is also applicable to initrd. There are the following two scenarios in the boot process of the Linux system: (1) Manually create initramfs for the kernel, that is, the minimum onboard kernel, and write it to Flash by burning, that is, the kernel directly boots the root file system; you can also compile the manually created initramfs and directly embed it into the kernel. Applicable scenarios are non-standard hardware system customization.

[0003] (2) For kernel initramfs expansion compatibility, the current method is usually used on standard computers, which can focus on non-core kernel module expansion, fix the startup process unchanged, and dynamically change the driver and file system related programs.

[0004] Initramfs is formed by executing dracut on a standard computer to package the drivers and user-mode programs currently in use by the computer through a compression algorithm. After the system is powered on, GRUB will be used to boot first. Here, the GRUB configuration file will pass initramfs as the startup "initrd=" parameter to the kernel. The detailed description of the kernel parameter is "initrd=initramfs-kernel version.architecture.img". During the kernel startup process, the initramfs is read, decompressed, and jumped to execute the parameter "initrd=". Summary of the invention

[0005] The purpose of the present invention is to provide a method, medium and device for protecting the security of a file system of a Linux system, aiming to improve the security of initramfs / initrd under the Linux system.

[0006] The present invention is mainly achieved through the following technical solutions: A method for protecting the security of a file system of a Linux system, encrypting initramfs / initrd, wherein the initramfs / initrd encryption includes the following steps: Step S1: Call dracut in the Linux system to generate initramfs / initrd; Step S2: dracut calls the binary executable program and passes the parameters of the initramfs / initrd generation path, obtains the overall length of the initramfs / initrd file initramfs / initrd_length and the encryption block length block_length through parameter parsing, and creates the encrypted file initramfs / initrd_encrypt; Step S3: for the initramfs / initrd generated in step S1, the overall length of the initramfs / initrd file initramfs / initrd_length is divided into blocks according to the encryption block length block_length to obtain a plurality of initramfs / initrd blocks, and form a block sequence La; Step S4: Obfuscating and arranging the initramfs / initrd blocks in the block sequence La by a sorting algorithm to obtain a block sequence Lb; Step S5: Perform AES encryption on the initramfs / initrd blocks in the block sequence Lb in sequence; Step S6: Generate a mem_header header of 64 bytes of memory for initramfs / initrd, wherein the mem_header header includes fixed characters, a separator, and the length of initramfs / initrd when not encrypted, and the fixed characters are consistent with the characters determined in the kernel; Step S6: Open the encrypted file initramfs / initrd_encrypt, first write the 64-byte mem_header header, and then write all the encrypted initramfs / initrd blocks in the block sequence Lb in sequence to obtain the encrypted initramfs / initrd file.

[0007] In order to better implement the present invention, further, in the step S2, the parameters include the initramfs / initrd file path to be encrypted and the encryption block size; based on the initramfs / initrd file path to be encrypted, the file is opened and read into the memory, and the overall length of the file is assigned to initramfs_length; based on the encryption block size, the encryption block length is obtained and stored in a variable as block_length; if the encryption block is less than 512 bytes, block_length is forcibly assigned to 512 bytes.

[0008] In order to better implement the present invention, further, in step S3, if the length of the last initramfs / initrd block does not meet the encryption block length block_length, the length of the last initramfs / initrd block is padded to the encryption block length block_length by space filling.

[0009] In order to better implement the present invention, further, in step S4, the sorting algorithm is any one of a reverse algorithm, a cross arrangement algorithm, and a custom sorting method.

[0010] In order to better implement the present invention, further, the initramfs / initrd is decrypted, and the initramfs / initrd decryption includes the following steps: Step T1: The kernel obtains the encrypted file initramfs / initrd_encrypt and loads it into the memory mem_initramfs / initrd, reads the starting 64 bytes of data from the memory mem_initramfs / initrd to the mem_header header, and determines whether it is consistent with the fixed characters in the mem_header header. If they are consistent, it proceeds to step T2; Step T2: for the encrypted initramfs / initrd file, the overall length of the initramfs / initrd file (initramfs / initrd_length) is divided into blocks according to the encryption block length (block_length), to obtain the encrypted block sequence Lb, and each encrypted block in the block sequence Lb is decrypted by AES in turn, to restore the decrypted block sequence Lb after the arrangement obfuscation; Step T3: De-obfuscate the initramfs / initrd blocks in the decrypted block sequence Lb by using a reverse sorting algorithm to obtain a block sequence La; Step T4: Generate decrypted initramfs / initrd: Create memory initramfs / initrd_decrypt to make the kernel use the decrypted initramfs / initrd, copy the initramfs / initrd blocks in the block sequence La to the memory initramfs / initrd_decrypt in sequence; calculate the length of initramfs / initrd, if the calculated initramfs / initrd length is consistent with the unencrypted initramfs / initrd length, proceed to step T5; Step T5: Replace the kernel initramfs / initrd execution address: the memory initramfs / initrd_decrypt points to the memory mem_initramfs / initrd reference pointer to provide it to the kernel for access.

[0011] In order to better implement the present invention, further, in step T3, if the last initramfs / initrd block in the block sequence La has a padding item, the padding symbol is removed.

[0012] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the security protection method for the file system of the Linux system.

[0013] An electronic device comprises a memory and a processor; the memory stores a computer program; the processor is used to execute the computer program in the memory to implement the security protection method of the file system of the Linux system.

[0014] The beneficial effects of the present invention are as follows: The present invention encrypts initramfs / initrd after dracut generates initramfs / initrd, and uses the kernel usage code for decryption to prevent anyone from obtaining the internal content by means of general decompression when initramfs / initrd contains core code, thereby effectively improving the security of initramfs / initrd under the Linux system. Some confidential or important system services, drivers, and core script codes are included in initramfs / initrd. By encrypting initramfs / initrd, anyone who obtains initramfs / initrd will be restricted by the secret key if they want to obtain the content therein, thereby improving the security of the operating system to a certain extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1The encryption flow chart of initramfs / initrd in Example 1; Figure 2 The schematic diagram of the principle of initramfs / initrd slicing in Example 1; Figure 3 This is a schematic diagram of the principle of reverse arrangement of initramfs / initrd blocks in Example 1; Figure 4 This is a schematic diagram of the structure of the mem_header header of initramfs / initrd; Figure 5 This is a decryption flow chart of initramfs / initrd in Example 1. DETAILED DESCRIPTION

[0016] Embodiment 1: A security protection method for a file system of a Linux system includes initramfs / initrd encryption and initramfs / initrd decryption. The original process of initramfs / initrd generation is to call dracut and generate initramfs / initrd, such as Figure 1 As shown, the present invention expands the original process, and after generating initramfs / initrd, adds the processes of initramfs / initrd header generation, initramfs / initrd obfuscation, and initramfs / initrd block encryption.

[0017] Dracut is a script file under Linux. The script file is easy to be read by the user. Here, we avoid writing encryption logic directly into the original script. Here, a binary executable program in a compilable language is used for process closure. After dracut generates initramfs / initrd, the initramfs / initrd generation path is passed by calling the execution program parameter.

[0018] Preferably, the initramfs / initrd encryption comprises the following steps: (1) Parameter analysis dracut calls the binary executable and passes it the parameters of the initramfs / initrd path. There are two parameters here - parameter one: the initramfs / initrd file path to be encrypted; parameter two: the encryption block size.

[0019] Get the initramfs / initrd file path from parameter 1 and open the file to read it into memory, assigning the overall file length to initramfs / initrd_length; get the encrypted block size from parameter 2 and store it in the variable block_length. If the encrypted block is less than 512 bytes, block_length is forcibly assigned to 512 bytes; generate the encrypted file initramfs / initrd_encrypt, and directly add the file suffix ".encrypt" after the original file path file name. For example: the encrypted file of initramfs / initrd-4.19.90.img should be named initramfs / initrd-4.19.90.img.encrypt.

[0020] (2) initramfs / initrd block segmentation The original initramfs / initrd is divided into blocks according to block_length to generate a block sequence La. Figure 2 As shown in the figure, the length of initramfs / initrd is divided by the block length block_length. If the length of the current last block cannot meet the block length block_length, it is padded to block_length by space filling and recorded as N.

[0021] (3) Algorithm arrangement confusion The current step uses a sorting algorithm to confuse the initramfs / initrd blocks in the block sequence La to obtain the block sequence Lb, such as Figure 3 As shown in the figure, the reverse algorithm (from {1,2,...,N} to {N,...,2,1}) is used here to implement obfuscation arrangement. However, it is not limited to the reverse algorithm, and cross arrangement, custom sorting, etc. can also be used. At the same time, the initramfs / initrd encryption side and the initramfs / initrd decryption side both use the same sorting algorithm and are not exposed to the outside.

[0022] (4) initramfs / initrd block encryption The initramfs / initrd data blocks in the block sequence Lb are encrypted with AES in sequence. The encryption key required by the encryption algorithm is directly defined in the program.

[0023] For the byte encryption of any initramfs / initrd block in the block sequence Lb, the encryption length is mandatory to be 512 bytes, but the AES algorithm can only encrypt 16 bytes by default, and 32 AES encryptions are required to cover 512 bytes in sequence. In the initramfs / initrd encryption rules, the minimum encryption block size of block_length is 512 bytes (mandatory assignment in step (1)). When the current block_length and encryption length are the same, it is considered as global encryption of the sequence block.

[0024] If the current block_length is any length greater than 512 bytes, the AES algorithm does not encrypt more than 512 bytes. This can be regarded as partial encryption of initramfs / initrd.

[0025] (5) initramfs / initrd generates header like Figure 4 As shown, the current step allocates a 64-byte memory named mem_header. mem_header starts with the start bit of a fixed character, which is defined as "initramfs / initrd_encrypt" (you can specify any character, but it must be consistent with the character determined by the kernel). The space character is used as a separator in the middle, followed by the length of initramfs / initrd before encryption.

[0026] (6) Encrypted initramfs / initrd file generation First, open the initramfs / initrd_encrypt file (.encrypt suffix); then, write the 64-byte mem_header; finally, write all the blocks in the block sequence Lb to the file in sequence.

[0027] Preferably, the kernel will pass the parameter "initrd" from GRUB to read, decompress, and execute initramfs / initrd. The general process is: read initramfs / initrd, decompress initramfs / initrd, and execute initramfs / initrd. To use encrypted initramfs / initrd, the original process needs to be expanded. Specifically, Figure 5 As shown, initramfs / initrd decryption includes the following steps: Prerequisites: The current kernel has obtained the specified encrypted initramfs / initrd path and loaded it into the memory, and the memory is mem_initramfs / initrd.

[0028] block_length is defined in the kernel code and is consistent with the encryption block size passed in encryption step 1 (minimum 512 bytes).

[0029] (1) initramfs / initrd header reading Read the first 64 bytes of mem_initramfs / initrd data to mem_header. Determine whether the fixed start character meets "initramfs / initrd_encrypt". If so, continue to execute the subsequent decryption process; otherwise, it means that the current process decryption is not applicable, and directly return to the original unencrypted initramfs / initrd process for execution.

[0030] Read mem_header to get the unencrypted initramfs / initrd length as initramfs / initrd_length variable.

[0031] (2) Decryption of initramfs / initrd blocks Split initramfs / initrd_length by block_length to get the encrypted sequence Lb. Get each encrypted block in the encrypted block sequence Lb in turn, and perform 32 AES decryption in turn. At this point, the entire initramfs / initrd has been restored to the state after the arrangement obfuscation.

[0032] (3) Reverse arrangement obfuscation algorithm The decrypted block sequence Lb is restored to the block sequence La through the reverse sorting algorithm. Here, the reverse sorting algorithm is the reverse algorithm. Then, executing the reverse algorithm again can return to the state of the block sequence La. In the decryption step, for the initramfs / initrd block N, the unencrypted initramfs / initrd_length modulo operation block_length, if there is a padding item greater than 0, the initramfs / initrd block N should be removed from the padding symbol space. If other arrangement algorithms are used, it is necessary to implement the relevant inverse operation to restore to the block sequence La.

[0033] (4) Generate decrypted initramfs / initrd Open up initramfs / initrd_decrypt as the kernel memory for decrypting initramfs / initrd, and copy the blocks in the La block sequence to initramfs / initrd_decrypt in sequence. At the same time, the length calculated by initramfs / initrd_decrypt is compared with the size of the unencrypted initramfs / initrd. If the lengths are inconsistent, no subsequent operations are performed. Directly return to the general initramfs / initrd kernel process. (5) Replace the kernel initramfs / initrd execution address The initramfs / initrd_decrypt memory points to the mem_initramfs / initrd memory reference pointer to provide access to the kernel, so that the decrypted initramfs / initrd executes the general process through the kernel original initramfs / initrd.

[0034] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any simple modification or equivalent change made to the above embodiment based on the technical essence of the present invention shall fall within the protection scope of the present invention.

Claims

1. A security protection method for a file system of a Linux system, characterized in that: Encrypt initramfs / initrd, and initramfs / initrd encryption includes the following steps: Step S1: Call dracut in the Linux system to generate initramfs / initrd; Step S2: dracut calls the binary executable program and passes the parameters of the initramfs / initrd generation path, obtains the overall length of the initramfs / initrd file initramfs / initrd_length and the encryption block length block_length through parameter parsing, and creates the encrypted file initramfs / initrd_encrypt; Step S3: for the initramfs / initrd generated in step S1, the overall length of the initramfs / initrd file initramfs / initrd_length is divided into blocks according to the encryption block length block_length to obtain a plurality of initramfs / initrd blocks, and form a block sequence La; Step S4: Obfuscating and arranging the initramfs / initrd blocks in the block sequence La by a sorting algorithm to obtain a block sequence Lb; Step S5: Perform AES encryption on the initramfs / initrd blocks in the block sequence Lb in sequence; Step S6: Generate a mem_header header of 64 bytes of memory for initramfs / initrd, wherein the mem_header header includes fixed characters, a separator, and the length of initramfs / initrd when not encrypted, and the fixed characters are consistent with the characters determined in the kernel; Step S6: Open the encrypted file initramfs / initrd_encrypt, first write the 64-byte mem_header header, and then write all the encrypted initramfs / initrd blocks in the block sequence Lb in sequence to obtain the encrypted initramfs / initrd file.

2. A method for protecting the security of a file system of a Linux system according to claim 1, characterized in that: In the step S2, the parameters include the initramfs / initrd file path to be encrypted and the encryption block size; based on the initramfs / initrd file path to be encrypted, the file is opened and read into the memory, and the overall length of the file is assigned to initramfs_length; based on the encryption block size, the encryption block length is obtained and stored in a variable as block_length; if the encryption block is less than 512 bytes, block_length is forcibly assigned to 512 bytes.

3. A method for protecting the security of a file system of a Linux system according to claim 1, characterized in that: In the step S3, if the length of the last initramfs / initrd block does not satisfy the encrypted block length block_length, the length of the last initramfs / initrd block is padded to the encrypted block length block_length by space filling.

4. A method for protecting the security of a file system of a Linux system according to claim 1, characterized in that: In step S4, the sorting algorithm is any one of a reverse order algorithm, a cross arrangement algorithm, and a custom sorting method.

5. A method for protecting the security of a file system of a Linux system according to any one of claims 1 to 4, characterized in that: It also includes decrypting initramfs / initrd, and initramfs / initrd decryption includes the following steps: Step T1: The kernel obtains the encrypted file initramfs / initrd_encrypt and loads it into the memory mem_initramfs / initrd, reads the starting 64 bytes of data from the memory mem_initramfs / initrd to the mem_header header, and determines whether it is consistent with the fixed characters in the mem_header header. If they are consistent, it proceeds to step T2; Step T2: for the encrypted initramfs / initrd file, the overall length of the initramfs / initrd file (initramfs / initrd_length) is divided into blocks according to the encryption block length (block_length), to obtain the encrypted block sequence Lb, and each encrypted block in the block sequence Lb is decrypted by AES in turn, to restore the decrypted block sequence Lb after the arrangement obfuscation; Step T3: De-obfuscate the initramfs / initrd blocks in the decrypted block sequence Lb by using a reverse sorting algorithm to obtain a block sequence La; Step T4: Generate decrypted initramfs / initrd: Create memory initramfs / initrd_decrypt to make the kernel use the decrypted initramfs / initrd, copy the initramfs / initrd blocks in the block sequence La to the memory initramfs / initrd_decrypt in sequence; calculate the length of initramfs / initrd, if the calculated initramfs / initrd length is consistent with the unencrypted initramfs / initrd length, proceed to step T5; Step T5: Replace the kernel initramfs / initrd execution address: the memory initramfs / initrd_decrypt points to the memory mem_initramfs / initrd reference pointer to provide it to the kernel for access.

6. A method for protecting the security of a file system of a Linux system according to claim 5, characterized in that: In step T3, if the last initramfs / initrd block in the block sequence La has a padding item, the padding symbol is removed.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the security protection method for the file system of the Linux system described in any one of claims 1 to 6 is implemented.

8. An electronic device, characterized in that: It comprises a memory and a processor; the memory stores a computer program; the processor is used to execute the computer program in the memory to implement the security protection method for the file system of the Linux system according to any one of claims 1-6.

Images