A method and apparatus for generating an encrypted operating system installation file

Abstract

The method and apparatus for generating encrypted operating system installation files, in this embodiment, at the operating system level, encrypts the files of the kernel, temporary file system, and root file system necessary for running the operating system layer by layer. Data in the root file system can only be accessed by sequentially decrypting the files during system startup on the target product hardware platform according to the bootloader, kernel, temporary file system, and root file system. This avoids the risk of static decryption after system files are extracted, achieving system-level protection of storage media data and improving operating system security. Writing the aforementioned files according to second hardware address mapping information prevents users without access rights from directly reading the files, further enhancing data security. At the user interface level, users can only use product functions in a limited operating environment, preventing users with lower-level permissions from accessing data in the root file system, effectively protecting storage media data at the user level.

Description

Technical Field

[0001] This article relates to information security technology, and in particular to a method and apparatus for generating encrypted operating system installation files. Background Technology

[0002] Linux is one of the world's leading operating systems, originating from Unix. Linux is open-source under the GNU General Public License (GPL), allowing users to freely distribute and modify the software while adhering to the license agreement. As open-source software, Linux boasts a large developer community that continuously optimizes and improves its functionality. It also has numerous different distributions, each with unique features and advantages. Linux is renowned for its exceptional stability, security, and high customizability. Its main advantages include: 1) Security: Linux possesses excellent security, with an extremely low risk of being attacked by viruses and malware; 2) Flexibility: Users can customize the Linux system according to their own needs; 3) Free: Linux is completely free and open-source software, and can be used and distributed without restrictions while adhering to the GPL; 4) Rich software ecosystem: Linux has a large number of free and open-source applications and tools to meet a wide variety of application needs; 5) Excellent performance: Linux has high resource utilization, lower system latency, and supports multithreading and high throughput, enabling stable operation for extended periods and making it suitable for various critical and high-concurrency task scenarios.

[0003] Linux holds a significant position across various industries due to its wide range of applications, making it the preferred operating system solution in many fields. Its main application scenarios include: 1) Servers: Linux is most widely used in the server field; its stability and security make it a popular choice for server systems across various sectors, with many enterprises using Linux-based servers to provide services; 2) Embedded Systems: The Linux kernel is widely used in embedded devices such as routers, switches, and network storage devices; its lightweight and customizable features make it the best choice for embedded systems. Especially with the rapid development of the Internet of Things (IoT) and artificial intelligence (AI), Linux is increasingly favored in these fields, with many IoT devices and AI systems built on Linux; 3) Scientific Computing and Supercomputing: Linux dominates the supercomputer field, with the vast majority of world-class supercomputers powered by the Linux operating system; its excellent scalability and computing efficiency make it well-suited for handling various complex scientific computing tasks; 4) Cloud Computing: Most cloud computing platforms, such as AWS, Google Cloud, and Azure, customize and optimize their infrastructure based on the Linux operating system. These platforms leverage Linux's stability and security to support various services such as virtual machines, containers, and serverless computing to meet the needs of different users, thus achieving market dominance. 5) Personal Desktop: Linux has several personal desktop distributions such as Ubuntu and Fedora. Users who prioritize system security and privacy often choose these distributions as their personal desktop system. Furthermore, the active Linux community provides abundant resources and technical support, allowing users to deeply optimize and customize their operating system.

[0004] With the rapid development of science and technology and the increasing market competition, in today's highly digitalized and networked era, enterprises often encounter the following problems in the process of producing and selling products: 1) Intellectual property theft: Enterprises' innovative products and technologies are easily imitated or stolen by competitors, especially in software products and code. Unauthorized copying and redistribution seriously affect the market share and brand reputation of enterprises; 2) Data leakage risk: Enterprise decisions increasingly rely on data-driven approaches, and sensitive data stored on devices (such as customer information, trade secrets, etc.) have become the primary targets of hacker attacks. Data leakage not only leads to economic losses but also triggers legal liabilities and a crisis of user trust; 3) Software cracking: Hackers and malicious users often crack software by reverse engineering... Using technology to crack product authorizations leads to unauthorized and unrestricted use of a company's commercial products. This cracking behavior not only affects the rights and interests of authorized users and companies, but also leads to the emergence of counterfeit and imitation products, seriously damaging the company's image. 4) Compliance requirements: In many industries, especially in finance, healthcare, government, and industrial control, data security and privacy protection are subject to strict legal and regulatory requirements. Companies must take effective protective measures to ensure that their products and services comply with relevant laws and regulations. 5) Market competition pressure: Companies need to maintain their competitiveness in the industry through continuous technological innovation. However, the rapid iteration and updating of technology makes it easy for competitors to quickly imitate and copy the company's innovative achievements. Effective protective measures must be taken to protect the company's return on investment.

[0005] Today, smart products from enterprises are typically delivered and released in a combination of hardware and software. The hardware devices contain built-in operating systems and software. This hardware-software hybrid product model is prevalent across various industries, especially in the Internet of Things (IoT), smart homes, medical devices, and industrial automation. This built-in software and data constitute the core trade secrets of enterprises. To better protect their software intellectual property and data security, finding a robust information protection solution is essential. This is not only a necessary means for enterprises to protect their own interests but also crucial for their sustainable development. To protect the intellectual property of their products, enterprises often use various data encryption technologies. The advantages of these protection solutions mainly include: 1) Enhancing the confidentiality and integrity of software and data: ensuring that unauthorized users cannot access the device's content, protecting the intellectual property security of the software; 2) Enhancing user privacy: users can confidently store critical data on the device without worrying about data theft or leakage; 3) Eliminating the risk of data leakage after the device is stolen or lost: even if the device is stolen, the data within it cannot be maliciously stolen or recovered, thus protecting data security; 4) Compliance with industry and regulatory requirements: encrypting software and data ensures compliance with relevant laws and regulations and the regulatory requirements of industry authorities. Protective measures using mainstream encryption technologies can mitigate various risks to enterprises, such as the theft of software intellectual property, the theft of core data, the cracking and illegal distribution of software products. The mainstream encryption schemes in this field include: 1) Disk encryption: using system-level encryption technology to encrypt the entire operating system and disk data, such as BitLocker for Windows, FileVault for macOS, and dm-crypt / LUKS for Linux; 2) File system encryption: using file system encryption software to encrypt specific directories or files, such as EncryptingFileSystem for Windows, DataProtection for macOS, and eCryptfs for Linux; 3) Container encryption: using encrypted containers for data storage, such as VeraCrypt and DiskCryptor; 4) Application encryption: using encryption software to encrypt specific programs and the data generated by those programs, such as Microsoft Office document encryption and 7-Zip file encryption. Among the encryption technologies mentioned above, disk encryption technology has the advantage of providing comprehensive protection for the entire operating system and disk data; however, its disadvantages are that it greatly reduces disk performance, negatively impacting the user experience. At the same time, the disk is also vulnerable to decryption, as hackers can use appropriate tools to brute-force crack the disk key to decrypt the disk data.Other encryption technologies besides disk encryption can flexibly and selectively encrypt critical file systems, software, and data, but they cannot fully protect the entire system and data. Other data besides encrypted data is still at risk of being leaked.

[0006] In conclusion, how to achieve system and data security without reducing disk performance remains an unresolved issue. Summary of the Invention

[0007] This application provides a method for generating an encrypted operating system installation file, including:

[0008] The kernel file, temporary file system file, and root file system tool file used to build the operating system are encrypted separately.

[0009] Based on the decryption information of the kernel file and the pre-determined first hardware address mapping information, a bootloader file is generated;

[0010] The bootloader file, encrypted kernel file, temporary file system file, and root file system tool file are written to the storage medium according to the second hardware address mapping information to obtain a storage medium containing the operating system. The second hardware address information includes: the first hardware address mapping information, the third hardware address mapping information of the temporary file system file, and the fourth hardware address mapping information of the root file system tool file.

[0011] The bootloader code integrates the kernel file loading and decryption code; the kernel code integrates the temporary file system loading and decryption code; the temporary file system code integrates the root file system utility file loading and decryption code; a storage medium is physically connected to a product for system operation and data storage on the product's hardware platform; the second hardware address mapping information includes predetermined offset address information for the bootloader file, the encrypted kernel file, the temporary file system file, and the root file system utility file.

[0012] On the other hand, embodiments of this application also provide a computer storage medium storing a computer program, which, when executed by a processor, runs the above-described method for generating encrypted operating system installation files.

[0013] Furthermore, embodiments of this application also provide a terminal, including: a memory and a processor, wherein the memory stores a computer program; wherein,

[0014] The processor is configured to execute computer programs in memory;

[0015] When the computer program is executed by the processor, it performs the method described above for generating encrypted operating system installation files.

[0016] Furthermore, embodiments of this application also provide an apparatus for generating encrypted operating system installation files, comprising: an encryption unit, a generation unit, and a writing processing unit; wherein,

[0017] The encryption unit is configured to encrypt the kernel file, temporary file system file, and root file system tool file used to build the operating system, respectively.

[0018] The generation unit is configured to generate a bootloader file based on the decryption information of the kernel file and the pre-determined first hardware address mapping information;

[0019] The write processing unit is configured to write the bootloader file, the encrypted kernel file, the temporary file system file, and the root file system tool file into the storage medium according to the second hardware address mapping information, thereby obtaining a storage medium containing the operating system. The second hardware address information includes: the first hardware address mapping information, the third hardware address mapping information of the temporary file system file, and the fourth hardware address mapping information of the root file system tool file.

[0020] The bootloader code integrates the kernel file loading and decryption code; the kernel code integrates the temporary file system loading and decryption code; the temporary file system code integrates the root file system utility file loading and decryption code; a storage medium is physically connected to a product for system operation and data storage on the product's hardware platform; the second hardware address mapping information includes predetermined offset address information for the bootloader file, the encrypted kernel file, the temporary file system file, and the root file system utility file.

[0021] At the operating system level, this disclosure encrypts the kernel file, temporary file system file, and root file system tool file—essential for running the operating system—layer by layer. Data in the root file system can only be accessed by sequentially decrypting the bootloader, kernel, temporary file system, and root file during system startup on the target product hardware platform. This avoids the risk of static decryption after extraction of one or more system files, effectively protecting storage media data at the system level and enhancing operating system security. Furthermore, writing the second hardware address mapping information into the bootloader file, encrypted kernel file, temporary file system file, and root file system tool file prevents unauthorized users from directly reading files, improving data security. At the user interface level, users can only use product functions in limited operating environments, such as HTTPS services, preventing users from gaining low-level access to data in the root file system, thus effectively protecting storage media data at the user level.

[0022] Other features and advantages of this application will be set forth in the following description, and will be apparent in part from the description, or may be learned by practicing the application. Other advantages of this application can be realized and obtained by means of the solutions described in the description and the accompanying drawings. Attached Figure Description

[0023] The accompanying drawings are used to provide an understanding of the technical solutions of this application and constitute a part of the specification. They are used together with the embodiments of this application to explain the technical solutions of this application and do not constitute a limitation on the technical solutions of this application.

[0024] Figure 1 A flowchart illustrating a method for generating encrypted operating system installation files according to embodiments of this disclosure;

[0025] Figure 2 This is a schematic diagram of the data structure of the storage medium according to an embodiment of the present disclosure;

[0026] Figure 3 A structural block diagram of an apparatus for generating encrypted operating system installation files according to embodiments of this disclosure;

[0027] Figure 4 This is a flowchart illustrating an application example of this disclosure. Detailed Implementation

[0028] This application describes several embodiments, but these descriptions are exemplary and not restrictive, and it will be apparent to those skilled in the art that many more embodiments and implementations are possible within the scope of the embodiments described herein. Although many possible combinations of features are shown in the drawings and discussed in the detailed description, many other combinations of the disclosed features are also possible. Unless specifically limited, any feature or element of any embodiment may be used in combination with, or may replace, any feature or element of any other embodiment.

[0029] This application includes and contemplates combinations of features and elements known to those skilled in the art. The embodiments, features, and elements disclosed in this application can also be combined with any conventional features or elements to form unique inventive solutions. Any feature or element of any embodiment can also be combined with features or elements from other inventive solutions to form another unique inventive solution. Therefore, it should be understood that any feature shown and / or discussed in this application can be implemented individually or in any suitable combination. Therefore, the embodiments are not limited except by the limitations imposed by the appended claims and their equivalents. Furthermore, various modifications and changes can be made within the scope of the appended claims.

[0030] Furthermore, in describing representative embodiments, the specification may have presented methods and / or processes as a specific sequence of steps. However, the method or process should not be limited to the specific order of steps described herein, to the extent that it does not depend on such a specific order. As will be understood by those skilled in the art, other sequences of steps are also possible. Therefore, the specific order of steps set forth in the specification should not be construed as a limitation of the claims. Moreover, the claims concerning the method and / or process should not be limited to the steps performed in the written order, and those skilled in the art will readily understand that these orders can be varied and still remain within the spirit and scope of the embodiments of this application.

[0031] Figure 1 A flowchart of a method for generating encrypted operating system installation files for embodiments of this disclosure is shown below. Figure 1 As shown, it includes:

[0032] Step 101: Encrypt the kernel file, temporary file system file, and root file system tool file used to build the operating system.

[0033] Step 102: Generate a bootloader file based on the decryption information of the kernel file and the pre-determined first hardware address mapping information;

[0034] Step 103: Write the bootloader file, encrypted kernel file, temporary file system file, and root file system tool file into the storage medium according to the second hardware address mapping information to obtain a storage medium containing the operating system. The second hardware address information includes: the first hardware address mapping information, the third hardware address mapping information of the temporary file system file, and the fourth hardware address mapping information of the root file system tool file.

[0035] The bootloader code integrates kernel file loading and decryption code; the kernel code integrates temporary file system loading and decryption code; the temporary file system code integrates root file system utility file loading and decryption code; a storage medium is physically connected to a product for system operation and data storage on the product's hardware platform; the second hardware address mapping information contains predetermined offset address information for the bootloader file, encrypted kernel file, temporary file system file, and root file system utility file.

[0036] At the operating system level, this disclosure encrypts the kernel file, temporary file system file, and root file system file—essential for running the operating system—layer by layer. Data in the root file system can only be accessed by sequentially decrypting the bootloader, kernel, temporary file system, and root file system during system startup on the target product hardware platform. This avoids the risk of static decryption after extraction of one or more system files, effectively protecting storage media data at the system level and enhancing operating system security. Furthermore, writing the second hardware address mapping information into the bootloader file, encrypted kernel file, temporary file system file, and root file system utility files prevents unauthorized users from directly reading files, further improving data security. At the user interface level, users can only use product functions in limited operating environments, such as HTTPS services, preventing users from gaining low-level access to data in the root file system, thus effectively protecting storage media data at the user level.

[0037] Based on steps 101 to 103, this embodiment of the disclosure realizes the customization and editing of the kernel file, temporary file system file and root file system tool file required for the operation of the operating system, and obtains the encrypted operating system runtime file.

[0038] In this embodiment, the operating system installation file is embedded in the storage medium. The storage medium is in an unrecognized RAW format, making it impossible to locate and identify the data. The mounted storage medium is identified as an uninitialized disk, which does not contain decrypted disk partition information. Physical protection is provided while maintaining disk performance, preventing the data in the storage medium from being decrypted. The installation files and runtime data of the loaded software are stored in the directory of the encrypted root file system, thus achieving security protection for the software and runtime data.

[0039] In one exemplary instance, the operating system in this disclosure includes: the Linux operating system.

[0040] In one exemplary instance, the temporary system file in this disclosure embodiment is primarily responsible for the initialization of various hardware devices and user file systems during system startup. The temporary file system file in this disclosure embodiment includes: an initialization RAM file system file.

[0041] In this disclosure, the terminal users without access rights include local users and network users without operating system administrator privileges.

[0042] In one exemplary instance, the method of this disclosure embodiment further includes:

[0043] The first hardware address mapping information of the kernel file is hidden and / or encrypted in the bootloader file; when the bootloader file runs, the first hardware address mapping information is obtained by decrypting through the de-hiding and decryption information corresponding to the hiding and / or encryption.

[0044] The kernel file hides and / or encrypts the third hardware address mapping information of temporary file system files; when the kernel file runs, the third hardware address mapping information is obtained by decrypting through the de-hiding and decryption information corresponding to the hiding and / or encryption.

[0045] The fourth hardware address mapping information of the root file system tool file is hidden and / or encrypted in the temporary file system file. When the temporary file system file is running, the fourth hardware address mapping information is obtained by decrypting through the unhiding and decryption information corresponding to the hiding and / or encryption.

[0046] In one exemplary instance, the offset address information in this disclosure includes: offset address information of the storage medium determined by the Master Boot Record (MBR).

[0047] This disclosed example, at the storage medium level, uses the offset address information of the storage medium determined by the Master Boot Record (MBR) to implement a modified MBR partition format structure. Compared with the MBR in related technologies, it only uses the MBR for booting and does not use the MBR partition format. The storage medium does not contain any partition table or disk partitions and will be identified as an uninitialized disk when mounted. Compared with the MBR, GPT and other partition formats in related technologies, it avoids the risk of the file partition information of the storage medium being identified, thereby effectively protecting the data of the storage medium at the physical layer.

[0048] See Figure 2 The data structure of the storage medium in this embodiment mainly includes the hardware addresses and file sizes of the bootloader file, kernel file, temporary system file, and root file system tool file in the storage medium; the starting and ending hardware addresses of all the above files in this embodiment must be within the effective hardware address range of the storage medium and cannot overlap with the hardware addresses of other files in the storage medium; the storage addresses of different files in this embodiment can be set and adjusted based on pre-set offset address information.

[0049] In one exemplary instance, the root file system tool file in this disclosure embodiment can create directory structures, copy service files, and create toolsets; the toolset of the root file system tool file can be built using Busybox; BusyBox in this disclosure embodiment integrates executable files of commonly used Unix tools, and is a collection of tools; the use of Busybox technology in this disclosure embodiment can achieve compatibility with various hardware platforms, especially embedded hardware compatibility. In one exemplary instance, the kernel file in this disclosure embodiment can be generated using cross-compilation. This disclosure embodiment configures kernel options according to the hardware requirements of the product, referring to related technologies.

[0050] In one exemplary instance, the bootloader file of this disclosure embodiment can be generated using GRUB. This disclosure embodiment can also use other methods to generate the bootloader; for example, GRUB2 and Syslinux.

[0051] In one exemplary instance, the method of this disclosure embodiment further includes:

[0052] Configure the temporary filesystem to be integrated into the kernel file in the kernel options configuration; or...

[0053] Configure the way temporary file system files are loaded in the kernel options to load temporary file system files in the configured manner.

[0054] After the above processing, when the operating system starts, the bootloader is responsible for reading, decrypting, and loading the kernel file; the kernel executes the reading, decryption, and loading of the temporary file system file; after the kernel loads and runs the temporary file system, the temporary file system executes custom code to implement the reading, decryption, and loading of the root file system.

[0055] In one exemplary instance, the method of this disclosure embodiment further includes:

[0056] The decryption key and corresponding decryption algorithm for the kernel file are stored in the bootloader file;

[0057] The kernel file stores the decryption key and corresponding decryption algorithm for the temporary file system file.

[0058] The decryption key and corresponding decryption algorithm of the root file system tool file are stored in a temporary file system file.

[0059] The encryption process performed in the above steps of this disclosure embodiment can be implemented based on the following encryption algorithms and / or tools:

[0060] Symmetric encryption algorithms: Advanced Encryption Standard (AES), Data Encryption Standard (DES), Blowfish, and RC4 (RivestCipher4), etc.

[0061] Asymmetric encryption algorithms include RSA (Rivest-Shamir-Adleman), Elliptic Curve Cryptography (ECC), and ECCDSA (Digital Signature Algorithm).

[0062] Encryption tools include: LUKS (LinuxUnifiedKeySetup), VeraCrypt (an open-source disk file encryption software), Cryptsetup (a command-line tool for interacting with dm-crypt to create, access, and manage encrypted devices), Dm-crypt (a disk encryption subsystem in the Linux kernel), and Fscrypt (a disk encryption subsystem in the Linux kernel), etc.

[0063] In one exemplary instance, the method of this disclosure embodiment further includes:

[0064] The kernel file is hidden, and the code to unhide the kernel file is integrated into the bootloader file;

[0065] The temporary file system files are hidden, and the code to unhide the temporary file system files is integrated into the kernel file;

[0066] The root file system utility files are hidden, and code for unhiding temporary file system files is integrated into the temporary file system files. In one exemplary instance, this disclosure embodiment physically connects the storage medium to the product hardware; different storage media are connected in different ways, for example, SATA devices are typically connected to the power supply and motherboard, NVMe devices are typically connected to the M.2 slot, and CompactFlash devices are typically connected to the CF slot. This disclosure embodiment can set the deployed storage medium as the sole boot medium in the product hardware BIOS; in addition, this disclosure embodiment can also employ one or more methods to secure the hardware boot configuration. For example: setting a BIOS password; disabling booting from external devices (USB, etc.); enabling secure boot functionality; using one-time tags to prevent physical disassembly of the product, etc.

[0067] The operating system file generated by the method in this disclosure can be applied to various hardware platforms such as personal computers, servers, embedded devices, and IoT devices, including but not limited to hardware with various X86, AMD64, and ARM CPU architectures capable of running the Linux operating system; for example, smart home devices in the consumer electronics field, office equipment in the enterprise application field, medical devices in the embedded field, and monitoring devices in the IoT field; it is also applicable to persistent storage media that can be recognized by the Linux operating system, and provides corresponding protection for the data in the storage media, such as SATA devices, NVMe devices, and CompactFlash devices.

[0068] This disclosure also provides a computer storage medium storing a computer program, which, when executed by a processor, runs the method described above for generating encrypted operating system installation files.

[0069] This disclosure also provides a terminal, including: a memory and a processor, wherein the memory stores a computer program; wherein,

[0070] The processor is configured to execute computer programs in memory;

[0071] The above method for generating encrypted operating system installation files is executed when a computer program is run by a processor.

[0072] Figure 3 A structural block diagram of the apparatus for generating operating system installation files according to embodiments of this disclosure is shown below. Figure 3 As shown, it includes: an encryption unit, a generation unit, and a write processing unit; wherein,

[0073] The encryption unit is configured to encrypt the kernel file, temporary file system file, and root file system tool file used to build the operating system, respectively.

[0074] The generation unit is configured to generate a bootloader file based on the decryption information of the kernel file and the pre-determined first hardware address mapping information;

[0075] The write processing unit is configured to write the bootloader file, the encrypted kernel file, the temporary file system file, and the root file system tool file into the storage medium according to the second hardware address mapping information, thereby obtaining a storage medium containing the operating system. The second hardware address information includes: the first hardware address mapping information, the third hardware address mapping information of the temporary file system file, and the fourth hardware address mapping information of the root file system tool file.

[0076] The bootloader code integrates kernel file loading and decryption code; the kernel code integrates temporary file system loading and decryption code; the temporary file system code integrates root file system utility file loading and decryption code; a storage medium is physically connected to a product for system operation and data storage on the product's hardware platform; the second hardware address mapping information contains predetermined offset address information for the bootloader file, encrypted kernel file, temporary file system file, and root file system utility file.

[0077] In one exemplary instance, the generation unit of this disclosure embodiment is further configured as follows:

[0078] The first hardware address mapping information of the kernel file is hidden and / or encrypted in the bootloader file; when the bootloader file runs, the first hardware address mapping information is obtained by decrypting through the de-hiding and decryption information corresponding to the hiding and / or encryption.

[0079] The kernel file hides and / or encrypts the third hardware address mapping information of temporary file system files; when the kernel file runs, the third hardware address mapping information is obtained by decrypting through the de-hiding and decryption information corresponding to the hiding and / or encryption.

[0080] The fourth hardware address mapping information of the root file system tool file is hidden and / or encrypted in the temporary file system file. When the temporary file system file is running, the fourth hardware address mapping information is obtained by decrypting through the unhiding and decryption information corresponding to the hiding and / or encryption.

[0081] In one exemplary instance, the offset address information in this disclosure includes offset address information of the storage medium determined using the Master Boot Record (MBR).

[0082] In one exemplary instance, the temporary file system file of this disclosure includes: an initialization RAM file system file.

[0083] In one exemplary instance, the apparatus of this disclosure embodiment further includes a kernel loading processing unit, configured as follows:

[0084] Configure the temporary filesystem to be integrated into the kernel file in the kernel options configuration; or...

[0085] Configure the way temporary file system files are loaded in the kernel options to load temporary file system files in the configured manner.

[0086] In one exemplary instance, the generation unit of this disclosure embodiment is further configured as follows:

[0087] The decryption key and corresponding decryption algorithm for the kernel file are stored in the bootloader file;

[0088] The kernel file stores the decryption key and corresponding decryption algorithm for the temporary file system file.

[0089] The decryption key and corresponding decryption algorithm of the root file system tool file are stored in a temporary file system file.

[0090] In one exemplary instance, the generation unit of this disclosure embodiment is further configured as follows:

[0091] The kernel file is hidden, and the code to unhide the kernel file is integrated into the bootloader file;

[0092] The temporary file system files are hidden, and the code to unhide the temporary file system files is integrated into the kernel file;

[0093] The code hides the root file system utility files and integrates code to unhide the temporary file system files.

[0094] The following application examples briefly illustrate the embodiments of this disclosure. These application examples are only used to illustrate the embodiments of this disclosure and are not intended to limit the scope of protection of the embodiments of this disclosure.

[0095] Application Examples

[0096] This disclosure addresses the security issues of operating systems and application software, protecting them from unauthorized access and injection. It can be used to ensure that a company's technological innovations and trade secrets are not stolen, cracked, or illegally distributed. The methods described in this disclosure can help companies address risks such as software cracking, data leakage, unauthorized access, and secondary distribution, protecting their core interests and increasing their competitiveness in the industry.

[0097] This disclosure provides a user environment that restricts access to the underlying system. Users can access the services provided by the product to achieve various product functions and meet business needs, but cannot access the product's underlying operating system and storage media data. This design of restricting underlying access not only ensures the convenience of user operation and protects the security of user's underlying data, but also further protects the security of enterprise products and maintains the competitiveness of enterprise products. Compared with current mainstream encryption protection technologies, this disclosure is based on operating system principles and combines multiple hiding and encryption technologies to deeply customize the operating system. The protection capability can cover the entire lifecycle of the operating system, system applications, and storage media data. In related software encryption protection schemes, disk partition information cannot be hidden. Hackers can easily obtain the disk partition structure by extracting disk partition table information and perform further decryption operations. This disclosure adopts a storage media-free partitioning scheme. The storage media will be identified as an uninitialized disk state when mounted in any system, thereby solving the problem of storage media data decryption. In relevant hardware encryption protection schemes, dedicated hardware devices (such as security chips or hardware keys) are typically used to generate and store keys for encrypted data. While hardware encryption schemes offer many security advantages, they also have some drawbacks, such as high cost, strong device dependence, poor compatibility, and lack of flexibility. Furthermore, hardware keys are also at risk of being lost or stolen; once lost or stolen, the data will be completely lost or stolen. This disclosed embodiment does not rely on any dedicated hardware module or chip and can be implemented on any hardware platform running the Linux operating system. It has the advantages of no hardware dependence, high flexibility, strong compatibility, and inherent protection against loss and theft.

[0098] Design the storage medium data structure; employ MBR partitioning technology, and plan the storage medium's data structure based on the total capacity of the storage medium and the size of the files to be stored; combining physical address mapping information, the data structure distribution of the storage medium is shown in [reference]. Figure 2 ;

[0099] A hardware address encryption algorithm is designed; to further improve the data security of the storage medium, embodiments of this disclosure hide and encrypt the hardware address mapping information. Correspondingly, during the operating system startup process, the hardware address mapping information is decrypted.

[0100] Figure 4 This is a flowchart illustrating an application example of this disclosure, such as... Figure 4 As shown, it includes:

[0101] S401: Create root file system tool files; The main consideration in this embodiment of the disclosure for creating root file system tool files is the compatibility of various hardware platforms, especially the compatibility of embedded hardware.

[0102] S402: Encrypt root file system; one of the encryption tools can be used to encrypt the root file system tool files and save the encryption key for later use.

[0103] S403: Configure kernel options; Configure the kernel according to the product's hardware requirements through cross-compilation, integrate the Initramfs temporary file system in the kernel options, and package the Initramfs file into the kernel file during kernel compilation.

[0104] S404: Create a temporary file system; This method uses the Initramfs file system as a temporary file system during the operating system startup process; During system startup, Initramfs will be responsible for initializing various hardware devices and decrypting and loading the root file system in S202.

[0105] S405: Custom root file system code; Since the root file system is encrypted, decryption code for the root file system utility files needs to be integrated into the kernel and Initramfs code. During the operating system boot process, after the kernel loads and runs the Initramfs temporary file system, Initramfs executes custom code to read, decrypt, and load the root file system.

[0106] S406: Encrypted Temporary File System; To further protect the Initramfs file and prevent its extraction through methods such as decompressing kernel files, after the Initramfs is created, one of the aforementioned encryption algorithms can be used to encrypt the Initramfs file, and the encryption key can be saved for later use.

[0107] S407: Custom temporary file system code; since the temporary file system is encrypted, Initramfs file decryption code needs to be integrated into the kernel code. During the operating system boot process, after the kernel is loaded, the kernel executes the custom code to implement the reading, decryption, and loading of Initramfs.

[0108] S408: Compile the kernel file; After completing all the above steps, the kernel file is generated by cross-compiling.

[0109] S409: Encrypt kernel file; To further protect the kernel file and prevent static extraction of the kernel file through disk mounting or other methods, after the kernel file is generated, one of the aforementioned encryption algorithms is used to encrypt the kernel file, and the encryption key is saved for later use.

[0110] S410: Create a bootloader; use GRUB to create a bootloader for the operating system.

[0111] S411: Custom kernel code; because the kernel file has been hidden and encrypted, the kernel file loading and decryption code needs to be integrated into the GRUB code. During the operating system boot process, GRUB first decrypts the kernel file hardware address and reads the kernel file, then decrypts the kernel file using a key, and finally loads the kernel file.

[0112] S412: Compile the bootloader; use tools such as make to compile the bootloader and generate the required bootloader file.

[0113] In this embodiment of the disclosure, after creating the files required for the operating system, the generated operating system files are also written into the storage medium to complete the creation of the storage medium.

[0114] S413: Writing the bootloader: In this embodiment of the disclosure, the bootloader, kernel file, and root file system are written to the storage medium in sequence; for example, tools such as dd (a command-line tool widely used in Linux and Unix systems, mainly used for reading, converting, and outputting data) can be used to write the files;

[0115] S414: Deploy storage media; physically connect the storage media to the product's hardware platform.

[0116] S415: Configure the product's boot device; set the storage medium as the sole boot medium in the product hardware's BIOS.

[0117] This disclosure hides and encrypts the operating system and storage media to protect the applications and data within them, while restricting user access to the underlying environment. This further protects the security of enterprise products and storage media data while ensuring user convenience. The method of this disclosure can better build industry technological barriers for enterprises, maintain the core competitiveness of their products, and protect the data security of their products. It should be noted that the method of this disclosure starts from the computer hardware startup and ends when the operating system finishes booting up. All intermediate stages are developed using progressive customization, achieving full lifecycle security protection for the operating system, software products, and storage media data through layers of hiding and encryption technologies.

[0118] It will be understood by those skilled in the art that all or some of the steps, systems, or apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all components may be implemented as software executed by a processor, such as a digital signal processor or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software may be distributed on a computer-readable medium, which may include computer storage media (or non-transitory media) and communication media (or transient media). As is known to those skilled in the art, the term "computer storage medium" includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, EEPROM, flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and can be accessed by a computer. Furthermore, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

Claims

1. A method for generating encrypted operating system installation files, characterized in that, include: The kernel file, temporary file system file, and root file system tool file used to build the operating system are encrypted separately. Based on the decryption information of the kernel file and the pre-determined first hardware address mapping information, a bootloader file is generated; The bootloader file, encrypted kernel file, temporary file system file, and root file system tool file are written to the storage medium according to the second hardware address mapping information to obtain a storage medium containing the operating system. The second hardware address information includes: the first hardware address mapping information, the third hardware address mapping information of the temporary file system file, and the fourth hardware address mapping information of the root file system tool file. The bootloader code integrates the kernel file loading and decryption code; the kernel code integrates the temporary file system loading and decryption code; the temporary file system code integrates the root file system utility file loading and decryption code; a storage medium is physically connected to a product for system operation and data storage on the product's hardware platform; the second hardware address mapping information includes predetermined offset address information for the bootloader file, the encrypted kernel file, the temporary file system file, and the root file system utility file.

2. The method according to claim 1, characterized in that, The method further includes: The first hardware address mapping information of the kernel file is hidden and / or encrypted in the bootloader file; when the bootloader file runs, the first hardware address mapping information is obtained by decrypting through the de-hiding and decryption information corresponding to the hiding and / or encryption. The kernel file hides and / or encrypts the third hardware address mapping information of the temporary file system file; when the kernel file runs, the third hardware address mapping information is obtained by decrypting through the de-hiding and decryption information corresponding to the hiding and / or encryption. The fourth hardware address mapping information of the root file system tool file is hidden and / or encrypted in the temporary file system file; when the temporary file system file is running, the fourth hardware address mapping information is obtained by decrypting through the unhiding and decryption information corresponding to the hiding and / or encryption.

3. The method according to claim 1, characterized in that, The offset address information includes: the offset address information of the storage medium determined by the Master Boot Record (MBR).

4. The method according to claim 1, characterized in that, The temporary file system files include: the initialization RAM file system file.

5. The method according to claim 1, characterized in that, The root file system tool files are built using Busybox.

6. The method according to claim 1, characterized in that, The method further includes: Configure the temporary filesystem to be integrated into the kernel file in the kernel options configuration; or... Configure the way the temporary file system file is loaded in the kernel options to load the temporary file system file in the configured manner.

7. The method according to any one of claims 1 to 6, characterized in that, The method further includes: The decryption key and corresponding decryption algorithm of the kernel file are stored in the bootloader file; The kernel file stores the decryption key and corresponding decryption algorithm for the temporary file system file. The temporary file system file stores the decryption key and corresponding decryption algorithm of the root file system tool file.

8. The method according to any one of claims 1 to 6, characterized in that, The method further includes: The kernel file is hidden, and code for unhiding the kernel file is integrated into the bootloader file; The temporary file system files are hidden, and code for unhiding the temporary file system files is integrated into the kernel file; The root file system tool file is hidden, and code to unhide the root file system tool file is integrated into the temporary file system file.

9. A computer storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the method for generating an encrypted operating system installation file as described in any one of claims 1 to 8.

10. A terminal, comprising: A memory and a processor, wherein the memory stores a computer program; wherein, The processor is configured to execute computer programs in memory; When the computer program is executed by the processor, it implements the method for generating an encrypted operating system installation file as described in any one of claims 1 to 8.

11. An apparatus for generating encrypted operating system installation files, comprising: The unit comprises an encryption unit, a generation unit, and a write processing unit; among which, The encryption unit is configured to encrypt the kernel file, temporary file system file, and root file system tool file used to build the operating system, respectively. The generation unit is configured to generate a bootloader file based on the decryption information of the kernel file and the pre-determined first hardware address mapping information; The write processing unit is configured to write the bootloader file, the encrypted kernel file, the temporary file system file, and the root file system tool file into the storage medium according to the second hardware address mapping information, thereby obtaining a storage medium containing the operating system. The second hardware address information includes: the first hardware address mapping information, the third hardware address mapping information of the temporary file system file, and the fourth hardware address mapping information of the root file system tool file. The bootloader code integrates the kernel file loading and decryption code; the kernel code integrates the temporary file system loading and decryption code; the temporary file system code integrates the root file system utility file loading and decryption code; a storage medium is physically connected to a product for system operation and data storage on the product's hardware platform; the second hardware address mapping information includes predetermined offset address information for the bootloader file, the encrypted kernel file, the temporary file system file, and the root file system utility file.

Images