Mirror image file burning processing method capable of starting full-disk encryption

Abstract

The invention relates to the field of intelligent equipment manufacturing, and discloses a burnt mirror image file processing method capable of starting full-disk encryption, which is used for processing a mirror image file before burning and solving the problem of long burning time of the mirror image file due to starting of a full-disk encryption technology. According to the scheme, firstly, storage partition information is obtained, then format recognition and screening are conducted on storage partitions, and a target partition containing a mountable file system is determined; then, an analysis tool matched with the format of the target partition is adopted, use state information of the target partition is extracted, and the use state information at least comprises position features of the free data blocks; positioning a storage area corresponding to the idle data block in the to-be-processed burning mirror image by combining the partition configuration information table and the position characteristics of the idle data block; and finally, carrying out data filling on an idle data block storage area positioned in the to-be-processed burning mirror image, and setting all bits in the area as logic high levels to obtain an optimized burning mirror image file.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of intelligent device manufacturing, in particular to a burning image file processing method for enabling full-disk encryption. BACKGROUND

[0002] In the manufacturing process of intelligent devices, the software burning of embedded multimedia memory cards (EMMC) is one of the procedures. The hardware characteristics of EMMC storage chips determine that all storage units are initialized to a logic high level (full 1 state) when they are shipped. The core logic of existing burning technology is to only rewrite the data segments with bit 0 in the image, so the number of 0 bits in the image file is directly related to the burning time. The lower the proportion of 0 bits, the higher the burning efficiency.

[0003] With the improvement of user data security requirements, full-disk encryption technology has become a standard security solution for intelligent devices. This technology uses encryption algorithms to encrypt all partition data in EMMC except the user partition to prevent data leakage after the device is lost. However, the application of full-disk encryption technology has caused a decrease in burning efficiency: when encryption is not enabled, the empty space in the image file that is not occupied by actual data can naturally remain full 1 state and does not need to be processed by the burner; but when full-disk encryption is used to process the image file, these empty spaces are filled with pseudo-random data (to ensure the integrity and anti-cracking of encrypted data), which replaces the originally full 1 empty space with a large number of 0 bits, thereby increasing the time of a single burning. SUMMARY

[0004] The technical problem to be solved by the present application is to provide a burning image file processing method for enabling full-disk encryption, which processes the image file before burning to solve the problem of long burning time caused by the use of full-disk encryption technology.

[0005] The technical solution adopted by the present application to solve the above technical problem is: A burning image file processing method for enabling full-disk encryption, comprising the following steps: S1. Obtain the system compilation product of an intelligent device, which at least contains a set of all storage partitions, a partition configuration information table, and a to-be-processed burning image; S2. Format identification and screening of the storage partition to determine the target partition containing a mountable file system; S3. Using an analysis tool adapted to the format of the target partition, extract the usage state information of the target partition, which at least contains the location characteristics of the idle data block; S4. Combine the partition configuration information table and the location characteristics of the idle data block to locate the storage area of the corresponding idle data block in the to-be-processed burning image; S5. Data padding is performed on the idle data block storage area located in the to-be-processed burning image, all bit positions in the area are set to a logic high level, and an optimized burning image file is obtained.

[0006] Further, in step S1, the to-be-processed burning image is an image file with full-disk encryption enabled, and the encryption range covers all functional partitions in the smart device except the user self-storage partition.

[0007] Further, in step S2, the mountable file system includes but is not limited to: ext4 file system, erofs file system, f2fs file system, and dynamic partition management system of the smart device.

[0008] Further, in step S2, when the target partition is screened, the boot startup type partition and the Raw data storage partition are determined as non-target partitions and are not included in the subsequent analysis process.

[0009] Further, in step S3, the analysis tool adapted to the format of the target partition includes: For dynamic partition, a partition metadata analysis tool is selected; for ext4, erofs, and f2fs partitions, a file system block state analysis tool is selected.

[0010] Further, in step S3, the position characteristics of the idle data block include: the starting index, the ending index, and the data block unit size of the idle data block in the target partition.

[0011] Further, in step S4, the way of locating the idle data block storage area includes: The starting offset of the target partition in the to-be-processed burning image is determined according to the partition configuration information, and the actual address range of the idle data block in the to-be-processed burning image is calculated based on the position characteristics of the idle data block.

[0012] Further, in step S5, the way of performing data padding includes: Before data padding, a copy of the to-be-processed burning image is created, and the padding operation is performed on the copy; after the padding is completed, the optimized burning image is subjected to integrity verification.

[0013] Further, step S5 further includes: the optimized burning image file is subjected to compression processing by using a compression tool.

[0014] Further, the smart device includes but is not limited to: a smart television, an Internet of Things terminal, or an embedded smart control device; the storage medium in the smart device uses an embedded multimedia storage card (EMMC).

[0015] The beneficial effects of the present application are: (1) Shorten the mirror burning time of the full-disk encryption intelligent device: The present scheme identifies the idle data block storage area in the to-be-processed burning mirror image, and uniformly sets the bit to a logical high level, thereby reducing the number of 0 bits to be rewritten during the burning process, and shortening the burning time.

[0016] (2) Consider both device data security and burning efficiency: The present scheme only optimizes the idle data block area in the mirror image and does not involve the encrypted functional partition data, is fully compatible with the security protection logic of the full-disk encryption technology, and meets the dual requirements of data security and production efficiency of intelligent devices.

[0017] (3) Wide application range and no increase in hardware cost: The present scheme realizes optimization based on partition analysis and data filling at the software level, without the need to modify or upgrade the burning hardware, and is compatible with the EMMC burning equipment on the existing intelligent device production line; at the same time, it supports multiple file systems such as ext4, erofs, and dynamic partition, and can cover multiple types of intelligent devices such as smart TVs, Internet of Things terminals, and embedded control devices. BRIEF DESCRIPTION OF DRAWINGS

[0018] Figure 1 A burning mirror image file processing method for enabling full-disk encryption in the present application.

[0019] Figure 2 A schematic diagram of the change of partition data of a single partition at different stages in the present application. DETAILED DESCRIPTION

[0020] The present application aims to provide a burning mirror image file processing method for enabling full-disk encryption, which processes the mirror image file before burning, and solves the problem of long mirror image burning time caused by the use of full-disk encryption technology. The core idea is to identify the idle area in the to-be-processed burning mirror image, and then perform targeted filling optimization, to realize burning efficiency improvement at the software level without damaging the encryption security and device function. Specifically, the system compilation product of the intelligent device is first obtained, the target partition containing the mountable file system is selected, and the partition usage state is analyzed by means of an adaptive tool to locate the idle data block position; then, the corresponding idle storage area is found in the to-be-processed burning mirror image according to the partition configuration information, the bit of the area is uniformly set to a logical high level, the number of 0 bits to be rewritten during burning is finally reduced, the burning time is shortened from the root, and the mirror image transmission and storage cost is reduced while the multi-device adaptability is considered, without the need for additional hardware investment.

[0021] In a specific implementation, the method for processing a burning image file for enabling full-disk encryption provided by the present application comprises the following steps: Figure 1 which comprises the following implementation process: 1. Obtain partition information: In this step, after system compilation, a compilation product can be obtained, wherein the compilation product at least contains a set of all storage partitions, a partition configuration information table and a burning image to be processed. According to the partition information table, the following information of all partitions contained in the original image can be obtained: partition format PARTITION_FORMAT, offset START_ADDR in the image, partition length PARTITION_SIZE.

[0022] 2. Identify partition format: In this step, for each partition, it is judged according to its partition format whether it contains a file system, such as an ext4 file system, an erofs file system, an f2fs file system and a dynamic partition management system of a smart device, etc. Such a partition can accurately identify the idle area through file system metadata to record the data block usage state. If it does not contain these file systems, it is not the target partition of the present solution optimization, and then it is skipped. If it contains, the following step is executed.

[0023] 3. Analyze partition metadata: In this step, according to the partition format, a corresponding general file system management tool is selected, such as the lpdump tool corresponding to the Android dynamic partition, the debugfs tool corresponding to the ext4 partition, etc.

[0024] Then, the partition usage information of the partition is obtained by using the above tool, and the information describing the usage state of the storage unit in the partition is extracted. For example, the Super partition layout is contained in the partition metadata of the dynamic partition, which records the range information of the used sectors in the current partition as the minimum storage unit. For example, the Block Bitmap is contained in the partition metadata of the ext4 partition, which records the usage state of all blocks in the form of a bitmap mapping block as the minimum storage unit.

[0025] 4. Obtain the position information of the used space of the partition: In this step, the used ranges USED_RANGES=[(START1,END1),(START2,END2)…] are obtained by sorting the partition usage information. Then, the information is saved to USED_INFOS, including: partition name PARTITION_NAME, partition start address in the image START_ADDR, partition size PARTITION_SIZE, partition data unit size BLOCK_SIZE, and the index list of used units USED_RANGES.

[0026] 5. Calculate the position information of the unused space of the partition: In this step, USED_INFOS is traversed, and the following steps are performed for each partition that needs to be processed: According to the start address START_ADDR of the partition in the image and the partition size PARTITION_SIZE, the end address END_ADDR of the partition in the image is calculated as END_ADDR=START_ADDR+PARTITION_SIZE. According to the index range list USED_BLOCK_RANGES of the used units, the address range list of the used units relative to START_ADDR is calculated: USED_ADDR_RANGES=[(START1*BLOCK_SIZE,(END1+1)*BLOCK_SIZE-1), (START2*BLOCK_SIZE,(END2+1)*BLOCK_SIZE-1)…].

[0027] 6. Fill the unused space of the encrypted image: In this step, a copy of the encrypted image file COPY is first created for filling operation. When filling, the file COPY is opened and the current file pointer P is moved to START_ADDR. Then, according to the address range list USED_ADDR_RANGES of the used units, the RANGE(START,END) is processed in turn: if the current pointer is contained in USED_ADDR_RANGES, the pointer is moved to the position END+1 to skip the current range; if the current pointer is not contained in USED_ADDR_RANGES, the bits in the range (P,START-1) are all rewritten to 1, and then the pointer is moved to END+1. Finally, the modified copy file is saved as a burning image file.

[0028] Figure 2The changes of the partition data of a single partition in different stages (i.e., an original state, a partition encryption state, and an optimized state filled with data) are shown. In the original state, the data in the original data area (block 0) is in an ordered state, the data in the data areas (blocks 1, 2, and 5) is also in an ordered state, and the idle areas (blocks 3, 4, 6, and 7) are not occupied by valid data, and the data is in a state of all 1s. When the original data in the original state is full-disk encrypted, the encryption algorithm performs pseudo-randomization processing on all areas (including idle areas) in the partition, and the data in the original data area, the data area, and the idle area is all encrypted into unordered pseudo-random data, which causes the originally all-1 empty space to be replaced by a large number of 0 bits, which is the root cause of the increase in the single burning time. Based on the scheme provided in the application, the positions of the idle data blocks (i.e., blocks 3, 4, 6, and 7) in the image are identified, and then the image data after full-disk encryption is rewritten, and the positions corresponding to the previous idle data blocks are filled with 1s. After this operation, the unordered pseudo-random data in the encrypted idle area is filled with all-1 data, and in subsequent burning, the burner can directly skip the area, thereby shortening the burning time.

[0029] Embodiment: The following takes a SOC platform based on the Android 14 scheme as an example. The scheme enables full-disk encryption technology to encrypt the burning image. The platform is used to illustrate how to process the factory burning image file generated by compilation to improve the burning efficiency.

[0030] I. Partition extraction and classification: The key products after system compilation of the intelligent device system need to be collected first, which is the basis for subsequent analysis of partitions and positioning of idle areas. Only when the original partition structure and image data are clear, can the encrypted functional data to be retained and the idle data that can be optimized be accurately distinguished, so as to avoid device failure caused by mistakenly modifying core data. The specific steps are as follows: Collecting compilation products: three types of core files are extracted from the system compilation output directory: Partition original image directory images: contains the original image files of each partition before merging, recording the native data structure of the partition.

[0031] Burning image file EMMC_V1.00001.bin: complete image generated based on all original partitions and partition tables, full-disk encryption is enabled, and it is the target file for subsequent optimization.

[0032] Partition configuration information file emmc.ini: records the position and size of each partition in the complete image (such as partition name, starting offset, and partition length), which provides a basis for extracting a single partition and calculating the address range.

[0033] Confirm the encryption range: through the system compilation log confirmation, all functional partitions in EMMC_V1.00001.bin except the user autonomous storage partition have been encrypted by FDE, and these encrypted partitions are the objects to be optimized subsequently.

[0034] The EMMC image contains multiple functional partitions, but not all partitions have idle areas that can be optimized. Only the partitions containing mountable file systems will record the explicit "used / free" data block state. The boot partition, raw data partition, and other partitions without file systems have functional code stored continuously, and there is no idle area to optimize. Therefore, the partitions need to be classified first, focusing on mountable partitions: Extract individual partitions: according to the partition configuration in emmc.ini, use the dd command to extract each partition from the complete image EMMC_V1.00001.bin to the processing directory split. For example, the super partition (Android dynamic partition) is recorded in emmc.ini as "start offset 0x79B00000 (1947MB), length 0xE2600000 (3622MB)", and the corresponding extraction command is: dd if=EMMC_V1.00001.bin of=super.bin bs=1M count=3622 skip=1947.

[0035] Screen mountable partitions: according to the compilation parameters and functions of each partition, determine whether it contains a mountable file system: Target partition: partitions containing file systems, such as Android super partition, ext4 partition, erofs partition, f2fs partition, etc. This type of partition records data block usage status through file system metadata, can accurately identify idle areas, and is marked as needing processing.

[0036] Non-target partition: boot partition, startup partition, raw data partition, this type of partition has no file system and does not need to be optimized, marked as skipped.

[0037] II. Idle area analysis and filling optimization: Take the super partition (dynamic partition) as an example, the following steps are described in detail: a. Use the Android standard command lpdump images / super_raw.img to obtain metadata information, which needs to use the information of the used sectors in the partition, as shown below: Line1 ------------------------ Line2 Super partition layout: Line3 --------------------- Line4 super: 2048 .. 3586504: system_a (3584456 sectors) Line5 super: 3588096 .. 4872648: vendor_a (1284552 sectors) Line6 super: 4874240 .. 5130600: product_a (256360 sectors) Line7 super: 5132288 .. 5192000: system_ext_a (59712 sectors) b. Parse the above information. Each line represents the information of a sub-partition. For example, the fourth line indicates that it contains a sub-partition named system_a, with a starting sector of 2048, an ending sector of 3586504, and a total number of sectors of 3584456. After parsing, you get a set of used sector ranges for a partition: ranges=[(2048, 3586504),(3588096, 4872648),(4874240, 5130600),(5132288, 5192000)].

[0038] c. As defined by dynamic partitioning, the initial partition contains metadata for 2048 sectors, which is reserved. Therefore, a metadata range is added to the beginning of the set `ranges`, resulting in the final set `ranges=[(0,2047),(2048, 3586504),(3588096, 4872648),(4874240, 5130600),(5132288, 5192000)]`. d. Open the previously extracted split / super.bin file and record the current file pointer p=0.

[0039] e. For each range in the set ranges, range = (start, end), execute steps f, g, and h sequentially to fill the partition. After the loop in the current example completes, the range of data filled in bytes is fill = [(1836290560, 1837105151), (2494796288, 2495610879), (2626867712, 2627731455)].

[0040] f. Calculate the length of the data that needs to be filled with all 1s, length = start x 512 - p.

[0041] g. Fill the data with length starting from p, and fill all 0xFF.

[0042] h. Move the pointer p by (end + 1) x 512.

[0043] i. After the loop is completed, if the total length of the partition is greater than p, fill the data with length total_length - p starting from p, and fill all 0xFF. In this example, it is 1170210816.

[0044] Processing of other partitions: For cache.img (ext4), chperm.img (erofs) and other partitions, the same logic as step two is used.

[0045] Among them, the step of obtaining partition metadata is replaced with the corresponding tool, such as dumpe2fs for ext4 partition, dump.erofs for erofs, and Filesystem blocks can be obtained.

[0046] Among them, the step of analyzing the used data range of the partition is replaced with the analysis of the corresponding information. For example, the Block bitmap in each Group of the ext4 partition can be used to determine the usage status of each Block; for example, the erofs partition stores its data in the compressed form at the beginning of the partition, and the total number of Filesystem blocks can be obtained to determine that the subsequent Block is unused.

[0047] Finally, the modified partitions are merged in order to generate the final image burning file EMMC_TRIM_V1.00001.bin.

[0048] To verify the effect of this scheme, the super partition data super_a.bin and super_b.bin in the target image A and the copy B can be obtained as shown in Table 1.

[0049] Table 1 Comparison of image files before and after optimization As can be seen, super_a.bin (encrypted and not optimized) has no change in data size after compression because each area contains encrypted and unordered pseudo-random data. After filling all 1s in the free area of super_b.bin (encrypted and optimized by this scheme), the number of bits to be burned for 0 is reduced by 30%, and the volume after compression is reduced by 30%.

[0050] While embodiments of the present application have been described, it is to be understood that the application is not limited to those embodiments. It is to be understood that modifications, changes, substitutions and variations can be made by those skilled in the art without departing from the spirit and scope of the present application as defined by the following claims.

Claims

1. A method for processing burning image files with full-disk encryption enabled, characterized in that, Includes the following steps: S1. Obtain the compilation artifacts of the intelligent device system, wherein the compilation artifacts include at least a set of all storage partitions, a partition configuration information table, and a burning image to be processed; S2. Perform format identification and filtering on the storage partition to determine the target partition containing a mountable file system; S3. Using a parsing tool adapted to the target partition format, extract the usage status information of the target partition, wherein the usage status information includes at least the location characteristics of the free data blocks; S4. Combining the partition configuration information table with the location characteristics of the free data block, locate the storage area of ​​the corresponding free data block in the image to be burned; S5. Fill the storage area of ​​the free data block located in the image to be processed with data, set all bits in the area to logic high level, and obtain the optimized image file.

2. The method for processing a burning image file with full-disk encryption as described in claim 1, characterized in that, In step S1, the image to be processed and burned is an image file with full disk encryption enabled, and the encryption scope covers all functional partitions in the smart device except for the user-defined storage partition.

3. The method for processing a burning image file with full-disk encryption as described in claim 1, characterized in that, In step S2, the mountable file system includes: The ext4 file system, the erofs file system, the f2fs file system, and the dynamic partition management system for smart devices.

4. The method for processing a burning image file with full-disk encryption as described in claim 3, characterized in that, In step S2, when filtering target partitions, boot partitions and raw data storage partitions are determined to be non-target partitions and are not included in the subsequent parsing process.

5. A method for processing burning image files with full-disk encryption as described in claim 3, characterized in that, In step S3, the use of a parsing tool adapted to the target partition format includes: For dynamic partitions, use a partition metadata parsing tool; for ext4, erofs, and f2fs partitions, use a file system block status parsing tool.

6. The method for processing a burning image file with full-disk encryption as described in claim 1, characterized in that, In step S3, the location characteristics of the free data block include: The starting index, ending index, and block size of the free data blocks within the target partition.

7. A method for processing burning image files with full-disk encryption as described in claim 6, characterized in that, In step S4, the method for locating the storage area of ​​free data blocks includes: Based on the partition configuration information, the starting offset of the target partition in the image to be processed for burning is determined, and the actual address range of the free data block in the image to be processed for burning is calculated by combining the location characteristics of the free data block.

8. A method for processing burning image files with full-disk encryption as described in claim 1, characterized in that, In step S5, the method of data filling includes: Before data filling, a copy of the image to be processed is created, and the filling operation is performed on the copy; after filling is completed, the integrity of the optimized image is verified.

9. A method for processing burning image files with full-disk encryption as described in claim 1, characterized in that, Step S5 also includes: compressing the optimized burning image file using a compression tool.

10. A method for processing a burning image file with full-disk encryption as described in any one of claims 1-9, characterized in that, The smart device includes: a smart TV, an Internet of Things terminal, or an embedded smart control device; the storage medium in the smart device is an embedded multimedia memory card.

Images