Fine-grained configurable single file secure storage system and method for embedded system

Abstract

The invention provides a single-file security storage system and method capable of fine-grained configuration for an embedded system, and the system comprises a security storage strategy analysis unit which is used for loading a preset strategy configuration file, and constructing a strategy library for rule matching in a memory; the secure storage perception interception unit is injected into an I / O path of an operating system, and an access request initiated by an upper-layer application is intercepted; the secure storage arbitration unit is used for receiving the access request submitted by the secure storage sensing and intercepting unit, analyzing a matching rule by inquiring the strategy library, and judging whether automatic secure storage needs to be carried out or a transparent transmission channel needs to be entered; and the secure storage execution unit is used for performing read-write processing on the data according to the arbitration result, and ensuring that data storage and read-write meet access requirements and decryption format regulations. According to the invention, whether security storage is carried out or not and which key is used can be dynamically determined according to the identifier of the access initiator, so that strong binding of a strategy and a data security protection level is realized.

Description

Technical Field

[0001] This invention relates to the field of embedded system data encryption technology, specifically to a single-file secure storage system and method with fine-grained configuration for embedded systems. Background Technology

[0002] Embedded operating systems have been widely applied in industrial control, IoT terminals, and smart devices. However, the critical data they process (such as device configuration parameters, user privacy information, and real-time control commands) faces the following challenges. First, embedded systems are generally constrained by resources, including low-performance processors, limited memory space, and stringent power consumption limits, making it difficult to bear the performance overhead of traditional security solutions. Second, existing encryption technologies generally use static preset configurations, which can only globally enable encryption based on file paths or types, and cannot flexibly map encryption behavior according to the real-time relationship between the initiator of the access (such as thread ID, role ID, etc.) and the access target (such as log files, configuration files, driver devices).

[0003] While current mainstream volume encryption, file encryption, and file system encryption technologies can shield upper-layer applications from interface differences, two major problems remain. First, fixed configurations lead to a lack of dynamic associations, preventing encryption rules from flexibly binding the access initiator-access target binary relationship. For example, in industrial control scenarios, encryption needs to be enabled based on operator roles and log file levels, but existing solutions can only globally encrypt the log directory or mechanically rely on file extensions. This results in high-privilege roles still needing to decrypt low-sensitivity files, or low-risk data being over-encrypted, leading to resource waste. Second, the mechanism for handling access outside the encryption scope is flawed. When an access target outside the encryption scope accesses an encrypted file, traditional solutions either return an error, causing system anomalies, lacking an intermediate mechanism such as returning ciphertext, which to some extent undermines the usability of encrypted files.

[0004] Common storage encryption schemes in existing embedded systems all have significant limitations in practical embedded applications. They either rely on specific kernels (such as eCryptFS), specific frameworks (such as EncFS relying on FUSE), are deeply bound to file systems leading to portability difficulties (such as FileX), have fixed encryption strategies that are difficult to adjust dynamically (such as LittleFS), consume too many resources (such as VeraCrypt), or have opaque integration (such as GnuPG). They generally suffer from poor portability, rigid configuration, and coarse-grained strategies.

[0005] Chinese patent document CN106372464A discloses an anti-piracy encryption method for static library files in an embedded system. The method includes: the embedded system starts and connects to an encryption IC, generating random numbers N1 and N2; the embedded system's software encryption program obtains these random numbers N1 and N2, and uses one of the random numbers as a key to encrypt the other, generating encryption result one; similarly, the encryption IC obtains these random numbers N1 and N2, performs the same encryption operation to generate encryption result two, and feeds encryption result two back to the embedded system; the embedded system compares encryption result one and encryption result two obtained in step S02. If they match, the system operates normally; otherwise, the system does not respond. This document fails to flexibly enable encryption based on the relationship between the visitor and the access target, leading to over-encryption of some files and wasting resources. Summary of the Invention

[0006] To address the shortcomings of existing technologies, the purpose of this invention is to provide a single-file secure storage system and method with fine-grained configuration for embedded systems.

[0007] According to the present invention, an embedded system with fine-grained configurability for single-file secure storage includes: Secure storage policy parsing unit: Loads the preset policy configuration file and builds a policy library for rule matching in memory; Secure storage awareness interception unit: Inject a secure storage awareness interception unit into the operating system I / O path to intercept access requests initiated by upper-layer applications; Secure storage arbitration unit: receives access requests submitted by the secure storage awareness and interception unit, and determines whether automatic secure storage or direct access to the transparent transmission channel is required by querying the policy library to parse matching rules. Secure storage execution unit: Based on the arbitration result of the secure storage arbitration unit, it performs read and write processing on the data to ensure that the data storage and read / write operations comply with access requirements and decryption format specifications.

[0008] Preferably, the strategy library construction in the secure storage policy parsing unit includes: constructing a mapping table of access initiators, access targets, and secure storage rules.

[0009] Preferably, the secure storage awareness interception unit includes: intercepting read and write access initiated by standard I / O and converting the access rules into a format that meets the requirements of the arbitration unit.

[0010] Preferably, the secure storage arbitration unit includes: performing secure storage rule matching through a policy library, parsing elements as a tuple attribute of the access initiator and the access target, and returning the success or failure of rule matching, as well as the encryption algorithm and key.

[0011] Preferably, the secure storage execution unit includes: If the rule matches successfully, the file data is encrypted or decrypted. The encoded data is stored in a single file line by line. During the encryption process, a control field is appended to the file header. During the decryption process, the integrity verification data is parsed from the file header, and the data is decrypted according to the length requirement and returned in plaintext. If the rule does not match successfully, the data is directly transmitted through the data pass-through channel without any data reading or writing processing.

[0012] According to the present invention, a method for finely configurable single-file secure storage in an embedded system is provided, the method comprising the following steps: Security storage policy library initialization steps: The security storage policy parsing unit loads the preset policy configuration file and builds the policy library in memory; Automatic encrypted data writing steps: The secure storage awareness and interception unit intercepts the file write request, and the secure storage arbitration unit matches the rules according to the access initiator and access target binary attributes. After the rules are triggered, the secure storage execution unit or transparent transmission channel processes and writes the data. Automatic data decryption and reading steps: The secure storage awareness and interception unit intercepts the file reading request, and the secure storage arbitration unit matches the rules according to the access initiator and access target binary attributes. After the rules are triggered, the secure storage execution unit or transparent transmission channel processes and reads the data.

[0013] Preferably, the initialization step of the secure storage policy library includes: loading a preset policy configuration file and constructing a mapping table between the access initiator, the access target, and the secure storage rules.

[0014] Preferably, the automatic encrypted data writing step includes: the file write request intercepted by the secure storage awareness interception unit is parsed by the secure storage arbitration unit and matched according to the rules in the policy library. The matching element is a binary attribute of the access initiator and the access target. If the rule matching is successful, the secure storage execution unit encrypts and encodes the file data, appends a control field to the file header, and stores the encoded data in a single file line by line. If the rule matching is unsuccessful, the data directly enters the data pass-through channel without data writing processing.

[0015] Preferably, the automatic encrypted data reading step includes: the file read request intercepted by the secure storage awareness interception unit is parsed by the secure storage arbitration unit and matched according to the rules in the policy library. The matching element is a binary attribute of the access initiator and the access target. If the rule matching is successful, the secure storage execution unit decrypts the encoded file data, decrypts the data and integrity verification value from the single file line by line, and decrypts the data in blocks according to the length requirement of the access request and returns the plaintext. If the rule matching is unsuccessful, the data directly enters the data pass-through channel without data reading and processing.

[0016] According to the present invention, a computer-readable storage medium storing a computer program is provided, wherein when the computer program is executed by a processor, the steps of the embedded system fine-grained configurable single-file secure storage method are implemented.

[0017] Compared with the prior art, the present invention has the following beneficial effects: 1. Fine-grained configurable transparent secure storage: This invention innovatively incorporates the access initiator (thread, role) into the secure storage decision-making process, using precise matching policy rules based on the access initiator-access target binary. This fine-grained policy-driven capability enables the system to dynamically determine whether to perform secure storage and which key to use based on the access initiator's identifier, achieving a strong binding between policy and data security protection level. This results in higher security and finer granularity compared to traditional globally transparent secure storage solutions.

[0018] 2. Automatic resource consumption optimization: By introducing a reserved pass-through channel mechanism, the secure storage execution unit can be bypassed directly for scenarios where the rules do not match and encryption is not required. This significantly reduces unnecessary secure storage computation overhead and latency, which is especially important for resource-constrained embedded systems and effectively balances security and performance.

[0019] 3. Embedded System Friendly: This invention fully considers the characteristics of embedded systems, performing transparent interception and arbitration within the operating system I / O framework. This is completely transparent to upper-layer applications, enabling secure storage without modifying application code. The modular design (policy parsing, awareness-based interception, arbitration, and execution) is clear and independent, requiring no external dependencies and possessing excellent portability. Furthermore, control fields (file size, key, and checksum) are built into the file header, simplifying file management. Encoded data is accessed line by line, allowing storage in a single file on any file system. Built-in integrity verification ensures security while greatly simplifying resource management and system integration in embedded environments. Attached Figure Description

[0020] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a diagram illustrating the overall architecture of the secure storage system in this invention. Figure 2 This is a flowchart of the coding process in this invention, using lines as the unit. Figure 3 This is a flowchart of the decoding process in this invention, organized by line. Figure 4 This is an example diagram illustrating the differentiated display of plaintext and ciphertext in this invention; Figure 5This is an example diagram of fine-grained file encryption and decryption configuration in this invention. Detailed Implementation

[0021] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0022] This invention provides a finely configurable single-file secure storage system for embedded systems, referring to... Figures 1-5 As shown, it includes: a secure storage policy parsing unit, a secure storage awareness and interception unit, a secure storage arbitration unit, and a secure storage execution unit. Specifically: Secure storage policy parsing unit: Loads the preset policy configuration file and builds the policy library in memory.

[0023] The policy library includes a mapping table of three entities: the access initiator (such as a unique identifier of the entity, such as a thread or role), the access target (such as a file, device, or other object that can be read and written through a standard I / O interface), and the secure storage rules (such as ciphertext algorithms and ciphertext keys).

[0024] The secure storage policy parsing unit converts preset static policy configurations into a fixed-format rule base, providing a basis for rule arbitration. Each rule in the policy base is constructed based on a triple of {access initiator-access target-encryption rule}. The access initiator identifier can be a unique identifier such as a thread ID or role permission; the access target includes paths to accessible resources such as file paths and device nodes, and can flexibly select matching modes, such as wildcards or regular expressions; the encryption rule can define the algorithm type (e.g., AES-256-CBC or SM4), key, and integrity verification mechanism (e.g., MD5 or SHA256). The configuration source is a fixed-format static file loaded at system startup, or a hard-coded policy compiled into firmware code in scenarios with extremely limited resources.

[0025] Secure storage awareness interception unit: The secure storage awareness interception unit is injected into the operating system I / O path to intercept access requests initiated by upper-layer applications and convert the access rules into a format that meets the requirements of the arbitration unit.

[0026] The secure storage-aware interception unit injects components into the operating system I / O framework to dynamically intercept file read / write requests and implements automatic secure storage routing based on policies. It includes: Intercept point injection: Inject hooks into the operating system I / O framework to monitor file operation requests (such as open, read, write, etc.) initiated by upper-layer applications in real time.

[0027] Request for standardization: The intercepted raw I / O requests (including thread or process ID, file path, operation type, etc.) are transformed into a unified structure (e.g., IO_REQUEST { subject_id, object_path, operation......}) and passed to the arbitration unit for permission determination.

[0028] Secure Storage Arbitration Unit: Receives access requests submitted by the Secure Storage Awareness and Interception Unit, parses the matching rules to determine whether automatic secure storage or direct passage is required. Specifically, it performs secure storage rule matching through the policy library, parses the elements as a tuple attribute of the access initiator and the access target, and returns the success or failure of the rule matching, as well as the encryption algorithm and key.

[0029] In one specific implementation, the standardized request structure IO_REQUEST { subject_id, object_path, operation......}, converted by the input perception interception unit, is used by the arbitration logic to first query the policy library. If a match is found, the encryption rule is returned; otherwise, the process enters the pass-through channel. This can be categorized into three scenarios: (1) If the rule is matched, the secure storage execution unit is triggered to ensure the confidentiality and integrity of the data; (2) When there is no regular matching, reading the encrypted file will force the original ciphertext to be transmitted, which will prevent leakage and avoid system errors. Writing to the encrypted file will be rejected to prevent data pollution of the encrypted file. (3) When accessing non-sensitive data, transmit plaintext directly to save resources.

[0030] Secure storage execution unit: performs encryption / decryption operations on data based on the decision of the arbitration unit, ensuring that data storage and reading / writing comply with access requirements and decryption format specifications during data reading and writing processes.

[0031] If the rule matches successfully, the file data is encrypted or decrypted. Encoded data is stored in a single file as line-by-line blocks. During encryption, control fields (including the actual file size and integrity check value) are appended to the file header. During decryption, the integrity check data is parsed from the file header, and the data is decrypted in blocks to return plaintext. If the rule does not match successfully, the data is directly transmitted through the data pass-through channel without any data reading or writing processing. If a non-rule-matching access is initiated and the file being read or written is encrypted, the read data will be in ciphertext form, and the write operation will be rejected to prevent data corruption of the encrypted file.

[0032] This invention also provides a finely configurable single-file secure storage method for embedded systems, based on the aforementioned finely configurable single-file secure storage system for embedded systems, comprising: Security storage policy library initialization steps: The security storage policy parsing unit loads the preset policy configuration file and builds the policy library in memory.

[0033] Automatic encrypted data writing steps: The secure storage awareness and interception unit intercepts the file write request, and the secure storage arbitration unit matches the rules according to the access initiator and access target binary attributes. After the rules are triggered, the secure storage execution unit or transparent transmission channel processes and writes the data.

[0034] Automatic data decryption and reading steps: The secure storage awareness and interception unit intercepts the file reading request, and the secure storage arbitration unit matches the rules according to the access initiator and access target binary attributes. After the rules are triggered, the secure storage execution unit or transparent transmission channel processes and reads the data.

[0035] In a preferred embodiment, the secure storage policy library initialization step includes: loading a preset policy configuration file and constructing a mapping table of the three entities: the access initiator (such as a unique identifier of the entity, such as a thread or role), the access target (such as a file, device, or other object that can be read and written through a standard I / O interface), and the secure storage rules (such as ciphertext algorithms and ciphertext keys).

[0036] The automatic encrypted data writing process includes: file write requests intercepted by the secure storage awareness interception unit are parsed by the secure storage arbitration unit and matched against rules using a policy library. The matching element is a binary attribute of the access initiator and the access target. If the rule match is successful, the secure storage execution unit encrypts and encodes the file data, appending control fields (including the actual file size and integrity check value) to the file header, and storing the encoded data line by line in a single file. If the rule match fails, the data directly enters the data pass-through channel without further data writing processing.

[0037] The automatic encrypted data reading step includes: File read requests intercepted by the secure storage awareness interception unit are parsed by the secure storage arbitration unit and matched against rules using a policy library. The matching element is a binary attribute of the access initiator and the access target. If the rule match is successful, the secure storage execution unit decrypts the encoded file data, extracting the data and integrity verification value line by line from the single file, and decrypting the data in blocks according to the length requirement of the access request, returning the data in plaintext. If the rule match fails, the data directly enters the data pass-through channel without further data reading or processing.

[0038] Reference Figure 4As shown, taking the commonly used automatic encryption of audit logs as an example, the configuration policy file specifies the audit thread ID as the main body, the audit log path (which can use wildcard format such as / log / audit_.*) as the access target identifier, and configures the encryption algorithm to use AES-256. At the same time, the encryption key and initialization vector are set. The configuration file can be stored as an automatically encrypted text file or serialized to a trusted environment such as HSM or TEE.

[0039] After the system starts, the audit thread begins to work. At this time, all file reading and writing during the execution of the audit thread is automatically processed by the secure storage execution unit, and the original audit thread's code logic does not need to be modified.

[0040] Add an access rule that defines thread A as having access to the secure storage unit. If thread A reads the audit log, it can obtain plaintext. However, if thread B, which does not have access to the secure storage unit, attempts to read the audit log, the returned data will be entirely encrypted. If it attempts to write, it will directly return an error indicating write failure, thus preventing data corruption.

[0041] Those skilled in the art will understand that, besides implementing the system and its various devices, modules, and units provided by this invention in the form of purely computer-readable program code, the same functions can be achieved entirely through logical programming of the method steps, making the system and its various devices, modules, and units of this invention function in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, the system and its various devices, modules, and units provided by this invention can be considered as a hardware component, and the devices, modules, and units included therein for implementing various functions can also be considered as structures within the hardware component; alternatively, the devices, modules, and units for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0042] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A single-file secure storage system with fine-grained configuration for embedded systems, characterized in that, include: Secure storage policy parsing unit: Loads the preset policy configuration file and builds a policy library for rule matching in memory; Secure storage awareness interception unit: Inject a secure storage awareness interception unit into the operating system I / O path to intercept access requests initiated by upper-layer applications; Secure storage arbitration unit: receives access requests submitted by the secure storage awareness and interception unit, and determines whether automatic secure storage or direct access to the transparent transmission channel is required by querying the policy library to parse matching rules. Secure storage execution unit: Based on the arbitration result of the secure storage arbitration unit, it performs read and write processing on the data to ensure that the data storage and read / write operations comply with access requirements and decryption format specifications.

2. The embedded system's finely configurable single-file secure storage system according to claim 1, characterized in that, The security storage policy parsing unit constructs a policy library by building a mapping table of access initiators, access targets, and security storage rules.

3. The embedded system's finely configurable single-file secure storage system according to claim 1, characterized in that, The secure storage awareness interception unit includes: intercepting read and write access initiated by standard I / O and converting the access rules into a format that meets the requirements of the arbitration unit.

4. The embedded system's finely configurable single-file secure storage system according to claim 1, characterized in that, The secure storage arbitration unit includes: matching secure storage rules through a policy library, parsing elements as a tuple attribute of the access initiator and the access target, and returning whether the rule matching was successful, as well as the encryption algorithm and key.

5. The embedded system's finely configurable single-file secure storage system according to claim 1, characterized in that, The secure storage execution unit includes: If the rule matches successfully, the file data is encrypted or decrypted. The encoded data is stored in a single file line by line. During the encryption process, a control field is appended to the file header. During the decryption process, the integrity verification data is parsed from the file header, and the data is decrypted according to the length requirement and returned in plaintext. If the rule does not match successfully, the data is directly transmitted through the data pass-through channel without any data reading or writing processing.

6. A method for finely configurable single-file secure storage in an embedded system, based on any one of claims 1 to 5, characterized in that, The method includes the following steps: Security storage policy library initialization steps: The security storage policy parsing unit loads the preset policy configuration file and builds the policy library in memory; Automatic encrypted data writing steps: The secure storage awareness and interception unit intercepts the file write request, and the secure storage arbitration unit matches the rules according to the access initiator and access target binary attributes. After the rules are triggered, the secure storage execution unit or transparent transmission channel processes and writes the data. Automatic data decryption and reading steps: The secure storage awareness and interception unit intercepts the file reading request, and the secure storage arbitration unit matches the rules according to the access initiator and access target binary attributes. After the rules are triggered, the secure storage execution unit or transparent transmission channel processes and reads the data.

7. The embedded system's finely configurable single-file secure storage method according to claim 6, characterized in that, The initialization steps of the secure storage policy library include: loading a preset policy configuration file and constructing a mapping table between the access initiator, the access target, and the secure storage rules.

8. The embedded system's finely configurable single-file secure storage method according to claim 6, characterized in that, The automatic encrypted data writing step includes: the file write request intercepted by the secure storage awareness interception unit is parsed by the secure storage arbitration unit and matched according to the rules in the policy library. The matching element is a binary attribute of the access initiator and the access target. If the rule matching is successful, the secure storage execution unit encrypts and encodes the file data, appends a control field to the file header, and stores the encoded data in a single file line by line. If the rule matching is unsuccessful, the data directly enters the data pass-through channel without data writing processing.

9. The embedded system's finely configurable single-file secure storage method according to claim 6, characterized in that, The automatic encrypted data reading step includes: the file read request intercepted by the secure storage awareness interception unit is parsed by the secure storage arbitration unit and matched according to the rules in the policy library. The matching element is a binary attribute of the access initiator and the access target. If the rule matching is successful, the secure storage execution unit decrypts the encoded file data, decrypts the data and integrity verification value from the single file line by line, and decrypts the data in blocks according to the length requirement of the access request and returns the plaintext. If the rule matching is unsuccessful, the data directly enters the data pass-through channel without reading or processing the data.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the embedded system fine-grained configurable single-file secure storage method as described in any one of claims 6 to 9.

Images