PROTECTION OF INTERPRETED SOURCE CODE IN VIRTUAL APPLIANCES

• US 20140047244A1
• Filed: 08/10/2012
• Published: 02/13/2014
• Est. Priority Date: 08/10/2012
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated (Kyndryl Holdings, Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: BUSWELL, JOHN I.
• Granted Patent: US 8,918,653 B2
• Time in Patent Office: Days
• US Class Current: 713/190
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system

Abstract

Protection of interpreted programming language code filesystem files from access and alteration may be provided by encrypting a file to be protected in a boot sequence. Run-time examination of a virtual appliance may be deterred by hiding the boot sequence in a restricted virtual appliance platform. No shell or filesystem access may be provided. Thus, permissions on a read-only filesystem (for example) may be kept from being altered. The permissions may be set along with filesystem access control lists to prevent unauthorized examination of the source files.

Claims

1. A computer program product for protecting interpreted code in a virtual appliance, the computer program product comprising a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code being configured to:

compress a file to be protected into a compressed filesystem file;

encrypt an interpreted programming language code filesystem file, wherein the interpreted programming language code filesystem file includes the file to be protected;

initiate a startup script employing the encrypted interpreted programming language code filesystem file with the compressed filesystem file;

decrypt the interpreted programming language code filesystem file; and

run the decrypted interpreted programming language code filesystem file.

2. The computer program product of claim 1, the computer readable program code being configured to:

set permissions on the file to be protected; and

prevent the file to be protected from being accessed according to the permissions.

3. The computer program product of claim 1, the computer readable program code being configured to map the encrypted interpreted programming language code filesystem file to a loopback device.

4. The computer program product of claim 1, wherein the interpreted programming language code filesystem file is encrypted with a universally unique identifier (UUID) as a decryption key passphrase.

5. The computer program product of claim 1, the computer readable program code being configured to hand the encrypted interpreted programming language code filesystem file from a kernel to the startup script during a startup process, prior to the virtual appliance'"'"'s needing access to the interpreted programming language code filesystem file.

6. The computer program product of claim 1, wherein the virtual appliance is run under a Linux operating environment.

7. The computer program product of claim 1, wherein the compressed filesystem file is a squashfs type file.

8-15. -15. (canceled)

16. A computing appliance, comprising:

a storage module;

a memory module; and

a processor, wherein the processor is configured to

compress a file to be protected into a compressed filesystem file stored in the storage module,

encrypt the file to be protected with an interpreted programming language code filesystem file,

initiate, in the memory, a startup script employing the interpreted programming language code filesystem file with the compressed filesystem file,

decrypt the interpreted programming language code filesystem file, and

run the decrypted interpreted programming language code filesystem file while preventing access to the compressed file system.

17. The computing appliance of claim 16, wherein the decrypted interpreted programming language code filesystem file is run within a virtual appliance.

18. The computing appliance of claim 16, wherein the decrypted interpreted programming language code filesystem file is run under a Linux based code.

19. The computing appliance of claim 18, wherein the compressed filesystem file is a squashfs file type.

20. The computing appliance of claim 17, wherein the processor is configured to associate the decrypted interpreted programming language code filesystem file with a loopback device configured as a virtual storage device within the storage module.