Protection of interpreted source code in virtual appliances
View Patent ↗Protection of interpreted programming language code filesystem files from access and alteration may be provided by encrypting a file to be protected in a boot sequence. Run-time examination of a virtual appliance may be deterred by hiding the boot sequence in a restricted virtual appliance platform. No shell or filesystem access may be provided. Thus, permissions on a read-only filesystem (for example) may be kept from being altered. The permissions may be set along with filesystem access control lists to prevent unauthorized examination of the source files.
1. A computer program product for protecting interpreted code in a virtual appliance, the computer program product comprising a non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code being configured to:
compress a file to be protected into a compressed filesystem file;
encrypt an interpreted programming language code filesystem file prior to execution in a startup script, wherein the encrypted interpreted programming language code filesystem file includes the file to be protected;
initiate the startup script employing the encrypted interpreted programming language code filesystem file with the compressed filesystem file;
decrypt, via the startup script, the encrypted interpreted programming language code filesystem file; and
run in the startup script the decrypted interpreted programming language code filesystem file.
2. The computer program product of claim 1 , the computer readable program code being configured to:
set permissions on the file to be protected; and
prevent the file to be protected from being accessed according to the permissions.
3. The computer program product of claim 1 , the computer readable program code being configured to map the encrypted interpreted programming language code filesystem file to a loopback device.
4. The computer program product of claim 1 , wherein the interpreted programming language code filesystem file is encrypted with a universally unique identifier (UUID) as a decryption key passphrase.
5. The computer program product of claim 1 , the computer readable program code being configured to hand the encrypted interpreted programming language code filesystem file from a kernel to the startup script during a startup process, prior to the virtual appliance's needing access to the interpreted programming language code filesystem file.
6. The computer program product of claim 1 , wherein the virtual appliance is run under a Linux operating environment.
7. The computer program product of claim 1 , wherein the compressed filesystem file is a squashfs type file.
8. A computing appliance, comprising:
a storage module;
a memory module; and
a processor, wherein the processor is configured to:
compress a file to be protected into a compressed filesystem file stored in the storage module,
encrypt, prior to execution in a startup script, the file to be protected with an interpreted programming language code filesystem file,
initiate, in the memory, a startup script employing the encrypted interpreted programming language code filesystem file with the compressed filesystem file,
decrypt the interpreted programming language code filesystem file, and
run the decrypted interpreted programming language code filesystem file while preventing access to the compressed file system.
9. The computing appliance of claim 8 , wherein the decrypted interpreted programming language code filesystem file is run within a virtual appliance.
10. The computing appliance of claim 8 ; wherein the decrypted interpreted programming language code filesystem file is run under a Linux based code.
11. The computing appliance of claim 10 , wherein the compressed filesystem file is a squashfs file type.
12. The computing appliance of claim 9 , wherein the processor is configured to associate the decrypted interpreted programming language code filesystem file with a loopback device configured as a virtual storage device within the storage module.