Protection of interpreted source code in virtual appliances
View Patent ↗Protection of interpreted programming language code filesystem files from access and alteration may be provided by encrypting a file to be protected in a boot sequence. Run-time examination of a virtual appliance may be deterred by hiding the boot sequence in a restricted virtual appliance platform. No shell or filesystem access may be provided. Thus, permissions on a read-only filesystem (for example) may be kept from being altered. The permissions may be set along with filesystem access control lists to prevent unauthorized examination of the source files.
1. A process of protecting a file within an interpreted programming language filesystem, comprising:
encrypting an interpreted programming language code filesystem file on a non-transitory computer readable medium, wherein:
the interpreted programming language code filesystem file includes the file to be protected, and
the file to be protected includes a set of permissions defining access rights to the file to be protected;
initiating a startup script employing the encrypted interpreted programming language code filesystem file with the file to be protected;
decrypting the interpreted programming language code filesystem file while maintaining the file to be protected inaccessible according to the set of permissions; and
running the decrypted interpreted programming language code filesystem file on the non-transitory computer readable medium.
2. The process of claim 1 including, compressing the file to be protected prior to encrypting the interpreted programming language code filesystem file.
3. The process of claim 1 , including associating the decrypted interpreted programming language code filesystem file with a loopback device.
4. The process of claim 1 , wherein running the decrypted interpreted programming language code filesystem file does not allow read access to the file to be protected.
5. The process of claim 1 , wherein the decrypted interpreted programming language code filesystem file is run within a virtual appliance.
6. The process of claim 5 , wherein the virtual appliance is operated under a Linux environment.
7. The process of claim 1 , including handing control of the encrypted interpreted programming language code filesystem file from a kernel to the startup script during a startup process, prior to running the decrypted interpreted programming language code filesystem file on the non-transitory computer readable medium.
8. The process of claim 2 , wherein the interpreted programming language code filesystem file is encrypted with a universally unique identifier (UUID) as a decryption key passphrase.