CN112784275B - Electronic device, boot image cloud deployment system and method - Google Patents

Abstract

A cloud deployment system and method for a boot image, the system comprising an electronic device and a server. The server comprises a storage medium and a control circuit. The electronic device is used to issue a request instruction. The storage medium is used to store a plurality of boot images, each of which comprises a plurality of destination files, and the combination sequence of the destination files of each boot image is different from the combination sequence of the destination files of other boot images. The control circuit is used to transmit one of the boot images back to the electronic device according to the request instruction, and the electronic device executes the received boot image.

Description

Electronic device, boot image cloud deployment system and method

Technical Field

This case relates to the field of cloud booting, and more particularly to an electronic device for cloud-deployment of a boot image, a cloud-deployment system for a boot image, and a method thereof.

Background Art

Electronic devices commonly used today need to execute a boot image during the boot process to start the operating system and programs of the electronic device, and the boot image is generally installed in the electronic device when it leaves the factory. However, manufacturers do not customize the boot image for a single electronic device. Instead, the same model or even the same type of electronic devices usually carry the same boot image for easy management and maintenance. However, electronic devices with the same boot image may become a channel for hackers to attack because they carry the same program code.

When different electronic devices have the same boot image, by analyzing the boot image in one of the electronic devices and finding the defects in the boot image, hackers can attack other electronic devices based on these defects. In some cases, hackers do not even need to implant malicious code into the electronic device, but use code reuse attacks to maliciously attack the electronic device. Specifically, code reuse attacks are a method of hijacking the control process and using existing code segments in the electronic device to piece together a malicious program.

Therefore, when faced with code reuse attacks by hackers, electronic devices equipped with the same boot image are vulnerable to attacks, or can be said to be completely defenseless. As information security issues become increasingly important today, electronic devices with such defects need to be improved.

Summary of the invention

In view of this, the present invention proposes an electronic device for cloud-based deployment of a boot image, a cloud-based deployment system for a boot image, and a method thereof.

According to some embodiments, a cloud deployment system for a boot image includes an electronic device and a server. The server includes a storage medium and a control circuit. The electronic device is used to issue a request instruction. The storage medium is used to store a plurality of boot images, each of which includes a plurality of destination files, and the combination order of the destination files of each boot image is different from the combination order of the destination files of other boot images. The control circuit is used to return one of the boot images to the electronic device according to the request instruction, and the electronic device executes the received boot image.

According to some embodiments, the electronic device includes a communication element and a controller. The controller is used to execute an input/output program to initialize the communication element. After the communication element is initialized, the controller issues a request instruction.

According to some embodiments, the storage medium further stores a plurality of source codes corresponding to the electronic device. The control circuit is used to compile and assemble the source codes into a target file, randomly arrange the target file, establish a link address corresponding to the target file, and obtain one of the boot images.

According to some embodiments, the storage medium further stores a plurality of source codes corresponding to the electronic device. The server has a private key, and the electronic device has a public key corresponding to the private key. The control circuit is used to compile and assemble the source code into a target file, randomly arrange the target file, establish a link address corresponding to the target file, and encrypt with the private key to obtain one of the boot images. The electronic device decrypts and executes the received boot image with the public key.

According to some embodiments, an electronic device for deploying a boot image in the cloud includes a communication element and a controller. The controller is used to execute an input and output program to initialize the communication element. After the communication element is initialized, the controller issues a request instruction and executes the received boot image.

According to some embodiments, the electronic device that deploys the boot image in the cloud further has a public key, and the electronic device that deploys the boot image in the cloud uses the public key to decrypt and execute the received boot image.

According to some embodiments, a method for cloud deployment of a boot image is suitable for an electronic device and a server. The method for cloud deployment of a boot image includes: the electronic device sends a request instruction; the server stores a plurality of boot images, each boot image includes a plurality of target files, and the combination order of the target files of each boot image is different from the combination order of the target files of other boot images; the server returns one of the boot images to the electronic device according to the request instruction; and the electronic device executes the received boot image.

According to some embodiments, before the electronic device issues the request command, the cloud deployment method of the boot image includes: the electronic device executes an input/output program to initialize a communication element of the electronic device; and, after the communication element is initialized, the electronic device issues a request command.

According to some embodiments, the cloud deployment method of the boot image further includes a boot image acquisition method. The boot image acquisition method includes: compiling and assembling multiple source codes corresponding to the electronic device into a target file; randomly arranging the target files; establishing a link address corresponding to the target file; and obtaining one of the boot images.

According to some embodiments, the cloud deployment method of the boot image further includes a boot image acquisition and verification method. The boot image acquisition and verification method includes: compiling and assembling multiple source codes corresponding to the electronic device into a target file; randomly arranging the target files; establishing a link address corresponding to the target file; encrypting with a private key to obtain one of the boot images; and decrypting and executing the received boot image with a public key, wherein the public key corresponds to the private key.

In summary, the cloud deployment system and method of the boot image proposed in some embodiments of the present case can deploy multiple different boot images on the server, and the server then provides one of the boot images to the electronic device for execution based on the request instruction of the electronic device. Since the boot image deployed by the server is obtained by randomly combining and arranging the target file, each boot image has a different combination order in the target file, and the server randomly provides any boot image to the electronic device, so the electronic device can obtain a different boot image. Since the boot image file executed by the electronic device each time it is turned on may be different, it can avoid being attacked by hackers.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram of a cloud deployment system for a boot image according to some embodiments of the present invention.

FIG. 2 is a schematic diagram of a boot image according to some embodiments of the present invention.

FIG. 3 is a flow chart of a method for cloud deployment of a boot image according to some embodiments of the present invention.

FIG. 4 is a flow chart of a method for cloud deployment of a boot image according to some embodiments of the present invention.

Explanation of symbols

10 Cloud deployment system for boot images

100 Electronic devices

120 Controller

140 Communication components

160 Read-only storage element

180 Random Access Memory Components

R Request command

200 Server

220 Control circuit

222 Compiler

224 assembler

226 Connector

240 Storage Media

BI Boot Image

LIB library

DRV Driver

OS operating system core

OBJ destination file

SC Source Code

S100-S140 Steps

S110’ Steps

DETAILED DESCRIPTION

In this case, the word "coupled" and its derivatives may be used. In some embodiments, "coupled" may be used to indicate that two or more elements are in direct physical or electrical contact with each other, or it may also mean that two or more elements are in indirect electrical contact with each other. The word "coupled" may also be used to indicate that two or more elements cooperate or interact with each other.

FIG1 is a schematic diagram of a cloud deployment system 10 for boot images of some embodiments of the present invention. The cloud deployment system 10 for boot images includes an electronic device 100 and a server 200. The electronic device 100 includes a controller 120, a communication element 140, a read-only storage element 160, and a random access storage element 180. The server 200 includes a control circuit 220 and a storage medium 240. The electronic device 100 is used to issue a request instruction R and execute a received boot image BI. The storage medium 240 of the server 200 is used to store a plurality of boot images BI. The control circuit 220 of the server 200 is used to return one of the boot images BI to the electronic device 100 according to the request instruction R. Among them, the electronic device 100 and the server 200 transmit signals or files through the network, and are not limited to the transmission method of the wired network or the wireless network. In the electronic device 100, the controller 120 is coupled to the communication element 140, the read-only storage element 160, and the random access storage element 180. In the server 200 , the control circuit 220 is coupled to the storage medium 240 .

FIG2 is a schematic diagram of a boot image BI of some embodiments of the present case. Please refer to FIG1 and FIG2 simultaneously. In some embodiments, each boot image BI includes multiple target files OBJ, and the combination order of the target file OBJ of each boot image BI is different from the combination order of the target file OBJ of other boot image BI. That is, the combination order of these target files OBJ is not the same in each boot image BI. Therefore, each time the server 200 returns one of these boot images BI to the electronic device 100, the combination order of the target file OBJ of the boot image BI received by the electronic device 100 is not exactly the same. According to some embodiments, when the server 200 randomly selects a boot image BI for the electronic device 100, the electronic device 100 will hardly receive a boot image BI with the same combination order of the target file OBJ.

Please continue to refer to Figure 1. In some embodiments, the cloud deployment system 10 of the boot image is used to enable the electronic device 100 to obtain the boot image BI from the server 200 to execute the boot program. Among them, the electronic device 100 sends a request command R to the server 200, and the server 200 returns the boot image BI to the electronic device 100 according to the request command R. Specifically, the server 200 stores a plurality of boot images BI, and the server 200 returns any one of the boot images BI to the electronic device 100 according to the request command R. It should be particularly noted that according to some embodiments, although each of the boot images BI stored in the server 200 can be executed by the electronic device 100, these boot images BI are obtained through random processing, so these boot images BI are actually not the same. Since the server 200 randomly provides different boot images BI to the electronic device 100, each time the electronic device 100 issues a request command R, the corresponding boot image BI obtained by the electronic device 100 may be different. Therefore, the electronic device 100 does not need to execute the same boot image BI every time to perform the boot process.

In some embodiments, the boot image BI is stored in the storage medium 240, and the control circuit 220 is used to receive the request command R, and randomly select a boot image BI from the storage medium 240 according to the request command R and return it to the electronic device 100. According to some embodiments, the control circuit 220 randomly selects the boot image BI according to the random number generation program. For example, the random number generation program outputs non-repeating random numbers to the boot image BI in the storage medium 240, and each boot image BI has a corresponding random number. The control circuit 220 selects the boot image BI with the largest random number to the electronic device 100.

It should be noted that in some embodiments, the electronic device 100 is not limited to whether it is equipped with a boot image BI. In the case where the electronic device 100 is not equipped with a boot image BI, the electronic device 100 will issue a request command R to obtain the boot image BI each time the boot process is performed. In some embodiments, the electronic device 100 does not issue the request command R when booting, but issues the request command R based on the update requirements of the electronic device 100, such as when the originally executed boot image BI has been used for more than a specific period of time or a specific number of times.

In some embodiments, when the electronic device 100 performs a boot process, the electronic device 100 first executes a basic input/output program (BIOS) so that the request command R is issued only after the communication element 140 is initialized. Specifically, the controller 120 is used to execute the input/output program to initialize the communication element 140, and issue the request command R after the communication element 140 is initialized. Specifically, the initialization of the communication element 140 represents the activation of the communication function of the communication element 140, and is not limited to activating the communication element 140 to a normal communication function or only activating part of the communication function (for example, only opening part of the communication bandwidth, communication speed, or communication mode). The communication element 140 is, for example, but not limited to, a wireless communication circuit, a wired communication circuit, or a circuit that has both wireless communication and wired communication. In some embodiments, the request command R includes identification (ID) information of the electronic device 100, and the identification information is, for example, but not limited to, the model, serial number, or related information that can be converted into a model and/or serial number of the electronic device 100. According to some embodiments, the read-only storage element 160 is used to store the input/output program. The controller 120 obtains the storage input/output program from the read-only storage element 160 to perform initialization. The read-only storage element 160 is, for example, a read-only memory (ROM).

Please refer to FIG. 1 and FIG. 2 simultaneously. In some embodiments, the electronic device 100 receives and runs the boot image BI to execute the boot program. Specifically, since the boot image BI includes a function library LIB, a driver DRV and an operating system kernel (OS, Operation System), wherein the function library LIB includes functions such as input and output, access, and mathematical operations, the controller 120 executes the boot program to enable the operating system and programs in the electronic device 100 to start operating. According to some embodiments, the driver DRV is used to activate the communication element 140 to normal communication function. The random access memory element 180 is used to store the received boot image BI. The random access memory element 180 is, for example, a flash memory (Random Access Memory, RAM).

In some embodiments, the control circuit 220 of the server 200 includes a compiler 222, an assembly 224, and a linker 226. The storage medium 240 of the server 200 is used to store the boot image BI and a plurality of source codes SC corresponding to the electronic device 100. The source code SC is the code of the operating system and the software. The control circuit 220 converts the source code SC into a plurality of target files OBJ, randomly arranges the order of the target files OBJ, and finally links the target files OBJ to obtain the boot image BI. The process of converting the source code SC into the target file OBJ is completed through the compilation of the compiler 222 and the assembly of the assembly 224. The process of linking the target file OBJ to the boot image BI is completed by linking the address of each target file OBJ according to the arrangement order of the target file OBJ through the linker 226. According to some embodiments, the linker 226 is, for example, a GNU linker, and the address of the target file OBJ is linked by a linker script file in the GNU linker. It should be particularly noted that the address of the target file OBJ is, for example, but not limited to, a physical location or a virtual location in the electronic device 100. And the linking method of the address of the target file OBJ is not limited to using independent jumpers or looking up a mapping table.

In some embodiments, each boot image BI stored in the storage medium 240 includes a plurality of target files OBJ. Among them, the combination order of the target file OBJ in any boot image BI is different from the combination order of the target file OBJ in other boot images BI, that is, the combination order of the target file OBJ between each boot image file BI is different. Specifically, the boot image BI includes a library LIB, a driver DRV and an operating system core OS, and the library LIB, the driver DRV and the operating system core OS respectively include a plurality of target file OBJ. In the process of the control circuit 220 obtaining the boot image BI, the control circuit 220 at least selects one of the library LIB, the driver DRV and the operating system core OS in the boot image BI to randomly arrange the target file OBJ. In addition, the boot image BI can also be a library LIB, a driver DRV and an operating system core OS The target file OBJ is randomly arranged, or any two of the library LIB, the driver DRV and the operating system core OS are randomly arranged for the target file OBJ.

Continuing with reference to FIG. 1 , in some embodiments, the server 200 can generate a certain number of boot images BI in advance and store them in the storage medium 240. In some embodiments, the server 200 can determine whether to generate more boot images BI for preparation based on the remaining number of boot images BI (i.e., the number of boot images BI that have not been sent back to the electronic device 100 for use). In some embodiments, when the server 200 receives the request command R, even if the storage medium 240 does not have a pre-made boot image BI, the control circuit 220 can also make a boot image BI according to the request command R to provide it to the electronic device 100.

In some embodiments, the electronic device 100 has a public key (not shown), and the server 200 has a private key (not shown), wherein the public key corresponds to the private key. The process of the control circuit 220 of the server 200 obtaining the boot image BI needs to be encrypted by the private key, and the controller 120 of the electronic device 100 then uses the public key to decrypt the received boot image BI. Specifically, the control circuit 220 uses the private key to encrypt the boot image BI to form a digital signature, and the encrypted boot image BI has this digital signature as verification. The control circuit 220 then stores the encrypted boot image BI in the storage medium 240, that is, the boot image BI stored in the storage medium 240 is encrypted. When the electronic device 100 obtains the encrypted boot image BI, the electronic device 100 uses the public key to decrypt the boot image BI to verify whether the digital signature is correct. When the digital signature is correct, the electronic device 100 can execute this verified boot image BI to perform the boot procedure. On the contrary, when the digital signature is wrong, the electronic device 100 can re-issue the request command R to the server 200 to re-send the boot image BI. In some embodiments, when the digital signature is correct, the electronic device 100 stores the boot image BI in the random access memory element 180. According to some embodiments, the control circuit 220 does not encrypt the boot image BI during the process of generating the boot image BI, but after the control circuit 220 selects the boot image BI to be sent back to the electronic device 100 from the storage medium 240, the control circuit 220 encrypts the boot image BI by the private key.

In some embodiments, the cloud deployment system 10 for boot images is not limited to only one electronic device 100. For example, the cloud deployment system 10 for boot images can include multiple electronic devices 100 at the same time, and is not limited to electronic devices 100 of a single frequency. And the server 200 generates the boot images BI corresponding to each electronic device 100 according to the source code SC corresponding to each electronic device 100. Since the request command R issued by the electronic device 100 has identification information, the server 200 can provide the corresponding boot images BI according to different electronic devices 100. According to some embodiments, the corresponding public key and private key in the cloud deployment system 10 for boot images are not limited to one group. For example, the cloud deployment system 10 for boot images can match different groups of public keys and private keys according to electronic devices 100 of different frequencies. Or for a single specific electronic device 100, the cloud deployment system 10 for boot images can provide a single group of public keys and private keys to distinguish other electronic devices 100.

FIG3 is a flow chart of a method for cloud deployment of a boot image in some embodiments of the present invention.

FIG3 , in some embodiments, a cloud deployment method of a boot image is suitable for execution by an electronic device 100 and a server 200. The cloud deployment method of a boot image includes the following steps: the electronic device 100 issues a request command R (step S110); the server 200 stores a plurality of boot images BI, each boot image BI includes a plurality of target files OBJ, and the combination sequence of the target files OBJ of each boot image BI is different from the combination sequence of the target files OBJ of other boot images BI (step S120); the server 200 returns one of the boot images BI to the electronic device 100 according to the request command R (step S130); and the electronic device 100 executes the received boot image BI (step S140).

FIG4 is a flow chart of a method for cloud deployment of a boot image in some embodiments of the present invention. Referring to FIG4 , in some embodiments, the method for cloud deployment of a boot image is suitable for execution by an electronic device 100 and a server 200. The method for cloud deployment of a boot image includes the following steps: the electronic device 100 executes an input/output program to initialize the communication element 140 of the electronic device (step S100); after the communication element 140 is initialized, the electronic device 100 issues a request instruction R (step S110′); the server 200 stores a plurality of boot images BI, each boot image BI includes a plurality of target files OBJ, and the combination order of the target files OBJ of each boot image BI is different from the combination order of the target files OBJ of other boot images BI (step S120); the server 200 transmits one of the boot images BI back to the electronic device 100 according to the request instruction R (step S130); and the electronic device 100 executes the received boot image BI (step S140).

In summary, the cloud deployment system and method of the boot image proposed in some embodiments of the present case can deploy multiple different boot images on the server, and the server then provides one of the boot images to the electronic device for execution based on the request instruction of the electronic device. Since the boot image deployed by the server is obtained by randomly combining and arranging the target file, each boot image has a different combination order in the target file, and the server randomly provides any boot image to the electronic device, so the electronic device can obtain different boot images. Since the boot image file executed by the electronic device each time it is turned on may be different, it can avoid being attacked by hackers. In some embodiments, the cloud deployment system and method of the boot image further include a pair of corresponding public keys and private keys. The server encrypts the boot image with a private key, and the electronic device decrypts the boot image with a public key. Therefore, the electronic device can also authenticate whether the boot image provided by the server is correct.

Claims (8)

1. A cloud deployment system for a boot image, comprising: An electronic device, used to issue a request instruction according to an update request; and A server, comprising: A storage medium for storing a plurality of boot images, each of the boot images comprising a plurality of destination files, the combination order of the destination files of each boot image being different from the combination order of the destination files of the other boot images; and a control circuit for returning one of the boot images to the electronic device according to the request instruction, and the electronic device executes the received boot image; The storage medium further stores a plurality of source codes corresponding to the electronic device, and the control circuit is used to compile and assemble the source codes into the target files, randomly arrange the target files, and establish link addresses corresponding to the target files to obtain one of the boot images. 2. The cloud deployment system of the boot image according to claim 1, wherein the electronic device comprises: a communication component; and A controller is used for executing an input and output program to initialize the communication element, and after the communication element is initialized, issuing the request instruction. 3. According to the cloud deployment system of the boot image as described in claim 1, wherein the storage medium further stores multiple source code corresponding to the electronic device, the server has a private key, and the electronic device has a public key corresponding to the private key, the control circuit is used to compile and assemble the source code into the target files, randomly arrange the target files, establish link addresses corresponding to the target files, and encrypt with the private key to obtain one of the boot images, and the electronic device decrypts with the public key and executes the received boot image. 4. An electronic device for deploying a boot image in the cloud, the electronic device comprising: a communication component; and A controller is used for executing an input and output program to initialize the communication element, and after the communication element is initialized, sends a request instruction according to an update request, and executes a received boot image. 5 . The electronic device according to claim 4 , further comprising a public key, and the electronic device that deploys the boot image in the cloud uses the public key to decrypt and execute the received boot image. 6. A method for cloud deployment of a boot image, suitable for an electronic device and a server, the method for cloud deployment of a boot image comprising: The electronic device issues a request instruction according to an update request; The server stores a plurality of boot images, each of which includes a plurality of target files, and a combination order of the target files of each boot image is different from a combination order of the target files of other boot images; The server returns one of the boot images to the electronic device according to the request command; and The electronic device executes the received boot image, The method further includes a method for obtaining a boot image, including: Compiling and assembling a plurality of source codes corresponding to the electronic device into the target files; Randomly arrange the target files; Create links to those destination files; and Obtain one of the boot images. 7. The method for cloud deployment of a boot image according to claim 6, wherein before the electronic device issues the request instruction, the method for cloud deployment of a boot image comprises: The electronic device executes an input/output program to initialize a communication element of the electronic device; and After the communication element is initialized, the electronic device issues the request instruction. 8. The cloud deployment method of the boot image according to claim 6 further comprises a boot image acquisition and verification method, comprising: Compiling and assembling a plurality of source codes corresponding to the electronic device into the target files; Randomly arrange the target files; Create link addresses corresponding to these target files; Encrypting using a private key to obtain one of the boot images; and The received boot image is decrypted and executed using a public key, wherein the public key corresponds to the private key.