Security and data isolation
Edge device security should be inherent in the system architecture, rather than relying on fixes after incidents. JelinaOS builds defense in depth across the system, data, and network layers to keep devices secure in complex environments.
System layer: an immutable foundation
Section titled “System layer: an immutable foundation”Read-only system
Section titled “Read-only system”The system partition is mounted read-only at runtime, forming the cornerstone of JelinaOS security:
- Programs, scripts, and accidental operations cannot modify system contents.
- Viruses and malicious programs cannot achieve persistence by modifying the system.
- System integrity is provided by the architecture, rather than relying on antivirus software.
Boot integrity validation
Section titled “Boot integrity validation”At each boot, the system validates the integrity of the current system partition and automatically switches to the standby system if a fault is detected. Even if an attacker attempts to damage the system, the device automatically returns to a trusted state on the next boot.
Data layer: protection through physical isolation
Section titled “Data layer: protection through physical isolation”Separate data partition
Section titled “Separate data partition”All user data and runtime writes are stored in a separate data partition, physically isolated from the system partition:
- Application faults and system failures do not propagate to the data partition.
- Original data is isolated from subsequent operations to reduce potential risks.
- The data partition is managed independently and can be backed up, cleaned up, or retained according to policy.
Controllable data lifecycle
Section titled “Controllable data lifecycle”| Operation | Data impact | Description |
|---|---|---|
| System update | None | Updates involve only system partitions |
| Factory reset | Reset | Restores the system and user-written data to the factory state; back up important data first |
| System crash | None | The data partition is independent of the system |
Network layer: minimal exposure and secure access
Section titled “Network layer: minimal exposure and secure access”Device registration and identity
Section titled “Device registration and identity”- Each device registers using a unique configuration, establishing a one-to-one identity binding with the cloud.
- Registration credentials are valid once, preventing device impersonation.
- Registration codes are bound to unique device identifiers to prevent tampering and transfer.
- Device types cannot be changed after registration, maintaining clear management boundaries.
- A license registration route supports manual registration, LAN registration servers, offline batch registration, and offline signing to meet licensing requirements in disconnected and private networks.
Secure channels
Section titled “Secure channels”- Devices communicate with the cloud through encrypted channels.
- In production mode, devices accept access only through the cloud. Direct access is unavailable even from the same LAN, minimizing network exposure.
- Remote SSH, remote desktop, and other maintenance capabilities are forwarded through secure channels without public Internet exposure.
Access control
Section titled “Access control”- Local device interfaces use key-based authentication and reject unauthorized requests.
- Access keys can be regenerated as needed to respond immediately to key exposure.
- The cloud provides a comprehensive role and permission system for fine-grained control over device operations.
Logging and auditing
Section titled “Logging and auditing”- Device logs are centrally reported to the cloud, with large-scale log storage supported by default.
- Critical operations are traceable, providing comprehensive evidence for security audits.
- Log control policies determine which logs are reported as needed.
Security design at a glance
Section titled “Security design at a glance”┌─────────────────────────────────────────────────────────────────────────┐│ Application Containers / native applications (controlled execution) │├─────────────────────────────────────────────────────────────────────────┤│ Access Local API key authentication / cloud role permissions │├─────────────────────────────────────────────────────────────────────────┤│ Network Encrypted channels / minimal production-mode exposure │├─────────────────────────────────────────────────────────────────────────┤│ Data Separate data partition / controlled data lifecycle │├─────────────────────────────────────────────────────────────────────────┤│ System Read-only system / boot integrity verification │└─────────────────────────────────────────────────────────────────────────┘These five protective layers form successive lines of defense. If one is breached, the others remain effective. Together they form JelinaOS’s comprehensive approach to edge security.