CN101277194B - A sending/receiving method of covert communication - Google Patents

Abstract

The invention discloses a sending/receiving method of covert communication. The method hides important information to be transmitted in a carrier in a computer network environment, making it difficult to be noticed. When sending network data, the sender randomly embeds secret information in the check field of the header of the network protocol data unit (TCP segment or UDP packet), and after embedding the secret information, corrects the data field to ensure that the checksum is still correct; After the network protocol data unit is received on the network, the secret information is extracted from the check field. The method utilizes the checksum of the protocol data unit and hides the information, which has good secrecy and anti-attack performance, is safe and reliable, and is especially suitable for the secret communication of important information with a small amount of data.

Description

A sending/receiving method of covert communication

technical field

The invention belongs to the technical field of communication and information security, relates to a communication method, and more particularly relates to a sending/receiving method of covert communication.

Background technique

Covert communication is an important aspect of communication and information security technology, and information hiding technology is an important method to realize covert communication, that is, to hide important information to be transmitted in the carrier so that it is not easy to be detected. There are many carriers of information hiding technology, such as text, image, audio, video, and TCP/IP headers. After searching, it is found that the existing information hiding methods based on the TCP/IP protocol mainly rely on the following domains to hide: (1) the option domain of the TCP or IP header and the domain that is rarely used when transmitting data; (2) the transmission data Fields that must be filled in to hide information, such as the source address field, destination address field, and flag field in the IP packet header, and the source port field, destination port field, and serial number field in the TCP packet header. Relying on the information hiding technology of these domains, since the hidden domains are well known, the secrecy is not high; for these technologies, attack methods such as packet filtering and chi square analysis have appeared, and these attack methods can be used to detect or extract TCP or The information hidden in the IP header is easy to be attacked and the security is not high.

Contents of the invention

The technical problem to be solved by the present invention is: aiming at the disadvantages of being easily attacked and having low security existing in the existing information hiding technology based on the TCP/IP protocol introduced above, a method for realizing secret communication in a computer network environment is proposed. Send/receive method to make secret information more confidential and anti-attack.

In order to achieve the above object, the technical solution of the present invention to solve the above problem is a sending/receiving method of covert communication. In the network environment, the information to be transmitted is first hidden in the carrier, and when the sender sends network data, the network protocol data The verification field of the unit header randomly embeds information, and the embedded information is verified through the correction data field; after receiving the network protocol data unit from the network, the receiver extracts the information from the verification field.

Wherein, the sending method includes the following steps:

Step 1: Encrypt the secret information to be sent with the shared key, and the cryptographic algorithm used is RC4;

Step 2: represent the encrypted information with a binary bit stream, and divide it into a group of 8 bits; if the length of the encrypted information is l, then there are m=l/8 groups; if the length of the encrypted information is not an integer multiple of 8 , then fill "0" after the last group; sort all groups according to the original order of information;

Step 3: Construct m transport layer protocol data units, fill the fields and data fields of each protocol data unit header, and generate a checksum, and fill in the checksum field;

Step 4: Embed the m groups of bit streams obtained in step 2 into the check fields of the m transport layer protocol data units obtained in step 3, embed each group of 8 bits into a protocol data unit, and embed In a random position agreed upon by both parties;

Step 5: For each protocol data unit obtained in step 4, correct the data field in the data unit according to its changed check bit, so that the check sum is still correct;

Step 6: Send all the m PDUs obtained in step 5 to the receiving party sequentially according to the protocol of the transport layer and the sequence of each packet.

The above-mentioned transport layer protocol data unit refers to a TCP segment or a UDP datagram, and its message format is shown in accompanying drawing 5, wherein the pseudo-header is only for calculating the checksum, and the pseudo-header and the TCP segments or UDP packets are calculated together.

The generation process of the check field of the above-mentioned transport layer protocol data unit, according to the calculation method of the checksum of the TCP and UDP protocols, promptly calculates the checksum together with the header, data and pseudo-header of the TCP segment or UDP report. When calculating, first divide the part to be checked into a sequence of many 16-bit words, and set the checksum to zero. After adding all the 16-bit words with one’s complement arithmetic operation, the inverse code of the obtained sum is used as the generated checksum. The generation process of the checksum is shown in Figure 6. See Figure 7 for the verification process of the checksum.

The aforementioned random position means that 8 random bit positions are selected from the 16 bit positions in the check field to hide the secret information. 8 random positions are agreed upon by both parties. The 8 random positions of each protocol data unit should be different and set in advance by both parties.

The above-mentioned embedding adopts a bit replacement method, that is, each group of 8 bits obtained in step 2 is used to replace 8 bits at random positions in the check field of each transport layer protocol data unit.

The above-mentioned correction of the data field in the data unit based on the changed check digit is similar to the process of verification in the transport layer protocol, that is, the part to be verified (including the pseudo header, header and data field) and the embedded secret The checksum of the information is combined with one's complement arithmetic and added as 16-bit words. If no information is embedded in the check field, the result of the addition should be 1, indicating that the checksum is correct. Because the checksum is changed after embedding the 8-bit secret information, it is necessary to modify the data field of the protocol data unit so that the result of the addition is still 1, so as to ensure that the checksum is still correct. The correction process is shown in Figure 8.

Above-mentioned according to the protocol of transport layer and the sequence of each packet are sent successively, transport layer protocol can be TCP protocol, because TCP protocol header sequence number field (seeing accompanying drawing 5), so directly send all message segments by sequence number field .

The above is sent in sequence according to the protocol of the transport layer and the order of each packet. The protocol of the transport layer can be the UDP protocol. Because the UDP protocol header does not have a sequence number field, the two parties have agreed in advance to select 16 bits of the UDP data field as a representation The sequence number of each UDP datagram and the position of these 16 bits are agreed in advance by both parties.

The receiving method includes the following steps:

Step 1: Receive all m transport layer protocol data units according to the transport layer protocol, and sort all the protocol data units according to the sequence numbers from small to large;

Step 2: For the m transport layer protocol data units obtained in step 1, according to 8 random positions in the check field of each protocol data unit agreed by both parties, extract the bit values of these 8 positions to form a set of bit streams ;

Step 3: Combine all m groups of bit streams obtained in step 2 into complete information according to the order in step 1;

Step 4: Use the shared key and the RC4 cryptographic algorithm to decrypt the information obtained in step 3 to obtain the secret information to be received.

The above-mentioned transport layer protocol data unit refers to a TCP segment or a UDP datagram, and its header format is shown in Figure 5. The pseudo-header of the UDP datagram is only for calculating the checksum, and the pseudo-header is used when calculating the checksum. Headers are computed together with UDP user datagrams.

The above-mentioned transport layer protocol can be the TCP protocol. When the sender uses the TCP protocol, because the sequence number field of the TCP protocol header (seeing accompanying drawing 5), the receiver directly sorts all message segments by the value of the sequence number field.

The above-mentioned transport layer protocol can be the UDP protocol, because there is no sequence number field in the UDP protocol header, so the two parties have agreed in advance to select 16 bits of the UDP data field as the sequence number representing each UDP datagram, and the positions of these 16 bits are given by The two parties agreed in advance to sort all datagrams according to the value of these 16 bits.

The aforementioned random position refers to randomly selecting 8 bit positions from the 16 bit positions in the check field. 8 random positions are agreed upon by both parties. The 8 random positions of each protocol data unit should be different and set in advance by both parties.

A sending/receiving method for covert communication of the present invention has the characteristics and beneficial effects as follows:

1. The hidden field relied on in the present invention is the check field of the protocol data unit header, and this field has not been used by other information hiding technologies, so it has better concealment;

2. In the present invention, the verification field is relied on to hide, and then the checksum is still correct by correcting the data field. This is a brand-new method of reversely applying the verification field, which has a good hiding effect;

3. Before being hidden, the secret information in the present invention is encrypted with the RC4 cryptographic algorithm, so that it has better secrecy. Even if the attacker finds the existence of steganography, it is difficult to decrypt the information;

4. In the present invention, the information to be embedded is divided into groups of 8 bits for embedding, and only 8 bits of the 16 bits of the check field are used when embedding, so that the statistical characteristics of the check field change less, and can resist statistical analysis-based attack method;

5. The present invention adopts a method of random embedding when embedding information, that is, embedding in 8 random positions of the 16-bit check field of each protocol data unit, and the random positions of each protocol data unit are different, making it difficult for an attacker to It is difficult to find the law to attack, and it has very good security.

Description of drawings

Fig. 1 is the flowchart of sending secret information based on TCP protocol among the present invention;

Fig. 2 is the flow chart of receiving secret information based on TCP protocol among the present invention;

Fig. 3 is the flowchart of sending secret information based on UDP protocol among the present invention;

Fig. 4 is the flow chart of receiving secret information based on UDP protocol in the present invention;

Fig. 5 (a) is the format of the TCP segment header in the TCP protocol, (b) is the format of the UDP data header in the UDP protocol, and (c) is the format of the pseudo-header;

Fig. 6 is the generation flowchart of checksum in TCP agreement and UDP agreement;

Fig. 7 is the verification flowchart in TCP agreement and UDP agreement;

Fig. 8 is a flow chart of correcting the data field according to the changed checksum in the present invention so that the checksum is still correct.

Detailed ways

The content of the present invention will be further described in detail below in conjunction with the accompanying drawings.

1. The method steps of using the data unit of the TCP protocol as a concealed carrier (referring to accompanying drawing 1 and accompanying drawing 2) are:

(1) Encrypt the secret message. The key is shared by the sender and the receiver, the cryptographic algorithm uses RC4, and the encrypted information is divided into 8-bit groups, a total of m groups.

(2) Construct m TCP segments. The source port, destination port, serial number and other header fields and data fields of each TCP segment are filled with corresponding correct values, and a 16-bit checksum is generated. The checksum generation process is to calculate the checksum with the header, data and pseudo-header of the TCP segment. When calculating, first divide the part to be checked into a sequence of 16-bit words, and set the checksum to Zero, after adding all 16-bit words using one's complement arithmetic, takes the one's complement of the resulting sum as the generated checksum. Refer to Figure 5 for the format of the TCP segment header, and Figure 6 for the generation process of the checksum.

(3) According to 8 random bit positions among the 16 bit positions agreed by both parties in advance, 8 bits are extracted from the 16-bit checksum of each TCP segment header obtained in step (2).

(4) Replace each group of 8-bit data extracted in step (3) with each group of 8-bit encrypted information obtained in step (1).

(5) Put each group of 8-bit data obtained in step (4) back into the check field according to the same random bit position in step (3).

(6) According to the check field changed in step (5), the data field of the message segment is corrected to ensure that the checksum verification is correct. The verification process of the TCP protocol checksum is to use the one's complement arithmetic operation with the part to be verified (including the pseudo header, header and data field) and the checksum, and add them according to 16-bit words. If the addition is obtained If the result is 1, it means that the checksum is correct; otherwise, the checksum is incorrect. For the verification process of the checksum, see Figure 7. The correction process of the checksum is similar to the verification process, that is, the part to be verified (including the pseudo header, the header and the data field) and the checksum embedded with the secret information are used together to perform an inverse code arithmetic operation, according to the 16-bit word Add, modify the data field of the TCP segment so that the result of the addition is still 1, so as to ensure the correctness of the checksum, see Figure 8 for the correction process of the checksum.

(7) The sender sends all TCP segments to the receiver in sequence.

(8) The receiver receives all m TCP segments.

(9) Extract the 16-bit checksum of each TCP segment header.

(10) Extract 8 bits from each 16-bit checksum obtained in step (9) according to 8 random positions among the 16 bit positions agreed in advance.

(11) Composing all the bits extracted in step (10) into information in sequence.

(12) Use the shared key to decrypt the information according to the RC4 cryptographic algorithm, so as to obtain the secret information to be received.

2. The method steps of using the data unit of the UDP protocol as a concealed carrier (referring to accompanying drawing 3 and accompanying drawing 4) are:

(1) Encrypt the secret message. The key is shared by the sender and the receiver, the cryptographic algorithm uses RC4, and the encrypted information is divided into 8-bit groups, a total of m groups.

(2) Construct UDP datagram. In each UDP datagram, the header fields and data fields such as source port, destination port and length are filled with corresponding correct values. Select 16 bits of the data field in the UDP message, and the 16 bit positions are agreed upon by both parties in advance. Fill the sequence number of each UDP packet into these 16 bits, so that the receiver can confirm the sequence of all UDP datagrams. The process of generating the checksum is to calculate the checksum together with the header, data and pseudo-header of the UDP message. When calculating, first divide the part to be checked into a sequence of 16-bit words, and set the checksum to Zero, after adding all 16-bit words using one's complement arithmetic, takes the one's complement of the resulting sum as the generated checksum. For the format of the UDP datagram header, see Figure 5, and for the generation process of the checksum, see Figure 6.

(3) According to 8 random bit positions among the 16 bit positions agreed by both parties in advance, 8 bits are extracted from the 16-bit checksum of each UDP header.

(4) Replace each group of 8-bit data extracted in step (3) with each group of 8-bit encrypted information obtained in step (1).

(5) Put each group of 8-bit data obtained in step (4) back into the check field according to the same random bit position in step (3).

(6) Correct the data field of the datagram according to the changed check field in step (5), so as to ensure that the checksum verification is correct. The verification process of the UDP protocol checksum is to use the one’s complement arithmetic operation with the part to be verified (including the pseudo header, header and data field) and the checksum, and add them according to 16-bit words. If the addition is obtained If the result is 1, it means that the checksum is correct; otherwise, the checksum is incorrect. For the verification process of the checksum, see Figure 7. The correction process of the checksum is similar to the verification process, that is, the part to be verified (including the pseudo header, the header and the data field) and the checksum embedded with the secret information are used together to perform an inverse code arithmetic operation, according to the 16-bit word To add, modify the data field of the UDP message so that the result of the addition is still 1, so as to ensure that the checksum is correct. For the correction process of the checksum, refer to Figure 8.

(7) The sender sends all UDP datagrams to the receiver.

(8) The receiver receives all UDP packets. And according to the agreed 16 bit positions in the data field of each datagram, the serial number of each datagram is extracted, and the datagrams are sorted.

(9) Extract the 16-bit checksum of each UDP datagram header

(10) Extract 8 bits from each 16-bit checksum obtained in step (9) according to 8 random positions among the 16 bit positions agreed in advance.

(11) Composing all the bits extracted in step (10) into information in sequence.

(12) Use the shared key to decrypt the information according to the RC4 cryptographic algorithm, so as to obtain the secret information to be received.

Claims (7)

1. transmission/the method for reseptance of a secret communication, in network environment the Information hiding that will transmit in carrier, it is characterized in that: this sending method comprises the steps:

Step 1: with sharing the secret information that secret key encryption will send, the cryptographic algorithm of use is RC4;

Step 2: the information after encrypting is represented with binary bit stream, be divided into one group of 8 bit, if encrypting the length of back information is l, then total m=l/8 group, if the length of encrypting back information is not 8 integral multiple, then in the end " 0 " is filled in one group back, the original order ordering of all groupings by information;

Step 3: construct m transport layer protocol data cell, fill each field and the data field of each protocol Data Unit stem, and generate verification and, insert in the verification territory;

Step 4: the m that obtains in the step 2 group bit stream is embedded into respectively in the verification territory of m the transport layer protocol data cell that obtains in the step 3, and 8 bits of every group are embedded in the protocol Data Unit, and are embedded on the random site that both sides appoint;

Step 5: to each protocol Data Unit that obtains in the step 4, revise data field in the data cell, make verification and still correct according to its verification territory that has changed; Wherein, the similar process of verification in the process of revising data field according to the verification territory and the transport layer protocol, promptly the part of wanting verification, the radix-minus-one complement arithmetical operation is reinstated in the verification and that comprises pseudo-head, head and data field and embedded secret information, presses 16 word additions; If do not embed secret information in the verification territory, the result that addition obtains should be 1, expression verification and correct; Because make verification and variation has taken place after embedding 8 bit secret informations, still be 1 so need modification protocol Data Unit data field to make the result of addition, to guarantee verification and still correct;

Step 6:, send to the recipient successively according to the agreement of transport layer and the sequencing of each grouping all m protocol Data Unit that obtains in the step 5;

This method of reseptance is, after the recipient receives network protocol data unit from network, from the information extraction of verification territory.

2. transmission/the method for reseptance of a kind of secret communication according to claim 1, it is characterized in that: described protocol Data Unit refers to TCP message segment or UDP datagram.

3. transmission/the method for reseptance of secret communication according to claim 1, it is characterized in that: the generative process in the verification territory of the transport layer protocol data cell in the described sending method step 3, according to TCP and udp checksum and computational methods, promptly head, data and the pseudo-head of TCP section or UDP newspaper calculation check together and; During calculating, earlier part to be verified is divided into the sequence of many 16 words, and verification and zero setting, with the radix-minus-one complement arithmetical operation all 16 word additions after, with obtain and radix-minus-one complement as the verification that generates with.

4. transmission/the method for reseptance of secret communication according to claim 1, it is characterized in that: telescopiny adopts the mode that bit is replaced in the described sending method step 4, promptly replaces the bit of 8 random sites of the both sides' agreement in each transport layer protocol data cell verification territory with every group that obtains in the step 28 bits.

5. transmission/the method for reseptance of a kind of secret communication according to claim 1, it is characterized in that: described method of reseptance comprises the steps:

Step (1): receive all m transport layer protocol data cells according to transport layer protocol, and from small to large all protocol Data Units are sorted according to sequence number;

Step (2): to m the transport layer protocol data cell that obtains in the step (1), 8 random sites according in each protocol Data Unit verification territory of both sides' agreement extract the bit value of these 8 positions, form one group of bit stream;

Step (3):, form complete information according to the order in the step (1) with all m group bit streams that obtain in the step (2);

Step (4): with sharing the information that obtains in key and the RC4 cryptographic algorithm decryption step (3), the secret information that acquisition will receive.

6. transmission/the method for reseptance of secret communication according to claim 1 or 5, it is characterized in that: described 8 random sites, finger is selected 8 random bit positions and is used for hiding secret information in 16 bit positions in the verification territory of transport layer protocol data cell, 8 random sites arrange to form by both party, 8 random sites of each protocol Data Unit should have nothing in common with each other, and set in advance by both party.

7. transmission/the method for reseptance of secret communication according to claim 1 or 5, it is characterized in that: described transport layer protocol is Transmission Control Protocol or udp protocol, directly sends, receives all message segments by the sequence number field during for Transmission Control Protocol; Appoint in advance by both party during for udp protocol that 16 bits choosing the UDP message territory are as the sequence number of representing each UDP datagram.

Images