Data multipath transmission disguise method based on protocol and sending rate

Abstract

The invention discloses a data multipath transmission camouflage method based on a protocol and a sending rate, and the method comprises the following steps: 1, carrying out the fragmentation of original data through an entrance node according to a predefined protocol rule based on the obtained original data, and obtaining a plurality of data segments; step 2, disguising the encrypted data segment by using a protocol disguising module to obtain a disguising message; step 3, forwarding the rate camouflage message to a multipath communication network in parallel on each path through a plurality of communication paths by adopting an entrance node; step 4, the exit node decapsulates and verifies the rate camouflage message to obtain a plurality of data segments; step 5, the exit node sends the plurality of data segments to a receiver server according to the serial numbers of the exit node; and step 6, the exit node and the entrance node are mutually exchanged, and then the step 1 is returned to continue. And the anti-analysis capability and the concealment of the communication system are enhanced while the transmission reliability is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of communication network security, and in particular to a data multipath transmission camouflage method based on protocol and sending rate. Background Art

[0002] In modern network communications, relying solely on data encryption technology is no longer sufficient to address new security threats. Although encryption protocols such as TLS and IPSec can protect the confidentiality of data payloads, attackers can still use traffic analysis technology to infer the content of communications from the timing characteristics of the data stream (such as packet sending rate and transmission interval) and protocol fingerprints (such as handshake behavior and port characteristics). For example, by analyzing the packet sending interval of a VoIP encrypted call, an attacker can reconstruct the voice rhythm of the call; for IoT devices, fixed protocol ports may reveal the device's business type. These metadata leaks expose significant security blind spots in traditional encryption technology, and more complex security protection measures are urgently needed to address these potential risks.

[0003] To address this type of security threat, existing technologies have evolved in two main directions: (1) Traffic camouflage strategies, which use protocol mimicry and traffic shaping to hide communication characteristics. Typical solutions include dynamically modifying protocol fields and injecting false traffic (such as the Tor network). Although these technologies can effectively disrupt attackers' identification of protocol fingerprints, they often find it difficult to conceal the inherent timing characteristics of business flows and still have a certain degree of identifiability. (2) Customized encryption transmission protocols, which enhance the security of the protocol layer by designing proprietary handshake processes and dynamic cipher suites. For example, the national secret SM9-over-TCP protocol used in financial private networks improves security through non-fixed port negotiation and two-way certificate authentication mechanisms. However, such protocols often retain certain identifiable features while pursuing compatibility. These features may still constitute unique fingerprints and be identified and marked by network probes, thus posing security risks. Summary of the Invention

[0004] This invention aims to build a multi-path covert transmission system that resists traffic analysis attacks. This system, through a collaborative mechanism of protocol and transmission rate camouflage, ensures the privacy and security of user data during communications. This solution, based on multi-path heterogeneous protocol fingerprint camouflage, transmission rate camouflage, and multi-path transmission technologies, builds on the TCP transmission architecture to form a multi-dimensional defense system covering multi-path protocol characteristics and traffic rates. This ensures the uncorrelation of cross-path traffic characteristics and effectively defends against traffic correlation attacks based on protocol fingerprint matching and correlation analysis, providing a secure transmission paradigm for heterogeneous network environments.

[0005] To achieve the above object, the present invention provides the following technical solution: a data multipath transmission camouflage method based on protocol and transmission rate, comprising the following steps:

[0006] Step 1: Based on the obtained multiple paths, a Transmission Control Protocol (TCP) connection is established between nodes on each path through a socket to construct a multipath communication network including an entry node, multiple transmission nodes, and an exit node; based on the obtained original data, the entry node segments the original data according to a predefined protocol rule to obtain multiple data segments;

[0007] Step 2: Based on the multiple data segments, obtain payloads of the multiple data segments; encrypt the payloads to obtain encrypted data segments; and disguise the encrypted data segments using a protocol camouflage module to obtain camouflaged messages;

[0008] Step 3: Based on the disguised message, disguise the transmission rate of the disguised message to obtain a rate disguised message; use the ingress node to forward the rate disguised message in parallel to the multipath communication network through multiple communication paths on each of the paths;

[0009] Step 4: The plurality of transmission nodes in the multipath communication network transmit the rate camouflage message to the egress node; the egress node decapsulates and verifies the rate camouflage message to obtain the plurality of data segments;

[0010] Step 5: Based on the multiple data segments in step 4, obtain the sequence numbers of the multiple data segments; the egress node sends the multiple data segments to the receiving server according to their own sequence numbers;

[0011] Step 6: swap the egress node with the ingress node, and then return to step 1 to continue.

[0012] Preferably, the step 1 is specifically implemented according to the following steps:

[0013] Step 1.1, during the transmission initialization phase, select the number of transmission nodes, transmission node IP addresses, egress nodes, and egress node IP addresses required for this transmission from the existing transmission node set. Then, based on the transmission node IP addresses and egress node IP addresses, plan multiple paths, the nodes on each path, and the IP address of the next-hop transmission node.

[0014] Step 1.2: Based on the IP address of the next-hop transmission node, each transmission node establishes a TCP connection with its corresponding IP address through a socket, forming a multipath communication network including an ingress node, multiple transmission nodes, and an egress node;

[0015] In step 1.3, if the original data obtained meets the preset conditions, the entry node will segment the original data according to the predefined protocol rules to obtain multiple data segments.

[0016] Preferably, step 2 is specifically implemented according to the following steps:

[0017] Step 2.1, the entry node generates an AES key, and encrypts the payload based on the AES key to obtain a ciphertext;

[0018] Step 2.2: Obtain the RSA public key of the exit node, and encrypt the AES key based on the RSA public key to obtain an encrypted AES key;

[0019] In step 2.3, the entry node generates an encrypted data segment including a custom header field based on the ciphertext and the encrypted AES key; the entry node then adds the custom header field to the encrypted data segment to obtain a custom message;

[0020] Step 2.4: Use a protocol camouflage module to camouflage the custom message to generate a camouflaged message.

[0021] Preferably, the step 2.4 is specifically implemented according to the following steps:

[0022] Step 2.4.1: Set the protocol library set of the protocol masquerade module;

[0023] Step 2.4.2: Set the available transmission path set consisting of the transmission nodes selected for this transmission task;

[0024] Step 2.4.3: For any transmission, assume that the entry node divides the data into multiple parts, and each part of the data is mapped to one of the available transmission paths p j , expressed as the following formula:

[0025]

[0026] In the above formula: D represents the data set, d x represents the data after the xth partition, where x∈{1≤x≤k}, k is the total number of data partitions;

[0027] Step 2.4.4: The protocol masquerade module selects a protocol s randomly or strategically from the protocol library set. i Encapsulate and form a mapping relationship: construct a mapping function based on the mapping relationship;

[0028] The mapping function is expressed as follows:

[0029] f:p j →s i,s i ∈S

[0030] In the above formula, f is the mapping function from path to protocol, and S is the protocol library set;

[0031] Step 2.4.5: Based on the mapping function, when each of the available transmission paths is to send data, the ingress node will i For custom message M j Perform protocol camouflage to obtain the message M' after protocol camouflage j , expressed as the following formula:

[0032] M′ j =Encapsulate(s i ,M j )

[0033] In the above formula, Encapsulate(s i ,M j ) means to convert M j Encapsulated as protocol i The payload is converted into a message after protocol disguise;

[0034] Step 2.4.6: After performing protocol camouflage on all data in dataset D that are mapped to different paths, the camouflaged message set M' is obtained at the ingress node, which can be expressed as follows:

[0035] M'={M'1,M'2,…,M' k}

[0036] In the above formula, each element in M' represents a disguised message formed by data after being disguised by the protocol, and k represents the number of disguised messages in the set.

[0037] Preferably, the step 3, using the ingress node to forward the rate camouflage message to the multipath communication network in parallel through multiple communication paths on each of the paths, includes:

[0038] Step 3.2.1: Set the time interval threshold of a transmission to Latency. If it is necessary to send the n+1th rate disguised message M' n+1 , then the time after the nth message is sent is T n , the time before the n+1th message is sent is T n+1 ;

[0039] Step 3.2.2: If T n+1 -T n If the time interval is less than the Latency threshold, the thread of the transmission is made to wait for Latency-Tn+1 +T n Send message M' after n+1 ;

[0040] Step 3.2.3: If T n+1 -T n If the latency is greater than or equal to the latency threshold, the message M' is sent to the selected path. n+1 , and send to the path A fill message of the same protocol is sent to other paths The method further comprises sending padding packets of the same protocol to balance the sending rate of each path.

[0041] Preferably, step 4 is specifically implemented according to the following steps:

[0042] In step 4.1, after the ingress node sends the rate masquerading message, each transit node will continue to receive the rate masquerading message sent from the previous hop. If the previous hop has sent all the rate masquerading messages, the process proceeds to step 4.6. If the rate masquerading messages have not been sent, the process proceeds to step 4.2.

[0043] Step 4.2: After receiving the rate camouflage message, the transmission node reads the entire rate camouflage message based on the rules set by the protocol camouflage module, then forwards the rate camouflage message in its entirety to the next hop and returns to step 4.1 to continue processing;

[0044] In step 4.3, when the rate camouflaged message is sent to the egress node, the egress node reads the entire message based on the size field in the camouflage protocol header; then, based on the camouflage protocol rules of the protocol camouflage module used in the rate camouflage message, the egress node separates the payload data from the rate camouflage message to obtain a de-camouflaged message;

[0045] In step 4.4, after receiving the de-obfuscated message, the egress node decrypts the encrypted AES key field in the de-obfuscated message using its own RSA private key to obtain the plaintext AES key. The egress node then decrypts the encrypted payload using the plaintext AES key to recover the original plaintext data segment.

[0046] In step 4.5, after the exit node obtains the plaintext data segment, it verifies the validity of the decrypted data based on the original data length field in the payload data header, and finally obtains multiple data segments, and then jumps to step 4.1.

[0047] Preferably, step 5 is specifically implemented according to the following steps:

[0048] Step 5.1: The egress node receives data in a multi-threaded manner. All threads receiving data from different paths share an expected sequence number field, which is used to indicate the sequence number of the data segment that the receiver should receive next. The initial value of the data segment is set to 0.

[0049] In step 5.2, after the egress node receives multiple data segments in step 4, if the sequence number of the data segment does not match the expected sequence number field, the thread will be blocked until a matching sequence number data segment is received and correctly forwarded, and execution will resume; if the sequence number of the data segment matches the expected sequence number field, the thread will immediately resume and send the data segment.

[0050] Preferably, the step 5.2 is specifically implemented according to the following steps:

[0051] Step 5.2.1: The egress node receives data from different paths in a multi-threaded manner;

[0052] Step 5.2.2: Each thread of the exit node reads data from the corresponding socket and decapsulates it;

[0053] Step 5.2.3: Each thread of the exit node competes for the mutex lock;

[0054] Step 5.2.4: After acquiring the mutex lock, determine whether the expected sequence number is consistent with the sequence number of the current data segment;

[0055] Step 5.2.5: If the sequence numbers are inconsistent, release the mutex lock; determine that the thread is blocked, wake up when the expected sequence number changes, and jump to step 5.2.3;

[0056] Step 5.2.6: If the sequence numbers are consistent, forward the data segment to the receiving server, correct the expected sequence number to the expected sequence number + 1, and wake up the thread blocked in step 5.2.5;

[0057] Step 5.2.7: Release the mutex lock and jump to step 5.2.2.

[0058] Beneficial effects:

[0059] In the multipath transmission camouflage system based on protocol and sending rate designed by the present invention, after all nodes are started, the entry node will fragment and encapsulate the data after receiving the data from the sender, and adopt strategies such as protocol, sending rate camouflage and multipath transmission to make the communication process more secure and privacy-protected.

[0060] This method combines multipath transmission with a differentiated protocol camouflage strategy, preventing attackers from inferring the complete communication relationship based solely on metadata from a single path. Traffic from the same transmission task is forwarded to the target server via different protocols. This not only increases traffic diversity, making it difficult to capture signatures, but also increases the time series complexity of the traffic, thereby improving anti-detection capabilities.

[0061] This method enhances traffic concealment. Data on different paths is not only disguised using different protocols but also modulated at the same time, effectively disrupting traffic pattern analysis and making it difficult for attackers to extract stable communication signatures. Compared to traditional multi-path communication schemes, this method is more suitable for concealed communication scenarios and significantly reduces the risk of identification and blocking. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 The general tasks that each node needs to perform in the data multipath transmission camouflage method based on protocol and transmission rate of the present invention;

[0063] Figure 2 A network topology diagram of a data multipath transmission camouflage method based on protocol and transmission rate of the present invention;

[0064] Figure 3 A flow chart of data processing by an ingress node in a data multipath transmission camouflage method based on protocol and transmission rate of the present invention;

[0065] Figure 4 A flow chart of data processing by an egress node in a data multipath transmission camouflage method based on protocol and transmission rate according to the present invention;

[0066] Figure 5 The present invention provides a protocol format of a message in a data multipath transmission camouflage method based on protocol and transmission rate;

[0067] Figure 6 A diagram showing the results of traffic analysis using Wireshark when the protocol and transmission rate-based data multipath transmission camouflage method of the present invention is not using protocol camouflage;

[0068] Figure 7 Figure 1 shows the results of traffic analysis using Wireshark after adopting protocol camouflage (taking HTTPS camouflage as an example) in a data multipath transmission camouflage method based on protocol and transmission rate according to the present invention;

[0069] Figure 8 A diagram showing the result of using Wireshark to analyze disguised traffic in a data multipath transmission disguise method based on protocol and transmission rate of the present invention. DETAILED DESCRIPTION

[0070] The following will clearly and completely describe the technical solutions of the present invention in the embodiments of the present invention in conjunction with the drawings of the present invention in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0071] Example 1

[0072] like Figure 1-8 The present invention discloses a data multipath transmission camouflage method based on protocol and transmission rate, such as Figure 3 As shown, please follow the steps below:

[0073] Step 1: Based on the obtained multiple paths, a Transmission Control Protocol (TCP) connection is established between nodes on each path through a socket to construct a multipath communication network including an entry node, multiple transmission nodes, and an exit node; based on the obtained original data, the entry node segments the original data according to a predefined protocol rule to obtain multiple data segments;

[0074] In the above, multiple paths to be taken for this transmission are obtained, and then TCP connections are established between nodes on each path through sockets to build a multipath communication network including an entry node, multiple transmission nodes, and an exit node. The entry node in the communication network is deployed on the user side and acts as an agent responsible for initial data processing and forwarding strategy formulation. The transmission nodes and exit nodes in the communication network are deployed in the cloud and are responsible for receiving and forwarding data. Subsequently, the entry node obtains the original data sent by the sender and, based on the original data, segments it according to predefined protocol rules to obtain multiple data segments.

[0075] Step 2: Based on the multiple data segments, obtain payloads of the multiple data segments; encrypt the payloads to obtain encrypted data segments; and disguise the encrypted data segments using a protocol camouflage module to obtain camouflaged messages;

[0076] As described above, after the ingress node obtains multiple data segments, it adds a custom protocol header field based on the data segments to identify the structure of the data segments and transmission control information. Subsequently, the payload of the data segments is encrypted to obtain encrypted data segments to enhance the confidentiality and anti-analysis capabilities of the data. Finally, a protocol camouflage module is introduced to camouflage the encrypted data to obtain a camouflaged message with differentiated protocol characteristics.

[0077] Step 3: Based on the disguised message, disguise the transmission rate of the disguised message to obtain a rate disguised message; use the ingress node to forward the rate disguised message in parallel to the multipath communication network through multiple communication paths on each of the paths;

[0078] As described above, after the ingress node obtains the disguised message with differentiated protocol characteristics, it disguises the transmission rate of the disguised message so that the data flow behaves in accordance with the expected characteristics during transmission. Based on the rate disguised message, the ingress node randomly sends the rate disguised message through multiple communication paths, achieving parallel forwarding on each path.

[0079] Step 4: The plurality of transmission nodes in the multipath communication network transmit the rate camouflage message to the egress node; the egress node decapsulates and verifies the rate camouflage message to obtain the plurality of data segments;

[0080] The ingress node sends the rate camouflaged message to the multipath communication network. The rate camouflaged messages forwarded through different paths all have their own message protocol characteristics. The multiple transmission nodes forward the rate camouflaged message to the next-hop transmission node of the transmission node based on the message protocol characteristics and content consistency until it is sent to the egress node. When the rate camouflaged message arrives at the egress node, the egress node parses the rate camouflaged message to obtain a de-camouflaged message. The de-camouflaged message is decapsulated and verified to obtain the multiple data segments.

[0081] Step 5: Based on the multiple data segments in step 4, obtain the sequence numbers of the multiple data segments; the egress node sends the multiple data segments to the receiving server according to their own sequence numbers;

[0082] After the egress node obtains the data segments in step 4, it will send the data segments to the receiving server in sequence based on the sequence numbers of the data segments, thus achieving an end-to-end data transmission closed loop;

[0083] Step 6: swap the egress node with the ingress node, and then return to step 1 to continue.

[0084] When the receiving server receives the sender's complete request, it generates a response message. At this time, the exit node and the entry node exchange roles, with the exit node acting as the new sender and the entry node acting as the final receiving server. The response data will undergo the same protocol camouflage and multi-path transmission process (steps 1-5) as the forward transmission at the exit node to ensure communication consistency and maintain camouflage characteristics and anti-analysis capabilities, thereby making the overall communication process bidirectionally symmetrical.

[0085] The above-mentioned step 1 is specifically implemented according to the following steps:

[0086] Step 1.1, during the transmission initialization phase, select the number of transmission nodes, transmission node IP addresses, egress nodes, and egress node IP addresses required for this transmission from the existing transmission node set. Then, based on the transmission node IP addresses and egress node IP addresses, plan multiple paths, the nodes on each path, and the IP address of the next-hop transmission node.

[0087] If the number of paths is n, then at least n transmission nodes must be selected to build a multipath communication network;

[0088] Step 1.2: Based on the IP address of the next-hop transmission node, each transmission node establishes a TCP connection with its corresponding IP address through a socket, forming a multipath communication network including an ingress node, multiple transmission nodes, and an egress node;

[0089] After planning multiple paths, each transmission node establishes a TCP connection with the corresponding IP address of the next-hop transmission node via a socket, forming a multipath communication network consisting of an entry node, multiple transmission nodes, and an exit node. This multipath communication network enables multipath transmission of data, preventing the complete path and data from being fully controlled by a single node, thereby improving the anonymity and security of the system.

[0090] In step 1.3, if the original data obtained meets the preset conditions, the entry node will segment the original data according to the predefined protocol rules to obtain multiple data segments.

[0091] After the multipath communication network is built, the entry node reads the client's data according to the preset size or random size to obtain data shards;

[0092] The preconditions mentioned above are that the original data meets the protocol requirements or the predetermined size standard. If the data received by the ingress node does not meet the protocol requirements or the predetermined size standard, data padding can be performed until the original data meets the protocol requirements or the predetermined size standard. The padding data is random data generated based on the payload of the actual protocol request.

[0093] The above-mentioned step 2 is specifically implemented according to the following steps:

[0094] Step 2.1: The entry node generates an AES key and encrypts the payload based on the AES key to obtain a ciphertext; the size of the ciphertext is 24 bytes larger than the original size;

[0095] Step 2.2: After the population node obtains the ciphertext, it obtains the RSA public key of the exit node, encrypts the AES key based on the RSA public key, and obtains the encrypted AES key;

[0096] In step 2.3, the entry node generates an encrypted data segment containing a custom header field based on the ciphertext and the encrypted AES key; the entry node then adds a custom header field to the encrypted data segment, with a total length of 310 bytes, to obtain a custom message; wherein, the header field includes: package size (4 bytes), encrypted AES key (256 bytes), task identification number (36 bytes), serial number (4 bytes), original data length (4 bytes), and encrypted data length (4 bytes). The size of the encrypted data payload is the original data size + 24 bytes. Therefore, the total size of the entire message is the original data size plus 332 bytes;

[0097] The specific meanings and functions of the custom header fields in step 2.3 are as follows:

[0098] Package size: indicates the total size of this custom message, which is used by each node to read the complete custom message;

[0099] Encrypted AES key: The symmetric key used to encrypt the payload, encrypted using the exit node's RSA public key.

[0100] Task identification number: used to identify each transmission path for performing different tasks. That is, each time a transmission task is registered and n paths are planned, a unique identification number will be generated for each path. Each node will accurately forward the data from the previous hop to the next hop based on this field;

[0101] Sequence number: used to identify the offset position of the data carried by the custom message in the complete data. The egress node will deliver the data of each path in sequence based on this;

[0102] Original data length: The exit node will verify the decrypted payload data based on this field;

[0103] Encrypted data length: The exit node will intercept the encrypted payload data based on this field.

[0104] In step 2.4, a protocol camouflage module is used to camouflage the user-defined message, ensuring that the camouflaged message complies with predetermined protocol features and transmission specifications, and generating a camouflaged message with differentiated protocol features that can be sent.

[0105] The above-mentioned step 2.4 is specifically implemented according to the following steps:

[0106] Step 2.4.1: Set the protocol library set of the protocol masquerade module;

[0107] The protocol library set expression S is: S={s1,s2,…,s n}, where s i Represents the i-th communication protocol type used for masquerading, such as HTTP, HTTPS, TLS, DNS, etc., but not limited to this set; where i∈{1≤i≤n}, n is the total number of communication protocol types used for masquerading.

[0108] Step 2.4.2: Set the available transmission path set consisting of the transmission nodes selected for this transmission task;

[0109] The set of available transmission paths is P:p j ={p1,p2,…,p m}, where p j represents the jth available transmission path, where j∈{1≤j≤m}, and m is the total number of optional transmission paths in this task.

[0110] Step 2.4.3: For any transmission, assume that the entry node divides the data into k parts, each data d j are respectively mapped to one of the available transmission paths p j , expressed as the following formula:

[0111]

[0112] In the above formula: D represents the data set, d x Represents the data after the xth partition, where x∈{1≤x≤k}, k is the total number of data parts.

[0113] Step 2.4.4: For available transmission path p j , the protocol masquerading module selects protocol s randomly or strategically from S i Encapsulate and form a mapping relationship: construct a mapping function based on the mapping relationship;

[0114] The mapping function is expressed as follows:

[0115] f:p j →s i ,s i ∈S

[0116] In the above formula, f is the mapping function from path to protocol. The protocol selection can be based on randomness, traffic feature matching, or specific policy decisions, and different transmission tasks select different paths and protocols.

[0117] Step 2.4.5: Based on the mapping function, on each available transmission path p j When sending data, the entry node will use the available transmission path pj Corresponding protocols i For custom message M j Perform protocol camouflage, the custom message content is used as the selected protocol s i The payload is obtained by disguising the protocol as message M' j , expressed as the following formula:

[0118] M′ j =Encapsulate(s i ,M j )

[0119] In the above formula, Encapsulate(s i ,M j ) means to convert M j Encapsulated as protocol i Payload, forming a message after protocol disguise.

[0120] Step 2.4.6: After performing protocol camouflage on all data in dataset D that are mapped to different paths, a set M' of camouflaged packets with differentiated protocol characteristics is obtained at the ingress node, which can be expressed as follows:

[0121] M'={M'1,M'2,…,M' k}

[0122] In the above formula, each element in M' represents a disguised message formed by data after being disguised by the protocol, and k represents the number of disguised messages in the set.

[0123] After the ingress node obtains the disguised message set M' with differentiated protocol characteristics, it will transmit the messages in the disguised message set in parallel based on the path p. Each message M'j is sent on the path pj according to its corresponding disguised protocol si. The disguised message M' with differentiated protocol characteristics is sent at the ingress node. j Previously, a sending rate camouflage module was introduced, based on which the sending rate of the message would be disguised;

[0124] The step 3, using the ingress node to forward the rate camouflage message in parallel to the multipath communication network through multiple communication paths on each of the paths, includes:

[0125] Step 3.2.1: Set the time interval threshold of a transmission to Latency. If it is necessary to send the n+1th rate disguised message M' n+1 , then the time after the nth message is sent is T n , the time before the n+1th message is sent is T n+1 ;

[0126] Step 3.2.2: If T n+1 -T n If the time interval is less than the Latency threshold, the thread of the transmission is made to wait for Latency-T n+1 +T n Send message M' after n+1 ;

[0127] Step 3.2.3: If T n+1 -T n If the latency is greater than or equal to the latency threshold, the message M' is sent to the selected path. n+1 , and send to the path A fill message of the same protocol is sent to other paths The same protocol is used to fill packets to balance the sending rate of each path.

[0128] The above-mentioned step 4 is specifically implemented according to the following steps:

[0129] In step 4.1, after the ingress node sends the rate masquerading message, each transit node will continue to receive the rate masquerading message sent from the previous hop. If the previous hop has sent all the rate masquerading messages, the process proceeds to step 4.6. If the rate masquerading messages have not been sent, the process proceeds to step 4.2.

[0130] Step 4.2: After receiving the rate camouflage message, the transmission node reads the entire rate camouflage message based on the rules set by the protocol camouflage module, then forwards the rate camouflage message in its entirety to the next hop and returns to step 4.1 to continue processing;

[0131] In step 4.3, when the rate camouflaged message is sent to the egress node, the egress node reads the entire message based on the size field in the camouflage protocol header. Subsequently, based on the camouflage protocol rules used by the rate camouflage message, the egress node separates the payload data from the rate camouflage message to obtain the de-camouflaged message.

[0132] In step 4.4, after receiving the de-obfuscated message, the egress node decrypts the encrypted AES key field in the de-obfuscated message using its own RSA private key to obtain the plaintext AES key. It then decrypts the encrypted payload using the plaintext AES key to recover the original plaintext data segment.

[0133] In step 4.5, after the exit node obtains the plaintext data segment, it verifies the validity of the decrypted data based on the original data length field in the payload data header, and finally obtains multiple data segments, and then jumps to step 4.1.

[0134] The above-mentioned step 5 is specifically implemented according to the following steps:

[0135] Step 5.1: The egress node receives data in a multi-threaded manner. All threads receiving data from different paths share an expected sequence number field, which is used to indicate the sequence number of the data segment that the receiver should receive next. The initial value of the data segment is set to 0.

[0136] In step 5.2, after the egress node receives multiple data segments in step 4, if the sequence number of the data segment does not match the expected sequence number field, the thread will be blocked until a matching sequence number data segment is received and correctly forwarded, and execution will resume; if the sequence number of the data segment matches the expected sequence number field, the thread will immediately resume and send the data segment.

[0137] The above-mentioned step 5.2 is specifically implemented according to the following steps:

[0138] Step 5.2.1: The egress node uses a multi-threaded approach to receive data from different paths;

[0139] Step 5.2.2: Each thread of the exit node reads data from the corresponding socket and decapsulates it;

[0140] Step 5.2.3: Each thread of the exit node competes for the mutex lock;

[0141] Step 5.2.4: After acquiring the mutex lock, determine whether the expected sequence number is consistent with the sequence number of the current data segment;

[0142] Step 5.2.5: If the sequence numbers are inconsistent, release the mutex lock; determine that the thread is blocked, wake up when the expected sequence number changes, and jump to step 5.2.3;

[0143] Step 5.2.6: If the sequence numbers are consistent, forward the data segment to the receiving server, correct the expected sequence number to the expected sequence number + 1, and wake up the thread blocked in step 5.2.5;

[0144] Step 5.2.7: Release the mutex lock and jump to step 5.2.2.

[0145] The method of the present invention divides the data of a session into multiple fragments and disguises them as different protocols for transmission, thereby ensuring the confidentiality of the data during transmission. In addition, the present invention forwards the disguised datagrams in parallel through multiple paths, thereby improving the security of user privacy in network transmission and ensuring that the recipient can receive the data correctly and in an orderly manner. In order to enhance the confidentiality of communication traffic, the present method introduces a hybrid encryption scheme and designs a traffic rate camouflage strategy, further improving the ability to resist correlation attacks, man-in-the-middle attacks, and traffic analysis attacks. Overall, the present invention can ensure that both parties communicate securely and efficiently in a complex network environment.

[0146] In the multipath transmission camouflage system designed by this invention, based on protocols and transmission rates, after all nodes are started, the entry node will fragment and encapsulate the data after receiving the sender's data. It also adopts strategies such as protocol and transmission rate camouflage and multipath transmission to enhance the security and privacy protection capabilities of the communication process. Compared with existing technologies, this invention has the following advantages:

[0147] Existing technologies for network covert communication and user privacy protection are mainly divided into three categories: covert transmission methods based on traffic protocol camouflage, split transmission schemes based on multiplexing protocols, and covert transmission methods based on traffic shaping;

[0148] Current mainstream traffic protocol camouflage technologies (such as Shadowsocks, Obfsproxy, and Meek) mainly disguise traffic at the protocol layer, making it appear as ordinary HTTPS or WebSocket traffic. Although such methods can disrupt protocol fingerprint characteristics, they usually adopt a fixed protocol camouflage strategy throughout the communication process, so that the traffic maintains stable statistical characteristics for a long time, making it easy to be detected by traffic analysis tools. In contrast, this solution combines multi-path transmission with differentiated protocol camouflage strategies, making it impossible for attackers to deduce the complete communication relationship through the metadata of a single path alone. Traffic of the same transmission task is forwarded to the target server via different protocols, which not only enhances the diversity of traffic and makes it difficult to capture characteristics, but also increases the complexity of the time series of traffic, thereby improving anti-detection capabilities.

[0149] Multipath communication improves bandwidth utilization and enhances anti-blocking capabilities by transmitting data in parallel over different paths. However, the core goal of existing multipath communication technologies is primarily to optimize transmission efficiency, not traffic concealment. Most current research focuses on the network and transport layers, resulting in a fixed distribution of data packets across different paths or adjustments based on network congestion, which easily leads to recognizable traffic patterns. Furthermore, existing multipath communication schemes often lack protocol-layer camouflage, limiting their ability to counter active probing and deep traffic inspection. In contrast, this method implements a multipath transmission mechanism at the application layer that combines protocol camouflage with transmission rate camouflage, further enhancing traffic concealment. Data on different paths is not only disguised using different protocols, but the transmission rate is also modulated, effectively disrupting traffic pattern analysis and making it difficult for attackers to extract stable communication features. Compared to traditional multipath communication schemes, this method is more suitable for stealthy communication scenarios and can significantly reduce the risk of identification and blocking.

[0150] Traditional transmission rate camouflage technologies mainly rely on traffic filling or rate adjustment to make the traffic transmission pattern close to normal communication. However, traffic filling often brings large bandwidth overhead, while simple rate adjustment tends to form stable rate characteristics, which may still be exposed in long-term traffic analysis. In addition, existing methods usually only perform rate camouflage on a single path and lack adaptability to multi-path environments, resulting in limited defense capabilities under global traffic analysis. In contrast, this method designs a rate camouflage mechanism for multi-path transmission. By dynamically adjusting the data sending timing, it achieves fine-grained rate camouflage, and combines it with protocol camouflage technology to make it difficult for attackers to infer communication behavior through traffic pattern analysis. This mechanism makes the traffic patterns on different paths present more complex time characteristics, avoiding the periodicity or fixed patterns that may be introduced by traditional rate adjustment methods, thereby significantly improving the ability to resist traffic analysis.

[0151] In response to the above vulnerabilities, the present invention proposes a multi-path transmission scheme based on protocol camouflage and rate camouflage. Its main technical innovations include: (1) Multi-path differentiated protocol camouflage mechanism, which randomizes port features at the transport layer and injects mimic handshake messages at the application layer, so that each path traffic presents different protocol fingerprints. The same session traffic is transmitted to the destination through different protocols and different paths, effectively blocking the association analysis based on protocol fingerprints; (2) Multi-path dynamic rate camouflage mechanism: This mechanism breaks through the limitations of traditional single-path traffic shaping technology and dynamically controls the message sending rate of each transmission path by establishing a rate camouflage module. The present invention proposes a multi-path data transmission method based on protocol and sending rate camouflage for the first time, deeply integrating protocol camouflage and sending rate camouflage into the multi-path transmission architecture. By blinding the communication features in multiple dimensions, the present solution effectively solves the security contradiction between encrypted content and traffic feature leakage, and avoids the limitations of relying solely on traffic camouflage or encryption technology. Compared with traditional solutions, the present invention significantly enhances the ability to resist traffic analysis attacks and also provides a new idea and method for network security and privacy protection.

[0152] In summary, this method achieves highly concealed data transmission by combining protocol camouflage with multi-path transmission. Data is fragmented and disguised as different protocols before transmission, forwarding it to the target server via multiple paths, enhancing its anti-detection capabilities. Furthermore, the introduction of a hybrid encryption scheme and rate camouflage strategy effectively protects against correlation attacks, man-in-the-middle attacks, and traffic analysis attacks, while ensuring accurate data recovery at the receiver. This makes communication more secure and difficult to track in complex network environments.

[0153] A specific example of the method of the present invention is as follows:

[0154] Corresponding to step 1, multiple communication paths are selected in a transmission task, and the entry node segments the sender's traffic according to the preset rules, and fills the data segments with insufficient size; Figure 2 The number of paths, n, in this experiment is 3, representing a communication network consisting of 8 nodes across 3 paths. In this network, all client requests and server responses are transmitted using the same method. The parameters set for this experiment include a data segment size of 3000 bytes and a latency threshold of 50ms. After receiving data from the client, the entry node segments the data and pads each segment to 3000 bytes.

[0155] Corresponding to step 2, add header information to all data segments and encrypt the payload part to form a packaged message; add header fields to all data segments and encrypt the data part to form a message. The specific added content includes: package size (4 bytes), encrypted AES key (256 bytes), task identification number (36 bytes), serial number (4 bytes), original data length (4 bytes), and encrypted data length (4 bytes). The message size generated is 3332 bytes. Taking the sending of a certain message as an example, assuming that the sending selection of this message is Figure 2 Path 1 is used as the sending path, and the protocol mapped by this path is HTTPS. This part of the message is used as the payload of the HTTPS protocol. The disguised process is referred to in step 2.4. The disguised message has the fingerprint characteristics of the HTTPS protocol. At the same time, path 2 and path 3 will use different protocols to disguise and send other data message fragments. The specific format of the generated disguised datagram is as follows: Figure 5 shown.

[0156] Corresponding to step 3, if the ingress node has completed steps 1 and 2, before the ingress node forwards the message on multipath, it will disguise the sending rate based on the intervals between two adjacent sending. The specific process is as follows: Figure 3 As shown. Each time data is sent, the time interval TimeGap is calculated from the last data sent, and it is determined whether this interval reaches the set threshold Latency (Latency is 50ms). If TimeGap is in the interval [0,50], the data is sent after 50-TimeGap; if TimeGap is in the interval (50,100), the data is sent directly; if TimeGap is in the interval (100,x], the data is sent to each path at the same time as the data is sent. Invalid message of the same protocol.

[0157] Corresponding to step 4, when the intermediate node receives the message, it directly forwards it to the next hop. When the egress node receives the message, it parses the protocol data according to the protocol rules and then decapsulates it into plaintext data segments.

[0158] Corresponding to step 5, after obtaining the plaintext data segments, the exit node will send these data segments to the receiver in order according to the sequence number field in the message header, and wait for the receiver's response data; when the exit node sends data to the receiver, it will send the data segments in order from small to large according to the sequence number. The specific process of steps 4 and 5 is as follows Figure 4 shown.

[0159] Corresponding to step 6, the receiver's response data to the request is transmitted in the same manner. In this case, the server is the sender and the client is the receiver. The above experimental steps only illustrate the process of the client request data reaching the server. The server then generates the response data and needs to send it to the client. At this time, the response data is transmitted through the same path and method. Once all the response data is transmitted, the transmission task is complete.

[0160] Start the entry node, transmission node and exit node, configure the browser proxy port to the port that the entry node listens to, and then visit www.baidu.com. Each node will run according to the above steps, and the operation log of each node will be output to the terminal during the operation. First, turn off the protocol camouflage module, capture the node traffic through Tcpdump during the website access, and analyze it through Wireshark. The results are as follows Figure 6 As shown in the figure, we can see that all traffic without disguise is TCP protocol. Then start the protocol disguise module, re-run the node to access the website, and capture the data packets of the node on path 1 (the path uses HTTPS disguise). The results of Wireshark analysis are as follows: Figure 7 As shown in the figure, we can see that the node performs a TLS handshake before transmitting data, and then the protocol of the transmitted data is displayed as TLS, and the data part is encrypted. In order to further verify whether it is disguised as HTTPS, the TLS protocol is parsed using the protocol parsing function of Wireshark: the TLS private key of the previous hop of the node is imported into Wireshark to parse these data packets. The parsed results are as follows Figure 8 As shown, you can see that the displayed protocols include HTTP and TLS, and the transmitted data has become plain text.

[0161] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A data multipath transmission camouflage method based on protocol and transmission rate, characterized in that: Including the following steps: Step 1: Based on the obtained multiple paths, a Transmission Control Protocol (TCP) connection is established between nodes on each path through a socket to construct a multipath communication network including an entry node, multiple transmission nodes, and an exit node. Based on the acquired original data, the entry node segments the original data according to a predefined protocol rule to obtain a plurality of data segments; Step 2: obtaining payloads of the plurality of data segments based on the plurality of data segments; encrypting the payload to obtain an encrypted data segment; Disguise the encrypted data segment using a protocol camouflage module to obtain a camouflaged message; Step 3: Based on the disguised message, disguise the transmission rate of the disguised message to obtain a rate disguised message; use the ingress node to forward the rate disguised message in parallel to the multipath communication network through multiple communication paths on each of the paths; Step 4: the plurality of transmission nodes in the multipath communication network send the rate camouflage message to the egress node; The egress node decapsulates and verifies the rate camouflage message to obtain a plurality of data segments; Step 5: Based on the multiple data segments in step 4, obtain the serial numbers of the multiple data segments; The egress node sends the plurality of data segments to the receiving server according to their own sequence numbers; Step 6: swap the egress node with the ingress node, and then return to step 1 to continue.

2. The method according to claim 1, characterized in that The step 1 is specifically implemented according to the following steps: Step 1.1, during the transmission initialization phase, select the number of transmission nodes, transmission node IP addresses, egress nodes, and egress node IP addresses required for this transmission from the existing transmission node set. Then, based on the transmission node IP addresses and egress node IP addresses, plan multiple paths, the nodes on each path, and the IP address of the next-hop transmission node. Step 1.2: Based on the IP address of the next-hop transmission node, each transmission node establishes a TCP connection with its corresponding IP address through a socket, forming a multipath communication network including an ingress node, multiple transmission nodes, and an egress node; In step 1.3, if the original data obtained meets the preset conditions, the entry node will segment the original data according to the predefined protocol rules to obtain multiple data segments.

3. The method according to claim 1, characterized in that The step 2 is specifically implemented according to the following steps: Step 2.1, the entry node generates an AES key, and encrypts the payload based on the AES key to obtain a ciphertext; Step 2.2: Obtain the RSA public key of the exit node, and encrypt the AES key based on the RSA public key to obtain an encrypted AES key; In step 2.3, the entry node generates an encrypted data segment including a custom header field based on the ciphertext and the encrypted AES key; the entry node then adds the custom header field to the encrypted data segment to obtain a custom message; Step 2.4: Use a protocol camouflage module to camouflage the custom message to generate a camouflaged message.

4. The method according to claim 3, characterized in that The step 2.4 is specifically implemented according to the following steps: Step 2.4.1: Set the protocol library set of the protocol masquerade module; Step 2.4.2: Set the available transmission path set consisting of the transmission nodes selected for this transmission task; Step 2.4.3: For any transmission, assume that the entry node divides the data into multiple parts, and each part of the data is mapped to one of the available transmission paths p j , expressed as the following formula: In the above formula: D represents the data set, d x represents the data after the xth partition, where x∈{1≤x≤k}, k is the total number of data partitions; Step 2.4.4: The protocol masquerade module selects a protocol s randomly or strategically from the protocol library set. i Encapsulate and form a mapping relationship: construct a mapping function based on the mapping relationship; The mapping function is expressed as follows: f:p j →s i ,s i ∈S In the above formula, f is the mapping function from path to protocol, and S is the protocol library set; Step 2.4.5: Based on the mapping function, when each of the available transmission paths is to send data, the ingress node will i For custom message M j Perform protocol camouflage to obtain the message M′ after protocol camouflage j , expressed as the following formula: M′ j =Encapsulate(s i ,M j ) In the above formula, Encapsulate(s i ,M j ) means to convert M j Encapsulated as protocol i The payload is converted into a message after protocol disguise; Step 2.4.6: After performing protocol camouflage on all data in dataset D that are mapped to different paths, the camouflaged message set M' is obtained at the ingress node, which can be expressed as follows: M'={M'1,M'2,…,M' k } In the above formula, each element in M' represents a disguised message formed by data after being disguised by the protocol, and k represents the number of disguised messages in the set.

5. The method according to claim 1, wherein The step 3, using the ingress node to forward the rate camouflage message in parallel to the multipath communication network through multiple communication paths on each of the paths, includes: Step 3.2.1: Set the time interval threshold of a transmission as Latency. If it is necessary to send the n+1th rate disguised message M′ n+1 , then the time after the nth message is sent is T n , the time before the n+1th message is sent is T n+1 ; Step 3.2.2: If T n+1 -T N If the time interval is less than the Latency threshold, the thread of the transmission is made to wait for Latency-T n+1 +T n Send message M' after time n+1 ; Step 3.2.3: If T n+1 -T n If the latency is greater than or equal to the latency threshold, the message M' is sent to the selected path. n+1 , and send to the path A fill message of the same protocol is sent to other paths The method further comprises sending padding packets of the same protocol to balance the sending rate of each path.

6. The method according to claim 3, characterized in that The step 4 is specifically implemented according to the following steps: Step 4.1: After the ingress node sends the rate masquerading message, each transit node will continue to receive the rate masquerading message sent from the previous hop; If the previous hop has sent all the rate masquerading messages, jump to step 4.6; if the rate masquerading messages have not been sent, go to step 4.2; Step 4.2: After receiving the rate camouflage message, the transmission node reads the entire rate camouflage message based on the rules set by the protocol camouflage module, then forwards the rate camouflage message in its entirety to the next hop and returns to step 4.1 to continue processing; Step 4.3, when the rate masquerading message is sent to the egress node, the egress node reads the entire message based on the size field in the masquerading protocol header; Subsequently, based on the camouflage protocol rule of the protocol camouflage module used by the rate camouflage message, the egress node separates the payload data from the rate camouflage message to obtain a de-camouflaged message; In step 4.4, after receiving the de-obfuscated message, the egress node decrypts the encrypted AES key field in the de-obfuscated message using its own RSA private key to obtain the plaintext AES key. The egress node then decrypts the encrypted payload using the plaintext AES key to recover the original plaintext data segment. In step 4.5, after the exit node obtains the plaintext data segment, it verifies the validity of the decrypted data based on the original data length field in the payload data header, and finally obtains multiple data segments, and then jumps to step 4.

1.

7. The method according to claim 1, characterized in that The step 5 is specifically implemented according to the following steps: Step 5.1: The egress node receives data in a multi-threaded manner. All threads receiving data from different paths share an expected sequence number field, which is used to indicate the sequence number of the data segment that the receiver should receive next. The initial value of the data segment is set to 0. In step 5.2, after the egress node receives multiple data segments in step 4, if the sequence number of the data segment does not match the expected sequence number field, the thread will be blocked until a matching sequence number data segment is received and correctly forwarded, and execution will resume; if the sequence number of the data segment matches the expected sequence number field, the thread will immediately resume and send the data segment.

8. The method according to claim 7, characterized in that The step 5.2 is specifically implemented according to the following steps: Step 5.2.1: The egress node receives data from different paths in a multi-threaded manner; Step 5.2.2: Each thread of the exit node reads data from the corresponding socket and decapsulates it; Step 5.2.3: Each thread of the exit node competes for the mutex lock; Step 5.2.4: After acquiring the mutex lock, determine whether the expected sequence number is consistent with the sequence number of the current data segment; Step 5.2.5: If the sequence numbers are inconsistent, release the mutex lock; Determine if the thread is blocked, wake up when the expected sequence number changes, and jump to step 5.2.3; Step 5.2.6: If the sequence numbers are consistent, forward the data segment to the receiving server, correct the expected sequence number to the expected sequence number + 1, and wake up the thread blocked in step 5.2.5; Step 5.2.7: Release the mutex lock and jump to step 5.2.2.

Images