A TLS protocol construction method and system based on network covert channel

Abstract

The present invention relates to a TLS protocol construction method and system based on a network covert channel, wherein the construction method comprises: modulating the encryption suite and key exchange parameters in the TLS protocol handshake process as covert information, and cooperating with the TLS protocol to complete the entire handshake process. The present invention uses a covert channel to complete the key exchange in the TLS protocol, thereby ensuring the covert transmission of key information in the TLS protocol, and effectively improving the security of the TLS communication process without affecting the TLS protocol handshake time.

Description

Technical Field

[0001] The present invention relates to the fields of network security, information transmission and secure communication, and in particular to a TLS protocol construction method and system based on a network covert channel. Background Art

[0002] As a hidden and unconventional channel outside the normal channel used in network traffic, network covert channel aims to hide the existence of the communication process itself. It has good concealment and has become a safe and effective method for transmitting confidential information in untrusted networks. However, this method has the problem of low information transmission rate and cannot be applied to large-scale data transmission. The TLS protocol, another method of secure information transmission, negotiates a symmetric key through key exchange and then encrypts the data with the symmetric key, which can support high-speed data transmission.

[0003] Covert channels can be mainly divided into storage-type covert channels and time-type covert channels. A typical application of storage-type covert channels is to use the least significant bit of the timestamp in the TCP data packet to hide data. The embedding of covert data will not change the behavior or statistical characteristics of normal traffic, but each data packet can only carry one bit of covert data, resulting in a low transmission rate of covert information.

[0004] The present invention combines TLS protocol encrypted communication with a network covert channel. After the covert channel transmits the key, the key-encrypted data is transmitted. The covert channel transmits only a small amount of key data, which solves the problem that the covert channel cannot support the transmission of a large amount of data as a whole. At the same time, the covert channel is used to hide part of the TLS protocol communication process, thereby enhancing the security of TLS protocol communication. Summary of the invention

[0005] The purpose of the present invention is to provide a TLS protocol construction method and system based on a network covert channel, which utilizes the covert channel to implement key exchange of the TLS protocol, improve data transmission security, and enhance information transmission efficiency.

[0006] To achieve the above object, the present invention provides the following solutions:

[0007] A method for constructing a TLS protocol based on a network covert channel, the method comprising the following steps:

[0008] 1) The covert channel server and the covert channel client forward the Client Hello data packet sent by the TLS client;

[0009] 2) The covert channel server obtains a Server Hello data packet sent from the TLS server, modulates the encryption suite information in the Server Hello data packet into covert information, modifies the encryption suite field in the Server Hello data packet into constructed encryption suite information, wherein the constructed encryption suite is generated according to the encryption suite information in the Server Hello data packet, and sends the modified Server Hello data packet using the covert channel;

[0010] 3) The covert channel client obtains the Server Hello data packet sent from the covert channel server, demodulates the hidden information in the Server Hello data packet to the encryption suite information, modifies the encryption suite field in the Server Hello data packet to the demodulated encryption suite information, and sends the modified Server Hello data packet to the TLS client;

[0011] 4) The covert channel server and the covert channel client forward the Certificate data packet sent by the TLS server;

[0012] 5) The covert channel server determines the type of data packet sent by the TLS server. If it is a Server KeyExchange message, obtains the Server Key Exchange data packet sent by the TLS server, modulates the key exchange parameters in the Server KeyExchange data as covert information, modifies the key exchange parameter field in the Server Key Exchange data packet to the constructed key exchange parameters, wherein the constructed key exchange parameters are generated according to the constructed encryption suite, and sends the modified Server Key Exchange data packet through the covert channel. If it is a Server HelloDone message, the covert channel server and the covert channel client forward the Server Hello Done data packet;

[0013] 6) The covert channel client obtains the Server Key Exchange data packet sent from the covert channel server, demodulates the hidden information in the Server Key Exchange data packet into key exchange parameters, modifies the key exchange parameter field in the Server Key Exchange data packet into the demodulated key exchange parameters, and sends the modified Server Key Exchange data packet to the TLS client;

[0014] 7) The covert channel client obtains a Client Key Exchange data packet sent from the TLS client, modulates the key exchange parameters in the Client Key Exchange data packet into covert information, modifies the key exchange parameter field in the Client Key Exchange data packet into constructed key exchange parameters, wherein the constructed key exchange parameters are generated according to the constructed encryption suite, and sends the modified Client Key Exchange data packet to the TLS covert channel server using a covert channel;

[0015] 8) The covert channel server obtains the Client Key Exchange data packet sent from the covert channel client, demodulates the hidden information in the Client Key Exchange data packet into key exchange parameters, modifies the key exchange parameter field in the Client KeyExchange data packet into the demodulated key exchange parameters, and sends the modified Client KeyExchange data packet to the TLS server;

[0016] 9) The covert channel server and the covert channel client forward the remaining handshake message data packets sent by the TLS client and the server;

[0017] Optionally, the encryption suite information in the modulated Server Hello data packet in step 2) is covert information, the key exchange parameters in the modulated Server Key Exchange data in step 5) are covert information, and the key exchange parameters in the modulated Client Key Exchange data in step 7) are covert information. The specific modulation and demodulation methods are agreed upon by the covert channel server and the covert channel client before establishing the TLS handshake mechanism.

[0018] Optionally, in step 2), the encryption suite field in the Server Hello data packet is modified to be the constructed encryption suite information, and the constructed encryption suite specifically includes:

[0019] The signature algorithm in the constructed encryption suite is consistent with the signature algorithm in the encryption suite of the Server Hello data packet, and the constructed encryption suite is selected from the encryption suites supported by the TLS client.

[0020] If the key exchange algorithm selected in the encryption suite of the Server Hello packet requires the TLS server to send a Server Key Exchange message, the key exchange algorithm that requires the TLS server to send a ServerKey Exchange message is also selected in the constructed encryption suite.

[0021] If the key exchange algorithm selected in the encryption suite of the Server Hello packet does not require the TLS server to send a Server Key Exchange message, a key exchange algorithm that does not require the TLS server to send a Server Key Exchange message is also selected in the constructed encryption suite.

[0022] Optionally, step 5) modifies the key exchange parameter field in the Server Key Exchange data packet to the constructed key exchange parameters, and step 7) modifies the key exchange parameter field in the Client Key Exchange data packet to the constructed key exchange parameters, and the method for generating the constructed key exchange parameters is determined by the key exchange algorithm selected in the constructed encryption suite.

[0023] The present invention is also used to provide a TLS protocol construction system based on a network covert channel, the system comprising:

[0024] 1) Data packet information acquisition module, used to obtain the handshake data packets sent by the TLS client and the TLS server, determine the type of data packets obtained and the source of the data packets, and if the data packet source is the same end, send it to other modules for processing; if the data packet source is the opposite end, extract the corresponding field information of the data packet according to the data packet type, and then send it to other modules for processing;

[0025] 2) a cryptographic suite information generation module, used to generate cryptographic suite information, wherein the cryptographic suite information is used to modify the cryptographic suite field in the Server Hello data packet;

[0026] 3) A key exchange parameter generation module, used to generate key exchange parameters, which are used to modify the key exchange parameter fields in the Server Key Exchange data packet and the Client Key Exchange data packet;

[0027] 4) a concealed information modulation module, used to modulate the information extracted in the data packet information acquisition module into concealed information;

[0028] 5) A hidden information demodulation module, used to demodulate the hidden information embedded in the data packet;

[0029] 6) A data packet modification and sending module is used to modify the corresponding fields of the data packet according to the information received from other modules, and send the modified data packet.

[0030] According to the specific embodiments provided by the present invention, the present invention discloses the following technical effects:

[0031] (1) Strong security. The present invention implements encrypted and authenticated transmission of the TLS protocol based on a network covert channel, combines the covert channel with encrypted transmission, and enhances the security of the TLS protocol transmission process by hiding part of the information communicated by the protocol.

[0032] (2) Fast transmission rate: The method used in the present invention does not directly use covert channels to transmit a large amount of covert information, but only transmits key information in the TLS protocol handshake process. Therefore, the handshake time of the TLS protocol increased by the covert channel transmission of information can be ignored. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0034] Figure 1 A diagram showing the principle steps of a method for constructing a TLS protocol based on a network covert channel provided in the first embodiment of the present invention;

[0035] Figure 2 A flowchart of a method for constructing a TLS protocol based on a network covert channel provided in the first embodiment of the present invention;

[0036] Figure 3 This is a structural diagram of a TLS protocol construction system based on a network covert channel provided in Embodiment 2 of the present invention. DETAILED DESCRIPTION

[0037] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0038] The purpose of the present invention is to provide a TLS protocol construction method and system based on a network covert channel, which improves the data security transmission rate and security by combining the covert channel with the TLS protocol to transmit keys.

[0039] At present, network attacks are becoming more and more frequent, posing an increasing threat to Internet user data and privacy. As a technology for covert data transmission, network covert channels can safely and effectively protect user data and privacy. However, traditional covert channels are limited by transmission speed and cannot carry out large-scale data transmission. Encrypted communication can achieve high-speed data transmission, making up for the defect of low information transmission speed of covert channels.

[0040] The TLS protocol construction method and system based on network covert channel proposed in the present invention modulate the encryption suite and key exchange parameters required for negotiating the key into covert information, and implement the key exchange process through the covert channel. The amount of hidden information transmitted is small, which can reduce the impact of hidden information on the TLS protocol handshake time during the transmission process. At the same time, the high concealment of the covert channel can ensure the security of key information in the TLS protocol, effectively improving the security of the TLS communication process.

[0041] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0042] Embodiment 1:

[0043] This embodiment is used to provide a TLS protocol construction method based on a network covert channel. Figure 1 As shown, the method comprises the following steps:

[0044] 1) The covert channel server and the covert channel client forward the Client Hello data packet sent by the TLS client;

[0045] 2) The covert channel server obtains a Server Hello data packet sent from the TLS server, modulates the encryption suite information in the Server Hello data packet into covert information, modifies the encryption suite field in the Server Hello data packet into constructed encryption suite information, wherein the constructed encryption suite is generated according to the encryption suite information in the Server Hello data packet, and sends the modified Server Hello data packet using the covert channel;

[0046] Among them, the encryption suite information in the modulated Server Hello data packet in step 2) is hidden information, and the key exchange parameters in the modulated Server Key Exchange data in step 5) are hidden information. The specific modulation and demodulation methods are agreed upon by the covert channel server and the covert channel client before establishing the TLS handshake mechanism.

[0047] For example, if the modulation encryption suite is concealed information, the encryption suite can be represented by an m-bit mask, where m is the number of encryption suite types, and one bit in the m-bit mask represents an encryption suite. When it represents the selection or support of a certain symmetric encryption algorithm, the corresponding bit position is "1", otherwise it is set to "0", and then the m-bit mask representing the encryption suite is embedded in the last m bits of the Random field in the Server Hello data packet. When demodulating, only the last m bits of the corresponding field need to be extracted, and then the m-bit mask is converted into an encryption suite. The modulation and demodulation method is agreed upon by the covert channel server and the covert channel client before establishing the handshake mechanism.

[0048] Specifically, in step 2), the encryption suite field in the Server Hello data packet is modified to be the constructed encryption suite information, and the constructed encryption suite specifically includes:

[0049] The signature algorithm in the constructed encryption suite is consistent with the signature algorithm in the encryption suite of the Server Hello data packet, and the constructed encryption suite is selected from the encryption suites supported by the TLS client.

[0050] If the key exchange algorithm selected in the encryption suite of the Server Hello packet requires the TLS server to send a Server Key Exchange message, the key exchange algorithm that requires the TLS server to send a ServerKey Exchange message is also selected in the constructed encryption suite.

[0051] If the key exchange algorithm selected in the encryption suite of the Server Hello packet does not require the TLS server to send a Server Key Exchange message, a key exchange algorithm that does not require the TLS server to send a Server Key Exchange message is also selected in the constructed encryption suite.

[0052] For example, if the cipher suite of the Server Hello packet is TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, the constructed cipher suite can be TLS_DHE_RSA_WITH_AES_128_GCM_SHA256.

[0053] 3) The covert channel client obtains the Server Hello data packet sent from the covert channel server, demodulates the hidden information in the Server Hello data packet to the encryption suite information, modifies the encryption suite field in the Server Hello data packet to the demodulated encryption suite information, and sends the modified Server Hello data packet to the TLS client;

[0054] 4) The covert channel server and the covert channel client forward the Certificate data packet sent by the TLS server;

[0055] 5) The covert channel server determines the type of data packet sent by the TLS server. If it is a Server KeyExchange message, obtains the Server Key Exchange data packet sent by the TLS server, modulates the key exchange parameters in the Server KeyExchange data to covert information, modifies the key exchange parameter field in the Server Key Exchange data packet to the constructed key exchange parameters, wherein the constructed key exchange parameters are generated according to the constructed encryption suite, and sends the modified Server Key Exchange data packet through the covert channel. If it is a Server HelloDone message, the covert channel server and the covert channel client forward the Server Hello Done data packet;

[0056] The key exchange parameters in the modulated Server Key Exchange data in step 5) are concealed information, and the specific modulation and demodulation methods are agreed upon by the covert channel server and the covert channel client before establishing the handshake mechanism.

[0057] For example, the modulation key exchange parameter can embed the key exchange parameter into the key exchange parameter field in the data packet, and only the corresponding field information needs to be extracted during demodulation. The modulation and demodulation method is agreed upon by the covert channel server and the covert channel client before establishing the handshake mechanism.

[0058] Wherein, in step 5), the key exchange parameter field in the Server Key Exchange data packet is modified to be the constructed key exchange parameter, and the method for generating the constructed key exchange parameter is determined by the key exchange algorithm selected in the constructed encryption suite.

[0059] For example, if the constructed cipher suite is TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, the key exchange parameters p, g, and Pubkey generated by the DHE key exchange algorithm are all constructed key exchange parameters.

[0060] 6) The covert channel client obtains the Server Key Exchange data packet sent from the covert channel server, demodulates the hidden information in the Server Key Exchange data packet into key exchange parameters, modifies the key exchange parameter field in the Server Key Exchange data packet into the demodulated key exchange parameters, and sends the modified Server Key Exchange data packet to the TLS client;

[0061] 7) The covert channel client obtains a Client Key Exchange data packet sent from the TLS client, modulates the key exchange parameters in the Client Key Exchange data packet into covert information, modifies the key exchange parameter field in the Client Key Exchange data packet into constructed key exchange parameters, wherein the constructed key exchange parameters are generated according to the constructed encryption suite, and sends the modified Client Key Exchange data packet to the TLS covert channel server using a covert channel;

[0062] The key exchange parameters in the modulated Client Key Exchange data in step 7) are concealed information, and the specific modulation and demodulation methods are agreed upon by the covert channel server and the covert channel client before establishing the handshake mechanism.

[0063] For example, the modulation key exchange parameter can embed the key exchange parameter into the key exchange parameter field in the data packet, and only the corresponding field information needs to be extracted during demodulation. The modulation and demodulation method is agreed upon by the covert channel server and the covert channel client before establishing the handshake mechanism.

[0064] Wherein, in step 7), the key exchange parameter field in the Client Key Exchange data packet is modified to be the constructed key exchange parameter, and the method for generating the constructed key exchange parameter is determined by the key exchange algorithm selected in the constructed encryption suite.

[0065] For example, if the constructed encryption suite is TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, the key exchange parameters p, g, and Pubkey are generated by the DHE key exchange algorithm, where Pubkey is the constructed key exchange parameter.

[0066] 8) The covert channel server obtains the Client Key Exchange data packet sent from the covert channel client, demodulates the hidden information in the Client Key Exchange data packet into key exchange parameters, modifies the key exchange parameter field in the Client KeyExchange data packet into the demodulated key exchange parameters, and sends the modified Client KeyExchange data packet to the TLS server;

[0067] 9) The covert channel server and the covert channel client forward the remaining handshake message data packets sent by the TLS client and the server;

[0068] This example provides a TLS protocol based on a network covert channel. Its specific implementation process is as follows: Figure 2 shown.

[0069] In this example, the encryption suite and key exchange parameter information are modulated into covert information, and the key exchange process is implemented through a covert channel. The amount of covert information is small, which can minimize the impact on the TLS protocol handshake time. At the same time, the concealment of the covert channel is used to ensure the transmission of key information in the TLS protocol, effectively improving the security of the entire communication process.

[0070] Embodiment 2:

[0071] This embodiment is used to provide a TLS protocol construction system based on a network covert channel. Figure 3 As shown, the system comprises:

[0072] 1) Data packet information acquisition module, used to obtain the handshake data packets sent by the TLS client and the TLS server, determine the type of data packets obtained and the source of the data packets, and if the data packet source is the same end, send it to other modules for processing; if the data packet source is the opposite end, extract the corresponding field information of the data packet according to the data packet type, and then send it to other modules for processing;

[0073] Among them, the source of the data packet in the data packet information acquisition module is the same end, that is, the TLS client is the same end as the covert channel client, and the TLS server is the same end as the covert channel server; the source of the data packet is the opposite end, that is, the TLS server is the opposite end of the covert channel client, and the TLS client is the opposite end of the covert channel server.

[0074] Specifically, the data packet information acquisition module determines the type of data packet obtained. If the handshake data packet is a Server Hello data packet, the encryption suite field information in the data packet is extracted and handed over to the encryption suite information generation module for processing; if the handshake data packet is a Server Key Exchange data packet or a Client Key Exchange data packet, the key exchange parameter field information is extracted and handed over to the key exchange parameter generation module for processing.

[0075] 2) a cryptographic suite information generation module, used to generate cryptographic suite information, wherein the cryptographic suite information is used to modify the cryptographic suite field in the Server Hello data packet;

[0076] 3) A key exchange parameter generation module, used to generate key exchange parameters, which are used to modify the key exchange parameter fields in the Server Key Exchange data packet and the Client Key Exchange data packet;

[0077] 4) a concealed information modulation module, used to modulate the information extracted in the data packet information acquisition module into concealed information;

[0078] 5) A hidden information demodulation module, used to demodulate the hidden information embedded in the data packet;

[0079] 6) A data packet modification and sending module is used to modify the corresponding fields of the data packet according to the information received from other modules, and send the modified data packet.

[0080] The principles and implementation methods of the present invention are described in this article using specific examples. The description of the above embodiments is only used to help understand the method and core idea of ​​the present invention. At the same time, for those skilled in the art, according to the idea of ​​the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting the present invention.

Claims

1. A method for constructing a TLS protocol based on a network covert channel, characterized in that: The method comprises the following steps: 1) The covert channel server and the covert channel client forward the Client Hello data packet sent by the TLS client; 2) The covert channel server obtains a Server Hello data packet sent from the TLS server, modulates the encryption suite information in the Server Hello data packet into covert information, modifies the encryption suite field in the Server Hello data packet into constructed encryption suite information, wherein the constructed encryption suite is generated according to the encryption suite information in the Server Hello data packet, and sends the modified Server Hello data packet using the covert channel; 3) The covert channel client obtains the Server Hello data packet sent from the covert channel server, demodulates the hidden information in the Server Hello data packet to the encryption suite information, modifies the encryption suite field in the Server Hello data packet to the demodulated encryption suite information, and sends the modified Server Hello data packet to the TLS client; 4) The covert channel server and the covert channel client forward the Certificate data packet sent by the TLS server; 5) The covert channel server determines the type of data packet sent by the TLS server. If it is a Server Key Exchange message, obtains the Server Key Exchange data packet sent by the TLS server, modulates the key exchange parameters in the Server Key Exchange data to covert information, modifies the key exchange parameter field in the Server Key Exchange data packet to the constructed key exchange parameters, wherein the constructed key exchange parameters are generated according to the constructed encryption suite, and sends the modified Server Key Exchange data packet through the covert channel. If it is a Server Hello Done message, the covert channel server and the covert channel client forward the Server Hello Done data packet; 6) The covert channel client obtains the Server Key Exchange data packet sent from the covert channel server, demodulates the hidden information in the Server Key Exchange data packet into key exchange parameters, modifies the key exchange parameter field in the Server Key Exchange data packet into the demodulated key exchange parameters, and sends the modified Server Key Exchange data packet to the TLS client; 7) The covert channel client obtains the ClientKey Exchange data packet sent from the TLS client, modulates the key exchange parameters in the ClientKeyExchange data to covert information, modifies the key exchange parameter field in the Client KeyExchange data packet to the constructed key exchange parameters, wherein the constructed key exchange parameters are generated according to the constructed encryption suite, and sends the modified Client Key Exchange data packet to the TLS covert channel server by using the covert channel; 8) The covert channel server obtains the Client Key Exchange data packet sent from the covert channel client, demodulates the hidden information in the Client Key Exchange data packet into key exchange parameters, modifies the key exchange parameter field in the Client Key Exchange data packet into the demodulated key exchange parameters, and sends the modified Client Key Exchange data packet to the TLS server; 9) The covert channel server and the covert channel client forward the remaining handshake message data packets sent by the TLS client and the TLS server.

2. The method for constructing a TLS protocol based on a network covert channel according to claim 1, characterized in that: The encryption suite information in the modulated ServerHello data packet in step 2) is concealed information, the key exchange parameters in the modulated ServerKeyExchange data in step 5) are concealed information, and the key exchange parameters in the modulated ClientKeyExchange data in step 7) are concealed information. The specific modulation and demodulation methods are agreed upon by the covert channel server and the covert channel client before establishing the TLS handshake mechanism.

3. The TLS protocol construction method based on network covert channel according to claim 1 is characterized in that: Step 2) Modify the encryption suite field in the ServerHello data packet to the constructed encryption suite information, and the constructed encryption suite specifically includes: (1) The signature algorithm in the constructed encryption suite is consistent with the signature algorithm in the encryption suite of the Server Hello data packet, and the constructed encryption suite is selected from the encryption suites supported by the TLS client; (2) If the key exchange algorithm selected in the cipher suite of the Server Hello packet requires the TLS server to send a Server Key Exchange message, the constructed cipher suite also selects a key exchange algorithm that requires the TLS server to send a Server Key Exchange message; (3) If the key exchange algorithm selected in the encryption suite of the Server Hello packet does not require the TLS server to send a Server Key Exchange message, then the key exchange algorithm that does not require the TLS server to send a Server Key Exchange message is also selected in the constructed encryption suite.

4. The method for constructing a TLS protocol based on a network covert channel according to claim 1, characterized in that: Step 5) modifies the key exchange parameter field in the ServerKey Exchange data packet to the constructed key exchange parameters, and step 7) modifies the key exchange parameter field in the Client KeyExchange data packet to the constructed key exchange parameters, and the constructed key exchange parameter generation method is determined by the key exchange algorithm selected in the constructed encryption suite.

5. A TLS protocol construction system based on network covert channel, characterized in that: The system comprises: a data packet information acquisition module, an encryption suite information generation module, a key exchange parameter generation module, a concealed information modulation module, a concealed information demodulation module, and a data packet modification and sending module, and is used to execute the method according to any one of claims 1 to 4, wherein: 1) A data packet information acquisition module is used to acquire the handshake data packets sent by the TLS client and the TLS server, determine the type of the acquired data packets and the source of the data packets, the TLS client is the same end as the covert channel client, the TLS server is the same end as the covert channel server, the TLS server is the opposite end of the covert channel client, and the TLS client is the opposite end of the covert channel server; if the handshake data packet is a Server Hello data packet, extract the encryption suite field information in the data packet and hand it over to the encryption suite information generation module for processing; if the handshake data packet is a Server Key Exchange data packet or a Client KeyExchange data packet, extract the information of the key exchange parameter field and hand it over to the key exchange parameter generation module for processing; 2) a cryptographic suite information generation module, used to generate cryptographic suite information, wherein the cryptographic suite information is used to modify the cryptographic suite field in the ServerHello data packet; 3) a key exchange parameter generation module, used to generate key exchange parameters, which are used to modify the key exchange parameter fields in the ServerKey Exchange data packet and the ClientKey Exchange data packet; 4) a concealed information modulation module, used to modulate the information extracted in the data packet information acquisition module into concealed information; 5) A hidden information demodulation module, used to demodulate the hidden information embedded in the data packet; 6) A data packet modification and sending module is used to modify the corresponding fields of the data packet according to the received information and send the modified data packet.

Images