Network steganography information coding and mapping method and device and medium

Abstract

The invention provides a network steganography information coding and mapping method and device and a medium, and belongs to the technical field of network communication and security. The method comprises the following steps: creating a service node for recording auxiliary information for sending a hidden secret message; the sender registers a service node; binary information coding and address mapping are carried out on a hidden secret message needing to be sent, a data packet is generated, and a request is sent to a sending direction service node; the service node establishes communication connection, registers the total number of data packets of the communication, and then sends the total number of the data packets to the receiver; after the sender finishes sending, the receiver verifies whether the number of the received data packets is consistent with the total number of the data packets sent by the service node; and when the number of the data packets is consistent, the receiver decodes the data packets into corresponding binary strings according to known information coding rules and address mapping rules. According to the method, the steganography information capacity is maximized, the concealment is higher, and meanwhile, the method has good flexibility and safety.

Description

Technical Field

[0001] The invention relates to a network steganographic information encoding and mapping method, device and medium, belonging to the field of network communication and security technology. Background Art

[0002] Big data analysis can skip the data content and mine intelligence only from the data background. When communication behavior is discovered, people who use ciphertext communication stand out and become the focus of monitoring and analysis. Modern communication security requires not only confidentiality of content, but also concealment of the process. Steganography is a technology that embeds secret messages into various carriers (such as digital images, audio, video or text) to achieve covert communication. It is an effective means to deal with big data intelligence acquisition and a necessary supplement to encryption technology.

[0003] Network steganography is a steganography method based on network protocols. This method constructs a covert channel to transmit secret information. Specifically, this method exploits redundant fields and rule loopholes in network protocols and places secret information in network data packets to achieve the transmission of secret information. Compared with steganography methods such as text, image, audio, and video, network steganography can avoid network devices such as intermediate network nodes. At the same time, network steganography is transparent, that is, users have no direct perception of network data flows when accessing data.

[0004] Common network steganography methods mainly include storage type, timing type, hybrid type and other covert channels. Storage type network steganography generally chooses to modify the header and payload of the network protocol. Timing type network steganography refers to a network steganography method that embeds secret information by modifying the packet flow structure and using the characteristic changes of the timing of data transmission. Hybrid network steganography refers to the combination of storage type and timing type network steganography methods. Other network steganography methods mainly hide secret information through the length information of the packet and the classification information of the IP source address.

[0005] The method based on IP source address classification hides secret messages in the steganographic process by classifying the source address field of the data packet, and chooses to use the IP address existing in the public network. It actually exists in the network, so it is not easy to attract the attention of attackers. It solves the existing network steganography method based on data packet field modification.

[0006] The existing network steganography method based on IP source address uses the combination of data source address classification and multi-dimensional feature mapping to hide information according to information encoding rules, address classification and mapping rules. Specifically, the two communicating parties use different IP source addresses to represent a number of bits of binary digital encoding. The service node is used to record the basic information and communication status of the two communicating parties, and the service node is used to complete the auxiliary confirmation of the integrity of the secret information. However, the existing method based on IP source address classification has low hiding capacity and low address utilization. Therefore, it is necessary to study more efficient related network steganography methods. Summary of the invention

[0007] The purpose of the present invention is to provide a method, device and medium for encoding and mapping network steganographic information, which realizes the refined utilization and efficient steganography of IPv6 address space, and maximizes the capacity of steganographic information by formulating different encoding and mapping rules for different address categories, making it more concealed while having good flexibility and security.

[0008] In order to achieve the above object, the present invention is implemented through the following technical solutions: Creating a service node for recording auxiliary information of sending hidden secret messages, wherein the auxiliary information includes the real IP address, the category and number of IP addresses, the number of each multi-dimensional feature, and the total number of data packets; The sender registers with the service node. The registration information includes the real IP addresses and ports of the sender and receiver. Perform binary information encoding and address mapping on the hidden secret message to be sent, generate a data packet, and send a request to the service node in the sending direction; The service node establishes a communication connection, registers the total number of data packets in this communication, and then sends the total number of data packets to the receiver; After the sender has finished sending, the receiver verifies whether the number of packets received is consistent with the total number of packets sent by the service node; When the number of data packets is consistent, the receiver decodes them into corresponding binary strings according to known information encoding rules and address mapping rules.

[0009] Preferably, the binary information encoding and address mapping are specifically performed as follows: The secret information M is encrypted to form a bit stream of L bits; According to the type and function of the IP source address, all addresses are divided into a set of IPv4-mapped IPv6 addresses. and pure IPv6 address classification set ; The secret information M is segmented according to the multi-dimensional feature size of the IPv6 address. The first segment of the information after segmentation is taken as M1, and the other segments are M2. The information segment M1 corresponds to the address , the information segment M2 corresponds to the address ; Convert each information segment into a decimal notation; according to and The address is mapped based on the decimal identifier corresponding to the information encoding segment.

[0010] Preferably, the multidimensional features The calculation is as follows: , in, Indicates The value range of the dimension; is the number of multidimensional features; The secret information M The results after segmentation according to the size of multi-dimensional features are as follows: , in, Categorize addresses The corresponding binary information segment, to Categorize addresses Middle The binary information segment corresponding to the dimension, ; Preferably, the address The length of the corresponding binary information segment M1 for: , in, Indicates address classification The total number of addresses contained in .

[0011] Said address The length of the corresponding information segment M2 for: .

[0012] Preferably, for Address, only one-dimensional feature mapping is performed; for The address is mapped using the multi-dimensional features of the IPv6 address, which include Address structure levels, such as prefix, subnet identifier, and interface identifier.

[0013] Preferably, the The address mapping is as follows: , in, express Corresponding The IP address in A collection of IPv6 address categories mapped to IPv4. for The corresponding decimal number.

[0014] Preferably, the The address mapping is as follows: , , in, represents a prefix set, Represents a collection of subnets, Represents a set of interface identifiers. express The corresponding decimal value is, express The corresponding decimal value is, express The corresponding decimal value.

[0015] The advantages of the present invention are: (1) The method based solely on IP source address classification (comparison method) uses a simple modulo operation to segment information and map it to IPv4 mapped addresses (16 in total) and pure IPv6 addresses (256 in total). The information capacity depends on the size of the classification space (16 IPv4 mapped addresses and 256 pure IPv6 addresses). This results in less information carried by IPv4 addresses, which can easily lead to resource waste in practical applications.

[0016] The present invention introduces multiple features such as subnet identifier and interface identifier, each of which can independently carry information. The IPv6 address consists of a prefix, a subnet identifier and an interface identifier, and each dimension maps different secret information. Through the collaborative encoding of multi-dimensional features, the information capacity is significantly increased, and the secret information that can be carried is larger.

[0017] (2) Flexibility The multi-dimensional features (prefix, subnet identifier, interface identifier, etc.) in the method of the present invention provide a high degree of flexibility, and the encoding rules of each dimension can be dynamically adjusted according to the application scenario. It can adapt to different network environments (such as dynamic prefix, specific service division) and the carrying requirements of various information types. The flexible mapping method is easier to combine with other steganographic technologies to realize cross-protocol steganographic information transmission.

[0018] (3) Security The multi-dimensional mapping of the present invention distributes information into multiple feature dimensions (prefix, subnet identifier, interface identifier), significantly improving the dispersion of steganographic traffic. Attackers need to monitor multiple dimensions simultaneously to infer steganographic patterns, increasing the difficulty of detection and analysis. Through the diversified mapping of dynamic prefixes and features, steganographic communication has stronger randomness and uncertainty, further enhancing security. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0020] Figure 1 It is a schematic diagram of the process of the present invention.

[0021] Figure 2 It is a schematic diagram of the transmission process of the present invention. DETAILED DESCRIPTION

[0022] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] Example 1 like Figure 1-Figure 2 As shown in the figure, a network steganographic information encoding and mapping method, combined with IP source address classification and multi-dimensional feature mapping, realizes the refined utilization of IPv6 address space and efficient steganography. By formulating different encoding and mapping rules for different address classifications, the capacity of steganographic information is maximized, the concealment is stronger, and it has good flexibility and security. It includes: S1: Create a service node for recording auxiliary information for sending hidden secret messages, wherein the auxiliary information includes the real IP address, IP address classification and number, the number of each multi-dimensional feature and the total number of packets.

[0024] As a refinement of the above embodiment, recording the real IP address helps to track the source of the message. The IP address classification and number are used to decode the secret information. The total number of data packets is used by both parties to confirm the transmission integrity and prevent the loss or damage of steganographic information due to packet loss.

[0025] S2: The sender registers with the service node. The registration information includes the real IP addresses and ports of the sender and receiver.

[0026] S3: Binary information encoding and address mapping are performed on the hidden secret message to be sent, and a data packet is generated, and a request is sent to the service node in the sending direction.

[0027] S4: The service node establishes a communication connection, registers the total number of data packets in this communication, and then sends the total number of data packets to the receiver.

[0028] S5: After the sender finishes sending, the receiver verifies whether the number of received data packets is consistent with the total number of data packets sent by the service node.

[0029] S6: When the number of data packets is consistent, the receiver decodes them into corresponding binary strings according to known information encoding rules and address mapping rules.

[0030] As a refinement of the above embodiment, the information encoding method is as follows: The secret information M is encrypted and formed into an L-bit bit stream file, which is expressed as: .

[0031] According to the type and function of the IP source address, all addresses S are divided into a set of IPv4-mapped IPv6 address classifications. and pure IPv6 address classification set . The address starts with the fixed prefix ::FFFF, indicating that it is mapped from IPv4. The address does not contain a mapping prefix and is completely defined in accordance with the IPv6 standard. According to the classification rule, the binary secret information M is split into two parts M1 and M2, and corresponds to and Information segment. M is calculated based on the size of the multi-dimensional feature. Divide it further into several sections: , in, Categorize addresses The corresponding binary information segment, to Categorize addresses Middle The binary information segment corresponding to the dimension, .

[0032] M1 and M2 are segmented according to the address feature dimension. For M1, The scale is small, and the IPv4 mapped address has a single feature, so there is no need to perform multi-dimensional feature division. Therefore, M1 is only divided into a segment B1 with a length of: , in, Indicates address classification The total number of addresses contained in .

[0033] For M2, its overall length is: , Since pure IPv6 addresses have rich feature dimensions, they are divided into several segments, namely to , corresponding to different IPv6 address features, such as prefix P, subnet identifier E, interface identifier I, etc. Length Satisfies the following formula. Among them, is the value range of the i-th dimension. Further description of this dimension will be expanded later. Information encoding refers to converting each segment Convert to decimal and express it as .

[0034] , in, is the number of multidimensional features. As a refinement of the above embodiment, the specific manner of address mapping is as follows: for , due to its fixed structural characteristics, only one-dimensional feature mapping is required, and the mapping rules are as follows: , for , using the multi-dimensional features of IPv6 addresses for mapping. The relevant dimensions include prefix P, subnet identifier E, and interface identifier I. In particular, when the multi-dimensional features are prefix P, subnet identifier E, and interface identifier I, there are , , ; Prefix P represents the prefix set of the network range , the size is The subnet identifier E is used to distinguish the collection of subnets. ,size The interface identifier I is used to distinguish the combination of the host ,size . Then the number of bits of binary strings of different dimensions is: , Then M2 is divided into: , The mapping rules are: , in, represents a prefix set, Represents a collection of subnets, Represents a set of interface identifiers. express The corresponding decimal value is, express The corresponding decimal value is, express The corresponding decimal value.

[0035] In particular, when the multi-dimensional features are prefix P, subnet identifier E, and interface identifier I, we have , Right now: ; The final steganographic address generation result is: .

[0036] Coding example: Assume that the bit stream corresponding to the secret information M to be steganographic is 10111010110011, where the length m = 14. The IP address space is divided into and .in, Contains 16 addresses in the following format: in, Contains 256 addresses, namely: (1) 2001:db8:85a3:1:: to 2001:db8:85a3:1::ff (2) 2001:db8:85a3:2:: to 2001:db8:85a3:2::ff (3) 2001:db8:85a3:3:: to 2001:db8:85a3:3::ff (4) 2001:db8:85a3:4:: to 2001:db8:85a3:4::ff Divide the secret information M according to the address classification ratio, then we have , The split result is , .

[0037] The corresponding decimal is 11, corresponding to . Then, Corresponding multi-dimensional feature mapping is performed. Assume that there is only a single value 2001:db8:1:: in the prefix set T1, that is is 1, , no further coding is required. There are four choices for subnet identification mapping, namely 2001:0db8:85a3:0001:: / 64, 2001:0db8:85a3:0002:: / 64, 2001:0db8:85a3:0003:: / 64, 2001:0db8:85a3:0004:: / 64, that is is 4, then , , which is 2001:0db8:85a3:0003:: / 64. Interface mapping identifier, the range is 0 to 255 (hexadecimal FF), that is is 256, then .but The final steganographic address is: 2001:0db8:85a3:0003::b3.

[0038] Decoding example: On the receiving side, assume that the IP addresses of the received data packets are ::FFFF:192.0.2.11 and 2001:0db8:85a3:0003::b3. The receiver determines and For SIPv4 addresses, the receiver extracts 11 and converts it into binary 1011. For SIPv6 addresses, the receiver converts it into binary 1011 according to the length of each dimension. , , . In the subnet identification dimension information table, we find that 2001:0db8:85a3:0003:: / 64 is the binary 10 information segment. We extract the hexadecimal b3 to get the binary information segment 10110011.

[0039] The disclosed embodiment also provides a network steganographic information encoding and mapping device, including a processor and a memory. Optionally, the device may also include a communication interface and a bus. The processor, the communication interface, and the memory may communicate with each other through the bus. The communication interface may be used for information transmission. The processor may call the logic instructions in the memory to execute the network steganographic information encoding and mapping method of the above embodiment.

[0040] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.

[0041] The memory, as a computer-readable storage medium, can be used to store software programs and computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present disclosure. The processor executes the function application and data processing by running the program instructions / modules stored in the memory, that is, implementing the network steganographic information encoding and mapping method in the above embodiment.

[0042] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory may include a high-speed random access memory and may also include a non-volatile memory.

[0043] The embodiment of the present disclosure provides a computer-readable storage medium storing computer-executable instructions, wherein the computer-executable instructions are configured to execute the above-mentioned network steganographic information encoding and mapping method.

[0044] The computer-readable storage medium mentioned above may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.

[0045] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A network steganographic information encoding and mapping method, characterized in that: include: Creating a service node for recording auxiliary information of sending hidden secret messages, wherein the auxiliary information includes the real IP address, the category and number of IP addresses, the number of each multi-dimensional feature, and the total number of data packets; The sender registers with the service node. The registration information includes the real IP addresses and ports of the sender and receiver. Perform binary information encoding and address mapping on the hidden secret message to be sent, generate a data packet, and send a request to the service node in the sending direction; The service node establishes a communication connection, registers the total number of data packets in this communication, and then sends the total number of data packets to the receiver; After the sender has finished sending, the receiver verifies whether the number of packets received is consistent with the total number of packets sent by the service node; When the number of data packets is consistent, the receiver decodes them into corresponding binary strings according to known information encoding rules and address mapping rules.

2. The network steganographic information encoding and mapping method according to claim 1 is characterized in that: The binary information encoding and address mapping are specifically as follows: The secret information M is encrypted to form a bit stream of L bits; According to the type and function of the IP source address, all addresses are divided into a set of IPv4-mapped IPv6 addresses. and pure IPv6 address classification set ; The secret information M is segmented according to the multi-dimensional feature size of the IPv6 address. The first segment of the information after segmentation is taken as M1, and the other segments are M2. The information segment M1 corresponds to the address , the information segment M2 corresponds to the address ; Convert each information segment into a decimal notation; according to and The address is mapped based on the decimal identifier corresponding to the information encoding segment.

3. The network steganographic information encoding and mapping method according to claim 2 is characterized in that: The multidimensional features The calculation is as follows: ， in, Indicates The value range of the dimension; is the number of multidimensional features; The secret information M The results after segmentation according to the size of multi-dimensional features are as follows: ， in, Categorize addresses The corresponding binary information segment, to Categorize addresses Middle The binary information segment corresponding to the dimension, .

4. The network steganographic information encoding and mapping method according to claim 3 is characterized in that: Said address The length of the corresponding binary information segment M1 for: ， in, Indicates address classification The total number of addresses contained in .

5. Said address The length of the corresponding information segment M2 for: 。 6. The network steganographic information encoding and mapping method according to claim 2, characterized in that: for Address,only one-dimensional feature mapping is performed; for The address is mapped using the multi-dimensional features of the IPv6 address, which include Address structure hierarchy.

7. The network steganographic information encoding and mapping method according to claim 5, characterized in that: Said The address mapping is as follows: ， in, express Corresponding The IP address in A collection of IPv6 address categories mapped to IPv4. for The corresponding decimal number.

8. The network steganographic information encoding and mapping method according to claim 5, characterized in that: Said The address mapping is as follows: ， ， in, represents a prefix set, Represents a collection of subnets, Represents a set of interface identifiers. express The corresponding decimal value is, express The corresponding decimal value is, express The corresponding decimal value.

9. A network steganographic information encoding and mapping device, comprising a processor and a memory storing program instructions, characterized in that: The processor is configured to execute the network steganographic information encoding and mapping method as described in any one of claims 1-7 when running the program instructions.

10. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the program is executed by a processor, the network steganographic information encoding and mapping method as described in any one of claims 1 to 7 above is implemented.

Images