Relay emission type information hidden transmission system and method based on HID interface

Abstract

The invention discloses a relay emission type information hidden transmission system and method based on an HID interface, and the method comprises the steps: enabling an HID interface device to implant an information collection Trojan horse into a target host based on the first control instruction information of a data return receiving device; performing search processing on a target host file and target host information by using the information collection Trojan to obtain target sending information and sending the target sending information to HID interface equipment; performing first receiving processing on the target sending information by utilizing HID interface equipment to obtain target data information; sending the target data information to the data return receiving device by using an HID interface device; and the data return receiving equipment performs second receiving processing on the target data information to obtain target data. According to the relay transmitting type information hidden transmission system and method based on the HID interface, universal HID data interface equipment is adopted, high-value information of a target host is obtained, the data return hidden performance is high, and the high-value information obtaining problem is solved.

Description

Technical Field

[0001] The present invention relates to the field of cyberspace security, and in particular to a relay transmission type information concealment transmission system and method based on a HID interface. Background Art

[0002] For the target network, the encoded Trojan horse payload and decoding script are stored in the target host by simulating keystrokes, and the decoding operation is completed to complete the implantation. The high-value information of the host (or mobile phone) is collected through the Trojan horse payload, and the acquired high-value information is transmitted to the remote end through the communication module in the special camouflaged HID hardware (mouse, keyboard, power bank), so as to achieve the acquisition of high-value information of the host (or mobile phone) in the isolated network and long-distance return. The relay transmission type information concealment transmission system and method of the present invention based on the HID interface adopts a universal HID (Human Interface Device) data interface device, which is compatible with Windows, Linux, and MacOS operating systems without special drivers, and achieves the acquisition of high-value information in the isolated network. The data return is highly concealed, which solves the problem of obtaining high-value information. Summary of the invention

[0003] The technical problem to be solved by the present invention is to provide a relay-type information covert transmission system and method based on the HID interface, which adopts a device with a universal HID (Human Interface Device) data interface and is compatible with Windows, Linux, and MacOS operating systems without a special driver, thereby reducing costs and improving the concealment of data return.

[0004] In order to solve the above technical problems, the first aspect of the present embodiment discloses a relay transmission type information concealment transmission system based on HID interface, including: HID interface device, target host and data return receiving device;

[0005] The HID interface device is used to receive and process the control instruction information transmitted by the data return receiving device, implant an information collection Trojan into the target host, obtain and process the target transmission information transmitted by the target host, and transmit it to the data return receiving device;

[0006] The target host is used to connect to the target network to receive and send network data, and uses the implanted information collection Trojan to collect information and obtain the target sending information;

[0007] The data return receiving device is used to receive the target sending information transmitted by the HID interface device;

[0008] The target host and the HID interface device are connected via USB interface data; the HID interface device and the data return receiving device are connected via wireless network data.

[0009] As an optional implementation, in the first aspect of this embodiment, the HID interface device includes a camouflage module, a USB shunt module, a main control MCU module and a communication module;

[0010] The camouflage module is used to camouflage the HID interface device;

[0011] The USB shunt module is used to receive the control instruction information sent by the main control MCU module and send it to the target host, and receive the target host return information sent by the target host and send it to the communication module;

[0012] The main control MCU module is used to receive the control instruction information sent by the communication module;

[0013] The communication module is used to receive the control instruction information sent by the data feedback receiving device and send it to the main control MCU module, and send the target host feedback information to the data feedback receiving device;

[0014] The USB shunt module is connected to the target host via a USB interface; the main control MCU module is data-connected to the USB shunt module and the communication module respectively.

[0015] The second aspect of this embodiment discloses a relay transmission type information concealment transmission method based on the HID interface, the method comprising:

[0016] S1, based on the first control instruction information, the HID interface device implants an information collection Trojan into the target host;

[0017] S2, using the information collection Trojan horse to search and process the target host file and target host information, obtain the target sending information and send it to the HID interface device;

[0018] S3, using the HID interface device, performing a first receiving process on the target transmission information to obtain target data information;

[0019] S4, using the HID interface device, sending the target data information to the data return receiving device;

[0020] S5, the data feedback receiving device performs a second receiving process on the target data information to obtain the target data.

[0021] As an optional implementation, in the second aspect of this embodiment, the implanting of an information collection Trojan horse by the HID interface device into the target host based on the first control instruction information includes:

[0022] S11, the HID interface device receives and obtains the first control instruction information sent by the data feedback receiving device;

[0023] S12, decrypting the first control instruction information to obtain first control instruction decrypted information;

[0024] S13, based on the first communication protocol, parsing and processing the first control instruction decryption information to obtain network instruction type information;

[0025] S14, determining whether the network instruction type information is equal to a first set value, and obtaining a network instruction type determination result;

[0026] S15, when the result of judging the network instruction type is yes, execute S16 to S18;

[0027] When the result of judging the network instruction type is no, executing S11;

[0028] S16, encapsulating the network instruction type information based on the second communication protocol to obtain second instruction information;

[0029] S17, using the HID interface device, sending the second instruction information to the target host;

[0030] S18, processing the second instruction information and implanting the Trojan into the target host.

[0031] As an optional implementation, in the second aspect of this embodiment, the use of the information collection Trojan horse to search and process the target host file and the target host information, obtain the target sending information and send it to the HID interface device, including:

[0032] S21, the information collection Trojan receives and obtains the second control instruction information sent by the HID interface device;

[0033] S22, based on the second communication protocol message structure, processing the second control instruction information to obtain target sending information;

[0034] S23, sending the target sending information to the HID interface device.

[0035] As an optional implementation manner, in the second aspect of this embodiment, the processing of the second control instruction information based on the second communication protocol message structure to obtain the target sending information includes:

[0036] S2201, based on the second communication protocol message structure, parse and process the second control instruction information to obtain second message type information, second instruction function information, second data length and second instruction data information;

[0037] S2202, determining whether the second message type information is equal to a third set value, and obtaining a second message type determination result;

[0038] When the result of determining the second message type is yes, executing S2203 to S2204;

[0039] When the result of the second message type determination is no, the second instruction data information is updated to target sending information, and S2205 is executed;

[0040] S2203, encrypting the second instruction data information to obtain third instruction data information;

[0041] S2204, performing structured processing on the third instruction data information according to the second communication protocol message structure and using the second data length to obtain target sending information;

[0042] S2205, determining whether the target sending information is equal to a fourth set value, and obtaining a target sending determination result;

[0043] S2206, when the target sends a judgment result of yes, execute S2207 to S2208;

[0044] When the target sends a judgment result of no, executing S2209 to S2210;

[0045] S2207, the information collection Trojan performs key information extraction processing on the target host information according to the first preset rule to obtain target acquisition information;

[0046] S2208, encrypting the target acquisition information to obtain a target file to be sent;

[0047] S2209, the information collection Trojan performs key file extraction processing on the target host file according to the second preset rule to obtain the target acquisition file;

[0048] S2210, encrypting the target file to obtain a target file to be sent;

[0049] S2211, encapsulate the target file to be sent according to the first communication protocol to obtain target sending information.

[0050] As an optional implementation manner, in the second aspect of this embodiment, the using the HID interface device to perform a first receiving process on the target sending information to obtain the target data information includes:

[0051] S31, the HID interface device receives and obtains the target sending information;

[0052] S32, based on the second communication protocol, parsing and processing the target transmission information to obtain the target information to be transmitted;

[0053] S33, encapsulating the target information to be transmitted according to the first communication protocol to obtain target data information.

[0054] As an optional implementation manner, in the second aspect of this embodiment, the parsing and processing the target sending information based on the second communication protocol to obtain the target data information includes:

[0055] S331, obtaining the target sending information;

[0056] S332, using the second communication protocol message structure, parse and process the target sending information to obtain the target sending information.

[0057] As an optional implementation manner, in the second aspect of this embodiment, the using the HID interface device to send the target data information to the data return receiving device includes:

[0058] S41, the HID interface device receives the first control instruction information transmitted by the data feedback receiving device;

[0059] S42, parsing the first control instruction information based on the first communication protocol to obtain third instruction type information;

[0060] S43, determining whether the third instruction type information is equal to a fifth set value, and obtaining a third instruction type determination result;

[0061] S44, when the third instruction type judgment result is yes, execute S45;

[0062] When the third instruction type determination result is no, executing S41;

[0063] S45, the HID interface device sends the target data information to the data feedback receiving device.

[0064] As an optional implementation manner, in the second aspect of this embodiment, the data return receiving device performs a second receiving process on the target data information to obtain the target data, including:

[0065] S501, obtaining user demand instruction information;

[0066] S502, parsing the user demand instruction information to obtain user instruction type information;

[0067] S503, determining whether the user instruction type information is equal to a sixth set value, and obtaining a user instruction type determination result;

[0068] S504, when the user instruction type is determined to be yes, execute S505 to S507;

[0069] When the user instruction type determination result is no, executing S508 to S510;

[0070] S505, encrypting the user demand instruction information to obtain encrypted user instruction information;

[0071] S506, encapsulating the encrypted user instruction information based on the first communication protocol to obtain first control instruction information;

[0072] S507, the data feedback receiving device sends the first control instruction information to the HID interface device;

[0073] S508, the data feedback receiving device receives and obtains the target data information;

[0074] S509, parsing the target data information based on the first communication protocol to obtain first target data information;

[0075] S510: decrypt the first target data information to obtain target data.

[0076] A third aspect of this embodiment discloses a relay transmission type information concealment transmission device, the device comprising:

[0077] A memory storing executable program code;

[0078] a processor coupled to the memory;

[0079] The processor calls the executable program code stored in the memory to execute part or all of the steps in the relay transmission type information covert transmission method disclosed in the second aspect of this embodiment.

[0080] The fourth aspect of the present invention discloses a computer-readable storage medium, which stores computer instructions. When the computer instructions are called, some or all of the steps in the relay transmission type information covert transmission method disclosed in the second aspect of this embodiment are executed.

[0081] Compared with the prior art, this embodiment has the following beneficial effects:

[0082] The present invention provides a relay transmission type information concealment transmission system and method based on HID interface, adopts universal HID data interface equipment, is compatible with Windows, Linux, MacOS operating systems without special driver, realizes the acquisition of high-value information in isolated network, has strong data return concealment, and solves the problem of obtaining high-value information. BRIEF DESCRIPTION OF THE DRAWINGS

[0083] In order to more clearly illustrate the technical solution in this embodiment, the drawings required for use in the description of the embodiment will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0084] Figure 1 Schematic diagram of application scenario of the relay transmission type information concealment transmission system based on HID interface provided by this embodiment;

[0085] Figure 2 It is a schematic diagram of the composition of a relay transmission type information concealment transmission system based on the HID interface disclosed in this embodiment;

[0086] Figure 3 This is a flow chart of a relay transmission type information concealment transmission method based on the HID interface disclosed in this embodiment;

[0087] Figure 4 It is a structural schematic diagram of another relay transmission type information concealment transmission device based on the HID interface disclosed in this embodiment. DETAILED DESCRIPTION

[0088] In order to enable those skilled in the art to better understand the solution of the present invention, the technical solution in this embodiment will be clearly and completely described below in conjunction with the drawings in this embodiment. Obviously, the described embodiment is only a part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0089] The terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, device, product or equipment that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or equipment.

[0090] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0091] In this application, the word "exemplary" is used to mean "used as an example, illustration, or description." Any embodiment described in this application as "exemplary" is not necessarily to be construed as being preferred or advantageous over other embodiments. The following description is given to enable any technician in the field to implement and use the present application. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present application can be implemented without using these specific details. In other instances, well-known structures and processes will not be elaborated in detail to avoid obscuring the description of the present application with unnecessary details. Therefore, the present application is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in the present application.

[0092] It should be noted that since the method of the embodiment of the present application is executed in a computer device, the processing objects of each computer device exist in the form of data or information. For example, time is actually time information. It can be understood that if size, quantity, position, etc. are mentioned in subsequent embodiments, they are all corresponding data for processing by the computer device. The details will not be repeated here.

[0093] It should be noted that the artificial intelligence related technologies that may be involved in this application are briefly described. Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that machines have the functions of perception, reasoning and decision-making.

[0094] Artificial intelligence technology is a comprehensive discipline that covers a wide range of fields, including both hardware-level and software-level technologies. The basic technologies of artificial intelligence generally include sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics and other technologies. Artificial intelligence software technology mainly includes computer vision technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0095] Computer Vision (CV) is a science that studies how to make machines "see". To put it more specifically, it refers to machine vision such as using cameras and computers to replace human eyes to identify and measure targets, and further processing graphics so that the computer processing becomes an image that is more suitable for human observation or transmission to instruments for detection. As a scientific discipline, computer vision studies related theories and technologies, and attempts to establish an artificial intelligence system that can obtain information from images or multi-dimensional data. Computer vision technology usually includes image processing, image recognition, image semantic understanding, image retrieval, OCR, video processing, video semantic understanding, video content / behavior recognition, three-dimensional object reconstruction, 3D technology, virtual reality, augmented reality, simultaneous positioning and map construction, and other technologies, as well as common biometric recognition technologies such as face recognition and fingerprint recognition.

[0096] Unimodal information is data of only one type, such as text, image, audio, video, electromagnetic signal, etc. Multimodal information is data that includes at least two types of unimodal information. Furthermore, multimodal information is suitable for complex tasks that require the integration of multiple information sources, such as sentiment analysis, robot interaction, autonomous driving, etc. By integrating information from multiple modalities, higher performance and accuracy can usually be achieved on the task.

[0097] A large model refers to an artificial neural network model with a very large number of parameters. In the field of artificial intelligence, a large model generally refers to a model with hundreds of millions to trillions of parameters. Models usually need to be trained on large-scale data sets and require a large amount of computing resources to be optimized and adjusted. Large models are often used to solve complex tasks such as natural language processing, computer vision, and speech recognition. Generative AI is an AI that can create new content and ideas, including conversations, stories, images, videos, and music. In an embodiment of the present application, the large model may be ChatGPT, BERT, XLNet, Zhipu model, Claude, Moonshot AI model, ChatGLM model, Qianyi Tongwen model, MiniMax model, Spark model, Llama model, 360GPT model, Qwen model, Baichuan model, Skylark model, vivoLM model, and Wenxin Yiyan scale language models, which are not limited in the embodiments of the present application.

[0098] The embodiments of the present application provide a relay transmission type information covert transmission method, system, device, computer equipment and computer readable storage medium based on HID interface, which are described in detail below.

[0099] See also Figure 1 , Figure 1 An architectural diagram of a network communication system provided in an embodiment of the present application, the system may include a target network, the target network including a target host implanted with a Trojan horse, a HID interface device (mouse, keyboard) and a data return receiving device, the target host, the HID interface device (mouse, keyboard) and a data return receiving device.

[0100] Those skilled in the art will understand that Figure 1 The application environment shown in the figure is only one application scenario of the present application solution and does not constitute a limitation on the application scenario of the present application solution. Other application environments may also include Figure 1 More or less computer equipment as shown in Figure 1 Only one target network is shown in the figure. It can be understood that the system may also include one or more other services, which are not specifically limited here.

[0101] It should be noted that Figure 1 The application scenario diagram of the information hidden transmission system shown is only an example. The information hidden transmission system and scenario described in the embodiment of the present application are intended to more clearly illustrate the technical solution of the embodiment of the present application, and do not constitute a limitation on the technical solution provided in the embodiment of the present application. Ordinary technicians in this field can know that with the evolution of the signal analysis, control and management system and the emergence of new business scenarios, the technical solution provided in the embodiment of the present application is also applicable to similar technical problems.

[0102] The present invention discloses a hidden information transmission system, which utilizes a relay transmission type hidden information transmission system based on a HID interface, adopts a universal HID data interface device, is compatible with Windows, Linux, and MacOS operating systems without a special driver, and achieves the acquisition of high-value information of the target host. The data transmission is highly concealed, and the difficulty of obtaining high-value information is solved. The following are detailed descriptions.

[0103] Embodiment 1

[0104] See also Figure 2 , Figure 2 : is a schematic diagram of the composition of a relay transmission type information concealment transmission system based on the HID interface disclosed in this embodiment. Figure 2 The relay transmission type information concealment transmission system based on the HID interface described is applied to a network communication system, such as a local server or a cloud server of the network communication system, and this embodiment does not limit it. Figure 3 As shown, the relay transmission type information concealment transmission system based on the HID interface includes: a HID interface device 102, a target host 101 and a data return receiving device 103;

[0105] The HID interface device 102 is used to receive and process the control instruction information transmitted by the data return receiving device 103, implant the information collection Trojan into the target host 101, obtain and process the target transmission information transmitted by the target host 101, and transmit it to the data return receiving device 103;

[0106] It should be noted that the HID interface device 102 includes but is not limited to a mouse, a keyboard, and a power bank, which is not limited in the present invention;

[0107] The target host 101 is used to connect to the target network to receive and send network data, collect information using the implanted information collection Trojan horse, and obtain the target sending information;

[0108] It should be noted that the target host 101 includes but is not limited to an industrial computer, a server, a desktop computer, a notebook computer and a mobile phone, and the present invention is not limited thereto;

[0109] The data return receiving device 103 is used to receive the target sending information transmitted by the HID interface device 102;

[0110] It should be noted that the data return receiving device 103 includes but is not limited to an industrial computer, a server, a desktop computer and a notebook computer, and the present invention is not limited thereto;

[0111] The target host 101 and the HID interface device 102 are connected via USB interface data; the HID interface device 102 and the data return receiving device 103 are connected via wireless network data.

[0112] It can be seen that the relay transmission type information covert transmission system based on the HID interface described in this embodiment adopts a universal HID data interface device and is compatible with Windows, Linux, and MacOS operating systems without a special driver, thereby achieving the acquisition of high-value information of the target host, and the data feedback is highly concealed, solving the problem of obtaining high-value information.

[0113] Wherein, the HID interface device 102 includes a camouflage module, a USB shunt module, a main control MCU module and a communication module;

[0114] The camouflage module is used to camouflage the HID interface device;

[0115] It should be noted that the camouflage module disguises the HID interface device as a USB device of different forms, which is specifically designed according to the required form and is not limited in this embodiment;

[0116] The USB shunt module is used to receive the control instruction information sent by the main control MCU module and send it to the target host, and receive the target host return information sent by the target host and send it to the communication module;

[0117] It should be noted that, in this embodiment, the USB shunt module is implemented by using an stm32 chip, and the chip has a built-in USB interface that can directly connect the USB socket to the pins of the chip;

[0118] The main control MCU module is used to receive the control instruction information sent by the communication module;

[0119] It should be noted that the main control MCU module is implemented using the STM32F103 chip, which can control the operation of the system, with built-in 512KFlash, 64kSRAM, and CPU frequency of 72M;

[0120] It should be noted that the main control MCU module supports power supply stabilization and circuit reset functions and needs to be connected to an 8M external crystal oscillator;

[0121] The communication module is used to receive the control instruction information sent by the data feedback receiving device and send it to the main control MCU module, and send the target host feedback information to the data feedback receiving device;

[0122] It should be noted that the communication module adopts the SIM7100C chip, which supports dual-band GSM / GPRS / EDGE and dual-band UMTS / HSPA+, supports 2G / 3G / 4G mobile communication modes, has the characteristics of low power consumption and small size, and provides USB, SPI, UART, I2C and other interfaces to facilitate communication between modules;

[0123] The USB shunt module is connected to the target host via a USB interface; the main control MCU module is data-connected to the USB shunt module and the communication module respectively.

[0124] It can be seen that the HID interface device based on the HID interface described in this embodiment is compatible with Windows, Linux, and MacOS operating systems without the need for a special driver, and the data return is highly concealed, thus solving the problem of obtaining high-value information.

[0125] Embodiment 2

[0126] See also Figure 3 , Figure 3 This is a flow chart of a relay transmission method for concealed information transmission based on the HID interface disclosed in this embodiment. Figure 3 The relay transmission method based on the HID interface is applied to a network communication system, such as a local server or a cloud server in the network communication system, and is not limited in this embodiment. Figure 3 As shown, the relay transmission type information concealment transmission method based on the HID interface includes:

[0127] S1, based on the first control instruction information, the HID interface device implants an information collection Trojan into the target host;

[0128] It should be noted that the first control instruction information refers to the control instruction information in a communication standard format transmitted by the data feedback receiving device via a wireless network;

[0129] S2, using the information collection Trojan horse to search and process the target host file and target host information, obtain the target sending information and send it to the HID interface device;

[0130] S3, using the HID interface device, performing a first receiving process on the target transmission information to obtain target data information;

[0131] S4, using the HID interface device, sending the target data information to the data return receiving device;

[0132] S5, the data feedback receiving device performs a second receiving process on the target data information to obtain the target data.

[0133] It can be seen that the relay transmission type information covert transmission method based on the HID interface described in this embodiment is implemented, and high-value data is acquired and transmitted based on the HID interface. It is compatible with Windows, Linux, and MacOS operating systems without the need for a special driver, and the data return is highly concealed, which solves the problem of acquiring high-value information.

[0134] In an optional embodiment, in the above step S1, the HID interface device implants an information collection Trojan into the target host using the first control instruction information based on the data feedback receiving device, including:

[0135] S11, the HID interface device receives and obtains the first control instruction information sent by the data feedback receiving device;

[0136] It should be noted that the first control instruction information refers to the control instruction information sent by the data feedback receiving device and conforming to the wireless network communication standard;

[0137] It should be noted that the wireless network refers to a communication network established by one of Bluetooth, 2G wireless communication, 3G wireless communication and 4G wireless communication, which is not limited in this embodiment;

[0138] S12, decrypting the first control instruction information to obtain first control instruction decrypted information;

[0139] S13, based on the first communication protocol, parsing and processing the first control instruction decryption information to obtain network instruction type information;

[0140] It should be noted that the network instruction type information indicates whether to start the Trojan horse;

[0141] S14, determining whether the network instruction type information is equal to a first set value, and obtaining a network instruction type determination result;

[0142] It should be noted that the first setting value is set to 0, which means that the Trojan program is started;

[0143] S15, when the result of judging the network instruction type is yes, execute S16 to S18;

[0144] When the result of judging the network instruction type is no, executing S11;

[0145] S16, encapsulating the network instruction type information based on the second communication protocol to obtain second instruction information;

[0146] It should be noted that the encapsulation process refers to combining the network instruction type information according to the message structure of the second communication protocol:

[0147] S17, using the HID interface device, sending the second instruction information to the target host;

[0148] S18, processing the second instruction information and implanting the Trojan into the target host.

[0149] It can be seen that by implementing the relay transmission method based on the HID interface described in this embodiment, the HID interface device implants an information collection Trojan into the target host, and the data return is highly concealed, which solves the problem of obtaining high-value information.

[0150] In an optional embodiment, in the above step S18, the processing of the second instruction information to implant the Trojan into the target host includes:

[0151] S181, obtaining the second instruction information;

[0152] S182, parsing the second instruction information based on the second communication protocol to obtain first instruction function information;

[0153] It should be noted that the second communication protocol refers to the HID standard communication protocol;

[0154] The message format of the HID standard communication is shown in the following table:

[0155] Table 1 HID communication message format

[0156] 1byte lbyte 2byte 65535byte Type SμbType Length Data

[0157] It should be noted that the Type field in Table 1 indicates the message type, 0 is a request, 1 is a response; the Subtype field indicates the function type, 0 is collecting key information, 1 is collecting key files, and 2 is running instructions; the Length field indicates the length of the Date field; the Date field is the actual transmitted data;

[0158] It should be noted that the first instruction function information refers to the value of the Subtype field;

[0159] S183, determining whether the first instruction function information is equal to a second set value, and obtaining a first instruction function determination result;

[0160] It should be noted that, in this embodiment, the second setting value is set to 2, indicating that the Trojan program is running;

[0161] S184, when the first instruction function judgment result is yes, execute S185 to S187;

[0162] When the first instruction function judgment result is no, executing S181;

[0163] S185, encoding the Trojan horse payload to obtain an information collection Trojan horse;

[0164] It should be noted that the encoding process means performing Unicode encoding on the Trojan horse payload to obtain the information collection Trojan horse in text format;

[0165] S186, the HID interface device receives the Trojan HID input instruction;

[0166] S187, based on the Trojan HID input instruction, decoding and running the information collection Trojan, and implanting the information collection Trojan into the target host;

[0167] It should be noted that the Trojan HID typing instruction simulates keyboard keystrokes, uses cmd.exe to store the encoded Trojan and decoding script into the host, and decodes and runs it to complete the Trojan implantation.

[0168] It can be seen that the relay transmission type information covert transmission method based on the HID interface described in this embodiment is implemented to complete the implantation of the Trojan horse, lay the foundation for obtaining high-value information, and the data feedback is highly concealed, which solves the problem of obtaining high-value information.

[0169] In an optional embodiment, in the above step S2, the use of the information collection Trojan horse to search and process the target host file and the target host information, obtain the target sending information and send it to the HID interface device, including:

[0170] S21, the information collection Trojan receives and obtains the second control instruction information sent by the HID interface device;

[0171] It should be noted that the second control instruction information represents control instruction information that complies with HID standard communication;

[0172] S22, based on the second communication protocol message structure, processing the second control instruction information to obtain target sending information;

[0173] S23, sending the target sending information to the HID interface device.

[0174] It can be seen that the relay-type information covert transmission method based on the HID interface described in this embodiment is implemented. The information collection Trojan searches and processes the target host files and target host information, obtains the target sending information and sends it to the HID interface device. The data feedback is highly concealed, which solves the problem of obtaining high-value information.

[0175] In an optional embodiment, in the above step S22, the processing of the second control instruction information based on the second communication protocol message structure to obtain the target sending information includes:

[0176] S2201, based on the second communication protocol message structure, parse and process the second control instruction information to obtain second message type information, second instruction function information, second data length and second instruction data information;

[0177] It should be noted that the second message type information is the value of the Type field in Table 1;

[0178] It should be noted that the second instruction function information is the value of SubType in Table 1;

[0179] It should be noted that the second data length is the value of Length in Table 1;

[0180] It should be noted that the second instruction data information is the value of Data in Table 1;

[0181] S2202, determining whether the second message type information is equal to a third set value, and obtaining a second message type determination result;

[0182] It should be noted that, in this embodiment, the third setting value is set to 1, indicating that the second message type is a response message;

[0183] When the result of determining the second message type is yes, executing S2203 to S2204;

[0184] When the result of the second message type determination is no, the second instruction data information is updated to target sending information, and S2205 is executed;

[0185] S2203, encrypting the second instruction data information to obtain third instruction data information;

[0186] S2204, performing structured processing on the third instruction data information according to the second communication protocol message structure and using the second data length to obtain target sending information;

[0187] S2205, determining whether the target sending information is equal to a fourth set value, and obtaining a target sending determination result;

[0188] It should be noted that, in this embodiment, the fourth setting value is set to 0, indicating that key information collection is performed;

[0189] S2206, when the target sends a judgment result of yes, execute S2207 to S2208;

[0190] When the target sends a judgment result of no, executing S2209 to S2210;

[0191] S2207, the information collection Trojan performs key information extraction processing on the target host information according to the first preset rule to obtain target acquisition information;

[0192] S2208, encrypting the target acquisition information to obtain a target file to be sent;

[0193] S2209, the information collection Trojan performs key file extraction processing on the target host file according to the second preset rule to obtain the target acquisition file;

[0194] S2210, encrypting the target file to obtain a target file to be sent;

[0195] S2211, encapsulating the target file to be sent according to the first communication protocol to obtain target sending information

[0196] S221, based on the second communication protocol message structure, parse and process the second control instruction information to obtain second message type information, second instruction function information, second data length and second instruction data information;

[0197] It should be noted that the second message type information is the value of the Type field in Table 1;

[0198] It should be noted that the second instruction function information is the value of SubType in Table 1;

[0199] It should be noted that the second data length is the value of Length in Table 1;

[0200] It should be noted that the second instruction data information is the value of Data in Table 1;

[0201] S222, when the second message type information is 0, execute S223 to S224;

[0202] When the second message type information is 1, execute S225;

[0203] S223, encrypting the second instruction data information to obtain third instruction data information;

[0204] S224, performing structured processing on the third instruction data information according to the second communication protocol message structure and using the second data length to obtain target sending information;

[0205] It should be noted that the structured processing means that according to the second communication protocol message structure,

[0206] S225, when the second instruction function information is 0, execute S226;

[0207] When the second instruction function information is 1, execute S227;

[0208] S226, the information collection Trojan performs key information extraction processing on the target host information according to the first preset rule to obtain target acquisition information;

[0209] It should be noted that the first preset rule indicates information search based on keywords, which is mainly used to extract key information such as account name and password extraction, port opening information, service opening information, software installation information, and screen capture, and supports keyboard record acquisition of password input windows of RAR compression packages, Excel, Word, PPT, Putty, and Xshell;

[0210] S227, the information collection Trojan performs key file extraction processing on the target host file according to the second preset rule to obtain the target acquisition file;

[0211] It should be noted that the file search based on keywords is mainly used to extract files whose file names or file contents contain certain keywords;

[0212] S228, encrypting the target file to obtain a target file to be sent;

[0213] It should be noted that the encryption process refers to using the RSA2048 asymmetric encryption algorithm or the AES256 algorithm to encrypt the target acquisition file;

[0214] S229, encapsulating the target file to be sent according to the first communication protocol to obtain target sending information;

[0215] It should be noted that the encapsulation process refers to combining data of the target file to be sent according to the message structure of the first communication protocol.

[0216] It can be seen that the relay transmission type information covert transmission method based on the HID interface described in this embodiment is implemented, based on the second communication protocol message structure, the second control instruction information is processed to obtain the target sending information, and the data feedback is highly concealed, which solves the problem of obtaining high-value information.

[0217] In an optional embodiment, in the above step S3, the using the HID interface device to perform a first receiving process on the target transmission information to obtain the target data information includes:

[0218] S31, the HID interface device receives and obtains the target sending information;

[0219] S32, based on the second communication protocol, parsing and processing the target transmission information to obtain the target information to be transmitted;

[0220] S33, encapsulating the target information to be transmitted according to the first communication protocol to obtain target data information.

[0221] It can be seen that the relay transmission type information covert transmission method based on the HID interface described in this embodiment is implemented, and the HID interface device is used to perform a first receiving process on the target sent information to obtain the target data information. The data feedback is highly concealed, which solves the problem of obtaining high-value information.

[0222] In an optional embodiment, in the above step S32, the parsing and processing of the target transmission information based on the second communication protocol to obtain the target information to be transmitted includes:

[0223] S321, obtaining the target sending information;

[0224] S322, based on the second communication protocol message structure, parse and process the second control instruction information to obtain third message type information, third instruction function information, third data length and fourth instruction data information;

[0225] It should be noted that the third message type information is the value of the Type field in Table 1;

[0226] It should be noted that the third instruction function information is the value of SubType in Table 1;

[0227] It should be noted that the third data length is the value of Length in Table 1;

[0228] It should be noted that the fourth instruction data information is the value of Data in Table 1;

[0229] S323, when the third message type information is 0, execute S324;

[0230] When the third message type information is 1, execute S325;

[0231] S324, performing structured processing on the fifty-fourth instruction data information according to the second communication protocol message structure and using the third data length to obtain target information to be transmitted;

[0232] It should be noted that the structured processing means combining the target information to be transmitted according to the message structure of the second communication protocol.

[0233] It can be seen that the relay transmission type information covert transmission method based on the HID interface described in this embodiment is implemented. Based on the second communication protocol, the target information sent is parsed and processed to obtain the target information to be transmitted, laying the foundation for subsequent data transmission. The data feedback is highly concealed, which solves the problem of obtaining high-value information.

[0234] In an optional embodiment, in the above step S33, the target sending information is parsed based on the second communication protocol to obtain the target data information, including:

[0235] S331, obtaining the target sending information;

[0236] S332, using the second communication protocol message structure, parsing the target sending information to obtain the target sending information;

[0237] It can be seen that the relay transmission type information covert transmission method based on the HID interface described in this embodiment is implemented, based on the second communication protocol, the target information sent is parsed and processed to obtain the target information to be transmitted, which lays the foundation for the subsequent target data information feedback. The data feedback is highly concealed, which solves the problem of obtaining high-value information.

[0238] In an optional embodiment, in the above step S332, the use of the second communication protocol message structure to parse the target sending information to obtain the target sending information includes:

[0239] S3321, obtaining the target sending information;

[0240] S3322, based on the second communication protocol message structure, extract and process the target transmission information to obtain target data length information and the first target transmission data;

[0241] It should be noted that the extraction process means extracting the values ​​of the third and fourth bytes of the target transmission information to obtain the target data length information; extracting the Data value of the target transmission information to obtain the first target transmission data;

[0242] S3323, extracting the data of the target data length information in the first target sending data to obtain target sending information;

[0243] It can be seen that the relay transmission type information covert transmission method based on the HID interface described in this embodiment is implemented, and the target sending information is parsed and processed using the second communication protocol message structure to obtain the target sending information, thereby laying the foundation for the subsequent target data information return. The data return is highly concealed, which solves the problem of obtaining high-value information.

[0244] In an optional embodiment, in the above step S4, using the HID interface device to send the target data information to the data return receiving device includes:

[0245] S41, the HID interface device receives the first control instruction information transmitted by the data feedback receiving device;

[0246] S42, parsing the first control instruction information based on the first communication protocol to obtain third instruction type information;

[0247] It should be noted that the parsing process refers to extracting information according to the message structure of the first communication protocol;

[0248] S43, determining whether the third instruction type information is equal to a fifth set value, and obtaining a third instruction type determination result;

[0249] It should be noted that, in this embodiment, the fifth setting value is set to 0;

[0250] S44, when the third instruction type judgment result is yes, execute S45;

[0251] When the third instruction type determination result is no, executing S41;

[0252] S45, the HID interface device sends the target data information to the data feedback receiving device.

[0253] It can be seen that the relay transmission type information covert transmission method based on the HID interface described in this embodiment is implemented, and the target data information is sent to the data feedback receiving device using the HID interface device. The data feedback is highly concealed, which solves the problem of obtaining high-value information.

[0254] In an optional embodiment, in the above step S5, the data feedback receiving device performs a second receiving process on the target data information to obtain the target data, including:

[0255] S501, obtaining user demand instruction information;

[0256] S502, parsing the user demand instruction information to obtain user instruction type information;

[0257] It should be noted that the parsing process means extracting the value of the corresponding field based on the structure of the user demand instruction information to obtain the user instruction type information;

[0258] S503, determining whether the user instruction type information is equal to a sixth set value, and obtaining a user instruction type determination result;

[0259] It should be noted that, in this embodiment, the sixth setting value is set to 0, indicating that the user instruction type is a sending instruction;

[0260] S504, when the user instruction type is determined to be yes, execute S505 to S507;

[0261] When the user instruction type determination result is no, executing S508 to S510;

[0262] S505, encrypting the user demand instruction information to obtain encrypted user instruction information;

[0263] It should be noted that the encryption process refers to encryption process performed according to the RSA2048 asymmetric encryption algorithm or the AES256 algorithm;

[0264] S506, encapsulating the encrypted user instruction information based on the first communication protocol to obtain first control instruction information;

[0265] S507, the data feedback receiving device sends the first control instruction information to the HID interface device;

[0266] S508, the data feedback receiving device receives and obtains the target data information;

[0267] S509, parsing the target data information based on the first communication protocol to obtain first target data information;

[0268] S510, decrypting the first target data information to obtain target data;

[0269] It should be noted that the decryption process refers to the decryption process performed according to the RSA2048 asymmetric encryption algorithm or the AES256 algorithm.

[0270] It can be seen that the relay transmission type information covert transmission method based on the HID interface described in this embodiment is implemented, and the data feedback receiving device performs a second receiving process on the target data information to obtain the target data. The data feedback is highly concealed, which solves the problem of obtaining high-value information.

[0271] Embodiment 3

[0272] See also Figure 4 , Figure 4 : is a schematic diagram of the structure of a relay transmission type information concealment transmission device based on the HID interface disclosed in this embodiment. Figure 4 The described device can be applied to a network communication system, such as a local server or a cloud server in a network communication system, and this embodiment does not limit this. Figure 4 As shown, the device may include:

[0273] A memory 201 storing executable program codes;

[0274] a processor 202 coupled to the memory 201;

[0275] The processor 202 calls the executable program code stored in the memory 201 to execute the steps of the relay transmission method for concealed information transmission based on the HID interface described in the second embodiment.

[0276] Embodiment 4

[0277] This embodiment discloses a computer-readable storage medium storing a computer program for electronic data exchange, wherein the computer program enables a computer to execute the steps of the relay transmission method for concealed information transmission based on the HID interface described in the second embodiment.

[0278] Embodiment 5

[0279] This embodiment discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to enable a computer to execute the steps of the relay transmission method based on the HID interface described in the first embodiment.

[0280] The device embodiments described above are only illustrative, wherein the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, i.e., they may be located in one place, or they may be distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

[0281] Through the specific description of the above embodiments, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on such an understanding, the above technical solution can be essentially or partly contributed to the prior art in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, and the storage medium includes a read-only memory (ROM), a random access memory (RAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), a one-time programmable read-only memory (OTPROM), an electronically erasable rewritable read-only memory (EEPROM), a compact disc (CD-ROM) or other optical disc storage, a magnetic disk storage, a magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0282] Finally, it should be noted that the relay transmission type information covert transmission system, method and device based on the HID interface disclosed in this embodiment are only the preferred embodiments of the present invention, which are only used to illustrate the technical solution of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, ordinary technicians in this field should understand that it is still possible to modify the technical solutions recorded in the aforementioned embodiments, or to replace some of the technical features therein by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A relay transmission type information concealment transmission system based on HID interface, characterized in that: The system comprises: a HID interface device, a target host and a data return receiving device; The HID interface device is used to receive and process the control instruction information transmitted by the data return receiving device, implant an information collection Trojan into the target host, obtain and process the target transmission information transmitted by the target host, and transmit it to the data return receiving device; The target host is used to connect to the target network to receive and send network data, and uses the implanted information collection Trojan to collect information and obtain the target sending information; The data return receiving device is used to receive the target sending information transmitted by the HID interface device; The target host and the HID interface device are connected via USB interface data; the HID interface device and the data return receiving device are connected via wireless network data.

2. According to the HID interface-based relay transmission information concealment system of claim 1, it is characterized in that: The HID interface device includes a camouflage module, a USB shunt module, a main control MCU module and a communication module; The camouflage module is used to camouflage the HID interface device; The USB shunt module is used to receive the control instruction information sent by the main control MCU module and send it to the target host, and receive the target sending information sent by the target host and send it to the communication module; The main control MCU module is used to receive the control instruction information sent by the communication module; The communication module is used to receive the control instruction information sent by the data return receiving device and send it to the main control MCU module, and send the target sending information to the data return receiving device; The USB shunt module is connected to the target host via a USB interface; the main control MCU module is data-connected to the USB shunt module and the communication module respectively.

3. A relay transmission type information concealment transmission method based on HID interface, applied to the relay transmission type information concealment transmission system based on HID interface as claimed in claim 1 or claim 2, characterized in that: The method comprises: S1, based on the first control instruction information of the data feedback receiving device, the HID interface device implants an information collection Trojan into the target host; S2, using the information collection Trojan horse to search and process the target host file and target host information, obtain the target sending information and send it to the HID interface device; S3, using the HID interface device, performing a first receiving process on the target sending information to obtain target data information; S4, using the HID interface device, sending the target data information to the data return receiving device; S5, the data feedback receiving device performs a second receiving process on the target data information to obtain the target data.

4. The method for concealed information transmission based on the HID interface relay transmission according to claim 3 is characterized in that: The method of implanting an information collection Trojan into the target host by the HID interface device using the first control instruction information based on the data feedback receiving device includes: S11, the HID interface device receives and obtains the first control instruction information sent by the data feedback receiving device; S12, decrypting the first control instruction information to obtain first control instruction decrypted information; S13, based on the first communication protocol, parsing and processing the first control instruction decryption information to obtain network instruction type information; S14, determining whether the network instruction type information is equal to a first set value, and obtaining a network instruction type determination result; S15, when the result of judging the network instruction type is yes, execute S16 to S18; When the result of judging the network instruction type is no, executing S11; S16, encapsulating the network instruction type information based on the second communication protocol to obtain second instruction information; S17, using the HID interface device, sending the second instruction information to the target host; S18, processing the second instruction information and implanting the Trojan into the target host.

5. The method for concealed information transmission based on the HID interface relay transmission according to claim 3 is characterized in that: The method of using the information collection Trojan horse to search and process the target host file and the target host information, obtain the target sending information and send it to the HID interface device, includes: S21, the information collection Trojan receives and obtains the second control instruction information sent by the HID interface device; S22, based on the second communication protocol message structure, processing the second control instruction information to obtain target sending information; S23, sending the target sending information to the HID interface device.

6. The method for concealed information transmission based on the HID interface in relay transmission according to claim 5 is characterized in that: The processing of the second control instruction information based on the second communication protocol message structure to obtain target sending information includes: S2201, based on the second communication protocol message structure, parse and process the second control instruction information to obtain second message type information, second instruction function information, second data length and second instruction data information; S2202, determining whether the second message type information is equal to a third set value, and obtaining a second message type determination result; When the result of determining the second message type is yes, executing S2203 to S2204; When the result of the second message type determination is no, the second instruction data information is updated to target sending information, and S2205 is executed; S2203, encrypting the second instruction data information to obtain third instruction data information; S2204, performing structured processing on the third instruction data information according to the second communication protocol message structure and using the second data length to obtain target sending information; S2205, determining whether the target sending information is equal to a fourth set value, and obtaining a target sending determination result; S2206, when the target sends a judgment result of yes, execute S2207 to S2208; When the target sends a judgment result of no, executing S2209 to S2210; S2207, the information collection Trojan performs key information extraction processing on the target host information according to the first preset rule to obtain target acquisition information; S2208, encrypting the target acquisition information to obtain a target file to be sent; S2209, the information collection Trojan performs key file extraction processing on the target host file according to the second preset rule to obtain the target acquisition file; S2210, encrypting the target file to obtain a target file to be sent; S2211, encapsulate the target file to be sent according to the first communication protocol to obtain target sending information.

7. The method for concealed information transmission based on the HID interface in relay transmission according to claim 3 is characterized in that: The method of using the HID interface device to perform a first receiving process on the target transmission information to obtain target data information includes: S31, the HID interface device receives and obtains the target sending information; S32, based on the second communication protocol, parsing and processing the target transmission information to obtain the target information to be transmitted; S33, encapsulating the target information to be transmitted according to the first communication protocol to obtain target data information.

8. The method for concealed information transmission based on the HID interface relay transmission according to claim 7 is characterized in that: The step of parsing the target sent information based on the second communication protocol to obtain target data information includes: S331, obtaining the target sending information; S332, using the second communication protocol message structure, parse and process the target sending information to obtain target data information.

9. The method for concealed information transmission based on the HID interface relay transmission according to claim 3 is characterized in that: The method of using the HID interface device to send the target data information to the data return receiving device includes: S41, the HID interface device receives the first control instruction information transmitted by the data feedback receiving device; S42, parsing the first control instruction information based on the first communication protocol to obtain third instruction type information; S43, determining whether the third instruction type information is equal to a fifth set value, and obtaining a third instruction type determination result; S44, when the third instruction type judgment result is yes, execute S45; When the third instruction type determination result is no, executing S41; S45, the HID interface device sends the target data information to the data feedback receiving device.

10. The method for concealed information transmission based on the HID interface relay transmission according to claim 3, characterized in that: The data return receiving device performs a second receiving process on the target data information to obtain the target data, including: S501, obtaining user demand instruction information; S502, parsing the user demand instruction information to obtain user instruction type information; S503, determining whether the user instruction type information is equal to a sixth set value, and obtaining a user instruction type determination result; S504, when the user instruction type is determined to be yes, execute S505 to S507; When the user instruction type determination result is no, executing S508 to S510; S505, encrypting the user demand instruction information to obtain encrypted user instruction information; S506, encapsulating the encrypted user instruction information based on the first communication protocol to obtain first control instruction information; S507, the data feedback receiving device sends the first control instruction information to the HID interface device; S508, the data feedback receiving device receives and obtains the target data information; S509, parsing the target data information based on the first communication protocol to obtain first target data information; S510: decrypt the first target data information to obtain target data.

Images