Industrial internet covert communication system and method based on MQTT time behavior

Abstract

The invention provides an industrial internet covert communication system and method based on MQTT time behaviors, and relates to the technical field of network information security. Comprising an industrial gateway, a communication receiving end module and a communication sending end module, and the secret data is modulated to the time behavior of the server for forwarding the message by using the subscription mode and the QoS1 communication mechanism. The system performs identity authentication through a password field, theme subscription completes synchronization, a sender determines to forward or retransmit a message according to a data bit value (0 / 1), and a receiver analyzes data through timing. According to the scheme, the normal communication mode and the protocol field attribute of the MQTT are not changed, the concealment is high, the detection resistance is high, the transmission safety of the industrial secret-related data in an open link is guaranteed, and the method is suitable for industrial internet scenes of low-bandwidth and unstable network environments.

Description

Technical Field

[0001] The present invention relates to the field of network information security technology, and in particular to an industrial Internet covert communication system and method based on MQTT time behavior. Background Art

[0002] The Industrial Internet is a ubiquitous network connecting people, data, and machines. It enables the collection, transmission, and application of industrial data, optimizing production processes and management decisions, and improving the efficiency of manufacturing resource allocation and management services. Applications such as product traceability and predictive maintenance of industrial equipment often involve crucial confidential industrial data, such as core parameters throughout the production process and equipment operating status. However, as crucial trade secrets of manufacturing companies, this data could be subject to eavesdropping and theft by competitors during transmission from industrial gateways to cloud platforms over open wireless networks. Leakage of this information could result in significant economic losses for the company, impacting its core market competitiveness and even threatening its survival and development. Therefore, covert communication technologies can be employed to ensure the secure transmission of industrial data.

[0003] Network covert communication is a type of covert communication technology that uses legitimate network data streams as a carrier for information hiding, modulating secret information into these streams using various methods. It can be broadly categorized into two types: storage-based and time-based. Time-based covert communication modulates secret messages into information related to the transmission time of network data streams, offering superior concealment compared to storage-based covert communication. Covert communication based on inter-packet delay is a current research hotspot, but most existing algorithms for this type of communication generate anomalous data streams or signatures. This is because the embedding of secret messages alters the inherent temporal properties of normal carrier communications, increasing the probability of detection and analysis by the attacker. Furthermore, the introduction of synchronization mechanisms in time-based covert communication often increases algorithm complexity and system overhead.

[0004] Therefore, in the application scenarios of the industrial Internet, how to improve the security and effectiveness of covert communications and find suitable covert communication carriers have become urgent issues that need to be solved. Summary of the Invention

[0005] The purpose of the present invention is to overcome at least one technical problem existing in the prior art and to provide an industrial Internet covert communication system and method based on MQTT time behavior.

[0006] On the one hand, an embodiment of the present invention provides an industrial Internet covert communication system based on MQTT time behavior, the system comprising: an industrial gateway, a communication receiving end module and a communication sending end module; the industrial gateway is used to publish industrial data; the communication sending end module is integrated with a first identity authentication unit, a first information synchronization unit and a timing coding unit; the first identity authentication unit is used to verify the received CONNECT message embedded with the identity of the communication receiving end module, and determine whether to establish a covert communication connection; the first information synchronization unit is used to synchronize and confirm the SUBSCRIBE message transmitted by the received communication receiving end module in response to the establishment of a covert communication connection, and determine whether to start covert communication; the timing coding unit is used to start During covert communication, in the QoS1 communication mode, the industrial confidential data involved in the industrial data is modulated into the time behavior of the MQTT server forwarding message; the communication receiving end module is integrated with a second identity authentication unit, a second information synchronization unit and a timing decoding unit; the second identity authentication unit is used to send a CONNECT message embedded with an identity identifier to the first identity authentication unit; the second information synchronization unit is used to send a SUBSCRIBE message to the first information synchronization unit and receive a confirmation instruction returned by the first information synchronization unit; the timing decoding unit is used to parse and obtain industrial confidential data based on the confirmation instruction returned by the first information synchronization unit, by receiving a message with an agreed topic or retransmitting a message within a specified timestamp.

[0007] Furthermore, the communication sending end module is integrated in the MQTT server located in the data middle platform, and the communication receiving end module is integrated in the MATT client located in the industrial cloud platform.

[0008] Furthermore, the first identity authentication unit is used to reply a CONNACK message with a return code of 0 to the second identity authentication unit when the identity information matches successfully, indicating that the authentication is successful and a covert communication connection is established; if the identity information does not match, the first identity authentication unit is used to return a CONNACK message with a code other than 0 to the second identity authentication unit, disconnect the communication connection and exit the process.

[0009] Furthermore, the first information synchronization unit integrates a topic matching unit, a publishing status query unit and a synchronization confirmation result reply unit; the topic matching unit is used to confirm whether the topic subscribed by the communication receiving end module is consistent with the agreement between the two parties; the publishing status query unit is used to check whether there is a PUBLISH message being published on the topic; the synchronization confirmation result reply unit is used to reply with a SUBACK message if the topic matches and there is a publishable message, and the return code is 0, and the two parties start covert communication; if the topic does not match or there is no available publish message, reply with a SUBACK message and the return code is 1, indicating that the synchronization has failed and the communication is terminated.

[0010] Furthermore, the second information synchronization unit is configured to continuously monitor the SUBACK message, and if a SUBACK message with a return code of 0 is received, enter the timing decoding unit to perform a decoding operation, otherwise continue to wait.

[0011] Furthermore, the system also includes a data preprocessing module for extracting industrial confidential data from the industrial data and converting it into a binary bit stream S={s i |i=1,2,…,k}, where data bits s i ∈{0,1}.

[0012] Furthermore, the timing coding unit is used to map the binary bit stream into a message sending behavior, where bit 1 triggers immediate sending of a PUBLISH message, and bit 0 triggers message suppression and delayed retransmission.

[0013] Furthermore, the timing coding unit integrates a message forwarding subunit, a message suppression subunit and a retransmission control subunit; the message forwarding subunit is used to respond to bit 1 and forward the PUBLISH message containing the topic name to the communication receiving end module; the message suppression subunit is used to respond to bit 0 and discard the original PUBLISH message; the retransmission control subunit is used to start a timer and retransmit the PUBLISH message when the PUBACK confirmation message is not received within the timeout period.

[0014] Furthermore, the timing decoding unit is integrated with a window monitoring subunit, a bit decision subunit and a confirmation feedback subunit; the window monitoring subunit is used to set a time window of a preset length by starting a timer; the bit decision subunit is used to output bit 1 when a PUBLISH message with a subject name of the preset subject is received within the time window, otherwise, output bit 0, and receive a PUBLISH retransmission message with a subject name of the preset subject; the confirmation feedback subunit is used to reply a PUBACK confirmation message to the communication sending end module.

[0015] In the second aspect, an embodiment of the present invention provides an industrial Internet covert communication method based on MQTT time behavior, which is applied to the above-mentioned industrial Internet covert communication system based on MQTT time behavior. The method is applied to the communication sending end module and the communication receiving end module respectively, and the communication sending end module includes: step S10, verifying the received CONNECT message embedded with the identity of the communication receiving end module to determine whether to establish a covert communication connection; step S11, in response to establishing a covert communication connection, synchronously confirming the SUBSCRIBE message transmitted by the received communication receiving end module to determine whether to start covert communication; step S12, when starting covert communication, in QoS1 communication mode, modulating the industrial confidential data involved in the industrial data into the time behavior of the MQTT server forwarding message, including:

[0016] Step S120: For the i-th industrial confidential data bit s i , when s i =1, the communication sending end module forwards the PUBLISH message with the subject name of the agreed subject to the communication receiving end module; Step S121, for the i-th industrial confidential data bit s i , when s i =0, the communication sending end module actively discards the PUBLISH data packet with the subject name of the agreed subject and starts the timer; step S122, when no confirmation message is received within the specified timestamp, retransmits the PUBLISH message to the communication receiving end module; step S123, the communication sending end module receives the PUBACK confirmation message sent by the communication receiving end module; step S124, repeat steps S120 to S123 until all industrial confidential data bits s i The transmission is completed;

[0017] The communication receiving end module includes: step S20, sending a CONNECT message embedded with an identity identifier to the communication sending end module; step S21, sending a SUBSCRIBE message to the communication sending end module, and receiving a confirmation instruction returned by the communication sending end module; step S22, based on the confirmation instruction returned by the communication sending end module, by receiving a message or retransmission message of an agreed topic within a specified timestamp, parsing and obtaining industrial confidential data, including: step S220, setting a time window of preset duration by starting a timer; step S221, outputting bit 1 when receiving a PUBLISH message with a topic name of a preset topic sent by the communication sending end module within the time window; step S222, otherwise, outputting bit 0, and receiving a PUBLISH retransmission message with a topic name of a preset topic sent by the communication sending end module; step S223, replying to a PUBACK confirmation message; step S224, repeating steps S220 to S223 until all industrial confidential data are decoded.

[0018] On the other hand, the present invention also provides a computer-readable storage medium, which stores one or more instructions, and the computer instructions are used to enable the computer to execute the above-mentioned industrial Internet covert communication method based on MQTT time behavior.

[0019] On the other hand, the present invention provides an electronic device comprising: a memory and a processor; at least one program instruction is stored in the memory; the processor implements the above-mentioned industrial Internet covert communication method based on MQTT time behavior by loading and executing the at least one program instruction.

[0020] The beneficial effects of the present invention are as follows: the present invention uses the MQTT protocol as a carrier for covert communication of the industrial Internet, which itself has the advantages of low overhead, low bandwidth occupancy, low power consumption, low latency and high reliability. Under the premise of ensuring the normal transmission of industrial field data from the gateway to the cloud platform, the connection and subscription mode of the MQTT protocol is used to realize the identity authentication and synchronization confirmation of covert communication, and under the QoS1 communication mode of the MQTT protocol, the confidential industrial data is modulated into the time behavior of the MQTT server forwarding message by whether the PUBLISH message of the agreed topic is received within the specified timestamp. The normal communication mode of MQTT and the default attributes of the protocol field are not changed, the transmission of industrial data to the cloud is not affected, and it can effectively resist the detection of various steganographic analysis methods. Therefore, the present invention can significantly improve the anti-detection and security of the covert communication system of the industrial Internet. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The present invention will be further described below with reference to the accompanying drawings and examples.

[0022] Figure 1 This is a structural diagram of an industrial Internet covert communication system based on MQTT time behavior provided by Example 1 of the present invention.

[0023] Figure 2 This is a structural diagram of another industrial Internet covert communication system based on MQTT time behavior provided by Example 1 of the present invention.

[0024] Figure 3 This is a flowchart of the communication sending end module of an industrial Internet covert communication method based on MQTT time behavior provided by Example 2 of the present invention.

[0025] Figure 4 This is a flowchart of an industrial Internet covert communication method based on MQTT time behavior in a communication receiving end module provided by Example 2 of the present invention.

[0026] Figure 5 This is a partial block diagram of an electronic device provided in Example 4 of the present invention. DETAILED DESCRIPTION

[0027] Before discussing the exemplary embodiments in more detail, it should be mentioned that some exemplary embodiments are described as processes or methods depicted as flow charts. Although the flow charts describe the various operations as sequential processes, many of the operations therein can be implemented in parallel, concurrently, or simultaneously. In addition, the order of the various operations can be rearranged. The process can be terminated when its operation is completed, but can also have additional steps not included in the accompanying drawings. The process can correspond to a method, function, procedure, subroutine, subprogram, etc.

[0028] It should be understood that although the terms "first," "second," and the like may be used herein to describe various elements, these elements should not be limited by these terms. These terms are used solely to distinguish one element from another. For example, a first element may be referred to as a second element, and similarly, a second element may be referred to as a first element, without departing from the scope of the exemplary embodiments. The term "and / or" as used herein includes any and all combinations of one or more of the listed associated items.

[0029] The present invention will now be described in detail with reference to the accompanying drawings. This figure is a simplified schematic diagram, which only illustrates the basic structure of the present invention in a schematic manner, and therefore only shows the components related to the present invention.

[0030] For ease of understanding, the following professional terms are explained here:

[0031] MQTT (Message Queuing Telemetry Transport) is a lightweight messaging protocol based on a publish / subscribe model. It's specifically designed for industrial internet applications operating in low-bandwidth and unstable network environments. It provides real-time, reliable messaging services to connected devices using minimal code and limited bandwidth. It's a low-overhead, low-bandwidth instant messaging protocol and has become the primary method for transferring industrial internet data to the cloud. Therefore, MQTT has become a promising candidate for covert communication on the industrial internet.

[0032] Example 1

[0033] For ease of understanding, the invention concept is generally described before describing the embodiments of the present invention in detail: The present invention provides an industrial Internet covert communication system based on MQTT time behavior, using the MQTT protocol as a covert communication carrier in the industrial Internet. Based on an in-depth analysis of its system structure, communication mode and protocol, a time-behavior-based industrial Internet covert communication system, namely an encoding and decoding method, is designed. Utilizing the subscription / publish communication mode of the MQTT protocol, a covert communication method is designed: in the QoS1 communication mode of the MQTT protocol, confidential industrial data is modulated into the time behavior of the MQTT server forwarding message by determining whether a PUBLISH message of the agreed topic is received within a specified timestamp. Since the present invention does not change the default attributes of the MQTT normal communication mode and protocol fields, it does not affect the transmission of industrial data to the cloud, and can effectively resist detection by various steganographic analysis methods. Therefore, the present invention aims to provide an industrial Internet covert communication technology means with strong anti-detection capabilities to improve the security of industrial confidential data transmitted to the cloud in open wireless links.

[0034] The specific implementation is as follows:

[0035] like Figure 1-2 As shown, this is a structural diagram of an industrial Internet covert communication system based on MQTT time behavior provided by the present invention.

[0036] As an example, the system includes: an industrial gateway 3, a communication receiving end module 2 and a communication sending end module 1; the industrial gateway 3 is used to publish industrial data; the communication sending end module 1 is integrated with a first identity authentication unit 10, a first information synchronization unit 11 and a timing coding unit 12; the first identity authentication unit 10 is used to verify the received CONNECT message embedded with the identity identification of the communication receiving end module 2, and determine whether to establish a covert communication connection; the first information synchronization unit 11 is used to synchronize and confirm the SUBSCRIBE message transmitted by the received communication receiving end module 2 in response to the establishment of a covert communication connection, and determine whether to start covert communication; the timing coding unit 12 is used to, when covert communication is turned on, in the QoS1 communication mode, The industrial confidential data involved in the industrial data is modulated into the time behavior of the MQTT server forwarding message; the communication receiving end module 2 is integrated with a second identity authentication unit 20, a second information synchronization unit 21 and a timing decoding unit 22; the second identity authentication unit 20 is used to send a CONNECT message embedded with an identity identifier to the first identity authentication unit 10; the second information synchronization unit 21 is used to send a SUBSCRIBE message to the first information synchronization unit 11, and receive a confirmation instruction returned by the first information synchronization unit 11; the timing decoding unit 22 is used to parse and obtain industrial confidential data based on the confirmation instruction returned by the first information synchronization unit 11, by receiving a message or retransmitting a message on the agreed topic within the specified timestamp. Among them, the communication sending end module 1 is integrated in the MQTT server located in the data middle platform, and the communication receiving end module 2 is integrated in the MATT client located in the industrial cloud platform.

[0037] In some feasible implementations, the first identity authentication unit 10 is used to reply a CONNACK message with a return code of 0 to the second identity authentication unit 20 when the identity information matches successfully, indicating that the authentication is successful and a covert communication connection is established; if the identity information does not match, the first identity authentication unit 10 is used to return a CONNACK message with a code other than 0 to the second identity authentication unit, disconnect the communication connection and exit the process.

[0038] Preferably, the specific process of identity authentication is as follows: a. Identity information embedding: When sending a CONNECT message, the communication receiving end module 2 (MQTT client) embeds the identity information {{identity}} into the password field of the message body, for example, filling in "FactoryA_001" or other preset identity identification string (using UTF-8 encoding). b. Message sending and receiving: The CONNECT message containing the identity information is sent to the communication sending end module 1 (MQTT server) to initiate a connection request. c. Server-side authentication: After receiving the CONNECT message, the communication sending end module 1 (MQTT server) parses the {{identity}} information in the password field and compares it with a preset list of legal identities. If the identity information matches successfully (i.e., it belongs to an identity in the legal list), the sender responds with a CONNACK message with a return code of 0, indicating that the authentication is successful and the covert communication connection is established. If the identity information does not match (such as an illegal device or a forged identity), the sender responds with a CONNACK message with a return code non-0 (e.g., return codes 1-5, representing different connection rejection reasons), disconnects the communication connection, and exits the process. The Password field of the CONNECT message in the MQTT protocol is used to transmit identity information. This field was originally used for client authentication. This embodiment reuses it as an identity credential for covert communication. The default field attributes of the protocol are not modified to ensure compatibility. Since the identity information needs to be agreed upon in advance by the communicating parties through a secure channel (such as offline configuration or encrypted transmission), attackers cannot easily forge it, thereby preventing unauthorized devices from accessing the covert communication link. The authentication process fully follows the connection process of the MQTT protocol and does not require additional protocol extensions, which reduces system overhead and complexity while ensuring the legitimacy and security of covert communication. Specifically, assuming that the legal identity information is "ManufacturerX_ProductionLine01", when the Password field in the CONNECT message sent by the recipient is this string, the server verifies and establishes a connection; if the Password sent by the attacker is "FakeID", the server replies with a CONNACK rejecting the connection, preventing it from participating in covert communication.

[0039] In some feasible implementations, the first information synchronization unit 11 is integrated with a topic matching unit 110, a publishing status query unit 111 and a synchronization confirmation result reply unit 112; the topic matching unit 110 is used to confirm whether the topic subscribed by the communication receiving end module 2 is consistent with the agreement between the two parties; the publishing status query unit 111 is used to check whether there is a PUBLISH message being published on the topic; the synchronization confirmation result reply unit 112 is used to reply with a SUBACK message if the topic matches and there is a publishable message, and the return code is 0, and the two parties start covert communication; if the topic does not match or there is no available publish message, reply with a SUBACK message and a return code of 1, indicating that the synchronization has failed and the communication is terminated.

[0040] Preferably, the synchronization confirmation process includes: a. The receiver initiates a subscription request: the communication receiving end module 2 sends a SUBSCRIBE message to the communication sending end module 1, wherein: the topic filter is set to the covert communication topic name {{covert_topic}} agreed upon by both parties; the quality of service QoS is set to 1 (to ensure that the message is delivered at least once, laying the foundation for the subsequent retransmission mechanism). b. The sender verifies the topic and status: after receiving the SUBSCRIBE message, the communication sending end module 1 performs the following checks: topic matching: confirming that the topic {{covert_topic}} subscribed by the receiver is consistent with the agreement between the two parties; publishing status query: checking whether there is a PUBLISH message being published on the topic (to ensure that the topic is in an available state). c. The sender replies with the synchronization confirmation result: if the topic matches and there are publishable messages, the sender replies with a SUBACK message, and the return code is 0, indicating that "the covert communication conditions are met and the synchronization confirmation is successful", and the two parties can start communication; if the topic does not match or there are no available publish messages, the sender replies with a SUBACK message, and the return code is 1, indicating that "synchronization failed" and the communication is terminated. The above implementation utilizes the SUBSCRIBE and SUBACK message exchange process in the MQTT protocol to embed the synchronization confirmation of covert communication into the normal protocol process, eliminating the need for additional synchronization protocol development and reducing system overhead. QoS = 1 mode requires the receiver to reply with a PUBACK confirmation message before the sender considers the message transmission successful. This mechanism ensures the consistency of the communication status between the two parties during the synchronization phase, avoiding synchronization failures caused by network latency. The sender verifies the topic name and publishing status to ensure that the receiver is subscribed to a legitimate covert topic and that the topic is active, preventing the failure of covert communication due to topic failure.

[0041] The purpose of synchronization confirmation is: identity and subject consistency verification: to ensure that both communicating parties use the same hidden subject to avoid mis-sending of messages or interception by a third party; communication resource readiness confirmation: to confirm that the sender has the ability to forward the hidden message (the subject exists and can be published) and the receiver is ready to receive the message; time behavior modulation basis: after the synchronization is completed, both parties realize the modulation and decoding of confidential data in time behavior based on the timestamp mechanism of QoS=1 mode (such as Timer_1, Time_Stamp_1, etc.). If the synchronization confirmation fails (the sender replies with a SUBACK return code of 1), the system will directly exit the covert communication process to avoid invalid data transmission. At this time, both parties need to recheck the following content: Hidden subject name (preset subject)

[0042] The following checks are performed to ensure that {{covert_topic}} is shared consistently; the sender's topic publishing status is normal; and the network connection is stable, ensuring that SUBSCRIBE and SUBACK messages are transmitted correctly. Through the above process, this embodiment implements an efficient and reliable synchronization confirmation mechanism for covert communication, ensuring communication security while avoiding the complexity and overhead associated with traditional synchronization mechanisms.

[0043] In some feasible implementations, the second information synchronization unit 21 is configured to continuously monitor SUBACK messages. If a SUBACK message with a return code of 0 is received, the second information synchronization unit 21 enters the timing decoding unit for decoding. Otherwise, the second information synchronization unit 21 continues to wait. That is, the communication receiving end module 2 will not start the subsequent workflow until it receives a successful synchronization command.

[0044] In some feasible implementations, the system further includes a data preprocessing module 4 for extracting confidential industrial data from the industrial data and converting it into a binary bit stream S={s i |i=1,2,…,k}, where data bits s i ∈{0,1}.

[0045] Preferably, industrial confidential data mainly refers to: core parameters of product production: such as manufacturing process parameters, equipment operating status data, product quality inspection indicators, etc.; predictive maintenance data of industrial equipment: such as real-time monitoring data such as vibration, temperature, energy consumption, etc. collected by equipment sensors; other commercial confidential data: such as production process optimization plans, supply chain management data, order scheduling information, etc. Ways to obtain industrial confidential data (based on industrial Internet scenarios): Industrial field equipment collection: through sensors, PLCs (programmable logic controllers) and other equipment deployed on the production line, real-time collection of equipment operating status, process parameters and other data. For example: sensors monitor machine tool speed and tool wear; smart instruments collect workshop temperature, humidity, and energy consumption data. Protocol conversion and aggregation of industrial gateways: As an intermediate node between field equipment and the network, the industrial gateway obtains data from various devices through industrial protocols such as OPC UA, Modbus, and CANopen, converts it into a format transmittable by the MQTT protocol, and then publishes it to the MQTT server. Processing and screening of the data center: The data center (the node where the MQTT server is located) cleans and aggregates the original data uploaded by the industrial gateway, and screens out sensitive data involving commercial secrets (such as core process parameters, undisclosed equipment failure prediction model data, etc.) as the source of confidential data for covert communication. Specifically, the processing flow for industrial confidential data described in this embodiment is as follows: a. Data digitization and binary conversion: Regardless of whether the original data is an analog signal or a digital signal, it must be converted into a binary data stream S = {s i |i=1,2,···,k}, where data bits s i ∈{0,1}, each bit s i Corresponding to the smallest unit of information that needs to be transmitted in covert communication.

[0046] In some feasible implementations, the timing coding unit 12 is configured to map a binary bit stream into a message sending behavior, where bit 1 triggers immediate sending of a PUBLISH message, and bit 0 triggers message suppression and delayed retransmission.

[0047] Preferably, the timing coding unit 12 is integrated with a message forwarding subunit 120, a message suppression subunit 121 and a retransmission control subunit 122; the message forwarding subunit 120 is used to respond to bit 1 and forward the PUBLISH message containing the topic name to the communication receiving end module 2; the message suppression subunit 121 is used to respond to bit 0 and discard the original PUBLISH message; the retransmission control subunit 122 is used to start a timer and retransmit the PUBLISH message when no PUBACK confirmation message is received within a timeout period. Specifically, for the i-th confidential data bit s i ,like Figure 2 As shown, according to its value, it is divided into the following two cases: when s i=1, the covert communication sender (MQTT server) forwards the PUBLISH message with the topic name covert_topic to the receiver (MQTT client), where the quality of service QoS is 1; when s i =0, the covert communication sender (MQTT server) actively discards the PUBLISH data packet with the topic name overt_topic and starts timer Timer_1. If no confirmation message is received within the specified timestamp Time_Stamp_1, the PUBLISH message is retransmitted to the communication receiving end module 2 (MQTT client), where the retransmission identifier DUP is 1 and the quality of service QoS is 1.

[0048] In some feasible embodiments, the timing decoding unit 22 is integrated with a window monitoring subunit 220, a bit decision subunit 221 and a confirmation feedback subunit 222; the window monitoring subunit 220 is used to set a time window of a preset length by starting a timer; the bit decision subunit 221 is used to output bit 1 when a PUBLISH message with a subject name of the preset subject is received within the time window, otherwise, output bit 0 and receive a PUBLISH retransmission message with a subject name of the preset subject; the confirmation feedback subunit 222 is used to reply a PUBACK confirmation message to the communication sending end module 1.

[0049] Preferably, the communication receiving end module 2 starts the timer Timer_2; determines whether a PUBLISH message with the subject name covert_topic is received within the specified timestamp Time_Stamp_2, and if received, parses and obtains the industrial confidential data bit s i '=1; otherwise, parse to obtain industrial confidential data bit s i '=0, and receives the PUBLISH retransmission message with the topic name covert_topic; the communication receiving end module 2 replies with a PUBACK confirmation message. Specifically, the decoded industrial confidential data is finally presented in the form of a binary stream, and its basic unit is 1 or 0. However, these binary streams composed of 1 and 0 can represent various types of industrial confidential data after further processing and conversion, such as text, images, videos, numerical values ​​and other information, not just isolated 1 or 0. In this system, the communication receiving end module 2 parses each bit value (1 or 0) in the binary stream by judging whether a normal PUBLISH message or retransmission message is received within the specified time, and then combines these bit values ​​to form a complete binary stream, and then restores the binary stream to the original industrial confidential data according to specific encoding rules and data formats.

[0050] In the above implementation, the MQTT standard retransmission mechanism (QoS=1) is used to transmit information, which does not generate abnormal traffic characteristics and has high concealment; there is no need to modify the MQTT protocol stack and it can be directly deployed on the existing industrial Internet platform with strong compatibility; identity authentication and communication synchronization reuse the standard MQTT handshake process, reducing development costs; the communication behavior is highly similar to the retransmission phenomenon caused by network congestion, which improves anti-detection capabilities.

[0051] It is worth noting that all modules involved in this embodiment are logical units. In actual applications, a logical unit can be a physical unit, a part of a physical unit, or a combination of multiple physical units. Furthermore, to highlight the innovations of this invention, this embodiment does not include units that are not closely related to solving the technical problems proposed by this invention. However, this does not mean that other units do not exist in this embodiment.

[0052] Example 2

[0053] See also Figure 3-4 , this embodiment provides a flow chart of an industrial Internet covert communication method based on MQTT time behavior.

[0054] As an example, the method is applied to the industrial Internet covert communication system based on MQTT time behavior described in Example 1, and the method is applied to the communication sending end module and the communication receiving end module respectively.

[0055] Combine Figure 3 As shown, the communication sending end module includes:

[0056] Step S10: Verify the received CONNECT message embedded with the identity of the communication sending end module to determine whether a covert communication connection is established.

[0057] Step S11: In response to establishing the covert communication connection, synchronously confirm the received SUBSCRIBE message transmitted by the communication sending end module to determine whether to start the covert communication.

[0058] Step S12: When covert communication is enabled, in QoS1 communication mode, the confidential industrial data in the industrial data is modulated into the time behavior of the MQTT server forwarding message, including:

[0059] Step S120: For the i-th industrial confidential data bit s i , when s i =1, the communication sending end module forwards the PUBLISH message with the subject name as the agreed subject to the communication receiving end module.

[0060] Step S121: For the i-th industrial confidential data bit s i , when s i =0, the communication sending end module actively discards the PUBLISH data packet with the subject name as the agreed subject and starts the timer.

[0061] Step S122: When no confirmation message is received within the specified timestamp, retransmit the PUBLISH message to the communication receiving end module.

[0062] Step S123: The communication sending end module receives the PUBACK confirmation message sent by the communication receiving end module.

[0063] Step S124, repeat steps S120 to S123 until all industrial confidential data bits s i Transfer complete.

[0064] Combine Figure 4 As shown, the communication receiving end module includes:

[0065] Step S20: Send a CONNECT message embedded with an identity identifier to the communication sending end module.

[0066] Step S21: Send a SUBSCRIBE message to the communication sending end module, and receive a confirmation instruction returned by the communication sending end module.

[0067] Step S22: Based on the confirmation instruction returned by the communication sending end module, by receiving a message or retransmitted message with an agreed subject within a specified timestamp, parsing and obtaining industrial confidential data, including:

[0068] Step S220: Setting a time window of a preset duration by starting a timer.

[0069] Step S221: Output bit 1 when receiving a PUBLISH message with a preset topic name sent by the communication sending end module within the time window.

[0070] Step S222: Otherwise, output bit 0, and receive the PUBLISH retransmission message with the topic name being the preset topic sent by the communication sending end module.

[0071] Step S223: reply with a PUBACK confirmation message.

[0072] Step S224: Repeat steps S220 to S223 until all industrial confidential data are decoded.

[0073] It is not difficult to find that this embodiment is a method example corresponding to the first embodiment, and this embodiment can be implemented in conjunction with the first embodiment. The relevant technical details mentioned in the first embodiment are still valid in this embodiment, and to reduce repetition, they are not repeated here. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the first embodiment.

[0074] Example 3

[0075] An embodiment of the present invention further provides a storage medium storing a method for covert communication of an industrial internet based on MQTT time behavior. When executed by a processor, the program for covert communication of an industrial internet based on MQTT time behavior implements the steps of the method for covert communication of an industrial internet based on MQTT time behavior as described above. Because this storage medium utilizes all the technical solutions of all the aforementioned embodiments, it at least has all the beneficial effects brought about by the technical solutions of the aforementioned embodiments, and no further details are given here.

[0076] Example 4

[0077] See also Figure 5 An embodiment of the present invention also provides an electronic device, including: a memory and a processor; at least one program instruction is stored in the memory; the processor loads and executes the at least one program instruction to implement the industrial Internet covert communication method based on MQTT time behavior provided in Example 2.

[0078] The memory 702 and processor 701 are connected using a bus. The bus can include any number of interconnected buses and bridges, connecting various circuits of one or more processors 701 and memory 702. The bus can also connect various other circuits such as peripheral devices, voltage regulators, and power management circuits. These are all well known in the art and, therefore, are not described further herein. The bus interface provides an interface between the bus and the transceiver. The transceiver can be a single component or multiple components, such as multiple receivers and transmitters, providing a unit for communicating with various other devices over a transmission medium. Data processed by the processor 701 is transmitted over a wireless medium via an antenna. Furthermore, the antenna receives data and transmits it to the processor 701.

[0079] The processor 701 is responsible for managing the bus and general processing, and can also provide various functions, including timing, peripheral interfaces, voltage regulation, power management, and other control functions. The memory 702 can be used to store data used by the processor 701 when performing operations.

[0080] The above is only an embodiment of the present invention. Common knowledge such as the known specific structures and characteristics in the scheme is not described in detail here. Ordinary technicians in the field are aware of all common technical knowledge in the technical field of the invention before the application date or priority date, can obtain all existing technologies in the field, and have the ability to apply conventional experimental means before that date. Ordinary technicians in the field can improve and implement this scheme in combination with their own abilities under the inspiration given by this application. Some typical known structures or known methods should not become obstacles for ordinary technicians in the field to implement this application. It should be pointed out that for those skilled in the art, without departing from the structure of the present invention, several variations and improvements can be made, which should also be regarded as the scope of protection of the present invention. These will not affect the effect of the implementation of the present invention and the practicality of the patent. The scope of protection required by this application shall be based on the content of its claims, and the specific implementation methods and other records in the specification can be used to interpret the content of the claims.

Claims

1. An industrial Internet covert communication system based on MQTT time behavior, characterized in that: The system includes: an industrial gateway, a communication receiving end module and a communication sending end module; The industrial gateway is used to publish industrial data; The communication sending end module is integrated with a first identity authentication unit, a first information synchronization unit and a timing coding unit; The first identity authentication unit is used to verify the received CONNECT message embedded with the identity identifier of the communication receiving end module to determine whether to establish a covert communication connection; The first information synchronization unit is used to synchronize and confirm the SUBSCRIBE message transmitted by the communication receiving end module in response to establishing the covert communication connection, and determine whether to start the covert communication; The timing coding unit is used to modulate the industrial confidential data involved in the industrial data into the time behavior of forwarding messages by the MQTT server in the QoS1 communication mode when covert communication is enabled; The communication receiving end module is integrated with a second identity authentication unit, a second information synchronization unit and a timing decoding unit; The second identity authentication unit is used to send a CONNECT message embedded with an identity identifier to the first identity authentication unit; The second information synchronization unit is used to send a SUBSCRIBE message to the first information synchronization unit and receive a confirmation instruction returned by the first information synchronization unit; The timing decoding unit is used to parse and obtain industrial confidential data based on the confirmation instruction returned by the first information synchronization unit by receiving a message or retransmitted message with an agreed topic within a specified timestamp.

2. The industrial Internet covert communication system based on MQTT time behavior according to claim 1 is characterized in that: The communication sending end module is integrated in the MQTT server located in the data center, and the communication receiving end module is integrated in the MATT client located in the industrial cloud platform.

3. The industrial Internet covert communication system based on MQTT time behavior according to claim 1 is characterized in that: The first identity authentication unit is configured to reply to the second identity authentication unit with a CONNACK message having a return code of 0 when the identity information matches successfully, indicating that the authentication is successful and a covert communication connection is established; If the identity information does not match, a CONNACK message with a code other than 0 is returned to the second identity authentication unit, the communication connection is disconnected and the process is exited.

4. The industrial Internet covert communication system based on MQTT time behavior according to claim 1 is characterized in that: The first information synchronization unit is integrated with a topic matching unit, a publishing status query unit and a synchronization confirmation result reply unit; The topic matching unit is used to confirm whether the topic subscribed by the communication receiving end module is consistent with the agreement between the two parties; The publishing status query unit is used to check whether there is a PUBLISH message being published on the topic; The synchronization confirmation result reply unit is used to reply with a SUBACK message if the topic matches and there is a publishable message, and the return code is 0, and both parties start covert communication; if the topic does not match or there is no available publishable message, reply with a SUBACK message and the return code is 1, indicating that the synchronization failed and the communication is terminated.

5. The industrial Internet covert communication system based on MQTT time behavior according to claim 4 is characterized in that: The second information synchronization unit is used to continuously monitor the SUBACK message. If a SUBACK message with a return code of 0 is received, the second information synchronization unit enters the timing decoding unit to perform a decoding operation. Otherwise, the second information synchronization unit continues to wait.

6. The industrial Internet covert communication system based on MQTT time behavior according to claim 1 is characterized in that: The system also includes a data preprocessing module for extracting industrial confidential data from the industrial data and converting it into a binary bit stream S={s i |i=1,2,…,k}, where data bits s i ∈{0,1}.

7. The industrial Internet covert communication system based on MQTT time behavior according to claim 6 is characterized in that: The timing coding unit is used to map the binary bit stream into a message sending behavior, where bit 1 triggers immediate sending of a PUBLISH message, and bit 0 triggers message suppression and delayed retransmission.

8. The industrial Internet covert communication system based on MQTT time behavior according to claim 7 is characterized in that: The timing coding unit is integrated with a message forwarding subunit, a message suppression subunit and a retransmission control subunit; The message forwarding subunit is used to respond to bit 1 and forward the PUBLISH message containing the topic name to the communication receiving end module; The message suppression subunit is used to respond to bit 0 and discard the original PUBLISH message; The retransmission control subunit is used to start a timer and retransmit the PUBLISH message when no PUBACK confirmation message is received within a timeout period.

9. The industrial Internet covert communication system based on MQTT time behavior according to claim 8 is characterized in that: The timing decoding unit is integrated with a window monitoring subunit, a bit decision subunit and a confirmation feedback subunit; The window monitoring subunit is used to set a time window of preset length by starting a timer; The bit decision subunit is used to output bit 1 when receiving a PUBLISH message with a subject name of the preset subject within the time window; otherwise, output bit 0 and receive a PUBLISH retransmission message with a subject name of the preset subject; The confirmation feedback subunit is used to reply a PUBACK confirmation message to the communication sending end module.

10. A method for covert communication of the industrial Internet based on MQTT time behavior, the method being applied to the covert communication system of the industrial Internet based on MQTT time behavior according to any one of claims 1 to 9, characterized in that: The method is applied to a communication sending end module and a communication receiving end module respectively, and the communication sending end module includes: Step S10: Verify the received CONNECT message embedded with the communication receiving end module identity to determine whether a covert communication connection is established; Step S11: In response to establishing the covert communication connection, synchronously confirming the SUBSCRIBE message transmitted by the communication receiving end module, and determining whether to start the covert communication; Step S12: When covert communication is enabled, in QoS1 communication mode, the confidential industrial data in the industrial data is modulated into the time behavior of the MQTT server forwarding message, including: Step S120: For the i-th industrial confidential data bit s i , when s i =1, the communication sending end module forwards the PUBLISH message with the subject name of the agreed topic to the communication receiving end module; Step S121: For the i-th industrial confidential data bit s i , when s i =0, the communication sending end module actively discards the PUBLISH data packet with the subject name as the agreed subject and starts the timer; Step S122: If no confirmation message is received within the specified timestamp, retransmit the PUBLISH message to the communication receiving end module; Step S123: The communication sending end module receives the PUBACK confirmation message sent by the communication receiving end module; Step S124: Repeat steps S120 to S123 until all industrial confidential data bits s i The transmission is completed; The communication receiving end module includes: Step S20: Send a CONNECT message embedded with an identity identifier to the communication sending end module; Step S21: Send a SUBSCRIBE message to the communication sending end module, and receive a confirmation instruction returned by the communication sending end module; Step S22: Based on the confirmation instruction returned by the communication sending end module, by receiving a message or retransmitted message with an agreed subject within a specified timestamp, parsing and obtaining industrial confidential data, including: Step S220: Setting a time window of a preset duration by starting a timer; Step S221: when receiving a PUBLISH message with a preset topic name sent by the communication sending end module within the time window, output bit 1; Step S222: Otherwise, output bit 0 and receive the PUBLISH retransmission message with the topic name of the preset topic sent by the communication sending end module; Step S223: reply with a PUBACK confirmation message; Step S224: Repeat steps S220 to S223 until all industrial confidential data are decoded.

Images