A future covert channel communication method based on MQTT

Abstract

The application provides a future covert channel communication method based on MQTT, and the method comprises the following steps: an encoding method based on an m sequence is used by a sending party to encode a secret message to be transmitted, a signal pointer is generated, and a transmission time of the secret message is pre-announced to a receiving party through a small amount of control traffic; a legal MQTT traffic which does not reach the receiving party in a third-party network is used as a transmission carrier to establish a covert communication channel without modifying the original traffic content; and based on the covert communication channel, the receiving party listens to a specified MQTT topic, and a secret message is parsed and restored from subsequent legal traffic according to the signal pointer. The application completes covert communication without changing the content of the legal traffic, significantly improves the anti-detection capability of the channel, and has high throughput and robustness while ensuring communication concealment.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of covert communication technology in information security, and in particular to a future covert channel communication method based on MQTT. BACKGROUND

[0002] A network covert channel (NCC) is a secret communication channel hidden in normal network communication, which transmits hidden information using normal traffic to bypass detection and ensure information security. Existing covert channel technologies mainly achieve hidden transmission by embedding secret information in network traffic, and are divided into three main routes: self-generated traffic-based, third-party traffic-based, and non-embedded covert channels.

[0003] Although the self-generated traffic-based scheme can effectively mix legitimate traffic and hidden traffic, it can only achieve interference through delay adjustment and cannot truly carry secret information. The third-party traffic-based scheme achieves hidden transmission by innovatively using network protocol headers, but usually needs to modify the original traffic and has the problems of limited capacity and easy detection. The non-embedded scheme transmits information by referencing historical data packets, which has strong concealment, but has problems such as low transmission efficiency and hash collision.

[0004] Existing technologies generally have the defects of modifying carrier traffic content, low transmission efficiency, or easy detection, and there is an urgent need for a new covert channel scheme that does not need to modify traffic content and can improve concealment and communication efficiency. SUMMARY

[0005] The present application aims to at least partially solve one of the technical problems in the related art.

[0006] To this end, a first object of the present application is to provide a future covert channel communication method based on MQTT.

[0007] A second object of the present application is to provide an electronic device.

[0008] A third object of the present application is to provide a computer-readable storage medium.

[0009] A fourth object of the present application is to provide a computer program product.

[0010] To achieve the above objects, the first aspect of the present application provides a future covert channel communication method based on MQTT, comprising:

[0011] The sender uses an encoding method based on m-sequence to encode the secret message to be transmitted, generates a signal pointer, and preannounces the transmission time of the secret message to the receiver through a small amount of control traffic.

[0012] Using the legitimate MQTT traffic not reaching the receiver in the third-party network as a transmission carrier, a covert communication channel is established without modifying the original traffic content.

[0013] Based on the covert communication channel, the receiver listens to the specified MQTT topic, and according to the signal pointer, the secret message is parsed and restored from the subsequent legitimate traffic.

[0014] Optionally, the sender uses an m-sequence-based encoding method to encode the secret message to be transmitted, generates a signal pointer, and preannounces the transmission time of the secret message to the receiver through a small amount of control traffic, including:

[0015] The sender and the receiver agree on an m-sequence of i bits

[0016] The sender uses the m-sequence to sequentially scan the payload of the data packet, and each time the i-bit binary sequence q of the payload and the i-1 shifted version sequences [q1, q2, …, qi-1] of the sequence are calculated by performing bitwise AND operation with the sequence i-1 ] to obtain the sum value s; when s = 0, it indicates that the sequence used for calculation is the same as the sequence , which is considered as a collision;

[0017] After the collision occurs, the shifted relationship between the sequence and the original sequence q is checked to obtain the shift number x, and whether the x value meets the requirements of the secret message binary sequence b is checked according to the set encoding rule;

[0018] If the x value meets the requirements of the secret message binary sequence b, it is judged that the target data packet capable of carrying the secret message is found, the signal pointer is generated and sent to the receiver through a small amount of control traffic, and the transmission time of the target data packet is preannounced.

[0019] Optionally, the use of legitimate MQTT traffic not reaching the receiver in the third-party network as a transmission carrier to establish a covert communication channel without modifying the original traffic content includes:

[0020] The sender and the receiver establish a subscription-published communication connection through the MQTT protocol, the sender publishes a specific topic, and the receiver subscribes to the specific topic;

[0021] Using the unaltered MQTT traffic generated by the third-party network node as a covert message carrier; wherein the transmission of the secret message completely depends on the timing and payload content of the future-arriving legitimate data packets, without introducing additional covert channel traffic.

[0022] ​Optionally, the receiver listens to the specified MQTT topic based on the covert communication channel, and parses and restores the secret message from the subsequent legitimate traffic according to the pointer, including:

[0023] The receiver continuously listens to the target topic through the MQTT protocol, and waits for the control traffic indication from the sender.

[0024] After the receiver receives the signal pointer through the covert communication channel, according to the prompt of the signal pointer, the secret message is parsed and restored from the subsequent legitimate traffic according to the pre-agreed m-sequence encoding rule, and the covert communication is completed.

[0025] To achieve the above purpose, the second aspect of the present application provides an electronic device, comprising: a processor, and a memory connected with the processor in communication;

[0026] The memory stores computer execution instructions;

[0027] The processor executes the computer execution instructions stored in the memory to realize the method of any one of the first aspect.

[0028] To achieve the above purpose, the third aspect of the present application provides a computer readable storage medium, the computer readable storage medium stores computer execution instructions, the computer execution instructions are executed by the processor to realize the method of any one of the first aspect.

[0029] To achieve the above purpose, the fourth aspect of the present application provides a computer program product, the computer program is executed by the processor to realize the method of any one of the first aspect.

[0030] The technical scheme provided by the embodiments of the present application at least brings the following beneficial effects:

[0031] By pointing to the matching data packet that has not arrived at the receiving end to deliver the secret message, the technical effect of completing the covert communication by only transmitting the control pointer is realized innovatively, and the technical defect that the secret message must be sent through the channel traffic in the traditional scheme is completely avoided; an encoding method based on m-sequence is also proposed, which improves the transmission efficiency of the covert channel scheme.

[0032] Additional aspects and advantages of the present application will be in part apparent and in part pointed out hereinafter in the description of the application, which will be more fully understood in conjunction with the following description, which should be considered together with the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0033] The above and / or additional aspects and advantages of the present application will become apparent and more readily appreciated from the following description of the embodiments, taken in conjunction with the accompanying drawings, in which:

[0034] Figure 1 A flowchart of a future covert channel communication method based on MQTT provided by an embodiment of the present application;

[0035] Figure 2 An action mechanism diagram of a future covert channel communication method based on MQTT provided by an embodiment of the present application;

[0036] Figure 3 An implementation step diagram of a future covert channel communication method based on MQTT provided by an embodiment of the present application;

[0037] Figure 4 An action diagram of an encoding mode provided by an embodiment of the present application;

[0038] Figure 5 An experimental comparison diagram of a future covert channel communication method based on MQTT provided by an embodiment of the present application and a traditional method DETAILED DESCRIPTION

[0039] Embodiments of the present application are described in detail below with reference to the attached drawings, which show by way of example, embodiments in which the same or similar elements or elements having the same or similar functions are denoted by the same or similar reference numerals throughout the drawings. The embodiments described below by reference to the drawings are exemplary and are intended to explain the present application, and cannot be understood as limiting the present application.

[0040] Network covert channel (NCC) is a secret communication channel hidden in normal network communication. It uses normal network traffic as a carrier to transmit secret information, making it difficult for attackers to detect the existence of the secret information, bypassing the interception attack of the attacker and successfully received by the receiver. Existing network covert channels mainly use the technical path of embedding secret information in network traffic to achieve covert transmission. According to the source difference of the carrier traffic, existing research work can be systematically summarized into the following three technical routes: 1) covert channel based on self-generated traffic; 2) covert channel based on third-party traffic; 3) non-embedded covert channel. In the research of covert channel based on self-generated traffic, Cabuk et al. pioneered the covert channel scheme based on packet interval delay, which achieved covert data transmission by adjusting the transmission delay between consecutive network packets. This scheme mixes the covert channel traffic with the legal network traffic, effectively interfering with the statistical analysis of the adversary and improving the detection difficulty. However, the legal traffic in this method is only used as interference noise and does not actually carry secret information, which is fundamentally different from the present application. Ghassami et al. studied the secret queue channel (CQCS), which uses the delay correlation observed by users in a shared queue to achieve encoding and decoding; Zhang et al. designed a packet rearrangement time-based covert channel for VoLTE traffic, combined with gray coding to reduce packet loss rate. It should be noted that time-based covert channels generally have high implementation complexity and strong network environment dependence, and their communication efficiency decreases significantly when facing network delay or congestion, which to some extent restricts the research progress in this direction. The research of covert channel based on third-party traffic mainly focuses on the construction of storage-type covert channel, and its technical core is the innovative use of network protocol headers. Zander et al. based on the research of IP header TTL field showed that covert communication could be achieved by modulating the TTL field of consecutive data reports, but its channel capacity and concealment were subject to the modification of the TTL field by network nodes. Dakhane et al. implemented the IP ID reference model in Linux kernel 3.0, which avoided directly modifying the packet content by generating new traffic to mix with the original data packets, but this scheme only remained at the conceptual verification stage. The multi-protocol collaboration scheme proposed by Liu Ya et al. adopted a three-stage design of negotiating keys using ICMP protocol, writing keys into IP identification field, and embedding secret information in TCP sequence number field, which improved the security to some extent. However, the inherent defects of network header carriers, including limited capacity (1-2 bytes) and fixed field detection, still restrict the actual security performance of such schemes. In the field of non-embedded covert channel research, DYST

[11] opened up a new technical paradigm. It transmits secret messages by referencing historical data packets, without generating new traffic or modifying third-party traffic, and only needs a small amount of control channel traffic to notify the receiver, which has a significant advantage in concealment.However, DYST adopts a coding mode of calculating a fixed-length hash value of a third-party data packet by using a hash function, and the low collision property of the hash function leads to low transmission efficiency, which becomes a main bottleneck restricting its practical application.

[0041] In view of the problems in the prior art, the embodiment of the present application provides a future covert channel communication method based on MQTT, Figure 1 a flowchart of the future covert channel communication method based on MQTT provided by the embodiment of the present application, Figure 2 a mechanism diagram of the future covert channel communication method based on MQTT provided by the embodiment of the present application, Figure 3 an implementation step diagram of the future covert channel communication method based on MQTT provided by the embodiment of the present application.

[0042] With reference to Figure 1 , Figure 2 and Figure 3 , the method comprises the following steps:

[0043] In step 101, the sender encodes a secret message to be transmitted by using an encoding method based on an m sequence, generates a signal pointer, and preannounces a transmission time of the secret message to the receiver through a small amount of control traffic.

[0044] In the embodiment of the present application, the message encoding part is implemented in the covert sender, and the encoding mode mechanism diagram is shown in Figure 4 . The sender first checks the payload content of the legal MQTT data packet flowing through the sender and the receiver at the same time, especially the traffic in the topic subscribed by the receiver to the sender. This check is processed by applying the function S() in a targeted manner to ensure that the target data packet meeting the conditions is selected. The target data packet is a data packet capable of carrying a secret message, and the sender will mark it by using the encoding method based on the m sequence.

[0045] Once the target data packet (i.e., the data packet p t ) meeting the requirements is found, the sender generates a signal data packet. This signal data packet does not directly carry secret data, but indicates the arrival of the target data packet p t to the receiver in the form of a pre-announcement signal. This signal informs the receiver that the target data packet will arrive soon, thereby preparing for the subsequent transmission of secret information.

[0046] Specifically, for the binary sequence b of the secret message currently to be sent, the sender finds a target data packet (IdP) capable of carrying the secret message sequence i, which needs to go through the following steps:

[0047] (1) The sender and the receiver agree on an i-bit m sequence This m-sequence is used in the subsequent encoding and decoding processes.

[0048] (2) The sender uses the agreed m-sequence The payload of the data packet is scanned sequentially, and each time the i-bit binary sequence q of the payload and the i-1 shifted versions of that sequence [q1, q2, ..., q] are processed. i-1 ] and sequence Perform a bitwise AND operation followed by a sum to obtain the sum value s.

[0049] It should be noted that, due to the autocorrelation of the m-sequence, when s = 0, it indicates that the currently scanned sequence is... with sequence If they are the same, then a collision is considered to have occurred.

[0050] (3) In the event of a collision, the sender further checks the sequence. The shift relationship with the original sequence q is used to obtain the shifted number x. Then, the sender checks whether the value of x meets the requirements of the secret message binary sequence b according to the set encoding rules.

[0051] In a possible implementation, when i = 7 and the number of bits in the secret message sent each time is set to 1, the following encoding rule can be set:

[0052]

[0053] That is, if the number of shifts when a match occurs is 0 ≤ x < 3, the code is 0; if the number of shifts when a match occurs is 3 ≤ x < 7, the code is 1.

[0054] (4) If the value of x meets the requirements of the binary sequence b of the secret message, it is determined that the sender has found the target data packet (i.e., the data packet IdP carrying the secret message). At this time, the sender generates a signal pointer and sends the signal pointer to the receiver through a very small amount of control traffic to announce the arrival of the target data packet.

[0055] (5) If the value of x does not meet the requirements of the binary sequence b of the secret message, then discard the current sequence. Continue scanning for the next data packet until a target data packet that meets the requirements is found.

[0056] Through the above steps, the sender can effectively encode the target data packet and generate a signal pointer to notify the receiver, enabling the receiver to prepare in advance to receive the target data packet and achieve covert communication.

[0057] Step 102: Use legitimate MQTT traffic from a third-party network that has not yet reached the recipient as a transmission carrier to establish a covert communication channel without modifying the original traffic content.

[0058] In this embodiment, the establishment of the covert communication channel relies on the legitimate MQTT traffic in the third-party network that does not reach the receiver, and no modification is made to the original traffic content in this process.

[0059] Specifically, the sender and the receiver first establish a subscription-published communication connection through the MQTT protocol. The sender publishes a specific topic, and the receiver subscribes to the specific topic to receive the message published by the sender. In this way, the sender and the receiver establish a communication framework of a covert channel.

[0060] Then, in the communication process, the legitimate MQTT traffic generated by the third-party network node will serve as a transmission carrier of the covert message. This traffic is transmitted to the receiver through the network, and the content of the third-party traffic is not tampered with in the whole process.

[0061] Therefore, the transmission of the secret message completely relies on the timing and load content of the future-arriving legitimate MQTT data packets, without introducing additional covert channel traffic. The message delivery of the sender completely relies on the timing of the MQTT traffic generated by the third-party network node and not tampered with. Since the load content of these data packets is legitimate, the receiver can extract and restore the secret message from the legitimate traffic without introducing any traffic that does not conform to the protocol specification, ensuring the concealment.

[0062] In this way, the covert communication does not need to generate new data packets or modify existing data streams, but fully utilizes the third-party network traffic as a covert channel, effectively avoiding the detection of traffic analysis tools.

[0063] Step 103, based on the covert communication channel, the receiver listens to the specified MQTT topic, and parses and restores the secret message from the subsequent-arriving legitimate traffic according to the signal pointer.

[0064] In this embodiment, the message decoding process is implemented in the covert receiver. The receiver restores the secret message by listening to the specified MQTT topic and parsing the received legitimate traffic. The specific process is as follows:

[0065] (1) The receiver continuously listens to the target topic through the MQTT protocol and waits for the control traffic indication from the sender. The control traffic contains a signal pointer indicating that the receiver will soon receive a data packet carrying a covert message. Once the receiver receives the signal pointer, it knows that the next secret message transmission will start soon.

[0066] (2) After receiving the signal pointer, the receiver immediately starts to listen and analyze the following legitimate traffic. The receiver uses the S() method to scan the next packet that arrives immediately, checking the load content of the packet. The receiver identifies and extracts the hidden message in the target packet according to the prompt of the signal pointer. Through the pre-agreed m-sequence encoding rule, the receiver parses the load in the packet to recover the content of the secret message. The decoding process relies on the m-sequence encoding rule shared by the sender and the receiver in advance to ensure the accurate restoration of the data.

[0067] (3) Once the received legitimate traffic meets the encoding rule, the receiver can extract the complete secret message from it, realizing the success of covert communication. The whole process does not involve modifying the original traffic content, and all message transmission is through the timing and load content of the legal data packet.

[0068] In this way, the receiver can accurately extract and restore the hidden message in the legal MQTT traffic without relying on any form of modification or illegal traffic, thereby ensuring the concealment and security of communication.

[0069] The technical solution of the present application provides a future covert channel scheme, which transmits secret messages by pointing to matching data packets that have not yet arrived at the receiver, thereby avoiding sending secret messages directly through channel traffic. This scheme only transmits signal pointers through the control channel and uses unmodified legal network traffic for covert communication. Although the channel traffic may be considered by the enemy as channel-generated traffic and used to analyze channel characteristics, it should be noted that all channel traffic and the carrier traffic used are legal and unmodified MQTT protocol data units, which meet the standards of Internet of Things device communication. This enables the scheme to avoid traditional detection methods based on traffic data content, thereby greatly enhancing concealment.

[0070] In the Internet of Things environment, legal nodes transmit device data (such as temperature sensor data) through the MQTT protocol, and these legal traffic constitutes the data channel for covert communication. The covert sender monitors the traffic in the Internet of Things and selects target data packets (Interested Packets, IdPs) that meet the requirements. The sender sends control signals (such as persistent connection requests in the MQTT protocol) pointing to specific data packets through the control channel to inform the receiver in advance of the arrival of the target data packets. The receiver extracts and restores the hidden message content from these data packets according to the predetermined encoding method, thereby completing the transmission of the covert message.

[0071] The main advantage of the present application is that the carrier traffic and control signals used by the channel are completely unmodified legal traffic. In addition, the signal mechanism that precedes the secret message is a completely new working mechanism that greatly improves concealment.

[0072] In an embodiment of the present application, the advantage of the scheme in the present application in terms of communication concealment is verified by experiments, and the specific detection results are shown in the following table. Figure 5 The traffic data generated by the channel is completely legal in content, and cannot be detected by detecting the content of the data packet payload. The detection method mainly uses the statistical characteristics of the traffic data to classify the concealed traffic. When the frequency of the IdP is low, the detection effect of the classifier is significantly reduced, and the AUC value is only 0.56.

[0073] In order to realize the above-mentioned embodiment, the present application further provides an electronic device, comprising: a processor, and a memory connected with the processor in communication; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to realize the method provided by the foregoing embodiment.

[0074] In order to realize the above-mentioned embodiment, the present application further provides a computer readable storage medium, the computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to realize the method provided by the foregoing embodiment.

[0075] In order to realize the above-mentioned embodiment, the present application further provides a computer program product, comprising a computer program, which is executed by the processor to realize the method provided by the foregoing embodiment.

[0076] The collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in the present application comply with the relevant laws and regulations, and do not violate public order and good customs.

[0077] It should be noted that the personal information from the user should be collected for legal and reasonable purposes, and should not be shared or sold outside these legal uses. In addition, such collection / sharing should be carried out after obtaining the informed consent of the user, including but not limited to informing the user to read the user agreement / user notice before the user uses the function, and signing the agreement / authorization including authorization of relevant user information. In addition, any necessary steps should be taken to protect and ensure access to such personal information data, and to ensure that other people with access to personal information data comply with their privacy policy and processes.

[0078] The present application is expected to provide an embodiment in which the user can selectively prevent the use or access of personal information data. That is, the present disclosure is expected to provide hardware and / or software to prevent or prevent access to such personal information data. Once the personal information data is no longer needed, the risk is minimized by limiting data collection and deleting data. In addition, such personal information is de-identified to protect the privacy of the user, if applicable.

[0079] In the foregoing detailed description, reference is made to descriptive terms such as "one embodiment", "some embodiments", "an example", "a specific example" or "some examples" etc. for describing various embodiments of the application. These descriptive terms are used for the purpose of the description and are not meant to limit or restrict the scope of the application. The use of these terms does not imply that the application is comprised of at least the described embodiments, or that the described embodiments are the only embodiments the application is comprised of. The scope of the application is not limited to the described embodiments, but is rather defined by the appended claims. In the description of the embodiments of the application, reference is made to the terms "one embodiment", "some embodiments", "an example", "a specific example" or "some examples" etc. which are meant to describe a particular feature, structure, material or characteristic included in at least one embodiment of the application. The illustrative description of these terms does not imply that the application is comprised of at least the described embodiments or that the described embodiments are the only embodiments the application is comprised of. In the description of the embodiments of the application, the illustrative description of the above terms does not necessarily refer to the same embodiment or example described previously. Moreover, the described features, structures, materials or characteristics can be combined in any suitable manner in one or more embodiments or examples of the application. Furthermore, the described embodiments or examples of the application and the features thereof can be combined and combined in any suitable manner, without contradicting each other, by those skilled in the art.

[0080] Furthermore, the terms "first", "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or an indicated number of technical features. Thus, features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the application, the meaning of "a plurality" is at least two, for example two, three, etc., unless explicitly specified otherwise.

[0081] Any process or method descriptions or descriptions of the flow diagrams in the present application can be understood as representing code modules, segments, or portions of code which include one or more executable instructions for implementing specific logic functions (or steps) in the process, and that the various systems described herein can be comprised of numerous such code modules and that these modules can be held on one or more computer-readable media or in one or more memories or databases. Those skilled in the art will appreciate that many routine modifications can be made to the functionality of the above-described software descriptions, and these descriptions should not be construed as limiting the scope of the application in any manner. Furthermore, it should be appreciated that the functionality implemented by the software can be at least in part, hardware-implemented.

[0082] The logic and / or steps represented in the flowcharts and / or described herein, for example, can be considered as a sequence of instructions to implement logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, apparatus, or device, such as a computer-based system, processor- based system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. For purposes of this specification, a "computer-readable medium" can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer-readable medium can be a computer- readable storage medium or a computer-readable signal medium. The computer- readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer-readable storage medium include the following: an electrical connection having one or more wires (electrical connections), a portable computer diskette (a magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium can even be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, for example, via optical scanning of the paper or other medium, then compiled, interpreted, or otherwise processed in a suitable manner, if necessary, and then stored in a computer memory.

[0083] It should be understood that aspects of the application can be implemented in hardware, software, firmware or combinations thereof. In the above embodiments, various steps or methods can be implemented in software or firmware that is stored in memory and executed by a suitable instruction execution system. As such, in some embodiments, specifically configured hardware can be used to implement at least some of the functionality described herein. For example, if implemented in hardware, the hardware can include any or a combination of the following: a discrete logic circuit having logic gates for implementing logic functions upon data signals, an application specific integrated circuit having appropriate combinational logic gates, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0084] Those of skill in the art would understand that information and signals can be represented using any of a variety of technologies and techniques. For example, data, instructions, commands, information, signals, bits, symbols, and chips that can be referenced throughout the above description can be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof.

[0085] In addition, each of the function units in each embodiment of the present application can be integrated in one processing module, or each unit can be physically present separately, or two or more units can be integrated in one module. The integrated module can be realized in the form of hardware or in the form of a software function module. When the integrated module is realized in the form of a software function module and sold or used as an independent product, it can also be stored in a computer readable storage medium.

[0086] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it should be understood that the above embodiments are exemplary and should not be construed as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above embodiments within the scope of the present application.

[0087] It should be understood that the various forms of flow shown above can be reordered, added or deleted steps. For example, each step described in the present application can be executed in parallel, sequentially or in different order, as long as the desired results of the technical solutions of the present application can be achieved, which is not limited herein.

[0088] The above detailed description does not constitute a limitation on the scope of protection of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations and replacements can be made according to design requirements and other factors. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for future covert channel communication based on MQTT, characterized in that, The method comprises the following steps: The sender uses an m-sequence-based encoding method to encode a secret message to be transmitted, generates a signal pointer, and preannounces the transmission time of the secret message to the receiver through a small amount of control traffic; Using the legal MQTT traffic in the third-party network that has not reached the receiver as a transmission carrier, a covert communication channel is established without modifying the original traffic content; Based on the covert communication channel, the receiver listens to a specified MQTT topic, and parses and restores the secret message from the subsequent arriving legal traffic according to the signal pointer.

2. The method of claim 1, wherein, The sender uses an m-sequence-based encoding method to encode a secret message to be transmitted, generates a signal pointer, and preannounces the transmission time of the secret message to the receiver through a small amount of control traffic, comprising: The sender and the receiver agree on an m-sequence of i bits The sender uses the m-sequence to scan the payload of the data packet in turn, and each time calculates the sum of the bitwise AND of the i-bit binary sequence q of the payload and the i-1 shifted versions of the sequence [q1, q2, …, qi-1] and the sequence i-1 , to obtain a sum value s; when s = 0, it indicates that the sequence used for calculation is the same as the sequence , and a collision occurs. After the collision occurs, the checking sequence The shift relationship with the original sequence q is obtained, the shift bit number x is obtained, and whether the x value meets the requirement of the secret message binary sequence b is checked according to the set encoding rule. If the x value meets the requirements of the binary sequence b of the secret message, it is judged that the target data packet capable of carrying the secret message is found, the sender generates a signal pointer and sends the signal pointer to the receiver through a small amount of control traffic to preannounce the transmission time of the target data packet.

3. The method of claim 2, wherein, The legal MQTT traffic in the third-party network that has not reached the receiver is used as a transmission carrier to establish a covert communication channel without modifying the original traffic content, comprising: The sender and the receiver establish a subscription-published communication connection through the MQTT protocol, the sender publishes a specific topic, and the receiver subscribes to the specific topic; The unaltered MQTT traffic generated by the third-party network node is used as a covert message carrier; wherein the transmission of the secret message completely depends on the timing and load content of the future arriving legal data packets, and no additional covert channel traffic is introduced.

4. The method of claim 3, wherein, Based on the covert communication channel, the receiver listens to a specified MQTT topic, and parses and restores the secret message from the subsequent arriving legal traffic according to the pointer, comprising: The receiver continuously listens to the target topic through the MQTT protocol, and waits for the control traffic indication from the sender; After the receiver receives the signal pointer through the covert communication channel, the secret message is parsed and restored from the subsequent arriving legal traffic according to the pre-agreed m-sequence encoding rule according to the prompt of the signal pointer, and the covert communication is completed.

5. An electronic device, comprising: It comprises: A processor and a memory connected to the processor in communication; The memory stores computer execution instructions; The processor executes the computer execution instructions stored in the memory to realize the method of any one of claims 1-4.

6. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer execution instructions, and the computer execution instructions are executed by the processor to realize the method of any one of claims 1-4.

7. A computer program product, characterised in that, It comprises a computer program, which is executed by the processor to realize the method of any one of claims 1-4.

Images