Relay emission type information hidden transmission system and method based on HID interface

Abstract

The invention discloses a relay emission type information hiding transmission system and method based on an HID interface, and the method comprises the steps: enabling an HID interface device to implant an information collection program into a target host based on the first control instruction information of a data return receiving device; searching a target host file and target host information by using the information acquisition program to obtain target sending information, and sending the target sending information to HID interface equipment; performing first receiving processing on the target sending information by utilizing HID interface equipment to obtain target data information; sending the target data information to the data return receiving device by using an HID interface device; and the data return receiving equipment performs second receiving processing on the target data information to obtain target data. According to the relay transmitting type information hiding transmission system and method based on the HID interface, the universal HID data interface equipment is adopted, the target information in the target host is obtained, the data return hiding performance is high, and the target information obtaining problem is solved.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security, and in particular to a relay-type covert information transmission system and method based on HID interface. Background Technology

[0002] In today's digital age, cybersecurity has become a major issue concerning national security, public interests, and the legitimate rights and interests of citizens and other organizations and individuals. The security and confidentiality of data transmission are becoming increasingly critical, especially in scenarios with strict information security requirements.

[0003] Currently, research on information covert transmission systems combining HID interfaces with relay-based transmission modes is still in its developmental stage. Existing research mainly focuses on data transmission from a single HID device or simple relay transmission models. Further exploration is needed to develop efficient, secure, and covert relay-based information covert transmission systems based on HID interfaces. In authorized, isolated network environments, such as corporate internal security audits and government agency data backups, ensuring data confidentiality, integrity, and availability during transmission, and effectively defending against external attacks and internal threats, are critical issues that urgently need to be addressed.

[0004] This invention relates to a relay-type covert information transmission system and method using an HID interface. It employs a universal HID (Human Interface Device) data interface device, which is compatible with Windows, Linux, and MacOS operating systems without requiring a dedicated driver. It enables the acquisition of target information in isolated networks, and the data return transmission is highly covert. It can be used for authorized network security checks of isolated networks, system simulation tests, and other scenarios. It is strictly prohibited from being used for unauthorized network information acquisition. Summary of the Invention

[0005] The technical problem to be solved by the present invention is to provide a relay-type covert information transmission system and method based on HID interface. It adopts a device with a universal HID (Human Interface Device) data interface, which is compatible with Windows, Linux and MacOS operating systems without special drivers, thereby reducing costs and improving the covertness of data transmission.

[0006] To address the aforementioned technical problems, the first aspect of this embodiment discloses a relay-type covert information transmission system based on an HID interface, comprising: an HID interface device, a target host, and a data return receiving device;

[0007] The HID interface device is used to receive and process control command information transmitted by the data backhaul receiving device, implant information acquisition program into the target host, acquire and process target transmission information sent by the target host and transmit it to the data backhaul receiving device.

[0008] The target host is used to connect to the authorized target network to receive and send network data, and to collect information using the implanted information collection program to obtain the target sent information.

[0009] The data return receiving device is used to receive the target transmission information transmitted by the HID interface device;

[0010] The target host and the HID interface device are connected via a USB interface; the HID interface device and the data return receiving device are connected via a wireless network.

[0011] As an optional implementation, in the first aspect of this embodiment, the HID interface device includes a masquerade module, a USB splitter module, a main control MCU module, and a communication module;

[0012] The camouflage module is used to camouflage the HID interface device;

[0013] The USB splitter module is used to receive the control command information sent by the main control MCU module and send it to the target host, and to receive the target host feedback information sent by the target host and send it to the communication module.

[0014] The main control MCU module is used to receive the control command information sent by the communication module;

[0015] The communication module is used to receive the control command information sent by the data return receiving device and send it to the main control MCU module, and send the target host return information to the data return receiving device;

[0016] The USB splitter module is connected to the target host via a USB interface; the main control MCU module is connected to the USB splitter module and the communication module respectively.

[0017] The second aspect of this embodiment discloses a relay-type covert information transmission method based on an HID interface, the method comprising:

[0018] S1, based on the first control command information, the HID interface device implants an information collection program into the target host;

[0019] S2, the information acquisition program is used to search and process the target host file and target host information to obtain the target sending information and send it to the HID interface device;

[0020] S3, using the HID interface device, perform a first receiving process on the target transmitted information to obtain target data information;

[0021] S4, using the HID interface device, send the target data information to the data return receiving device;

[0022] S5, the data return receiving device performs a second receiving process on the target data information to obtain the target data.

[0023] As an optional implementation, in the second aspect of this embodiment, the step of embedding an information collection program into the target host using the HID interface device based on first control command information includes:

[0024] S11, the HID interface device receives and acquires the first control instruction information sent by the data return receiving device;

[0025] S12, decrypt the first control instruction information to obtain the first control instruction decryption information;

[0026] S13, based on the first communication protocol, the decryption information of the first control instruction is parsed to obtain network instruction type information;

[0027] S14, determine whether the network instruction type information is equal to the first preset value, and obtain the network instruction type determination result;

[0028] S15, when the network instruction type determination result is yes, execute S16 to S18;

[0029] If the network instruction type determination result is negative, execute S11;

[0030] S16, based on the second communication protocol, the network instruction type information is encapsulated to obtain the second instruction information;

[0031] S17, using the HID interface device, send the second instruction information to the target host;

[0032] S18, process the second instruction information and implant the information collection program into the target host.

[0033] As an optional implementation, in the second aspect of this embodiment, the step of using the information acquisition program to search and process the target host file and target host information to obtain target sending information and sending it to the HID interface device includes:

[0034] S21, the information acquisition program receives and acquires the second control command information sent by the HID interface device;

[0035] S22, based on the second communication protocol message structure, the second control command information is processed to obtain the target transmission information;

[0036] S23, send the target transmission information to the HID interface device.

[0037] As an optional implementation, in the second aspect of this embodiment, processing the second control command information based on the second communication protocol message structure to obtain target transmission information includes:

[0038] S2201, based on the second communication protocol message structure, the second control instruction information is parsed and processed to obtain the second message type information, the second instruction function information, the second data length, and the second instruction data information;

[0039] S2202, determine whether the second message type information is equal to the third preset value, and obtain the second message type judgment result;

[0040] If the second message type determination result is yes, execute S2203~S2204;

[0041] When the result of the second message type determination is negative, the second instruction data information is updated to the target sending information, and S2205 is executed;

[0042] S2203, the second instruction data information is encrypted to obtain the third instruction data information;

[0043] S2204, according to the second communication protocol message structure, the third instruction data information is structured using the second data length to obtain the target sending information;

[0044] S2205, determine whether the target transmission information is equal to the fourth preset value, and obtain the target transmission judgment result;

[0045] S2206, when the target sends a judgment result of yes, execute S2207~S2208;

[0046] If the target sends a judgment result of no, execute S2209~S2210;

[0047] S2207, the information acquisition program performs key information extraction processing on the target host information according to the first preset rule to obtain the target acquisition information;

[0048] S2208, The target acquisition information is encrypted to obtain the target file to be sent;

[0049] S2209, the information acquisition program performs key file extraction processing on the target host file according to the second preset rule to obtain the target acquisition file;

[0050] S2210, the target file is encrypted to obtain the target file to be sent;

[0051] S2211, according to the first communication protocol, the target file to be sent is encapsulated to obtain target sending information.

[0052] As an optional implementation, in the second aspect of this embodiment, the first receiving process of the target transmitted information using the HID interface device to obtain target data information includes:

[0053] S31, the HID interface device receives and acquires the target transmission information;

[0054] S32, based on the second communication protocol, the target transmission information is parsed and processed to obtain the target information to be transmitted;

[0055] S33, according to the first communication protocol, the target information to be launched is encapsulated to obtain target data information.

[0056] As an optional implementation, in the second aspect of this embodiment, the step of parsing the target transmission information based on the second communication protocol to obtain target data information includes:

[0057] S331, Obtain the target sending information;

[0058] S332, using the second communication protocol message structure, the target sending information is parsed and processed to obtain the target sending information.

[0059] As an optional implementation, in the second aspect of this embodiment, the step of using the HID interface device to send the target data information to the data return receiving device includes:

[0060] S41, the HID interface device receives the first control command information transmitted by the data return receiving device;

[0061] S42, based on the first communication protocol, the first control instruction information is parsed and processed to obtain the third instruction type information;

[0062] S43, determine whether the third instruction type information is equal to the fifth set value, and obtain the third instruction type determination result;

[0063] S44, when the result of the third instruction type determination is yes, execute S45;

[0064] If the result of the third instruction type determination is negative, execute S41;

[0065] S45, the HID interface device sends the target data information to the data return receiving device.

[0066] As an optional implementation, in the second aspect of this embodiment, the data return receiving device performs a second receiving process on the target data information to obtain the target data, including:

[0067] S501, obtain user request command information;

[0068] S502, the user request instruction information is parsed and processed to obtain user instruction type information;

[0069] S503, determine whether the user instruction type information is equal to the sixth preset value, and obtain the user instruction type determination result;

[0070] S504, when the user instruction type determination result is yes, execute S505 to S507;

[0071] If the user instruction type determination result is negative, execute S508 to S510;

[0072] S505, the user request instruction information is encrypted to obtain encrypted user instruction information;

[0073] S506, based on the first communication protocol, the encrypted user instruction information is encapsulated to obtain the first control instruction information;

[0074] S507, the data return receiving device sends the first control instruction information to the HID interface device;

[0075] S508, the data return receiving device receives the target data information;

[0076] S509, based on the first communication protocol, the target data information is parsed and processed to obtain the first target data information;

[0077] S510, the first target data information is decrypted to obtain the target data.

[0078] The third aspect of this embodiment discloses a relay-type covert information transmission device, the device comprising:

[0079] Memory containing executable program code;

[0080] A processor coupled to the memory;

[0081] The processor calls the executable program code stored in the memory to execute some or all of the steps in the relay-type covert information transmission method disclosed in the second aspect of this embodiment.

[0082] The fourth aspect of the present invention discloses a computer-readable storage medium storing computer instructions, which, when invoked, execute some or all of the steps in the relay-type covert information transmission method disclosed in the second aspect of this embodiment.

[0083] Compared with the prior art, this embodiment has the following beneficial effects:

[0084] This invention provides a relay-type covert information transmission system and method based on HID interface. It adopts a general HID data interface device, which is compatible with Windows, Linux and MacOS operating systems without special drivers. It realizes the acquisition of isolated network target information, and the data return is highly covert, thus solving the problem of target information acquisition. Attached Figure Description

[0085] To more clearly illustrate the technical solutions in this embodiment, the accompanying drawings used in the description of the embodiment will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0086] Figure 1 This is a schematic diagram of an application scenario for the relay-type covert information transmission system based on the HID interface provided in this embodiment;

[0087] Figure 2 This is a schematic diagram of the composition of a relay-type covert information transmission system based on an HID interface disclosed in this embodiment;

[0088] Figure 3 This is a flowchart of a relay-type covert information transmission method based on an HID interface disclosed in this embodiment;

[0089] Figure 4This is a schematic diagram of another relay-type covert information transmission device based on an HID interface disclosed in this embodiment. Detailed Implementation

[0090] To enable those skilled in the art to better understand the present invention, the technical solutions of this embodiment will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0091] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this invention are used to distinguish different objects, not to describe a specific order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, apparatus, product, or device that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or devices.

[0092] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0093] In this application, the term "exemplary" is used to mean "used as an example, illustration, or description." Any embodiment described as "exemplary" in this application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use this application. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that this application can be made without using these specific details. In other instances, well-known structures and processes are not described in detail to avoid obscuring the description of this application with unnecessary detail. Therefore, this application is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed in this application.

[0094] It should be noted that since the method in this application embodiment is executed in a computer device, the processing objects of each computer device exist in the form of data or information, such as time, which is essentially time information. It is understood that if size, quantity, position, etc. are mentioned in subsequent embodiments, they are all corresponding data that exist so that the computer device can process them. Specific details will not be elaborated here.

[0095] It should be noted that the artificial intelligence-related technologies that may be involved in this application will be briefly described. Artificial intelligence (AI) is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to obtain optimal results. In other words, artificial intelligence is a comprehensive technology in computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. Artificial intelligence is the study of the design principles and implementation methods of various intelligent machines, enabling machines to have the functions of perception, reasoning, and decision-making.

[0096] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0097] Computer vision (CV) is a science that studies how to enable machines to "see." More specifically, it refers to machine vision, which uses cameras and computers to replace human eyes in recognizing and measuring targets, and then performs image processing to create images more suitable for human observation or transmission to instruments. As a scientific discipline, computer vision studies related theories and technologies, attempting to build artificial intelligence systems capable of extracting information from images or multidimensional data. Computer vision technologies typically include image processing, image recognition, image semantic understanding, image retrieval, OCR, video processing, video semantic understanding, video content / behavior recognition, 3D object reconstruction, 3D technology, virtual reality, augmented reality, simultaneous localization and mapping (SLAM), and common biometric recognition technologies such as facial recognition and fingerprint recognition.

[0098] Monomodal information refers to data of only one type, such as text, images, audio, video, or electromagnetic signals. Multimodal information refers to data that includes at least two types of monomodal information. Furthermore, multimodal information is suitable for complex tasks that require the integration of multiple information sources, such as sentiment analysis, robot interaction, and autonomous driving. By integrating information from multiple modalities, higher performance and accuracy can usually be achieved in these tasks.

[0099] Large models refer to artificial neural network models with a very large number of parameters. In the field of artificial intelligence, large models typically refer to models with hundreds of millions to trillions of parameters. These models usually need to be trained on large-scale datasets and require a significant amount of computing resources for optimization and tuning. Large models are commonly used to solve complex tasks such as natural language processing, computer vision, and speech recognition. Generative AI is a type of AI that can create new content and ideas, including dialogues, stories, images, videos, and music. In this embodiment, the large model can be a language model of the scale of ChatGPT, BERT, XLNet, Zhipu model, Claude, Moonshot AI model, ChatGLM model, Qianyitongwen model, MiniMax model, Xinghuo model, Llama model, 360GPT model, Qwen model, Baichuan model, Yunque model, vivoLM model, and Wenxin Yiyan, etc., and this embodiment does not limit the scope of the large model.

[0100] This application provides a relay-type covert information transmission method, system, device, computer equipment, and computer-readable storage medium based on an HID interface, which will be described in detail below.

[0101] Please see Figure 1 , Figure 1 This is a schematic diagram of the architecture of a network communication system provided in an embodiment of this application. The system may include an authorized target network, which is an authorized isolated network, including a target host with an embedded information collection program, HID interface devices (mouse, keyboard) and a data return receiving device.

[0102] Those skilled in the art will understand that Figure 1 The application environment shown is merely one application scenario of the solution in this application and does not constitute a limitation on the application scenario of the solution in this application. Other application environments may include those that are more specific to this application. Figure 1 The number of computer devices shown is more or less, for example Figure 1 Only one authorized target network is shown in the diagram. It is understood that the system may also include one or more other services, which are not specified here.

[0103] It should be noted that, Figure 1 The schematic diagram of the application scenario of the information covert transmission system shown is merely an example. The information covert transmission system and scenario described in the embodiments of this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided in the embodiments of this application. As those skilled in the art will know, with the evolution of signal analysis, control and management systems and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0104] It should be noted that the technical solutions listed in this invention are only applicable to authorized isolated network environments, such as legal scenarios like internal security audits of enterprises and data backups of government agencies, and are strictly prohibited from being used for unauthorized network information acquisition.

[0105] This invention discloses an information covert transmission system. Utilizing a relay-type information covert transmission system based on an HID interface, it employs a universal HID data interface device, requiring no special drivers and being compatible with Windows, Linux, and MacOS operating systems. This system enables the acquisition of target information from the target host, provides strong data covertness during data transmission, and solves the problem of target information acquisition. Detailed descriptions follow.

[0106] Example 1

[0107] Please see Figure 2 , Figure 2 This is a schematic diagram illustrating the composition of a relay-type covert information transmission system based on an HID interface disclosed in this embodiment. Figure 2 The described relay-type covert information transmission system based on the HID interface is applied to authorized isolated network communication systems, such as local servers or cloud servers within the network communication system; this embodiment is not limited to these applications. Figure 2 As shown, the relay-type covert information transmission system based on the HID interface includes: an HID interface device 102, a target host 101, and a data return receiving device 103.

[0108] The HID interface device 102 is used to receive and process the control command information transmitted by the data backhaul receiving device 103, implant an information collection program into the target host 101, acquire and process the target transmission information sent by the target host 101 and transmit it to the data backhaul receiving device 103.

[0109] It should be noted that the HID interface device 102 includes, but is not limited to, a mouse, keyboard, and power bank; this invention does not limit these to a specific type of device.

[0110] The target host 101 is used to connect to the authorized target network to receive and send network data, and to collect information using the implanted information collection program to obtain the target sent information.

[0111] It should be noted that the target host 101 includes, but is not limited to, industrial control computers, servers, desktop computers, laptops and mobile phones, and is not limited in this invention;

[0112] The data return receiving device 103 is used to receive the target transmission information transmitted by the HID interface device 102;

[0113] It should be noted that the data return receiving device 103 includes, but is not limited to, industrial control computers, servers, desktop computers and laptops, and is not limited in this invention;

[0114] The target host 101 and the HID interface device 102 are connected via a USB interface; the HID interface device 102 and the data return receiving device 103 are connected via a wireless network.

[0115] As can be seen, the relay-type covert information transmission system based on the HID interface described in this embodiment uses a general HID data interface device, which is compatible with Windows, Linux, and MacOS operating systems without the need for special drivers. It achieves the acquisition of target host target information, and the data return is highly covert, thus solving the problem of target information acquisition.

[0116] The HID interface device 102 includes a spoofing module, a USB splitter module, a main control MCU module, and a communication module.

[0117] The camouflage module is used to camouflage the HID interface device;

[0118] It should be noted that the camouflage module disguises the HID interface device as a USB device of different forms. The specific design depends on the required form, and this embodiment does not limit it.

[0119] The USB splitter module is used to receive the control command information sent by the main control MCU module and send it to the target host, and to receive the target host feedback information sent by the target host and send it to the communication module.

[0120] It should be noted that in this embodiment, the USB splitting module is implemented using an STM32 chip, which has a built-in USB interface that allows the USB port to be directly connected to the chip's pins.

[0121] The main control MCU module is used to receive the control command information sent by the communication module;

[0122] It should be noted that the main control MCU module is implemented using an STM32F103 chip. The STM32F103 chip can control the operation of the system and has 512K Flash, 64k SRAM, and a CPU frequency of 72M.

[0123] It should be noted that the main control MCU module supports power supply regulation and circuit reset functions, and requires connection to an 8M external crystal oscillator;

[0124] The communication module is used to receive the control command information sent by the data return receiving device and send it to the main control MCU module, and send the target host return information to the data return receiving device;

[0125] It should be noted that the communication module uses the SIM7100C chip, which supports dual-band GSM / GPRS / EDGE and dual-band UMTS / HSPA+, supports 2G / 3G / 4G mobile communication modes, and features low power consumption and small size. It provides interfaces such as USB, SPI, UART, and I2C to facilitate communication between modules.

[0126] The USB splitter module is connected to the target host via a USB interface; the main control MCU module is connected to the USB splitter module and the communication module respectively.

[0127] As can be seen, the HID interface device based on the HID interface described in this embodiment is compatible with Windows, Linux, and MacOS operating systems without the need for a dedicated driver, and has strong data backhaul concealment, thus solving the problem of obtaining target information.

[0128] Example 2

[0129] Please see Figure 3 , Figure 3 This is a flowchart illustrating a relay-based covert information transmission method based on an HID interface disclosed in this embodiment. Figure 3 The described relay-based covert information transmission method based on the HID interface is applicable to network communication systems, such as local servers or cloud servers within the network communication system; this embodiment is not limited to such applications. Figure 3 As shown, this relay-based covert information transmission method based on the HID interface includes:

[0130] S1, based on the first control command information, the HID interface device implants an information collection program into the target host;

[0131] It should be noted that the first control instruction information refers to control instruction information that conforms to the communication standard format and is transmitted by the data return receiving device through the wireless network.

[0132] S2, the information acquisition program is used to search and process the target host file and target host information to obtain the target sending information and send it to the HID interface device;

[0133] S3, using the HID interface device, perform a first receiving process on the target transmitted information to obtain target data information;

[0134] S4, using the HID interface device, send the target data information to the data return receiving device;

[0135] S5, the data return receiving device performs a second receiving process on the target data information to obtain the target data.

[0136] As can be seen, the relay-type covert information transmission method based on the HID interface described in this embodiment can acquire and transmit high-value data based on the HID interface. It is compatible with Windows, Linux, and MacOS operating systems without the need for a special driver, and the data return is highly covert, thus solving the problem of target information acquisition.

[0137] In an optional embodiment, step S1 above, wherein the HID interface device implants an information collection program into the target host using the first control command information based on the data return receiving device, includes:

[0138] S11, the HID interface device receives and acquires the first control instruction information sent by the data return receiving device;

[0139] It should be noted that the first control instruction information refers to control instruction information that conforms to the wireless network communication standard sent by the data return receiving device;

[0140] It should be noted that the wireless network refers to a communication network established by one of Bluetooth, 2G wireless communication, 3G wireless communication and 4G wireless communication, and this embodiment does not limit it;

[0141] S12, decrypt the first control instruction information to obtain the first control instruction decryption information;

[0142] S13, based on the first communication protocol, the decryption information of the first control instruction is parsed to obtain network instruction type information;

[0143] It should be noted that the network instruction type information indicates whether to initiate information collection;

[0144] S14, determine whether the network instruction type information is equal to the first preset value, and obtain the network instruction type determination result;

[0145] It should be noted that setting the first setting value to 0 indicates that the information collection program is started;

[0146] S15, when the network instruction type determination result is yes, execute S16 to S18;

[0147] If the network instruction type determination result is negative, execute S11;

[0148] S16, based on the second communication protocol, the network instruction type information is encapsulated to obtain the second instruction information;

[0149] It should be noted that the encapsulation process refers to combining the network instruction type information according to the message structure of the second communication protocol.

[0150] S17, using the HID interface device, send the second instruction information to the target host;

[0151] S18, process the second instruction information and implant the information collection program into the target host.

[0152] As can be seen, by implementing the relay-type covert information transmission method based on the HID interface described in this embodiment, the HID interface device implants an information collection program into the target host, resulting in strong data backhaul covertness and solving the problem of target information acquisition.

[0153] In an optional embodiment, step S18 above, processing the second instruction information and implanting the information collection program into the target host, includes:

[0154] S181, Obtain the second instruction information;

[0155] S182, based on the second communication protocol, the second instruction information is parsed and processed to obtain the first instruction function information;

[0156] It should be noted that the second communication protocol refers to the HID standard communication protocol;

[0157] The message format for HID standard communication is shown in the table below:

[0158] Table 1 HID Communication Message Format

[0159] 1 byte 1 byte 2 bytes 65535 bytes Type SubType Length Data

[0160] It should be noted that in Table 1, the Type field indicates the message type, with 0 for request and 1 for response; the Subtype field indicates the function type, with 0 for collecting key information, 1 for collecting key files, and 2 for running instructions; the Length field indicates the length of the Date field; and the Date field represents the actual data transmitted.

[0161] It should be noted that the first instruction function information refers to the value of the Subtype field;

[0162] S183, determine whether the first instruction function information is equal to the second set value, and obtain the first instruction function judgment result;

[0163] It should be noted that in this embodiment, the second setting value is set to 2, indicating that the information collection program is running;

[0164] S184, when the function judgment result of the first instruction is yes, execute S185 to S187;

[0165] If the result of the first instruction function judgment is negative, execute S181;

[0166] S185, the information acquisition payload is encoded to obtain the information acquisition program;

[0167] It should be noted that the encoding process refers to Unicode encoding of the information acquisition payload to obtain a text-formatted information acquisition program;

[0168] S186, the HID interface device receives the information acquisition HID input command;

[0169] S187, Based on the information collection HID input command, the information collection program is decoded and run, and the information collection program is implanted into the target host;

[0170] It should be noted that the information collection HID input command simulates keyboard keystrokes, and cmd.exe is used to store the encoded information collection program and decoding script into the host, and then decode and run them to complete the implantation of the information collection program.

[0171] As can be seen, implementing the relay-type covert information transmission method based on the HID interface described in this embodiment completes the implantation of the information acquisition program, lays the foundation for obtaining target information, and provides strong data backhaul covertness, thus solving the problem of obtaining target information.

[0172] In an optional embodiment, step S2 above, which involves using the information acquisition program to search and process the target host file and target host information to obtain target sending information and sending it to the HID interface device, includes:

[0173] S21, the information acquisition program receives and acquires the second control command information sent by the HID interface device;

[0174] It should be noted that the second control command information refers to control command information that conforms to HID standard communication.

[0175] S22, based on the second communication protocol message structure, the second control command information is processed to obtain the target transmission information;

[0176] S23, send the target transmission information to the HID interface device.

[0177] As can be seen, by implementing the relay-type covert information transmission method based on the HID interface described in this embodiment, the information acquisition program searches and processes the target host file and target host information to obtain the target sending information and sends it to the HID interface device. The data return is highly covert, solving the problem of target information acquisition.

[0178] In an optional embodiment, step S22 above, processing the second control command information based on the second communication protocol message structure to obtain the target transmission information, includes:

[0179] S2201, based on the second communication protocol message structure, the second control instruction information is parsed and processed to obtain the second message type information, the second instruction function information, the second data length, and the second instruction data information;

[0180] It should be noted that the second message type information is the value of the Type field in Table 1;

[0181] It should be noted that the second instruction function information is the value of SubType in Table 1;

[0182] It should be noted that the second data length is the value of Length in Table 1;

[0183] It should be noted that the second instruction data information is the value of Data in Table 1;

[0184] S2202, determine whether the second message type information is equal to the third preset value, and obtain the second message type judgment result;

[0185] It should be noted that in this embodiment, the third setting value is set to 1, indicating that the second message type is a response message;

[0186] If the second message type determination result is yes, execute S2203~S2204;

[0187] When the result of the second message type determination is negative, the second instruction data information is updated to the target sending information, and S2205 is executed;

[0188] S2203, the second instruction data information is encrypted to obtain the third instruction data information;

[0189] S2204, according to the second communication protocol message structure, the third instruction data information is structured using the second data length to obtain the target sending information;

[0190] S2205, determine whether the target transmission information is equal to the fourth preset value, and obtain the target transmission judgment result;

[0191] It should be noted that in this embodiment, the fourth preset value is set to 0, indicating that key information is collected;

[0192] S2206, when the target sends a judgment result of yes, execute S2207~S2208;

[0193] If the target sends a judgment result of no, execute S2209~S2210;

[0194] S2207, the information acquisition program performs key information extraction processing on the target host information according to the first preset rule to obtain the target acquisition information;

[0195] It should be noted that the first preset rule must comply with national laws and regulations and the scope of user authorization;

[0196] S2208, The target acquisition information is encrypted to obtain the target file to be sent;

[0197] S2209, the information acquisition program performs key file extraction processing on the target host file according to the second preset rule to obtain the target acquisition file;

[0198] It should be noted that the second preset rule must comply with national laws and regulations and the scope of user authorization;

[0199] S2210, the target file is encrypted to obtain the target file to be sent;

[0200] S2211, according to the first communication protocol, the target file to be sent is encapsulated to obtain target sending information.

[0201] S221, based on the second communication protocol message structure, the second control instruction information is parsed and processed to obtain the second message type information, the second instruction function information, the second data length, and the second instruction data information;

[0202] It should be noted that the second message type information is the value of the Type field in Table 1;

[0203] It should be noted that the second instruction function information is the value of SubType in Table 1;

[0204] It should be noted that the second data length is the value of Length in Table 1;

[0205] It should be noted that the second instruction data information is the value of Data in Table 1;

[0206] S222, when the second message type information is 0, execute S223 to S224;

[0207] When the second message type information is 1, execute S225;

[0208] S223, encrypt the second instruction data information to obtain the third instruction data information;

[0209] S224, according to the second communication protocol message structure, the third instruction data information is structured using the second data length to obtain the target sending information;

[0210] It should be noted that the aforementioned structured processing refers to processing according to the message structure of the second communication protocol.

[0211] S225, when the second instruction function information is 0, execute S226;

[0212] When the second instruction function information is 1, execute S227;

[0213] S226, the information acquisition program performs key information extraction processing on the target host information according to the first preset rule to obtain the target acquisition information;

[0214] It should be noted that the first preset rule means searching for information based on keywords, mainly used to extract key information such as username and password extraction, port open information, service open information, software installation information, and screenshots. It supports the acquisition of keystrokes from the password input windows of RAR compressed files, Excel, Word, PPT, PuTTY, and Xshell.

[0215] S227, the information acquisition program performs key file extraction processing on the target host file according to the second preset rule to obtain the target acquisition file;

[0216] It should be noted that the file search based on keywords is mainly used to extract files whose filenames or file content contain certain keywords;

[0217] S228, the target file is encrypted to obtain the target file to be sent;

[0218] It should be noted that the encryption process refers to encrypting the target file using the RSA2048 asymmetric encryption algorithm or the AES256 algorithm.

[0219] S229, according to the first communication protocol, the target file to be sent is encapsulated to obtain target sending information;

[0220] It should be noted that the encapsulation process refers to combining the data of the target file to be sent according to the message structure of the first communication protocol.

[0221] As can be seen, the relay transmission method for covert information transmission based on the HID interface described in this embodiment processes the second control command information based on the second communication protocol message structure to obtain the target transmission information. The data return is highly covert, solving the problem of target information acquisition.

[0222] In an optional embodiment, in step S3 above, the first receiving process of the target transmitted information using the HID interface device to obtain target data information includes:

[0223] S31, the HID interface device receives and acquires the target transmission information;

[0224] S32, based on the second communication protocol, the target transmission information is parsed and processed to obtain the target information to be transmitted;

[0225] S33, according to the first communication protocol, the target information to be launched is encapsulated to obtain target data information.

[0226] As can be seen, the relay-type covert information transmission method based on the HID interface described in this embodiment utilizes the HID interface device to perform a first receiving process on the target-sent information to obtain target data information. The data return is highly covert, solving the problem of target information acquisition.

[0227] In an optional embodiment, step S32 above, which involves parsing the target transmission information based on the second communication protocol to obtain the target information to be transmitted, includes:

[0228] S321, Obtain the target sending information;

[0229] S322, based on the second communication protocol message structure, the second control instruction information is parsed and processed to obtain the third message type information, the third instruction function information, the third data length and the fourth instruction data information;

[0230] It should be noted that the third message type information refers to the value of the Type field in Table 1;

[0231] It should be noted that the third instruction function information is the value of SubType in Table 1;

[0232] It should be noted that the third data length is the value of Length in Table 1;

[0233] It should be noted that the fourth instruction data information refers to the value of Data in Table 1;

[0234] S323, when the third message type information is 0, execute S324;

[0235] When the third message type information is 1, execute S325;

[0236] S324, according to the second communication protocol message structure, the fifth and fourth instruction data information is structured using the third data length to obtain the target information to be launched;

[0237] It should be noted that the structured processing refers to combining the target information to be transmitted according to the message structure of the second communication protocol.

[0238] As can be seen, the relay-type covert information transmission method based on the HID interface described in this embodiment, based on the second communication protocol, parses and processes the target information to be transmitted to obtain the target information to be transmitted, laying the foundation for subsequent data transmission. The data return is highly covert and solves the problem of target information acquisition.

[0239] In an optional embodiment, step S33 above, which involves parsing the target transmission information based on the second communication protocol to obtain target data information, includes:

[0240] S331, Obtain the target sending information;

[0241] S332, using the second communication protocol message structure, the target transmission information is parsed and processed to obtain the target transmission information;

[0242] As can be seen, the relay-type covert information transmission method based on the HID interface described in this embodiment, based on the second communication protocol, parses and processes the target information to be transmitted to obtain the target information to be transmitted, laying the foundation for subsequent target data information return transmission. The data return transmission is highly covert and solves the problem of target information acquisition.

[0243] In an optional embodiment, step S332 above, which involves parsing the target transmission information using the second communication protocol message structure to obtain the target transmission information, includes:

[0244] S3321, Obtain the target sending information;

[0245] S3322, based on the second communication protocol message structure, the target transmission information is extracted and processed to obtain the target data length information and the first target transmission data;

[0246] It should be noted that the extraction process refers to extracting the values ​​of the 3rd and 4th bytes of the target transmission information to obtain the target data length information; and extracting the Data value of the target transmission information to obtain the first target transmission data.

[0247] S3323, Extract the target data length information from the first target transmission data to obtain target transmission information;

[0248] As can be seen, the relay-type covert information transmission method based on the HID interface described in this embodiment utilizes the second communication protocol message structure to parse and process the target's transmitted information, thereby obtaining the target's transmitted information and laying the foundation for subsequent target data information return transmission. The data return transmission is highly covert, solving the problem of target information acquisition.

[0249] In an optional embodiment, step S4 above, which involves sending the target data information to the data return receiving device using the HID interface device, includes:

[0250] S41, the HID interface device receives the first control command information transmitted by the data return receiving device;

[0251] S42, based on the first communication protocol, the first control instruction information is parsed and processed to obtain the third instruction type information;

[0252] It should be noted that the parsing process refers to extracting information according to the message structure of the first communication protocol;

[0253] S43, determine whether the third instruction type information is equal to the fifth set value, and obtain the third instruction type determination result;

[0254] It should be noted that in this embodiment, the fifth preset value is set to 0;

[0255] S44, when the result of the third instruction type determination is yes, execute S45;

[0256] If the result of the third instruction type determination is negative, execute S41;

[0257] S45, the HID interface device sends the target data information to the data return receiving device.

[0258] As can be seen, the relay-type covert information transmission method based on the HID interface described in this embodiment, which uses the HID interface device to send the target data information to the data return receiving device, has strong data return covertness and solves the problem of target information acquisition.

[0259] In an optional embodiment, in step S5 above, the data return receiving device performs a second receiving process on the target data information to obtain the target data, including:

[0260] S501, obtain user request command information;

[0261] S502, the user request instruction information is parsed and processed to obtain user instruction type information;

[0262] It should be noted that the parsing process refers to extracting the values ​​of the corresponding fields based on the structure of the user requirement instruction information to obtain the user instruction type information;

[0263] S503, determine whether the user instruction type information is equal to the sixth preset value, and obtain the user instruction type determination result;

[0264] It should be noted that in this embodiment, the sixth setting value is set to 0, indicating that the user instruction type is a send instruction;

[0265] S504, when the user instruction type determination result is yes, execute S505 to S507;

[0266] If the user instruction type determination result is negative, execute S508 to S510;

[0267] S505, the user request instruction information is encrypted to obtain encrypted user instruction information;

[0268] It should be noted that the encryption process refers to encryption processing performed according to the RSA2048 asymmetric encryption algorithm or the AES256 algorithm.

[0269] S506, based on the first communication protocol, the encrypted user instruction information is encapsulated to obtain the first control instruction information;

[0270] S507, the data return receiving device sends the first control instruction information to the HID interface device;

[0271] S508, the data return receiving device receives the target data information;

[0272] S509, based on the first communication protocol, the target data information is parsed and processed to obtain the first target data information;

[0273] S510, decrypt the first target data information to obtain the target data;

[0274] It should be noted that the decryption process refers to decryption according to the RSA2048 asymmetric encryption algorithm or the AES256 algorithm.

[0275] As can be seen, by implementing the relay transmission method for covert information transmission based on the HID interface described in this embodiment, the data return receiving device performs a second receiving process on the target data information to obtain the target data. The data return transmission has strong covertness and solves the problem of obtaining target information.

[0276] Example 3

[0277] Please see Figure 4 , Figure 4 This is a schematic diagram of a relay-type covert information transmission device based on an HID interface disclosed in this embodiment. Figure 4 The described apparatus can be applied to network communication systems, such as local servers or cloud servers used in network communication systems; this embodiment is not limited to these applications. Figure 4 As shown, the device may include:

[0278] Memory 201 storing executable program code;

[0279] Processor 202 coupled to memory 201;

[0280] The processor 202 calls the executable program code stored in the memory 201 to execute the steps in the relay transmission method for covert information transmission based on the HID interface described in Embodiment 2.

[0281] Example 4

[0282] This embodiment discloses a computer-readable storage medium that stores a computer program for electronic data interchange, wherein the computer program causes a computer to execute the steps in the relay-type covert information transmission method based on the HID interface described in Embodiment 2.

[0283] Example 5

[0284] This embodiment discloses a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to perform the steps in the relay-type covert information transmission method based on the HID interface described in Embodiment 1.

[0285] The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0286] Through the detailed description of the above embodiments, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, including read-only memory (ROM), random access memory (RAM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), one-time programmable read-only memory (OTPROM), electrically-erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, disk storage, magnetic tape storage, or any other computer-readable medium that can be used to carry or store data.

[0287] Finally, it should be noted that the relay-type covert information transmission system, method, and apparatus based on the HID interface disclosed in this embodiment are merely preferred embodiments of the present invention and are only used to illustrate the technical solutions of the present invention, not to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A relay-type covert information transmission system based on an HID interface, characterized in that, The system includes: an HID interface device, a target host, and a data return receiving device; The HID interface device is used to receive and process control command information transmitted by the data backhaul receiving device, implant information acquisition program into the target host, acquire and process target transmission information sent by the target host and transmit it to the data backhaul receiving device. The target host is used to connect to the authorized target network to receive and send network data, and to collect information using the implanted information collection program to obtain the target sent information. The data return receiving device is used to receive the target transmission information transmitted by the HID interface device; The target host and the HID interface device are connected via a USB interface; the HID interface device and the data return receiving device are connected via a wireless network.

2. The relay-type covert information transmission system based on the HID interface according to claim 1, characterized in that, The HID interface device includes a spoofing module, a USB splitter module, a main control MCU module, and a communication module; The camouflage module is used to camouflage the HID interface device; The USB splitter module is used to receive the control command information sent by the main control MCU module and send it to the target host, and to receive the target transmission information sent by the target host and send it to the communication module; The main control MCU module is used to receive the control command information sent by the communication module; The communication module is used to receive the control command information sent by the data return receiving device and send it to the main control MCU module, and send the target sending information to the data return receiving device; The USB splitter module is connected to the target host via a USB interface; the main control MCU module is connected to the USB splitter module and the communication module respectively.

3. A relay-type covert information transmission method based on an HID interface, applied to the relay-type covert information transmission system based on an HID interface as described in claim 1 or claim 2, characterized in that, The method includes: S1, based on the first control command information of the data return receiving device, the HID interface device implants an information collection program into the target host; S2, the information acquisition program is used to search and process the target host file and target host information to obtain the target sending information and send it to the HID interface device; S3, using the HID interface device, perform a first receiving process on the target transmitted information to obtain target data information; S4, using the HID interface device, send the target data information to the data return receiving device; S5, the data return receiving device performs a second receiving process on the target data information to obtain the target data.

4. The relay-type covert information transmission method based on HID interface according to claim 3, characterized in that, The step of using the first control command information based on the data return receiving device to implant an information collection program into the target host by the HID interface device includes: S11, the HID interface device receives and acquires the first control instruction information sent by the data return receiving device; S12, decrypt the first control instruction information to obtain the first control instruction decryption information; S13, based on the first communication protocol, the decryption information of the first control instruction is parsed to obtain network instruction type information; S14, determine whether the network instruction type information is equal to the first preset value, and obtain the network instruction type determination result; S15, when the network instruction type determination result is yes, execute S16 to S18; If the network instruction type determination result is negative, execute S11; S16, based on the second communication protocol, the network instruction type information is encapsulated to obtain the second instruction information; S17, using the HID interface device, send the second instruction information to the target host; S18, process the second instruction information and implant the information collection program into the target host.

5. The relay-type covert information transmission method based on HID interface according to claim 3, characterized in that, The step of using the information acquisition program to search and process the target host file and target host information to obtain the target sending information and send it to the HID interface device includes: S21, the information acquisition program receives and acquires the second control command information sent by the HID interface device; S22, based on the second communication protocol message structure, the second control command information is processed to obtain the target transmission information; S23, send the target transmission information to the HID interface device.

6. The relay-type covert information transmission method based on HID interface according to claim 5, characterized in that, The process of processing the second control command information based on the second communication protocol message structure to obtain the target transmission information includes: S2201, based on the second communication protocol message structure, the second control instruction information is parsed and processed to obtain the second message type information, the second instruction function information, the second data length, and the second instruction data information; S2202, determine whether the second message type information is equal to the third preset value, and obtain the second message type judgment result; If the second message type determination result is yes, execute S2203~S2204; When the result of the second message type determination is negative, the second instruction data information is updated to the target sending information, and S2205 is executed; S2203, the second instruction data information is encrypted to obtain the third instruction data information; S2204, according to the second communication protocol message structure, the third instruction data information is structured using the second data length to obtain the target sending information; S2205, determine whether the target transmission information is equal to the fourth preset value, and obtain the target transmission judgment result; S2206, when the target sends a judgment result of yes, execute S2207~S2208; If the target sends a judgment result of no, execute S2209~S2210; S2207, the information acquisition program performs key information extraction processing on the target host information according to the first preset rule to obtain the target acquisition information; S2208, The target acquisition information is encrypted to obtain the target file to be sent; S2209, the information acquisition program performs key file extraction processing on the target host file according to the second preset rule to obtain the target acquisition file; S2210, the target file is encrypted to obtain the target file to be sent; S2211, according to the first communication protocol, the target file to be sent is encapsulated to obtain target sending information.

7. The relay-type covert information transmission method based on HID interface according to claim 3, characterized in that, The first receiving process, performed on the target transmitted information using the HID interface device to obtain target data information, includes: S31, the HID interface device receives and acquires the target transmission information; S32, based on the second communication protocol, the target transmission information is parsed and processed to obtain the target information to be transmitted; S33, according to the first communication protocol, the target information to be launched is encapsulated to obtain target data information.

8. The relay-type covert information transmission method based on HID interface according to claim 7, characterized in that, The step of parsing and processing the target transmitted information based on the second communication protocol to obtain target data information includes: S331, Obtain the target sending information; S332, using the second communication protocol message structure, the target sent information is parsed and processed to obtain target data information.

9. The relay-type covert information transmission method based on HID interface according to claim 3, characterized in that, The step of sending the target data information to the data return receiving device using the HID interface device includes: S41, the HID interface device receives the first control command information transmitted by the data return receiving device; S42, based on the first communication protocol, the first control instruction information is parsed and processed to obtain the third instruction type information; S43, determine whether the third instruction type information is equal to the fifth set value, and obtain the third instruction type determination result; S44, when the result of the third instruction type determination is yes, execute S45; If the result of the third instruction type determination is negative, execute S41; S45, the HID interface device sends the target data information to the data return receiving device.

10. The relay-type covert information transmission method based on the HID interface according to claim 3, characterized in that, The data return receiving device performs a second receiving process on the target data information to obtain the target data, including: S501, obtain user request command information; S502, the user request instruction information is parsed and processed to obtain user instruction type information; S503, determine whether the user instruction type information is equal to the sixth preset value, and obtain the user instruction type determination result; S504, when the user instruction type determination result is yes, execute S505 to S507; If the user instruction type determination result is negative, execute S508 to S510; S505, the user request instruction information is encrypted to obtain encrypted user instruction information; S506, based on the first communication protocol, the encrypted user instruction information is encapsulated to obtain the first control instruction information; S507, the data return receiving device sends the first control instruction information to the HID interface device; S508, the data return receiving device receives the target data information; S509, based on the first communication protocol, the target data information is parsed and processed to obtain the first target data information; S510, the first target data information is decrypted to obtain the target data.

Images