A key-based covert carrier screening method and device

Abstract

The application discloses a kind of screening methods and devices based on key-based covert carrier, belong to the field of covert communication of information security.Covered transceiver party is pre-cooperative with configuration hash function, shared key and covert algorithm, the shared key includes input key and screening key;Sender extracts candidate data packet load, calculates hash value in combination with input key, and determines covert carrier by mask screening mechanism using screening key, then executes data embedding to generate steganographic data packet and is transmitted through public channel;After receiving party intercepts steganographic data packet, according to the same key and hash function, load hash value is calculated, and covert carrier is positioned by mask screening, and covert data is extracted based on covert algorithm.The application realizes the screening of dynamic, key-driven communication carrier, effectively enhances the concealment and system security of covert communication.

Description

Technical Field

[0001] This invention relates to the field of covert communication in information security, and in particular to a key-based covert carrier screening method, apparatus, device, and storage medium. Background Technology

[0002] The stealth of a network covert channel refers to its ability to remain undetected, encompassing both imperceptibility and undetectability. Imperceptibility equates to transparency; the existence of the covert channel is transparent to normal users and undetectable, meaning it is indistinguishable from a business perspective. Undetectability refers to the statistical characteristics of the covert carrier remaining largely unchanged. The stealth of a network covert channel is related to the complexity of the covert algorithm, specifically the construction steps and encoding / decoding methods of the covert data. Currently, with the deepening research into network covert channels, the exploration of construction methods and carrier types has been gradually improved. Wendzel et al. used a pattern language markup language method to classify 109 covert channel construction techniques from 1987 to 2013 into 11 different patterns, with most covert channel construction techniques falling into four categories. Li Yanfeng et al. summarized and analyzed the construction techniques of two types of network covert channels—stored and time-based—from three aspects: symbol design, information encoding, and channel optimization, providing a review of the possible forms and construction methods of network covert channels. The stealth of existing network covert channels depends not only on the complexity of the covert algorithms themselves, but also primarily on the confidentiality of those algorithms. However, ongoing research has made network covert channels more vulnerable to reverse engineering attacks, leading to the leakage of covert algorithms. Once a covert algorithm is leaked, adversaries can easily crack the construction method of the network covert channel and find the carrier, thereby disrupting the covert communication process. Although we can encrypt covert data using encryption algorithms before embedding the encoding, this method only ensures that the content of the covert data is not known to adversaries after interception; it does not reduce the probability of the secret data being intercepted. The stealth of network covert channels requires new protection mechanisms. Summary of the Invention

[0003] The present invention aims to at least partially solve one of the technical problems in the related art.

[0004] To address this issue, this invention proposes a key-based method for filtering covert carriers. The method involves the collaborative configuration of a shared key, including an input key and a filtering key, a hash function, and a covert algorithm between the sender and receiver. The sender calculates the hash value of the payload of candidate data packets based on the input key and the hash function, and uses the filtering key to filter and determine the covert carrier through masking operations. Data embedding is performed on the selected carrier to generate a encrypted data packet, which is then transmitted through a public channel. The receiver, using the same key and algorithm, locates the covert carrier and extracts the covert data from intercepted data packets. This invention achieves key-driven dynamic carrier filtering and covert communication, effectively improving the concealment and security of information transmission.

[0005] Another objective of this invention is to provide a key-based covert carrier screening device.

[0006] The third objective of this invention is to provide a computer device.

[0007] A fourth objective of this invention is to provide a non-transitory computer-readable storage medium.

[0008] To achieve the above objectives, this invention proposes a key-based method for screening covert carriers, comprising: S1, the sender and receiver collaborate to configure the hash function, shared key, and covert algorithm; wherein, the shared key includes the input key used for hash calculation and the filtering key used for filtering; S2, the covert sender captures candidate data packets and extracts the corresponding payload portion, calculates the hash value of the payload based on the input key and hash function, and uses the filtering key to mask the hash value to determine the covert carrier; S3, perform a covert data embedding operation on the selected covert carrier, generate a coded data packet and transmit it through a public channel; S4, the covert receiver intercepts the encrypted data packet, calculates the hash value of the payload based on the same input key and hash function, uses the filtering key to mask the hash value to locate the covert carrier, and extracts the covert data according to the covert algorithm.

[0009] The key-based covert carrier screening method of this invention may also have the following additional technical features: In one embodiment of the present invention, the input key and the filtering key include: S11, the input key is used as the input parameter of the hash function to participate in the calculation of the load hash value, and the filtering key is used to filter the hash values ​​that meet the conditions through masking operations.

[0010] In one embodiment of the present invention, when retrieving the corresponding payload portion, the SHA-256 hash function is used to calculate the payload content, including: S21, concatenate the input key with the data packet payload as input to the hash function, and calculate the hash value; S22, the hash value is filtered by masking operation, and it is determined whether the result of bitwise AND operation between the hash value and the preset mask is consistent with the filtering key. If they are consistent, the corresponding data packet is selected as the cover carrier.

[0011] In one embodiment of the present invention, S31, the proportion of the covert carrier is controlled according to the length of the screening key, and the covert data embedding density is adjusted by a formula: ; S32, embed the selected covert carrier with data according to the preset covert algorithm to ensure that the embedded data packet retains the statistical characteristics of the original data packet.

[0012] In one embodiment of the present invention, after the covert receiver intercepts the encrypted data packet, the process includes: S41, extract the payload portion of the intercepted data packet and repeat the hash calculation process to obtain a hash value consistent with that of the sender; S42 uses the same mask to filter hash values ​​and confirms the identity of the hidden carrier using a formula: ; in, To filter keys, For hash value, This is the preset mask.

[0013] In one embodiment of the present invention, it further includes: S5 periodically updates the filtering key and dynamically reconstructs the set of covert carriers by recalculating the hash value mask conditions; the update cycle is related to network traffic characteristics to avoid regular exposure.

[0014] To achieve the above objectives, another aspect of the present invention provides a key-based covert carrier screening device, comprising: The configuration module is used for the covert collaborative configuration of hash functions, shared keys, and covert algorithms between the sender and receiver; the shared key includes an input key for hash calculation and a filtering key for filtering. The hash calculation and mask filtering module is used to covertly capture candidate data packets and extract the corresponding payload. It calculates the hash value of the payload based on the input key and hash function, and uses the filtering key to perform mask filtering on the hash value to determine the covert carrier. The data embedding and transmission module is used to perform covert data embedding operations on the selected covert carriers, generate coded data packets, and transmit them through public channels. The module for intercepting encrypted data packets and extracting hidden data is used to covertly intercept encrypted data packets. It calculates the hash value of the payload based on the same input key and hash function, uses a filtering key to mask the hash value to locate the hidden carrier, and extracts the hidden data according to the covert algorithm.

[0015] In one embodiment of the present invention, it further includes: The key update module is used to periodically update the screening keys and dynamically reconstruct the set of covert carriers by recalculating the hash value mask conditions; the update cycle is related to network traffic characteristics to avoid regular exposure.

[0016] This invention discloses a key-based covert carrier filtering method and apparatus. By having both the sender and receiver collaboratively configure the covert carrier based on a shared key and a hash function, and dynamically determining the covert carrier using a mask filtering mechanism, it effectively solves the problem of fixed or highly predictable carrier selection in traditional covert communication, making it easily detectable. It achieves a complete closed loop from key-driven hash calculation and mask condition filtering to data embedding and extraction, ensuring that both communicating parties can synchronously and accurately locate and utilize the covert carrier in public channels without needing a pre-shared carrier list. This significantly enhances the adversarial and security aspects of covert communication and improves the system's adaptability to dynamically changing network environments.

[0017] To achieve the above objectives, a third aspect of this application provides a computer device comprising a processor and a memory; wherein the processor runs a program corresponding to the executable program code by reading executable program code stored in the memory, for implementing a key-based covert carrier screening method as described in the first aspect embodiment.

[0018] To achieve the above objectives, a fourth aspect of this application provides a non-transitory computer-readable storage medium storing a computer program that, when executed by a processor, implements a key-based covert carrier screening method as described in the first aspect.

[0019] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0020] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a flowchart of a key-based covert carrier screening method according to an embodiment of the present invention; Figure 2 This is a schematic diagram of a key-based covert carrier screening device according to an embodiment of the present invention; Figure 3 It is a computer device according to an embodiment of the present invention. Detailed Implementation

[0021] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0022] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0023] The following description, with reference to the accompanying drawings, describes a key-based method, apparatus, device, and storage medium for screening covert carriers according to embodiments of the present invention.

[0024] The core idea of ​​this invention is to establish a key-driven dynamic carrier selection mechanism by pre-configuring a shared key, including an input key and a filtering key, a hash function, and a concealment algorithm, through collaborative configuration between the sender and receiver. The input key and data packet payload are concatenated and input into the hash function to generate a corresponding hash value. Then, a masking operation based on the filtering key is used to conditionally judge and filter the hash value, thereby dynamically determining usable concealment carriers from public network traffic. The sender performs data embedding on the selected carriers, generating encrypted data packets that retain the original statistical characteristics and transmitting them through a public channel. The receiver, using the same key and algorithm, performs symmetric hash calculations and masking on the intercepted data packets to accurately locate the concealment carrier and extract the embedded data according to the concealment algorithm. Through this closed-loop process, traditional information concealment methods relying on fixed carriers or preset rules are transformed into a dynamic carrier selection system based on cryptographic hashing and masking decisions, which is non-fixed and difficult to predict. This significantly improves the concealment, anti-detection capability, robustness, and security adaptability of covert communication in dynamic network environments.

[0025] Example 1 To achieve the above invention, embodiments of the present invention provide a key-based method for screening covert carriers, such as... Figure 1 As shown, it includes: S1, the sender and receiver collaborate to configure the hash function, shared key and covert algorithm; wherein, the shared key includes the input key for hash calculation and the filtering key for filtering.

[0026] Specifically, this step ensures the synchronization and security of subsequent hidden data embedding and extraction processes by establishing consistent cryptographic parameters between the communicating parties. Specifically, the two parties pre-negotiate and configure the SHA-256 hash function as the core computational tool. This function has characteristics such as fixed output length (256 bits), high computational efficiency, and strong collision resistance, meeting the basic requirements of hash functions in cryptography. Shared key It consists of two parts: the input key, which participates in the hash calculation and enhances the unpredictability of packet characteristics; and the filter key, which is used for subsequent hash value matching and filtering, and its length... This determines the probability of selecting a concealed carrier.

[0027] Furthermore, the synchronized configuration of the covert algorithm is equally crucial. This algorithm defines how covert data is embedded and extracted within legitimate data packets, such as by modifying redundant fields, time intervals, or protocol behavior to achieve information hiding. Both the sender and receiver must ensure consistency in the algorithm logic to ensure correct encoding and decoding of the covert data.

[0028] Further, filter the key length. Selection ratio with concealed carrier There is a clear mathematical relationship between them, namely This formula shows that, as As the number of packets increases, the proportion of the covert carrier in the total data packets decreases exponentially, effectively reducing the capacity of the covert channel and making it more difficult to detect through statistical analysis. In practical applications, this step is usually completed after the two communicating parties establish a secure channel, such as through Diffie-Hellman key exchange or TLS handshake protocol to achieve secure key transmission. The technical value of this step lies in the fact that by introducing a key-driven hash filtering mechanism, the covertness of the covert channel is extended from simply relying on algorithm complexity to also relying on key security, significantly improving the system's resistance to detection in the event of covert algorithm leakage.

[0029] Furthermore, S1 includes: S11, the input key is used as the input parameter of the hash function to participate in the calculation of the load hash value, and the filtering key is used to filter the hash values ​​that meet the conditions through masking operations.

[0030] Specifically, the shared key system of this invention achieves a deep binding between the covert carrier screening process and key security in principle. Its design follows the Kerckhoffs principle in cryptography, meaning that the security of the system should not rely on the secrecy of the algorithm, but should be entirely guaranteed by the secrecy of the key. The input key and the screening key are functionally decoupled and coordinated: the input key, as the dynamic salt value of the hash function, together with the data packet payload, constitutes the input for hash calculation. Its core principle lies in utilizing the one-wayness and avalanche effect of the hash function to ensure that, without knowing the key, an adversary cannot deduce or collide with the same hash value from the publicly available data packet payload, thus fundamentally destroying the possibility of an adversary predicting the screening result by analyzing the payload content. The screening key acts on the output of the hash function, and its principle is based on a probabilistic screening mechanism implemented through mask comparison. This mechanism treats the hash value as a pseudo-random number uniformly distributed within the value range, and determines whether the carrier is selected by comparing whether its specific low-order bits (defined by the screening key length) are equal to the preset screening key. This principle makes the screening results statistically uniform and random, and the screening probability can be precisely mathematically controlled by the key length, thus achieving a balance between the unpredictability and controllability of carrier selection.

[0031] Furthermore, the shared key is concretized into two discrete and functionally defined parameters. The input key, implemented as a binary sequence, is concatenated with the payload extracted from network packets during actual computation, serving as the input message for a standard cryptographic hash function (such as the SHA-256 algorithm used in the embodiments described in this specification). This concatenation operation ensures the key's direct influence on the hash result. The filtering key is also a binary sequence, with its length L being a key technical parameter. In the filtering stage, the system performs a bitwise AND operation between the calculated hash value hi and a mask generated from the length L, which is typically... Its function is to retain only the lower L bits of the hash value. The result is then compared bit by bit with a pre-shared filtering key. This judgment process can be performed using conditional expressions. Precise description. Only when the conditions are met is the corresponding data packet determined to be a qualified covert carrier, and then it enters the subsequent data embedding process. This implementation method only involves concatenation, hash calculation, and bit operations, and has the advantages of low computational overhead and fast processing speed, making it suitable for real-time processing in high-speed network environments.

[0032] Furthermore, the length L of the shared key, especially the screening key, is a core quantifiable indicator for controlling the overall performance of the covert channel. This length L directly determines the screening ratio r of the covert carrier, and the two satisfy a definite mathematical relationship: For example, when L=4, approximately 1 out of every 16 data packets is selected as a covert carrier; when L increases to 8, this proportion drops to approximately 1 / 256. This relationship provides a theoretical basis for fine-grained configuration under different security levels and communication capacity requirements. The length of the input key is mainly related to the strength of resistance to brute-force attacks and should generally have sufficient bits to resist exhaustive attacks. In addition, the key update cycle is also an important indicator, which can be dynamically set according to network traffic characteristics, time windows, or the amount of data transmitted. By periodically or event-driven updating of the screening key (and even the input key), the dynamic reconstruction and drift of the covert carrier set can be achieved, thereby effectively resisting detection methods based on long-term traffic statistical analysis and improving the long-term covertness of the channel.

[0033] Specifically, it can be seamlessly integrated into various storage-based covert channels, such as filtering and embedding payload fields of common protocol packets like HTTP, DNS, or ICMP. In actual deployment, both parties in covert communication need to pre-synchronize keys and agree on algorithms through a secure channel, after which carrier filtering and data communication can be automatically performed in public network traffic. This solution is particularly suitable for scenarios with extremely high requirements for communication covertness and rich network background traffic, such as the transmission of secret information in high-security networks, covert backlinks in penetration testing, or the distribution of invisible watermarks in digital rights management. Its core value lies in the fact that even if the embedding algorithms used in covert communication (such as least significant bit modification, specific field encoding) are made public due to in-depth research or reverse engineering, the adversary, without obtaining the current valid key, will still find it difficult to accurately and efficiently identify the very few carriers that actually carry secret information from a massive amount of legitimate network packets. This elevates the survivability of the covert channel from relying on algorithm confidentiality to a new level of relying on key security.

[0034] Specifically, the shared key structure and filtering method defined in this invention bring significant and verifiable technical effects. The primary effect is a greatly enhanced resistance to detection: since the filtering result is determined by both the key and the hash value, and the hash output has pseudo-randomness, the distribution of the concealed carrier in the carrier set is unbiased and uniform, preventing the formation of fixed patterns or dense areas that can be identified through statistical analysis. This effectively combats automated covert channel detection systems based on traffic statistics and machine learning. Secondly, a balance between security and efficiency is achieved: the filtering process requires only one hash calculation and one bit comparison, resulting in extremely low processing latency (down to the microsecond level), ensuring feasibility in high-throughput network environments. Furthermore, the security strength can be flexibly adjusted through the key length. Thirdly, an elegant degradation and recovery mechanism is provided: if a key leak is suspected, the communicating parties only need to negotiate and replace the key to quickly reconstruct a new, unpredictable concealed carrier filtering sequence without changing the core embedding algorithm or communication protocol, thus improving the system's maintainability and survivability. In summary, this design transforms the most vulnerable carrier selection stage in traditional covert channels into a dynamically randomized security process strongly protected by keys, fundamentally improving the robustness and reliability of network covert channels in real-world adversarial environments.

[0035] S2, the covert sender captures candidate data packets and extracts the corresponding payload portion, calculates the hash value of the payload based on the input key and hash function, and uses the filtering key to mask the hash value to determine the covert carrier.

[0036] Specifically, this step is one of the key links in building a covert network channel. Its technical implementation is based on the combination of accurate extraction of data packet content and hash filtering mechanism to ensure the dynamic selection of covert carrier and the synchronization of communication process.

[0037] Furthermore, the covert sender first uses network sniffing tools (such as libpcap, WinPcap, or DPDK) to capture candidate data packets in network traffic in real time. When extracting the payload, ensure that only the portion of the data packet that will not be modified by intermediate devices during transmission is selected, such as the payload in TCP / UDP segments, rather than fields like source IP or destination IP that may change due to NAT or routing policies. After payload extraction, compare it with the preset input key. Together, they are used as input to the SHA-256 hash function to calculate the hash value of the data packet. SHA-256, as a standard cryptographic hash algorithm, has an output length of 256 bits. It has good collision resistance and irreversibility, which can effectively prevent adversaries from obtaining the original payload content through reverse engineering.

[0038] Specifically, this step applies to stored or time-based network covert channels, such as embedding covert data in HTTP traffic or hiding information in DNS requests. The covert sender dynamically selects the covert carrier within the legitimate communication flow, avoiding the exposure of communication behavior through fixed patterns, thereby improving the covert channel's resistance to detection.

[0039] Specifically, this step introduces a key-controlled hash filtering mechanism, binding the selection of the covert carrier to key security. Even if the covert algorithm is leaked, an adversary will still be unable to accurately identify the covert carrier. Simultaneously, the filtering process is computationally efficient (single packet processing latency is less than [missing information]). This method is feasible for deployment in high-speed network environments, significantly enhancing the security and concealment of covert network communications.

[0040] Furthermore, S2 includes: S21, the input key and the data packet payload are concatenated as input to the hash function to calculate the hash value.

[0041] Specifically, this step involves concatenating a portion of the shared key (i.e., the Input Key) with the data packet payload, using this as input to the hash function to calculate the hash value. This provides a basis for subsequent screening of concealed carriers.

[0042] Specifically, this step first requires the covert sender to analyze candidate data packets captured in the network. Payload extraction is performed. The data packet payload typically contains application-layer data, such as the HTTP request body or DNS query content. This data is usually not modified by intermediate devices during network transmission, thus ensuring the consistency of the hash calculation input. After payload extraction, the Input Key is concatenated byte-by-byte with the payload content and used as the input to the SHA-256 hash function. SHA-256 is a widely used cryptographic hash algorithm that outputs a fixed-length 256-bit hash value, exhibiting good collision resistance and irreversibility.

[0043] Furthermore, key parameters involved in this step include the length and content of the Input Key, and the output length of the hash function. The Input Key is typically a 128-bit or 256-bit symmetric key, the content of which is pre-negotiated and securely distributed by the parties in covert communication. Hash value Its length is fixed at 256 bits, and its low... The bits will be used for subsequent filtering operations, where Length of the filter key. Filter ratio. From the formula The given information indicates that the longer the screening key length, the lower the matching probability and the smaller the proportion of the hidden carrier, thereby further enhancing the concealment.

[0044] Specifically, this step is applicable to the construction of covert channels in storage-based or time-based networks. The covert sender captures data packets in real time in a high-speed network environment and quickly determines whether they can be used as covert carriers through this hash calculation step. Because SHA-256 has high computational efficiency and the filtering process only involves bitmasking operations (…),… The processing latency of a single data packet can be controlled within... Within this range, it meets actual deployment needs.

[0045] Specifically, this step, by introducing key-dependent hash calculations, binds the choice of the cover material to key security. Even if the cover algorithm is leaked, an adversary cannot identify the cover material without the key. Simultaneously, due to the low hash value... Located in The uniform distribution within the range and the highly random and unbiased screening process effectively enhance the anti-detection capability of the network's covert channels.

[0046] S22, the hash value is filtered by masking operation, and it is determined whether the result of bitwise AND operation between the hash value and the preset mask is consistent with the filtering key. If they are consistent, the corresponding data packet is selected as the cover carrier.

[0047] Specifically, this step, based on the output characteristics of the SHA-256 hash function and combined with the filter key in the shared key, enables dynamic and random selection of candidate data packets, thereby enhancing the anti-detection capability of the network's covert channels.

[0048] Specifically, the covert sender captures candidate data packets. Then, its payload is first extracted and used as the input to the hash function. It is then combined with the preset input key to participate in the hash calculation, resulting in the hash value. Since SHA-256 outputs a 256-bit binary string, it has good uniform distribution characteristics and collision resistance, therefore the hash value can be regarded as... Random numbers within a certain range. Furthermore, to filter the concealed carrier, the sender constructs a mask. Where L is the bit length of the filter key. This mask is used to extract the hash value. The lower L bits, i.e., the execution bit and operation And compare the result with the FilterKey. If it satisfies... If so, the data packet is selected as the covert carrier for subsequent covert data embedding.

[0049] Furthermore, the screening key length L determines the proportion of the covert carrier, which is related to the screening ratio. It is inversely proportional. For example, when L=8, the selection ratio is 1 / 256, meaning that on average only one out of every 256 data packets is selected. This parameter can be dynamically adjusted according to actual communication needs and network traffic to balance stealth and communication efficiency.

[0050] Specifically, this step is suitable for covert channels in storage-based or time-based networks, especially in high-traffic, low-latency network environments, where it offers high computational efficiency and a processing latency of less than [missing information - likely a number]. This meets the needs of real-time communication. Furthermore, because the filtering process relies on a shared key, even if the concealment algorithm is leaked, adversaries will be unable to identify the concealment carrier without the key, thus significantly improving system security.

[0051] Specifically, by introducing a key-controlled hash filtering mechanism, the choice of the covert carrier is bound to the key security, enhancing the undetectability of the covert channel. Furthermore, this method conforms to the Kerckhoffs criterion, meaning that the system's security depends solely on the key, not the algorithm, thus improving the overall practicality and security of the scheme.

[0052] S3 performs a covert data embedding operation on the selected covert carrier, generates a coded data packet, and transmits it through a public channel.

[0053] Specifically, this step involves embedding information into data packets using a pre-defined covert algorithm based on a selected set of covert carriers, thereby hiding secret information within legitimate traffic and achieving the purpose of covert communication.

[0054] Furthermore, after selecting the covert carrier, the covert sender embeds the secret data into the payload of the selected data packet according to a preset covert algorithm. The covert algorithm can be based on techniques such as field modification, time interval adjustment, and traffic pattern perturbation; the specific implementation depends on the communication scenario and protocol type. The embedding operation must be performed without affecting the legitimacy of the data packet and network behavior, ensuring the safety of the embedded secret data packet. It can still pass through the detection and forwarding of conventional network devices. After embedding, the encrypted data packets are transmitted normally through public channels (such as the Internet, corporate intranets, etc.), thereby achieving the transmission of covert data.

[0055] Furthermore, the embedding efficiency and stealth of the concealment algorithm are the core considerations in this step. According to the formula... Filter key length Determines the proportion of concealed carriers This, in turn, affects the frequency of embedding operations and the transmission rate of covert data. In actual deployments, Typically, the number of bits is set to 6 or more to ensure the sparsity of the covert vector and reduce the likelihood of it being detected by the detector. Furthermore, the time delay of the embedding operation should be controlled within... Within this range, to meet the real-time requirements of high-speed network environments.

[0056] Specifically, this step applies to both stored-mode and time-based covert network channels, such as embedding covert information in protocols like HTTP, DNS, and ICMP. The covert sender and receiver need to coordinate the configuration of the covert algorithm and key before communication to ensure that both parties can synchronously identify and decode the covert data during reception and extraction. In practical deployments, this step can be integrated into network proxies, middleware, or custom protocol stacks to automate the processing of covert communication.

[0057] Specifically, this step effectively reduces the detectability of the covert channel by embedding secret information into dynamically selected covert carriers. Even if the covert algorithm is reverse-engineered, adversaries cannot accurately identify the covert carrier without the selection key, thus preventing them from extracting the secret information. This design binds the security of the covert channel to the security of the key, significantly improving the anti-detection capability and security of covert communication.

[0058] Furthermore, S3 includes: S31, the proportion of the hidden carrier is controlled according to the length of the screening key, and the embedding density of the hidden data is adjusted by a formula: .

[0059] Specifically, this step is achieved through the formula This technology adjusts the density of embedded covert data, thereby improving the anti-detection capability of the covert channel while ensuring communication efficiency. Its implementation is based on the uniformity of the hash function and the bit length control of the filtering key, offering high cryptographic security and computational efficiency.

[0060] Furthermore, after capturing the data packet, the covert sender first extracts the payload portion of the data packet and uses it, along with the input key from the shared secret key, as input to the SHA-256 hash function to calculate the corresponding hash value. Subsequently, the sender determines the filter key based on its length. Construct mask and using bitwise operations The hash value is filtered. If the condition is met, the data packet is selected as the covert carrier for subsequent covert data embedding operations.

[0061] Further, filter the key length. This is a key parameter, typically ranging from 1 to 32 bits. This parameter directly affects the proportion of concealed carriers. ,Right now For example, when hour, This means that, on average, only one out of every 64 data packets is selected as the covert carrier. With The increase, The density decreases exponentially, and the distribution of covert carriers becomes sparser, thus reducing the detectability of covert communication. Meanwhile, due to the good uniform distribution characteristics of SHA-256 output, its low... Located in The range can be considered as uniform random numbers, ensuring the unbiasedness and randomness of the screening process.

[0062] Specifically, this step applies to the construction of covert channels in both storage-based and time-based networks. The covert sender and receiver need to pre-configure a shared key before communication. The mechanism uses SHA-256 as the filtering function. In practical deployments, this mechanism can be applied to the periodic embedding of covert data, traffic masquerading, and countering statistical analysis-based detection systems. Since the filtering process involves only hash calculations and bitmasking operations, its processing latency is typically less than [a certain value]. It meets the real-time requirements of high-speed network environments.

[0063] Specifically, this step, through a key-controlled hash filtering mechanism, binds the selection of the covert carrier to key security, significantly improving the covert channel's resistance to reverse engineering. Even if the covert algorithm is leaked, adversaries, lacking the filtering key, cannot accurately identify the covert carrier, thus failing to extract the covert data. Furthermore, by adjusting... The value allows for flexible control of the embedded density of covert data, achieving a dynamic balance between covertness and communication efficiency, and providing a quantifiable and configurable security enhancement method for covert communication systems.

[0064] S32, embed the selected covert carrier with data according to the preset covert algorithm to ensure that the embedded data packet retains the statistical characteristics of the original data packet.

[0065] Specifically, this process first relies on the screening results of the covert carriers, that is, under the condition that... The operation is performed in the conditional data packet, where , L is the length of the filter key.

[0066] Furthermore, after completing packet filtering, the covert sender will conceal the data. According to the preset concealment algorithm Embedded into the payload portion of the selected data packet. Since the payload of network packets is typically generated by application layer protocols, it possesses high redundancy and modifiability, making it an ideal embedding location. The embedding operation must adhere to specific encoding rules, such as bit flipping, byte substitution, or differential encoding of certain fields in the payload, to minimize the modification to the original data packet. In some implementations, the embedding algorithm may be designed based on LSB (least significant bit) substitution, differential encoding, or semantic redundancy of protocol fields.

[0067] Furthermore, the embedding process must meet the following key indicators: (1) the embedding perturbation amplitude should be controlled within the range allowed by the protocol to avoid triggering the anomaly detection mechanism; (2) the embedding efficiency should be lower than that of the standard. (3) Embedded encrypted data packets to adapt to high-speed network environments; With the original data packet Consistency should be maintained in statistical characteristics (such as payload length distribution, time interval distribution, protocol field distribution, etc.) to ensure concealment. Specifically, the filtering key length L determines the sparsity of the concealment carrier, and the embedding operation is only performed on data packets that meet the filtering conditions, thereby reducing the embedding frequency of concealed data and further improving concealment.

[0068] Specifically, this step is widely applicable to covert channels in both storage-based and time-based networks, such as embedding covert information in protocols like HTTP, DNS, and TCP. The covert sender dynamically selects a covert carrier within normal communication traffic, embeds the covert data, and transmits it through a public channel. The covert receiver then uses the same selection rules and covert algorithms. Extract data. This mechanism is particularly effective against machine learning-based traffic analysis detection when filtering key lengths. At that time, the detector's recognition accuracy was close to that of random guessing, which significantly improved the anti-detection capability of covert communication.

[0069] Specifically, by embedding covert data into filtered sparse data packets, not only is the probability of the covert data being exposed reduced, but the key-controlled randomness filtering mechanism also makes the covert carrier set highly dynamic and unpredictable. Even covert algorithms... If leaked, adversaries will be unable to accurately identify the covert carrier without the filter key, thus effectively improving the overall security and concealment of the network's covert channels.

[0070] S4, the covert receiver intercepts the encrypted data packet, calculates the hash value of the payload based on the same input key and hash function, uses the filtering key to mask the hash value to locate the covert carrier, and extracts the covert data according to the covert algorithm.

[0071] Specifically, in some implementations, the covert receiver receives the encrypted data packet. Afterward, interception is performed to ensure that all possible cloaked data packets are processed uniformly. The interception process is typically implemented using network sniffing tools or custom network proxy modules. The covert receiver monitors the target network interface or specific communication link, capturing all passing data packets in real time and extracting candidate coded data packets from them. As a subsequent processing object.

[0072] Specifically, this step is applicable to covert channels in stored-mode or time-mode networks. The covert receiver can dynamically identify covert data packets within legitimate communication flows, without relying on the confidentiality of the covert algorithm. Even when the covert algorithm is leaked, adversaries still cannot identify the covert carrier without the key, thus significantly improving the anti-detection capability of covert communication. Furthermore, the processing latency of this step is less than [a certain value]. It meets the real-time requirements of high-speed network environments and has good practicality and deployment feasibility.

[0073] Furthermore, S4 includes: S41, extract the payload portion of the intercepted data packet and repeat the hash calculation process to obtain a hash value consistent with that of the sender.

[0074] Specifically, the technical implementation of this step is based on the SHA-256 hash function and a shared key. The synergistic effect ensures that the receiver can accurately reconstruct the set of covert carriers selected by the sender.

[0075] Specifically, the covert receiver first intercepts candidate data packets from the network. The payload portion is then extracted and used as input for hash calculation. Since the payload field of a data packet is typically not modified by intermediate devices during network transmission, this part exhibits good stability, ensuring that the receiver and sender calculate the same hash value under the same input conditions. In this process, the Input Key serves as a fixed input parameter to the hash function, ensuring key dependency in hash calculations and preventing adversaries from conducting effective analysis without possessing the key.

[0076] Specifically, in practical applications, this step is typically deployed in the network packet processing module of the covert communication receiver, suitable for storage-based or time-based covert channel scenarios. Its technical value lies in achieving dynamic and sparse selection of the covert carrier through a key-controlled hash filtering mechanism, thereby maintaining the covertness of communication even when the covert algorithm is exposed, significantly improving the anti-detection capability of the network covert channel.

[0077] S42 uses the same mask to filter hash values ​​and confirms the identity of the hidden carrier using a formula: ; in, To filter keys, For hash value, This is the preset mask.

[0078] Specifically, this step calculates the hash value of the packet payload based on the output characteristics of the SHA-256 hash function and the filter key in the shared key. Perform a bitmasking operation. The mathematical expression for a bitmasking operation is: In this context, "&" represents a bitwise AND operation, mask is used to extract the lower L bits of the hash value, and Filter Key is a pre-configured key value whose length L determines the sparsity of the filtering.

[0079] Specifically, this step applies to the construction of covert channels in both storage-based and time-based networks. Under the control of a shared key K, the covert sender and receiver can dynamically filter out a sparse set of covert carriers from a large number of legitimate data packets, effectively circumventing detection methods based on statistical analysis or machine learning. Since the filtering process relies on the key, even if the covert algorithm is leaked, adversaries cannot accurately identify the covert carriers without the key, thus improving the system's resistance to reverse engineering.

[0080] Specifically, by introducing a hash-based masking mechanism, the selection of the covert carrier is bound to key security, achieving dynamic and random nature in covert communication. Simultaneously, due to the uniform distribution of the SHA-256 output, its low L bits... The range can be considered as uniform random numbers, further ensuring the unbiasedness of the screening process. This strategy not only enhances the undetectability of network covert channels but also significantly improves its feasibility and security in practical deployment.

[0081] S5 periodically updates the filtering key and dynamically reconstructs the set of covert carriers by recalculating the hash value mask conditions; the update cycle is related to network traffic characteristics to avoid regular exposure.

[0082] Specifically, this step is technically based on a hash value masking mechanism. By dynamically adjusting the FilterKey, the set of covert carriers is randomly reconstructed, thereby enhancing the anti-detection capability of covert communication. In particular, this step periodically changes the FilterKey, enabling the covert sender and receiver to synchronously filter out new subsets of covert carriers using the same hash function and input key, thus avoiding the exposure of the covert carrier distribution patterns caused by a fixed key.

[0083] Furthermore, the length L of the filter key determines the screening ratio of the covert carrier. Where L is a positive integer. For example, when L=6, the screening ratio is... This means that, on average, only one out of every 64 data packets is selected as the covert carrier. The update cycle of the Filter Key should be correlated with network traffic characteristics, typically dynamically adjusted based on traffic fluctuations, packet arrival rates, or changes in network load, to ensure the non-periodic and unpredictable nature of the filtering process. In actual deployments, the update cycle can be set to once every 5 to 15 minutes, depending on the stability of the network environment and the real-time requirements of covert communication.

[0084] Furthermore, the covert sender recalculates the SHA-256 hash value of each packet payload after each Filter Key update. and use a mask Extract the lower L bits of the hash value and determine if it meets the requirements. If the conditions are met, the data packet is selected as the covert carrier for subsequent covert data embedding. Because SHA-256 has good collision resistance and uniform output characteristics, its low L bits are... Within the range, it approximately follows a uniform distribution, thus ensuring the randomness and unbiasedness of the selection of concealed carriers.

[0085] Specifically, this step is applicable to covert channels in both storage-based and time-based networks, and has significant advantages, especially in high-traffic, low-latency network environments. By dynamically updating the Filter Key, both parties in covert communication can achieve sparsity and randomization of the covert carrier set without changing the behavior of the public channel, effectively circumventing detection methods based on statistical analysis or machine learning. Experiments show that when the filter key length is greater than 6, the detection results of machine learning-based detectors approach the level of random guessing, significantly improving the undetectability of the covert channel.

[0086] Furthermore, the technical advantage of this step lies in extending the concealment of the covert channel from solely relying on algorithm complexity to also relying on key security, thus conforming to the Kerckhoffs criterion. Simultaneously, since the filtering process involves only bitwise operations and hash calculations, its processing latency is lower than... It is feasible to deploy in high-speed networks, thus achieving a balance between concealment and efficiency in practical applications.

[0087] This invention discloses a key-based covert carrier filtering method. By collaboratively configuring a shared key containing an input key and a filtering key, along with a hash function, between the covert sender and receiver, and employing a dynamic filtering mechanism based on this dual-key hash mask, this method effectively solves the key problem of traditional network covert channels being easily reverse-engineered and detected by traffic analysis due to their over-reliance on covert algorithms for confidentiality and fixed carrier selection patterns. This method calculates hash values ​​using the input key and data packet payload, and uses the filtering key to achieve probabilistic filtering and dynamic determination of carriers through mask comparison. This results in a key-controlled randomness and uniformity in the distribution of covert carriers. Thus, a complete closed loop is achieved from key-driven hash calculation and dynamic mask-conditional filtering to data embedding and extraction, firmly binding channel security to the key. Even if the covert algorithm is made public, adversaries cannot effectively locate the covert carrier without the key, significantly improving the undetectability, anti-reverse-engineering capabilities, and adaptability and robustness in dynamic network environments.

[0088] Example 2 To achieve the above invention, such as Figure 2 As shown, this embodiment also provides a key-based covert carrier screening device 10, which includes: The configuration module 100 is used for the covert collaborative configuration of hash function, shared key and covert algorithm between the sender and receiver; wherein, the shared key includes input key for hash calculation and filtering key for filtering.

[0089] The hash calculation and mask filtering module 200 is used to covertly capture candidate data packets and extract the corresponding payload, calculate the hash value of the payload based on the input key and hash function, and use the filtering key to perform mask filtering on the hash value to determine the covert carrier.

[0090] The data embedding and transmission module 300 is used to perform covert data embedding operations on the selected covert carriers, generate coded data packets, and transmit them through a public channel.

[0091] The 400 module for intercepting and extracting coded data packets is used to covertly intercept coded data packets. It calculates the hash value of the payload based on the same input key and hash function, uses a filtering key to mask the hash value to locate the covert carrier, and extracts the covert data according to the covert algorithm.

[0092] In one embodiment of the present invention, it further includes: a key update module, used to periodically update the screening key and realize the dynamic reconstruction of the covert carrier set by recalculating the hash value mask conditions; wherein, the update period is associated with network traffic characteristics to avoid regular exposure.

[0093] This invention discloses a key-based covert carrier screening device. Through the synergistic action of a configuration module, a hash calculation and mask screening module, a data embedding and transmission module, and a secret data packet interception and covert data extraction module, it effectively solves the problems of weak anti-detection capability and insufficient security in traditional covert communication caused by static and fixed carrier selection and strong algorithm dependence. The device implements a complete process of key-driven hash calculation, dynamic mask screening, data covert embedding, and synchronous extraction using a modular architecture. It integrates the periodic update mechanism of the screening key into the key update module, ensuring the dynamic reconstruction and irregularity of the covert carrier set. This achieves the hardware-based and systematic construction of network covert channels, firmly binding channel security to the key, significantly improving the undetectability of the communication process, its resistance to reverse engineering, and its reliability and engineering applicability in high-speed dynamic network environments.

[0094] To implement the methods of the above embodiments, the present invention also provides a computer device, such as... Figure 3 As shown, the computer device 600 includes a memory 601 and a processor 602; wherein, the processor 602 reads the executable program code stored in the memory 601 to run a program corresponding to the executable program code, so as to implement the various steps of the key-based covert carrier screening method described above.

[0095] To implement the above embodiments, this application also proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a key-based covert carrier screening method as described in the foregoing embodiments.

[0096] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0097] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A key-based method for screening covert carriers, characterized in that, include: S1, the sender and receiver collaborate to configure the hash function, shared key and covert algorithm; wherein, the shared key includes the input key for hash calculation and the filter key FilterKey for filtering hash values ​​hi that meet the conditions through masking operations. The length of Filter Key is L, and the range of L is 1 to 32 bits. S2, the covert sender captures candidate data packets and extracts the corresponding payload. The input key is concatenated with the payload and used as input to the SHA-256 hash function to calculate the hash value hi, thus constructing a mask. The lower L bits of hi are extracted using the mask, a bitwise AND operation is performed on hi, and the result of the operation is compared with the Filter Key. If (hi&mask) == Filter Key, the corresponding data packet is selected as the covert carrier. S3, perform a covert data embedding operation on the selected covert carriers to generate a encrypted data packet and transmit it through a public channel; wherein, when performing the covert data embedding operation on the selected covert carriers, a sparsity strategy is adopted, specifically including: The proportion of concealed carriers is determined based on the length of the screening key. ； The selected covert carrier is embedded with data according to a preset covert algorithm to ensure that the embedded data packet maintains the same statistical characteristics as the original data packet. S4, the covert receiver intercepts the encrypted data packet, calculates the payload hi based on the same input key and SHA-256, uses the filtering key to mask hi to locate the covert carrier, and extracts the covert data according to the covert algorithm.

2. The method as described in claim 1, characterized in that, After the covert receiver intercepts the encrypted data packet, it includes: S41, extract the payload portion of the intercepted data packet and repeat the hash calculation process to obtain hi consistent with the sender; S42 uses the same mask to filter hi and confirms the identity of the hidden carrier through a formula: 。 3. The method as described in claim 1, characterized in that, Also includes: S5 periodically updates the Filter Key and recalculates the masking conditions of hi to achieve dynamic reconstruction of the hidden carrier set; the update cycle is related to network traffic characteristics to avoid regular exposure.

4. A key-based covert carrier screening device, characterized in that, include: The configuration module is used to covertly configure the hash function, shared key and covert algorithm between the sender and receiver. The shared key includes the input key for hash calculation and the filter key for filtering hash values ​​hi that meet the conditions through masking operations. The length of the filter key is L, and L ranges from 1 to 32 bits. The hash calculation and mask filtering module is used to conceal the sender from capturing candidate data packets and extracting the corresponding payload. The input key is concatenated with the payload and used as input to the SHA-256 hash function to calculate the hash value hi, thus constructing a mask. The lower L bits of hi are extracted using the mask, a bitwise AND operation is performed on hi, and the result of the operation is compared with the Filter Key. If (hi&mask) == Filter Key, the corresponding data packet is selected as the covert carrier. The data embedding and transmission module is used to perform covert data embedding operations on the selected covert carriers, generate encrypted data packets, and transmit them through a public channel. Specifically, when performing covert data embedding operations on the selected covert carriers, a sparsity strategy is employed, including: The proportion of concealed carriers is determined based on the length of the screening key. : ； The selected covert carrier is embedded with data according to a preset covert algorithm to ensure that the embedded data packet maintains the same statistical characteristics as the original data packet. The module for intercepting encrypted data packets and extracting hidden data is used to covertly intercept encrypted data packets. It calculates the payload hi based on the same input key and SHA-256, uses a filtering key to mask hi in order to locate the hidden carrier, and extracts the hidden data according to the covert algorithm.

5. The apparatus as described in claim 4, characterized in that, Also includes: The key update module is used to periodically update the Filter Key and dynamically reconstruct the set of covert carriers by recalculating the masking conditions of hi; the update cycle is related to network traffic characteristics to avoid regular exposure.

6. An electronic device, comprising: processor; The memory stores executable instructions; when the processor executes the instructions, it implements a key-based covert carrier screening method as described in any one of claims 1-3.

7. A computer-readable storage medium storing a computer program, wherein when the computer program is executed by a processor, it implements a key-based covert carrier screening method as claimed in any one of claims 1-3.

Images