File hiding based on capacity disguise and double file system

doi:10.11772/j.issn.1001-9081.2016.04.0979

Abstract

Abstract: Concerning the poor robustness and low hiding strength of existing file hiding method based on Universal Serial Bus (USB), a new file hiding method based on capacity disguised and double file system was proposed. By analyzing the characteristics and management mechanism of Nand flash chips, the capacity disguise was achieved to deceive the host by tampering equipment capacity value in Command Status Wrap (CSW). Based on the memory management mechanism of the Flash Translation Layer (FTL), the storage area was divided into two parts including the hiding area and the common area by different marks, and a double file system was established using format function. Request for switching file system was sent by writing specific data, then it was achieved after user authentication to realize secure access to hiding areas. The experimental results and theoretical analysis show that the proposed method can achieve hiding file which is transparent to operating system, moreover, it is not affected by device operation and has better robustness and stronger hiding effect with respect to the methods based on hooking Application Programming Interface (API), modifying File Allocation Table (FAT) or encryption.

Key words: Flash Translation Layer (FTL), file hiding, File Allocation Table (FAT), double file system, authentication, capacity disguise

摘要： 针对现有基于通用串行总线(USB)移动存储设备的文件隐藏方法存在的鲁棒性差及隐藏强度低的问题,提出一种结合容量伪装和双文件系统的文件隐藏方法。在分析Nand flash芯片的特点及其管理机制的基础上,该方法通过篡改命令状态包(CSW)中的设备容量值,实现容量伪装,达到欺骗主机的目的;利用闪存转换层(FTL)存储管理机制,通过在物理块冗余区标记不同的内容把物理块分成两部分,划分隐藏区和普通区,利用格式化功能建立双文件系统;用户通过写特定数据发送切换文件系统请求,设备进行用户认证后完成文件系统切换,实现隐藏区的安全访问。理论分析和实验结果表明,该方法实现了对操作系统透明的文件隐藏;相对于挂接应用程序编程接口(API)、基于文件分配表(FAT)的修改以及加密等实现的文件隐藏方法,该方法不受系统对设备操作的影响,具有更好的鲁棒性和更高的隐藏强度。

关键词: 闪存转换层, 文件隐藏, 文件分配表, 双文件系统, 身份认证, 容量伪装

CLC Number:

TP309.1

WANG Kang, LI Qingbao. File hiding based on capacity disguise and double file system[J]. Journal of Computer Applications, 2016, 36(4): 979-984.

王康, 李清宝. 结合容量伪装和双文件系统的文件隐藏方法[J]. 计算机应用, 2016, 36(4): 979-984.

References

[1] FRINCKE D. Balancing cooperation and risk in intrusion detection[J]. ACM Transactions on Information and System Security, 2000, 3(1):1-29.
[2] LIN X J, LI Q B, WANG W, et al. Information hiding based on CAVLC in H.264/AVC standard[C]//Proceedings of the 4th International Conference on Multimedia Information Networking and Security. Piscataway, NJ:IEEE, 2012:900-904.
[3] Al-FRAJAT A K, JALAB H A, KASIRUM Z M, et al. Hiding data in video file:an overview[J]. Journal of Applied Sciences, 2010, 10(15):1644-1649.
[4] ZHANG H, WU C, NIU X, et al. A disk disguising and hiding method[C]//Proceedings of the 3rd International Conference on Convergence and Hybrid Information Technology. Piscataway, NJ:IEEE, 2008:517-520.
[5] RAY R, SANYAL J, DAS D, et al. A new challenge of hiding any encrypted secret message inside any text/ASCII file or in MS word file:RJDA algorithm[C]//Proceedings of the 2012 International Conference on Communication Systems and Network Technologies. Piscataway, NJ:IEEE, 2012:889-893.
[6] 姜子峰, 曾光裕, 王炜, 等. 基于磁盘冗余空间的数据隐藏[J]. 计算机应用研究, 2014, 31(3):839-842.(JIANG Z F, ZENG G Y, WANG W, et al. Data hiding based on disk slack space[J]. Application Research of Computers, 2014, 31(3):839-842.)
[7] NIU X P, LI Q B, WANG W, et al. G bytes data hiding method based on cluster chain structure[J]. Wuhan University Journal of Natural Sciences, 2013, 18(5):443-448.
[8] 刘玉, 刘洋, 饶炤骅, 等.基于FAT32磁盘文件系统结构的文件隐藏方法:CN1434450[P]. 2003-08-06.(LIU Y, LIU Y, RAO S H, et al. File hidden based on FAT32 disk file system structure:CN1434450[P]. 2003-08-06.)
[9] 蔡风华.基于 FAT32 文件系统的文件隐藏研究与实现[D]. 武汉:华中科技大学, 2007:1-52.(CAI F H. File Hidden Research and Implementation based on the FAT32 File System[D]. Wuhan:Huazhong University of Science and Technology, 2007:1-52.)
[10] 袁杰, 江祖敏. 基于FAT32的文件隐藏方法及在Linux上的实现[J]. 电子设计工程, 2012, 20(13):15-18.(YUAN J, JIANG Z M. Implementation of file hidden based on FAT32 in Linux system[J]. Electronic Design Engineering, 2012, 20(13):15-18.)
[11] 郭松辉, 王玉龙, 牛小鹏, 等. 基于闪存冗余块的文件隐藏技术[J]. 计算机应用研究, 2014, 32(8):900-904.(GUO S H, WANG Y L, NIU X P, et al. File hiding based on flash redundant blocks[J]. Application Research of Computers, 2014, 32(8):900-904.)
[12] BURTON B J. How to hide file in slack file space with Slacker.exe[EB/OL].[2013-04-18]. http://cfile27.uf.tistory.com/attach/214FDB4555D96EB418C14A.

[1]	Deyuan LIU, Jingquan ZHANG, Xing ZHANG, Wunan WAN, Shibin ZHANG, Zhi QIN. Cross-chain identity authentication scheme based on certificate-less signcryption [J]. Journal of Computer Applications, 2024, 44(12): 3731-3740.
[2]	Jianyang CUI, Ying CAI, Yu ZHANG, Yanfang FAN. Authenticatable privacy-preserving scheme based on signcryption from lattice for vehicular ad hoc network [J]. Journal of Computer Applications, 2024, 44(1): 233-241.
[3]	Juangui NING, Guofang DONG. Blockchain-based vehicle-to-infrastructure fast handover authentication scheme in VANET [J]. Journal of Computer Applications, 2024, 44(1): 252-260.
[4]	Songbai LAN, Fangxiao LI, Leyi SHI. CFL-based authentication and communication scheme for industrial control system [J]. Journal of Computer Applications, 2023, 43(4): 1183-1190.
[5]	Guishuang XU, Xinchun YIN. Certificateless conditional privacy-preserving authentication scheme for VANET [J]. Journal of Computer Applications, 2023, 43(11): 3358-3367.
[6]	Changgeng LIU, Yali LIU, Qipeng LU, Tao LI, Changlu LIN, Yi ZHU. Vehicle RKE two-factor authentication protocol resistant to physical cloning attack [J]. Journal of Computer Applications, 2023, 43(11): 3375-3384.
[7]	Yangnan GUO, Wenbao JIANG, Shuai YE. Supervisable blockchain anonymous transaction system model [J]. Journal of Computer Applications, 2022, 42(9): 2757-2764.
[8]	Hongliang TIAN, Jiayue WANG, Chenxi LI. Data storage scheme based on hybrid algorithm blockchain and node identity authentication [J]. Journal of Computer Applications, 2022, 42(8): 2481-2486.
[9]	Jie ZHANG, Shanshan XU, Lingyun YUAN. Internet of things access control model based on blockchain and edge computing [J]. Journal of Computer Applications, 2022, 42(7): 2104-2111.
[10]	Jingwen WU, Xinchun YIN, Jianting NING. Revocable aggregate signature authentication scheme for vehicular ad hoc networks [J]. Journal of Computer Applications, 2022, 42(3): 911-920.
[11]	XIAO Yuelei, DENG Xiaofan. Improvement and analysis of certificate-based wired local area network security association scheme [J]. Journal of Computer Applications, 2021, 41(7): 1970-1976.
[12]	WU Kaifan, YIN Xinchun. Lightweight anonymous mutual authentication protocol based on random operators for radio frequency identification system [J]. Journal of Computer Applications, 2021, 41(6): 1621-1630.
[13]	DU Xinyu, WANG Huaqun. Dynamic group based effective identity authentication and key agreement scheme in LTE-A networks [J]. Journal of Computer Applications, 2021, 41(6): 1715-1722.
[14]	Ping ZHANG, Yiqiao JIA, Jiechang WANG, Nianfeng SHI. Three-factor anonymous authentication and key agreement protocol [J]. Journal of Computer Applications, 2021, 41(11): 3281-3287.
[15]	ZHANG Xinglan, ZHAO Yijing. Two-way synchronous quantum identity authentication protocol based on single photon [J]. Journal of Computer Applications, 2020, 40(9): 2634-2638.