Hide and Seek in Time -
Robust Covert Timing Channels
Privacy Enhancing Technologies
Anonymität im Internet
Vorlesung
KOM - Multimedia Communications Lab
Prof. Dr.-Ing. Ralf Steinmetz (Director)
Dept. of Electrical Engineering and Information Technology
Dr.-Ing. Matthias Hollick Dept. of Computer Science (adjunct Professor)
Prof. Dr.-Ing. Ralf Steinmetz TUD – Technische Universität Darmstadt
Merckstr. 25, D-64283 Darmstadt, Germany
Matthias.Hollick@KOM.tu-darmstadt.de Tel.+49 6151 166150, Fax. +49 6151 166152
Cassius de Oliveira Puodzius
Tel.+49 6151 166158 www.KOM.tu-darmstadt.de
18. Mai 2012
© author(s) of these slides 2008

Presentation outline

Background

Covert Channel

Adversaries

Problem Definition

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-2

Background
Covert channel

Background

Covert Channel
Conceal the existence of communication by hiding it into overt communication (legitimate traffic)

Adversaries

Problem Definition

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-3

Background
Covert channel

Background

Covert Channel
Conceal the existence of communication by hiding it into overt communication (legitimate traffic)

Adversaries
Problem Definition
Covert storage channels: Data transmission by modifying unused or random bits in the packet header


Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-4

Background
Covert channel

Background

Covert Channel
Conceal the existence of communication by hiding it into overt communication (legitimate traffic)

Adversaries

Problem Definition
Covert storage channels: Data transmission by modifying unused or random bits in the packet header
Covert timming channels: Modulation of the message into temporal properties of the traffic

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-5

Background
Covert channel

Background

Covert Channel
Conceal the existence of communication by hiding it into overt communication (legitimate traffic)

Adversaries

Problem Definition
Covert storage channels: Data transmission by modifying unused or random bits in the packet header
Covert timming channels: Modulation of the message into temporal properties of the traffic

Channel Capacity
Adversaries Undetectability
Channel


Protocol Robustness
• Passive: Make use of statistical test toCorrector Code) legitimate traffic

Multi-channel (Error distinguish covert from

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-6

Background
Covert channel

Background

Covert Channel
Conceal the existence of communication by hiding it into overt communication (legitimate traffic)

Adversaries

Problem Definition
Covert storage channels: Data transmission by modifying unused or random bits in the packet header
Covert timming channels: Modulation of the message into temporal properties of the traffic

Channel Capacity
Adversaries Undetectability
Channel


Protocol Robustness
• Passive: Make use of statistical test toCorrector Code) legitimate traffic

Multi-channel (Error distinguish covert from
• Active (jammers): Disrupt covert timing channels by adding random delays to individual packets

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-7

Problem Definition
Create a covert timing channel which is resilient to passive and

Background
active adversaries

Covert Channel

Adversaries

Problem Definition

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-8

Problem Definition (2)
Channel Capacity

Background

Covert Channel
Maximum number of (covert) bits which are transmited in

Adversaries

Problem Definition bits per packet (bpp)
each packet, i.e.,

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-9

Problem Definition (2)
Channel Capacity

Background

Covert Channel
Maximum number of (covert) bits which are transmited in

Adversaries

Problem Definition bits per packet (bpp)
each packet, i.e.,
- R : transmission

Channel Capacity
Channel Undetectability
Determined by:
- Pe: bit error rate Corrector Code)


Protocol tRobustness rate

Multi-channel (Error(BER)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-10

Problem Definition (2)
Channel Capacity

Background

Covert Channel
Maximum number of (covert) bits which are transmited in

Adversaries

Problem Definition bits per packet (bpp)
each packet, i.e.,
- R : transmission

Channel Capacity
Channel Undetectability
Determined by:
- Pe: bit error rate Corrector Code)


Protocol tRobustness rate

Multi-channel (Error(BER)
Evaluation Trade-Off capacity → High R with low P

Modulation/Demodulation Scheme
t e

High channel

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-11

Problem Definition (3)
Channel Undetectability

Background

Covert Channel
A Adversaries is undetectable according to some statistical

covert time

Problem Definition
test, if the test cannot distinguish between legitimate and
covert traffic

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-12

Problem Definition (3)
Channel Undetectability

Background

Covert Channel
A Adversaries is undetectable according to some statistical

covert time

Problem Definition
test, if the test cannot distinguish between legitimate and
covert traffic

Channel Capacity
Channel Undetectability
P(x)

Shape Test

Protocol Robustness

Multi-channel (Error Corrector Code)
H (x)

Modulation/Demodulation Scheme
s
x

Evaluation Trade-Off
KS-test

Experimental Results
Hs(x) = supx|F(x) – S(x)|

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-13

Problem Definition (3)
Channel Undetectability

Background

Covert Channel
A Adversaries is undetectable according to some statistical

covert time

Problem Definition
test, if the test cannot distinguish between legitimate and
covert traffic

Channel Capacity
Channel Undetectability
P(x)

Shape Test Regularity Test

Protocol Robustness

Multi-channel (Error Corrector Code)
H (x)

Modulation/Demodulation Scheme
s
x

Evaluation Trade-Off
KS-test

Experimental Results
Hs(x) = supx|F(x) – S(x)| Hr = std(|σi - σj|/σi)

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-14

Protocol Robustness
To handle with:

Background

Covert Channel and/or error during transmission
Fortuitous delay

Adversaries
Jammers adversaries

Problem Definition

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-15

Protocol Robustness
To handle with:

Background

Covert Channel and/or error during transmission
Fortuitous delay

Adversaries
Jammers adversaries

Problem Definition

Channel Capacity Spreading Codes

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-16

Protocol Robustness
To handle with:

Background

Covert Channel and/or error during transmission
Fortuitous delay

Adversaries
Jammers adversaries

Problem Definition

Channel Capacity Spreading Codes
Protocol Robustness1. Choose a orthogonal code words c , ..., c ϵ {-1, 1}
Channel Undetectability
N

Sender:
 1 K

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-17

Protocol Robustness
To handle with:

Background

Covert Channel and/or error during transmission
Fortuitous delay

Adversaries
Jammers adversaries

Problem Definition

Channel Capacity Spreading Codes
Protocol Robustness1. Choose a orthogonal code words c , ..., c ϵ {-1, 1}
Channel Undetectability
N

Sender:
2. Encode k-th bit of the message by c' = b c
 1 K
k k k

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-18

Protocol Robustness
To handle with:

Background

Covert Channel and/or error during transmission
Fortuitous delay

Adversaries
Jammers adversaries

Problem Definition

Channel Capacity Spreading Codes
Protocol Robustness1. Choose a orthogonal code words c , ..., c ϵ {-1, 1}
Channel Undetectability
N

Sender:
2. Encode k-th bit of the message by c' = b c
 1 K
Multi-channel (Error Corrector Code) K parallel channels, s = Σ b k k k
ck
k

3. Simultaneouly transmit over

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-19

Protocol Robustness
To handle with:

Background

Covert Channel and/or error during transmission
Fortuitous delay

Adversaries
Jammers adversaries

Problem Definition

Channel Capacity Spreading Codes
Protocol Robustness1. Choose a orthogonal code words c , ..., c ϵ {-1, 1}
Channel Undetectability
N

Sender:
2. Encode k-th bit of the message by c' = b c
 1 K
Multi-channel (Error Corrector Code) K parallel channels, s = Σ b k k k
ck
k

3. Simultaneouly transmit over

Modulation/Demodulation Scheme

Evaluation Trade-OffReceiver: bit by 1/N <s, c > = b
k k
Decode k-th

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-20

Protocol Robustness (2)
Example:

Background N = 4, K = 4 msend = (-1, -1, 1, -1)

Covert Channel

Adversaries

Problem Definition

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-21

Protocol Robustness (2)
Example:

Background N = 4, K = 4 msend = (-1, -1, 1, -1)

Covert Channel

Adversaries
Vector basis:

Problem Definition1, 1, 1)
c = (-1, 1

Channel Capacity 1)
c = (1, -1, 1,
2
c = (1, 1, -1, 1)

Channel Undetectability
3
c = (1, 1, 1, -1)
Protocol Robustness
4


Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-22

Protocol Robustness (2)
Example:

Background N = 4, K = 4 msend = (-1, -1, 1, -1)

Covert Channel

Adversaries
Vector basis:

Problem Definition1, 1, 1)
c = (-1, 1
c ' = b c = (1, -1, -1, -1)
1 1 1

Channel Capacity 1)
c = (1, -1, 1,
2
c ' = b c = (-1, 1, -1, -1)
2 2 2
c = (1, 1, -1, 1) c ' = b c = (1, 1, -1, 1)

Channel Undetectability
3
c = (1, 1, 1, -1)
3
c ' = b c = (-1, -1, -1, 1)
3 3
Protocol Robustness
4 4 4 4


Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-23

Protocol Robustness (2)
Example:

Background N = 4, K = 4 msend = (-1, -1, 1, -1)

Covert Channel

Adversaries
Vector basis:

Problem Definition1, 1, 1)
c = (-1, 1
c ' = b c = (1, -1, -1, -1)
1 1 1

Channel Capacity 1)
c = (1, -1, 1,
2
c ' = b c = (-1, 1, -1, -1)
2 2 2
c = (1, 1, -1, 1) c ' = b c = (1, 1, -1, 1)

Channel Undetectability
3
c = (1, 1, 1, -1)
3 3 3
c ' = b c = (-1, -1, -1, 1)
Protocol Robustness
4 4 4 4


Multi-channel (Error Corrector0, -4, 0)
s = Σ b c = (0, Code)
k k

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-24

Protocol Robustness (2)
Example:

Background N = 4, K = 4 msend = (-1, -1, 1, -1)

Covert Channel

Adversaries
Vector basis:

Problem Definition1, 1, 1)
c = (-1, 1
c ' = b c = (1, -1, -1, -1)
1 1 1

Channel Capacity 1)
c = (1, -1, 1,
2
c ' = b c = (-1, 1, -1, -1)
2 2 2
c = (1, 1, -1, 1) c ' = b c = (1, 1, -1, 1)

Channel Undetectability
3
c = (1, 1, 1, -1)
3 3 3
c ' = b c = (-1, -1, -1, 1)
Protocol Robustness
4 4 4 4


Multi-channel (Error Corrector0, -4, 0)
s = Σ b c = (0, Code)
k k

Modulation/Demodulation Scheme¼ -4 = -1
b = 1/N <s, c > =
1 1

Evaluation Trade-Off b = 1/N <s, c > = ¼ -4 = -1
2 2

Experimental Results b = 1/N <s, c > = ¼ 4 = 1 3 3
b = 1/N <s, c > = ¼ -4 = -1

Conclusions 4 4
mreceived = (-1, -1, 1, -1)
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-25

Protocol Robustness (2)
Example:

Background N = 4, K = 4 msend = (-1, -1, 1, -1)

Covert Channel

Adversaries
Vector basis:

Problem Definition1, 1, 1)
c = (-1, 1
c ' = b c = (1, -1, -1, -1)
1 1 1

Channel Capacity 1)
c = (1, -1, 1,
2
c ' = b c = (-1, 1, -1, -1)
2 2 2
c = (1, 1, -1, 1) c ' = b c = (1, 1, -1, 1)

Channel Undetectability
3
c = (1, 1, 1, -1)
3 3 3
c ' = b c = (-1, -1, -1, 1)
Protocol Robustness
4 4 4 4


Multi-channel (Error Corrector2, -4, 0)
s = Σ b c = (1, Code)
k k

Modulation/Demodulation Scheme¼ -3 ≈ -1
b = 1/N <s, c > =
1 1

Evaluation Trade-Off b = 1/N <s, c > = ¼ -5 ≈ -1
2 2

Experimental Results b = 1/N <s, c > = ¼ 7 ≈ 1 3 3
b = 1/N <s, c > = ¼ -1 ≈ -1

Conclusions 4 4
mreceived = (-1, -1, 1, -1)
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-26

Modulation/Demodulation Scheme

Background
Prior
knowledge: channel characteristics (delay, jitter, ...)

Covert Channel

Adversaries

Problem Definition

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-27

Modulation/Demodulation Scheme

Background
Prior
knowledge: channel characteristics (delay, jitter, ...)

Covert Channel
Modulation

Adversaries

Modulation group: Group of K bits which are

Problem Definition
encoded each time on K parallel channels

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-28

Modulation/Demodulation Scheme

Background
Priorknowledge: channel characteristics (delay, jitter, ...)

Covert Channel
Modulation

Adversaries

Modulation group: Group of K bits which are

Problem Definition
encoded each time on K parallel channels

Channel Capacity
Linear modulation of inter-packet delay

Channel Undetectability

Protocol + β s (n = 1, ..., N)
t := α
n Robustness
n

Multi-channel (Error Corrector Code)
α: shift parameter


Modulation/Demodulation Scheme
β: pseudo-random parameter


Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-29

Modulation/Demodulation Scheme

Background
Priorknowledge: channel characteristics (delay, jitter, ...)

Covert Channel
Modulation

Adversaries

Modulation group: Group of K bits which are

Problem Definition
encoded each time on K parallel channels

Channel Capacity
Linear modulation of inter-packet delay

Channel Undetectability

Protocol + β s (n = 1, ..., N)
t := α
n Robustness
n

Multi-channel (Error Corrector Code)
α: shift parameter


Modulation/Demodulation Scheme
β: pseudo-random parameter


Evaluation Trade-Off fly
Remark: α is transmited on the
Experimental Results
 through one of the channels

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-30

Modulation/Demodulation Scheme

Background
Priorknowledge: channel characteristics (delay, jitter, ...)

Covert Channel
Receive a modulation group t, which might be
Modulation
Adversaries of K bits which are Demodulation
changed to t' due to some additive channel noise x


Modulation group: Group 

Problem Definition
encoded each time on K parallel channels

Channel Capacity
Linear modulation of inter-packet delay

Channel Undetectability

Protocol + β s (n = 1, ..., N)
t := α
n Robustness
n

Multi-channel (Error Corrector Code)
α: shift parameter


Modulation/Demodulation Scheme
β: pseudo-random parameter


Evaluation Trade-Off fly
Remark: α is transmited on the
Experimental Results
 through one of the channels

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-31

Modulation/Demodulation Scheme

Background
Priorknowledge: channel characteristics (delay, jitter, ...)

Covert Channel
Receive a modulation group t, which might be
Modulation
Adversaries of K bits which are Demodulation
changed to t' due to some additive channel noise x


Modulation group: Group 

Problem Definition
encoded each time on K parallel channels

Channel Capacity
Linear modulation of inter-packet delay To decode the k-th bit, one compute
b ' = 1/N < 1/β t', c >

Channel Undetectability
Protocol + β s (n = 1, ..., N) k k
t := α
 n Robustness
n
Hence one get b ' = b + 1/(N β) <x , c >

Multi-channel (Error Corrector Code)
k k k
α: shift parameter


Modulation/Demodulation Scheme
β: pseudo-random parameter


Evaluation Trade-Off fly
Remark: α is transmited on the
Experimental Results
 through one of the channels

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-32

Modulation/Demodulation Scheme (2)
Removing Regularity

Background
Variance of each modulation group g: σ = β σ such that β and σ are determined by K and T

Covert Channel
2 2 2

Adversaries g s s

Problem Definition

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-33

Modulation/Demodulation Scheme (2)
Removing Regularity

Background
Variance of each modulation group g: σ = β σ such that β and σ are determined by K and T

Covert Channel
2 2 2

Adversaries g s s
The correlation Definition modulated inter-packet delay t is given by
Problem coefficient of the


Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-34

Modulation/Demodulation Scheme (2)
Removing Regularity

Background
Variance of each modulation group g: σ = β σ such that β and σ are determined by K and T

Covert Channel
2 2 2

Adversaries g s s
The correlation Definition modulated inter-packet delay t is given by
Problem coefficient of the


Channel Capacity

Channel Undetectability

Protocol Robustness

The 
correlation of the inter-packet delays can dynamically change by appropriately controlling the
Multi-channel (Error Corrector Code)
generation of α and β

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-35

Modulation/Demodulation Scheme (2)
Removing Regularity

Background
Variance of each modulation group g: σ = β σ such that β and σ are determined by K and T

Covert Channel
2 2 2

Adversaries g s s
The correlation Definition modulated inter-packet delay t is given by
Problem coefficient of the


Channel Capacity

Channel Undetectability

Protocol Robustness

The 
correlation of the inter-packet delays can dynamically change by appropriately controlling the
Multi-channel (Error Corrector Code)
generation of α and β
As long as T is the parameter which controls the system robustness and undetectability, it remains
Modulation/Demodulation Scheme
fixed, while K is uniformly chosen in [1, K ]


Evaluation Trade-Off max

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-36

Modulation/Demodulation Scheme (2)
Removing Regularity

Background
Variance of each modulation group g: σ = β σ such that β and σ are determined by K and T

Covert Channel
2 2 2

Adversaries g s s
The correlation Definition modulated inter-packet delay t is given by
Problem coefficient of the


Channel Capacity

Channel Undetectability

Protocol Robustness

The 
correlation of the inter-packet delays can dynamically change by appropriately controlling the
Multi-channel (Error Corrector Code)
generation of α and β
As long as T is the parameter which controls the system robustness and undetectability, it remains
Modulation/Demodulation Scheme
fixed, while K is uniformly chosen in [1, K ]


Evaluation Trade-Off max
Experimental Results
Remark: A seed of a pseudo-random generator can be priorly shared between the sender and the


Conclusions that they are able to get β without any further communication
receiver, so
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-37

Evaluation Trade-Off

Background Transmission Rate
Covert Channel
Rt = K / N


Adversaries

Problem Definition

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-38

Evaluation Trade-Off

Background Transmission Rate
Covert Channel
Rt = K / N


Adversaries

Problem Definition
Channel Undetectability channel to transmit α
• At least one

Channel Capacity


Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-39

Evaluation Trade-Off

Background Transmission Rate
Covert Channel
Rt = K / N


Adversaries

Problem Definition
Channel Undetectability channel to transmit α
• At least one

Channel Capacity
Maximum transmission rate is N – 1/ N


Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-40

Evaluation Trade-Off (2)

Background Robustness

Covert Channel
G = β2 N

Adversaries Robustness gain

Problem Definition

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-41

Evaluation Trade-Off (2)

Background Robustness

Covert Channel
G = β2 N

Adversaries Robustness gain

Problem Definition

Channel Capacity

Channel Undetectability Tβ =fixed
is
TB

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-42

Evaluation Trade-Off (2)

Background Robustness

Covert Channel
G=β N

Adversaries
Robustness gain The relation between B and K

Problem2 Definition

Channel Capacity
Channel Undetectability
 β = TB
T is fixed

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-43

Evaluation Trade-Off (2)

Background Robustness

Covert Channel
G=β N

Adversaries
Robustness gain The relation between B and K

Problem2 Definition

Channel Capacity
Channel Undetectability
 β = TB
T is fixed

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results can achive higher robustness by
Hence, one

Conclusions 
Decreasing K

Increasing N and T
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-44

Evaluation Trade-Off (3)

Background Undetectability

Covert Channel
achieved with smaller T

Adversaries a approximation
Accurate shape

Problem Definition

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-45

Evaluation Trade-Off (3)

Background Undetectability

Covert Channel
achieved with smaller T with bigger T or Kmax

Adversaries a approximation
Accurate shape While better regularity achieved

Problem Definition

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-46

Experimental Results

Background
Experimental scenarios:
1. LAN environment in a medium-size campus network
Covert Channel


Adversaries

Problem Definition

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-47

Experimental Results

Background
Experimental scenarios:
1. LAN environment in a medium-size campus network
2. Covert Channel sender and receiver located in USA and Germany, respectively

WAN environment with
Adversaries


Problem Definition

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-48

Experimental Results

Background
Experimental scenarios:
1. LAN environment in a medium-size campus network
2. Covert Channel sender and receiver located in USA and Germany, respectively

WAN environment with
Adversaries

Network conditions for each scenario

Problem Definition

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-49

Experimental Results

Background
Experimental scenarios:
1. LAN environment in a medium-size campus network
2. Covert Channel sender and receiver located in USA and Germany, respectively

WAN environment with

Adversaries
Network conditions for each scenario

Problem Definition

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)
Carrier applications

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-50

Experimental Results (2)
Robustness

Background

Covert Channel

Adversaries

Problem Definition

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-51

Experimental Results (3)
Undetectability

Background

Covert Channel

Adversaries

Problem Definition

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-52

Thank you!

Background

Covert Channel

Adversaries

Problem Definition

Channel Capacity

Channel Undetectability

Protocol Robustness

Multi-channel (Error Corrector Code)

Modulation/Demodulation Scheme

Evaluation Trade-Off

Experimental Results

Conclusions
Mai 2012 | Informatik Fb20 | CASED | Cassius de Oliveira Puodzius KOM – Multimedia Communications Lab MN-00-53