6th European Conference - Academic Conferences

Modeling and Justification of the Store and Forward
Protocol: Covert Channel Analysis
Hind Al Falasi and Liren Zhang
United Arab Emirates University, Al Ain, United Arab Emirates
hindalfalasi@uaeu.ac.ae
lzhang@uaeu.ac.ae
Abstract: In an environment where two networks with different security levels are allowed to communicate, a
covert channel is created. The paper aims at calculating the probability of establishing a covert channel between
the high security network and the low security network using Markov Chain Model. The communication between
the networks follows the Bell-LaPadula (BLP) security model. The BLP model is a “No read up, No write down”
model where up indicates an entity with a high security level and down indicates an entity with a low security
level. In networking, the only way to enforce the BLP model is to divide a network into separate entities, networks
with a low security level, and others with a high security level. This paper discusses our analysis of the Store and
Forward Protocol that enforces the BLP security model. The Store and Forward Protocol (SAFP) is a gateway
that forwards all data from a low security network to a high security network, and it sends acknowledgments to
the low security network as if they were sent from the high security network; thereby achieving reliability of the
communication in this secure environment. A timing covert channel can be established between the two networks
by using the times of the acknowledgments to signal a message from the high security network to the low
security network. A high security network may send acknowledgments immediately or with some delay where the
time of the acknowledgments arrival is used to convey the message. The covert channel probability is found to be
equal to the blocking probability of the SAFP buffer when analyzing the problem using Markov Chain Model.
Increasing the size of the buffer at the SAFP decreases the covert channel probability. Carefully determining the
size of the buffer of the SAFP ensures minimizing the covert channel probability.
Keywords: covert channel, access model, Markov Chain Model, store and forward protocol
1. Introduction
Covert channels may be introduced to secure networks both intentionally and unintentionally.
Consider a computer system were two networks with different security levels are communicating; the
existence of covert channels can compromise the efforts exerted to prevent access to higher security
level information by a lower security level network. Security procedures should be established to
prevent the lower network from reading the higher network files, and ensure that the higher network
cannot write to the lower network files. We are referring to a multilevel secure setting where different
networks have different security levels. The notion of having rules that state “No read up", and "No
write down” is in accordance with the BLP security model (Bell and LaPadula 1973). The model's
security procedures make it mandatory for information to flow from the low security network to the
high security network only.
In this paper we are interested in one type of covert channel, a timing channel. In timing channels,
information is transmitted by the timings of events (Wray 1991). This channel is established whenever
the higher network is able to hold up the SAFP (Kang and Moskowitz 1995) response time to signal
an input to the lower network. An acknowledgement sent by the SAFP to the lower network without
delay means no message; however, if the acknowledgment is sent with delay, the value of the delay
is translated by the lower network as an alphabet. Therefore, a communication channel is established
between the two networks with the output constructed from the different delay time values. The
medium in which the covert channel exists is the network environment in our channel i.e. network
covert channel (Cabuk et al., 2009). The channel manages to control the timing of legitimate network
traffic to allow the leaking of confidential data. The purpose of the covert channel analysis is to
calculate the best size buffer for the SAFP to minimize the probability of the covert channel
establishment.
2. Background and motivation
Information flow between two networks with different security levels should not only be governed by
the rules of the BLP security model. An integral part of implementing the BLP security model is
ensuring that any weaknesses of the system implementing the model do not defeat the purpose
behind it. Being able to identify the circumstances that lead to establishing a covert channel between
the two communicating networks is the first step towards eliminating the covert channel. The
importance of identifying the existence of covert channels stems from the fact that they are used to
8