6th European Conference - Academic Conferences

Hind Al Falasi and Liren Zhang
transfer information secretly, where the ultimate goal of covert channels is to conceal the very
existence of the communication (Zander et al., 2007).
The capacity of the covert channel was analyzed as a function of buffer size and moving average size
by Kang and Moskowitz (Kang and Moskowitz, 1993; 1995). The analysis was performed on a Pump
that used randomized acknowledgments which are also used to control the input rate of a source. In
addition, several protocols were reviewed and implemented (Kang and Moskowitz, 1993), and the
proposed protocols in their work were designed to reduce the bandwidth of covert channels.
3. Store and Forward Protocol (SAFP)
The Store and Forward protocol is a simple protocol used for reliable communication between two
networks. The protocol effectiveness is limited in minimizing the existence of covert channels.
However, we use it in this paper as a benchmark to calculate the probability of a timing covert channel
as the advantage of the protocol is in its simplicity to analyze.
The idea behind this protocol is simple: There are two networks communicating, one network has a
low security level, and the other has a high security level. There is a gateway between the two
networks. The gateway does the following job: it receives a packet from the low security network,
stores it in a buffer, and then sends an acknowledgment to the low security network indicating the
successful receipt of that packet. The gateway then forwards the packet to the high security network
and waits for an acknowledgment of receipt. If no such acknowledgment is received, the gateway
retransmits the packet to the high security network. Only after the receipt of the acknowledgment
does the gateway delete that packet from its buffer.
All traffic from the high security network is ignored except for the acknowledgments. This notion is in
accordance with the BLP security model which is a “No read up, No write down” model where up
indicates an entity with high security level and down indicates an entity with low security level. The
gateway forwards all data from the low security network to the high security network, and it does not
forward acknowledgments from the high security network to the low security network; however, it
achieves reliability of the communication by sending acknowledgments to the low security network
(Figure 1).
Figure 1: Store and Forward Protocol (SAFP)
3.1 The covert channel
The problem with the store and forward protocol is that it permits covert channels to exist between the
high security network and the low security network through the acknowledgments. A timing covert
channel can be established between the two networks by using the time values of the
acknowledgments to signal a message from the high security network to the low security network. A
high security network may send acknowledgments immediately or with some delay where the value of
the delay is used to convey the message.
3.2 TCP sliding window effect
The SAFP notifies the low security network of the number of bytes it is willing to receive, which then
becomes the low security network send window. On the other side, the high security network notifies
the SAFP of the number of bytes it is willing to receive, which then becomes the SAFP send window.
At first glance, the use of TCP's sliding window appears to reduce the probability of the covert channel
by minimizing the number of acknowledgments. The low security network can send several packets
without waiting for acknowledgments. Similarly, the high security network can acknowledge several
9