Chapter 3 Time-to-live Covert Channels - CAIA

CHAPTER 3. TIME-TO-LIVE COVERT CHANNELS
Digital Subscriber Line (DSL) and WiMax as well as on CDs, DVDs, and blue-ray discs.
Furthermore, RS codes are suitable for channels with bursty errors.
RS codes are block codes. A (N,K) RS code has blocks of N symbols, with N − K RS
symbols appended to every K payload symbols. The maximum N depends on the size of
the symbols in bits M (N ≤ 2 M − 1). An RS decoder can correct 2E + S ≤ N − K errors
where E are erasures (symbols with bit errors of known position) and S are substitutions
(symbols with bit errors of unknown position).
The sender divides the covert data into blocks. Each block has a header with an 8-bit
sequence number, which enables the receiver to identify blocks lost due to corruption.
The header also contains a 32-bit CRC (CRC32) checksum computed over the header
fields and data, because the RS decoder we use [177] is not able to reliably indicate if all
errors were corrected in a received block. The RS encoder computes the error correction
data over the sequence number, checksum and covert data, and appends it to the block.
The receiver decodes blocks from the received bit stream as follows. For every new
bit received it checks if N symbols are in the buffer already. If that is the case it attempts
to decode a block using the RS decoder, and computes the CRC32 checksum over the
corrected header and covert data. If the checksum matches the sender’s checksum the
received block is valid. Otherwise the receiver removes the oldest bit from the buffer and
waits for the next bit.
Our protocol does not require synchronisation at the start. Any blocks sent by Alice
before Bob started receiving are obviously lost, but Bob will start receiving data once the
first complete block has been received.
We chose CRC32 as checksum because it provides better or equal error detection than
other existing 32-bit checksums [178]. At very high error rates CRC32 may be too weak,
but we assume that typically our scheme is used with lower error rates. Otherwise better
checksums could be used at the expense of more computational or header overhead.
3.4.3 Deletion channels
A simple error-correction code is insufficient for channels with deletions because every
deletion causes possible substitution errors in all following bits. Thus a decoder first has
to identify where the deletions occurred and insert dummy bits. Then an existing error
correcting code can be used to correct the errors caused by substitutions and dummy bits.
Ratzer developed an encoding scheme based on marker codes and Low Density Parity
Check (LDPC) codes [179]. Marker codes insert sequences of known bits, so-called
markers, at regular positions into the stream of payload bits. In Ratzer’s scheme the inner
marker code is used for re-synchronisation and the remaining substitution errors are then
corrected by the outer LDPC code. He proposed probabilistic re-synchronisation (also
referred to as sum-product algorithm).
54