Chapter 3 Time-to-live Covert Channels - CAIA

Algorithm 3.3 Block decoding algorithm
CHAPTER 3. TIME-TO-LIVE COVERT CHANNELS
function decode_block(block, deletion_list)
foreach pos in 1...markers do
if deletion_list[pos] > 0 then
block = insert(block, pos, deletion_list[pos])
corrected = rs_decode(block, deletion_list)
send_crc = get_sender_crc(block)
recv_crc = compute_crc(block)
if corrected ≥ assumed_deletions and recv_crc = send_crc then
// return valid block
decoder 3 . A valid block is found if the RS decoder is able to correct all errors and the
block checksum is valid.
This ‘brute-force’ decoding increases the code rate and is feasible for a small number
of symbols between markers and small deletion rates. Also, if the redundancy of the RS
code is much higher than needed on average a solution is found well before all combina-
tions have been tried. Our later analysis shows that the average number of bits decoded
per second is still much higher than the maximum transmission rate.
3.5 Empirical evaluation
First we analyse the error rate of the different modulation schemes without reliable trans-
port. We emulate the covert channel using overt traffic from different trace files and
measure the resulting bit error rates. Based on the channel model presented in Section 3.3
we then compute the channel capacities and transmission rates, and compare the different
modulation schemes. We also investigate the burstiness of the errors.
Later we evaluate the throughput of the channel using the techniques for reliable trans-
port described in the previous section. We analyse the throughput achieved for large ag-
gregates of overt traffic taken from traces as well as for single overt flows generated by
specific applications in a testbed. We compare the throughput with the channel capacity.
3.5.1 Datasets and methodology
The Covert Channels Evaluation Framework (CCHEF), described in Appendix A, can
emulate the use of covert channels based on overt traffic from traces. This makes it pos-
sible to evaluate the TTL covert channel with large realistic traffic aggregates that are
impossible to create in a testbed. The overt traffic was taken from the traces described in
3 The maximum number of tried combinations is limited to a configurable value.
58