Chapter 3 Time-to-live Covert Channels - CAIA

CHAPTER 3. TIME-TO-LIVE COVERT CHANNELS
We also conducted experiments over a real network using three different applications
as overt traffic. For a hybrid FEC+ARQ scheme we achieved throughputs of 50% or more
of the capacity, except in the case of high packet reordering. The throughput is up to over
hundred bits per second, much higher than the commonly accepted covert channel limit
of one bit per second [19].
3.6.1 Future work
The study of the channel characteristics could be extended towards further trace files.
The capacity and throughput analysis could also be extended to cover a wider range of
packet loss and reordering settings. Furthermore, experiments could be carried out across
different Internet paths, for example using the PlanetLab overlay network.
Improved modulation schemes should be developed to make the TTL channel stealth-
ier. Optimally covert sender and receiver would select the overt packets such that the
distribution of the induced TTL changes looks exactly like normal TTL noise. The TTL
noise distributions cannot be modelled easily with standard statistical distributions, but
covert sender and receiver could use more complex models calibrated on observed traffic.
The performance of the technique for reliable data transport could be further im-
proved. Longer RS codes would be more effective as header overhead is reduced, but
then data is received in a less timely fashion. Although RS codes perform well, there are
better error correcting codes, for example LDPC codes [179]. Furthermore, there may be
other approaches that are more efficient than a hierarchical marker scheme.
Since the error rate of the TTL channel varies significantly over time depending on
the overt traffic, it is questionable if a single error-correcting code could perform well in
different circumstances. Developing and evaluating an adaptive scheme is left for further
study. Another avenue left to explore is how much performance could be improved by
reducing the burstiness of errors through interleaving of the data prior to encoding.
When encoding the covert channel into TCP flows, the effects of packet loss and
reordering can be mitigated by utilising TCP sequence numbers. We outlined the design
of such a scheme, but an implementation and evaluation are still missing.
73