A packet-reordering covert channel over VoLTE voice and video traffics

Abstract

Covert timing channels hide covert message in some timing behavior of an entity. The most common entity is the inter-packet delays (IPDs) which are modulated to represent the covert message. However, since the IPDs of voice over LTE (VoLTE) traffic are limited within a small range have obvious regularity, modifications to IPDs during modulation are easily detected. Therefore, in this paper, we propose a method for building a VoLTE covert channel, which is based on interleaving reordering of voice packets and video packets over VoLTE mixed traffics. Since the number of video packets in the voice packet interval is random, the covert message can be modulated into the numbers of video packets. Moreover, this method helps to increase the capacity of the covert channel. The approach employs Gray code to improve robustness against network jitter. To achieve the undetectability of the covert channel, the method adopts modular operation and the block composed of voice packet intervals to reduce the distribution difference between the covert traffic and the overt traffic. To deal with different adversary models, two different schemes are designed including the one based on video frames and another based on video packets. The difference between the two schemes is whether the rearranged video packets belong to the same video frame. The experimental results show that this solution can achieve high capacity while keeping undetectable and robust.