How to limit capacity of timing covert channel by adding extra delays

Abstract

Covert channel is a communication channel that was not designed for information transmission. It is proven that in some circumstances the attacker has an ability to build a covert channel that cannot be detected. That is why the method of capacity limitation of a potential covert channel seems to be an effective counteraction that can be used when allowable level of covert channel capacity is set up. To use such method, it is needed to estimate residual covert channel capacity. Random delays before packet sending are considered as a tool of noise insertion into a covert channel. In this paper authors investigated the way to estimate covert channel capacity taking into account network load conditions. The main topics of the research are cases when time intervals between packet sending and packet receiving in network comply with normal and exponential distributions.