On/Off Covert Channel Capacity Limitation by Adding Extra Delays

Abstract

Covert channel is a communication channel that was not designed for information transmission. Covert channels in IP networks can be implemented in a way that is difficult to detect. That is why the method of capacity limitation of a potential covert channel seems to be an effective counteraction that can be used when allowable level of covert channel capacity is set up. To effectively protect information from leakage, it is needed to estimate residual covert channel capacity when limitation method was implemented. Random delays before packet sending are considered as a tool of noise insertion into a covert channel. In this paper authors investigated the way to estimate covert channel capacity taking into account network load conditions and ways of random delay generation. The main topics of the research are cases when time intervals between packet sending and packet receiving in network comply with normal and exponential distributions.