Construction of the Covert Channels - Computer Network Security - page 431

Let N be the number of packets, required for activation of the agents by the de-
scribed method. Now and further for simplicity we shall consider, that S

= n and the occurrence of addresses are independent from each other and appear with
probability 1/ M . Then using [1] we have the following theorem.

=… =S

< δ , and the
possible number of losses or inserts of packets is estimated O(1). Then the probability
of reception of the signal for the agent activation by the agent in PC(0,1) tends to 1
when

δ

<

where

0 1 2

Theorem 1. Let → ∞ , → ∞ so that =

.

⋅ → ∞

The time for revealing the covert channel is determined by the following theorem
(also received with help of the results in [1]).

Theorem 2. If , then statistics of pairs neighboring

addresses with probability, tending to 1, will reveal activation of the agent in PC(0,1)
for the warden U

so that

→ ∞ → ∞

.

If

1 3 < δ < 1 2

, the activation can take place with probability, tending to 1, faster,

than the U will find out that the covert channel exists.

4 Conclusions

The reordering of the sequence of packets can be used to construct covert channels.
Sometime the warden can easily reveal the covert channel at the first stage of com-
munication. We discussed little part of the properties of covert channels, which can
overcome the security mechanisms. A lot of mathematical problems here are still
unsolved. But the interesting thing is that the construction of effective security meth-
ods against such covert channels is a very difficult problem.

References

1. Kolchin V.F., Sevastianov B.A., Chistyakov V.P.: Random accommodations. Science,
Moscow (1976)
2. Timonina E.E.: The covert channels (review). Jet Info, November (2002) 3-11
3. Ahsan K., Kundur D.: Practical Data Hiding in TCP/IP. Workshop Multimedia and Security
at ACM Multimedia ' 02, December 6, Juan-les-Pins on the French Riviera (2002)
4. A Guide to Understanding Covert Channel Analysis of Trusted Systems. National Computer
Security Center, NCSC-TG-030, ver. 1 (1993)