1. Multiple Access Covert Channels
Ira Moskowitz
Naval Research Lab
Richard Newman
Univ. of Florida

2. Focus
Review covert channels from high assurance computing and anonymity
Define quasi-anonymous channel
Review analysis of single sender DMC
Analyze 2-sender DMC arising in anonymity systems

3. Covert Channels CC = communication contrary to design
Storage channels and timing channels
Storage channel capacity given by mutual information, in bits per symbol
Timing channel capacity analysis requires optimizing ratio of mutual information to expected time cost

4. Storage Channel Example
File system full/not full
High fills/leaves space in FS to signal 1 or 0
Low tries to obtain space and fails or succeeds to “read” 1 or 0
Low returns system to previous state
Picture here would be nice

5. Timing Channel Example
High uses full time quantum in time sharing host to send 1, gives up CPU early to send 0
Low measures time gaps between accesses to “read” 1 or 0
Picture of Hi and Lo timing…

6. Anonymity Systems Started with Chaum Mixes
Mix receives encrypted, padded msg
Decrypts/re-encrypts padded msg
Delays forwarding msg
Scrambles order of msg forwarding
Picture of mix taking messages and scrambling them

7. Mixes
Mix may be timed (count number of msgs forwarded each time it fires)
Mix may fire when threshold reached (count time between firings)
Mixes may be chained
Studied timed Mix-firewalls and covert channels – now for threshold Mix-firewalls

8. Mix-firewall figure
Enclave, Eve, Alice, Clueless

9. Mix-firewall CC Model Alice behind M-F Eve listening to output of M-F
Clueless senders behind M-F
Each sender (Alice or Clueless) may either send or not send a msg each tick
Alice modulates her behavior to try to communicate with Eve
Show CC from Alice to Eve

10. Threshold Mix – No Clueless
Noiseless timing channel
Minimum delay of q
Other delays of q +1, q +2, …
Capacity of this simple timing channel:
C = lim n!1 sup (log |Sn|)/n

11. Simple Timing Channel Capacity
Delays of q +1, q +2, …
Capacity of this simple timing channel:
C = log w[q,1] , where
w[q,1] is the unique positive root of
1 – (x –q + x –1)
For theta=1, C=1, for 2, C = .6942, for 10, C=.26, for 50,

12. Bounded Timing Channel Capacity
Delays of q, q +1, q +2, …, q +N
Capacity of bounded timing channel:
C = log w[q,N] , where
w[q,N] is the unique positive root of
1 – (x–q + x–(q +1) + … + x–(q +N))
For theta=1, C=1, for 2, C = .6942, for 10, C=.26, for 50,

13. Neurons Basis for nervous system
Soma receives information from dendrites
Soma sends information via electrical impulse (spike) down axon
Spike releases neurotransmitters across synaptic cleft at end of axon to dendrite
Give picture of neuron

14. Spikes
Spike, or action potential, changes potential from –70 mV to 50 mV
Information passed by timing, not by magnitude of spike voltage
Action potential propagation speed from 1 to 100’s of km/hr, F(size, sheath)
Spike duration is 1-2 ms.
Minimum refractory period between spikes
Give picture spike voltage change – action potential

15. Timing Channels & Spikes
Minimum delay
Refractory period
Information in timing
Constant # messages
Constant D voltage

16. MacKay-McCulloch Considered neuronal data rates
Refractory time TR = 1 msec
Increments of DT = 0.05 msec
Maximum time TM = TR + nDT = 2 msec
Capacity estimated (incorrectly) as:
C = log n / [(TM + TR )/2]
Incorrect numerator, should be n+1, denominator assumes uniform distribution of symbols.

17. MacKay-McCulloch Estimated 2.9 bps (3.1 bps is right)
Can rewrite estimated capacity as:
C = log n / [TR + nDT/2]
But
lim n!1log n / [TR + nDT/2] = 0 ,
when in fact, limiting rate is 3.24 bps
Graph of capacities of correct and M&M vs. log(n)

18. Majani & Rumsey
For constant symbol time, 2-input DMC, with noise, showed optimal distribution for inputs had pr(0) in [1/e , 1-1/e]
Liang proved conjecture for n-input DMC
These results do not apply when the symbol times vary
Graph of capacities of correct and M&M vs. log(n)

19. Noise What about when there is noise?
Can no longer use algebraic approach
Rather than using simple mutual info,
It = H(X)/E(T)
must use conditional entropy,
It = H(X)-H(X|Y)/E(T)
Graph of capacities of correct and M&M vs. log(n)

20. Conclusions
Introduced problem of covert channels through threshold Mix-firewalls
Analyzed simple (noiseless) channel
Compared to biological information model
Corrected earlier estimates of M & M
Showed that MRL results do not apply
First shot at analysis in presence of noise
Graph of capacities of correct and M&M vs. log(n)