Covert channel detection using Information Theory

TL;DR

This paper introduces an information theory framework to detect covert channels, revealing limitations of existing interference measures and characterizing the capacity of control-flow-based covert channels.

Contribution

It develops a novel information-theoretic detection method and analyzes the capacity of covert channels using control flows, addressing gaps in existing interference models.

Findings

Interference measures do not fully characterize covert information flow.

Enhanced interference notions cannot detect channels with less than one bit capacity.

The capacity of control-flow covert channels can be explicitly computed.

Abstract

This paper presents an information theory based detection framework for covert channels. We first show that the usual notion of interference does not characterize the notion of deliberate information flow of covert channels. We then show that even an enhanced notion of "iterated multivalued interference" can not capture flows with capacity lower than one bit of information per channel use. We then characterize and compute the capacity of covert channels that use control flows for a class of systems.