Capacity Bounds on Timing Channels with Bounded Service Times

Transcription

1 Capacity Bounds on Timing Channels with Bounded Service Times S. Sellke, C.-C. Wang, N. B. Shroff, and S. Bagchi School of Electrical and Computer Engineering Purdue University, West Lafayette, IN USA 6/22/07 1

2 What are Timing Channels? Msg(k)= of 22

3 Timing Channels Information is conveyed in the timing of the bits Sender: a 0, a 2,, a n-1. Server: S 0,S 2,, S n-1 Receiver: d 0, d 1, L, d n ; and recovers information. 3 of 22

4 Applications of Timing Channels Keyboard JitterBug [1] [1] G. Shah et al, Keyboards and Covert Channels, 2006 Best Student Paper Award, 15 th USENIX Security Symposium Implement timing channels using on-off technique over TCP/IP networks [2] [2] S. Cabuk et al, IP Covert Timing Channels: Design and Detection, 2004 Covert Timing Channels in Multi-Level Security (MLS) Systems [3],[4] [3] U. S. Department of Defense, ``The Orange Book, 1985 [4] J. Wray, An Analysis of Covert Timing Channels, of 22

5 Exponential Service Timing Channel ESTC: Service times S 1, S 2, are iid exponential random variables with parameter µ. Capacity of ESTC: Capacity of others: Deterministic Service Timing Channels have infinite capacity, even if service time is large. A. Anantharam and S. Verdu, Bits through Queues,, of 22

6 Bounded Service Timing Channels BSTC: service times S 1, S 2, L, S n are iid with bounded support. General BSTC: Symmetric BSTC Examples of BSTC: Uniform BSTC Gaussian BSTC 6 of 22

7 Lowest capacity BSTC? Is there a particular BSTC that serves a role similar to that of ESTC? That is, it has the lowest capacity among all BSTC with same service rate and support interval. 7 of 22

8 Our Contributions An upper bound lower bounds C L,1 and C L,2 C L,1 : C L,2 : For the uniform BSTC, C U.BSTC - C L,2! 0 as ²! 0 C U. BSTC - C L,1 < const. for all ² C U.BSTC < C BSTC : serves role similar to ESTC 8 of 22

9 Timing Channels with feedback With Feedback: The sender knows d k-1 before deciding a k Thus, the sender has full control of W k FB channel is reduced to a sequentially juxtaposed iid channel: W k! W k +S k 9 of 22

10 An Upper Bound on the Capacity New i.i.d Channels: W k! W k +S k where Recall: (inter-departure rate) (service rate) 10 of 22

11 An Upper Bound C U,PS (²) = µ sup 0< <1 G(², ) bits/sec, where = /µ and 11 of 22

12 Achievability: Scheme 1 A k : geometric r.v. to avoid queueing D k = (a k + 1/µ + / - ²) - (a k-1 + 1/µ + / - ²) = A + k / - 2 ² Values for A k are spaced 4 ² apart for error-free decoding 12 of 22

13 C L,1 (²): the First Lower Bound Error-free rate of scheme 1: C L,1 (²) = µ sup [H(p 1 ) /p 1 ] bits/sec 0< <1/(1+² µ) where p 1 = (4²µ ) / (1/ ² µ ) 13 of 22

14 14 of 22

15 Achievability: Scheme 2 If the absolute timing information is available to both sender and receiver. d k = a k + / - ² for k = 1, 2, L ) error-free decoding With long codeword length, the absolute timing can be obtained with arbitrary precision. 15 of 22

16 C L,2 (²): The Second Lower Bound Error-free rate of scheme 2: C L,2 (²) = µ sup [H(p 2 ) /p 2 ] bits/sec 0< <1/(1+ (1+2 )² µ) where p 2 = (2²µ ) / (1/ (1-2 ) ² µ ) = [ ] -, and = (1+²µ)/(2²µ) 16 of 22

17 17 of 22

18 Optimality of Our Schemes Define: C 1 (²) = C u (²) - C L,1 (²) C 2 (²) = C u (²) - C L,2 (²) Results on Uniform BSTC: C 1 (²) < log 2 (e) µ bits/sec C 2 (²)! 0 as ²! 0 18 of 22

19 Capacity of a Uniform BSTC For a uniform BSTC C 1 (²) < log 2 (e) µ bits/sec ) C U.BSTC (²) = C L,1 (²) + O(1) C 2 (²)! 0 as ²! 0 ) C U.BSTC (²) = C L,2 (²) + o(1) Scheme 2 is optimal; When ² is small, the uniform BSTC has the smallest capacity among all BSTCs with same µ and ². 19 of 22

20 Gaussian BSTC C = C L,2 + o(1) does not hold for G. BSTC. ²µ 0.1 All C L, Uniform BSTC C U C Gaussian BSTC C U C of 22

21 Summary Obtained one upper bound (C U ) and two error-free lower bounds (C L,1 and C L,2 ) on the capacity of BSTC. These bounds are asymptotically tight for the uniform BSTC: C U (U.BSTC) = C L,1 + O(1) ) C U.BSTC = C L,1 + O(1) C U (U.BSTC) = C L,2 + o(1) ) C U.BSTC = C L,2 + o(1) For any distribution-independent scheme, you cannot do better than Scheme 2. When ² is small, 21 of 22

22 Implementation S. Sellke, C-C. Wang, N.B. Shroff, and S. Bagchi, Covert Timing Channels over TCP/IP networks: from Theory to Practice, 2007 Practical Design and Implementation of a covert timing channel over TCP/IP networks. Experiments on computers at Purdue and Princeton Network Delay Characteristics: Small Jitter (3-5%) Rate of the TCP/IP Timing Channel: Up to 80 bit/sec, 5 times improvement over the on-off channels. What s more? For BSTC, a non-detectable scheme mimicking the normal traffic pattern. Error-control coding for timing channel. 22 of 22