| The study of covert channel is one of the subjects in the field of information security. Network covert timing channel is one of the many kinds of covert channels. It uses network packets as resource to build its own channel, and can transfer information between different hosts and processes, which may come from different security levels. Thus, attackers usually view it as an ideal way for stealing information. With the development of network, covert channel has a rapid growth in channel capacity and accuracy, so has the threat it causes. Thus, to the field of information security, the study of covert channel has profound meanings.Covertness is one of the most important features of covert channel. It can steal information without being detected, even under strict surveillance. Nowadays, most of the covert channel encodes the covert information into the inter-packet delays on the same connection. This encoding scheme causes a serious problem. With the covert channel continually generating specific inter-packet delays, some of the mathematical features of inter-packet delay sequence changes greatly. Most of the detecting methods are usually designed based on this weakness of covert channel, and through some algorithm, they can detect the existence of covert communication.To cope with the weakness of covert channel, we utilize the concurrent connection features in TCP, and designed a covert channel with multi-connection. The channel encodes the covert information into the inter-packet delays across different TCP connections, so to decrease the affects covert channel causes on the original inter-packet delays within the same link. To further improve the ability of detection-resilience, we study some of the important detection methods, analyzing the possible threat they may cause to our covert channel, and modifies our channel to avoid being detected. In this paper, we describe the detail design of our channel, including encoding and decoding method under multi-connection environment, demand-and model-based traffic generating, and entropy manipulation. At the end of the paper, we test our channel through experiments, and the results include transfer rate, accuracy and detection-resilience. Experiments show that our covert channel achieves promising scores in these aspects. |
