Covert channel limitation via special dummy traffic generating

Abstract

Covert channels in information systems may cause a protected data leakage and lead to violation of data confidentiality or integrity. Moreover, some types of covert channels can function even in case of network data encryption, tunneling or traffic firewall protection. A technique to eliminate such channels is traffic normalization which means sending packets with equal lengths and fixed header fields with equal inter-packets delays that leads to significant decreasing of efficient communication channels capacity and missing of functional capabilities of network protocols. Another way to counteract covert channel is to detect an active channel and limit it capacity. In this paper, we investigate covert channel protection means in packet networks based on their capacity limitation. We suggest a technique to counteract data leakage via covert channel based on dummy traffic generating and estimate maximum residual capacity of covert channel in case of counteracting measures for stream and block encryption of traffic and different distributions for covert channel and dummy traffic. Also we give recommendation for choosing the parameters of counteraction tool.