Wireless Covert Channel Detection Using Timing and Storage Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security devices, such as firewalls and intrusion detection systems, are unable to detect covert timing and storage channels in wireless communication, which are used to transmit covert information covertly and violate security policies.
Innovation Solution
A method and apparatus for detecting covert timing and storage channels by analyzing periodic characteristics of received signals, including identifying periodic signals, analyzing reception times and frames, and using XOR operations on communication protocol fields, constellation diagram distortions, and Cyclic Prefix intervals to identify covert channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional network security devices (firewalls, intrusion detection systems) are used, then basic network security is maintained, but covert timing channels and covert storage channels cannot be detected
Solution Approach 1:
The detection system is divided into specialized modules: a periodic signal detection unit for detecting covert timing channels by analyzing periodic characteristics of wireless signals, and a storage channel detection unit for detecting covert storage channels by analyzing protocol fields. This segmentation allows each module to focus on specific detection tasks, improving overall detection capability without requiring complete system redesign.
Solution Approach 2:
The patent introduces a wireless communication signal as an intermediary carrier for covert information transmission. The detection system monitors this intermediary signal to identify anomalies indicating covert channels, such as unusual periodic patterns in beacon frames or unexpected data in protocol fields, enabling detection without direct interaction with the covert communication endpoints.
2Adaptability or versatility
If existing communication protocol specifications are followed, then normal communication functionality is maintained, but covert information transmission through timing channels and storage channels occurs undetected
Solution Approach 1:
The detection system dynamically adapts to normal communication protocols while monitoring for covert channels. It learns and establishes baseline periodic characteristics of legitimate wireless signals (such as regular beacon frame intervals) and dynamically detects deviations from these baselines that indicate covert timing channels, allowing normal communication to continue while providing adaptive security monitoring.
Solution Approach 2:
The patent applies different detection strategies to different parts of the communication protocol: periodic signal analysis is applied to beacon frames and other periodic elements for timing channel detection, while field-by-field analysis of protocol data units is applied to identify covert storage channels. This localized application of detection methods maintains compatibility with normal protocol functionality while targeting specific covert channel vectors.
3Loss of information
If covert information is transmitted using time intervals of normal traffic, then covert communication is achieved, but network security is violated
Solution Approach 1:
The detection system utilizes periodic action by monitoring the periodic characteristics of wireless communication signals, particularly beacon frames transmitted at regular intervals. It establishes the expected periodic pattern and detects anomalies in these periodic transmissions that indicate covert timing channels, such as intentional variations in beacon intervals used to encode covert information, thereby detecting security violations while allowing normal periodic communications.
4Loss of information
If covert information is stored directly in network traffic headers or bodies, then covert storage channel communication is achieved, but detection by conventional security devices is impossible
Solution Approach 1:
The detection system performs preliminary analysis of protocol fields before covert information can be fully transmitted or processed. It establishes baseline characteristics of normal protocol fields and pre-identifies fields that are commonly used for covert storage (such as less frequently monitored header fields). This preliminary detection approach enables the system to flag suspicious activity in protocol fields before the covert communication is completed, making detection possible despite the隐蔽 nature of the storage channel.
Data Source
AI summary
Disclosed herein is a method for detecting a covert channel in wireless communication. The method includes setting a wireless communication specification, detecting a covert timing channel, and detecting a covert storage channel.