Covert Channel
Content
Covert Channel Analysis and Data Hiding in TCP/IP
by
Kamran Ahsan
A thesis submitted in conformity with the requirements for the degree of Masters of Applied Science Edward S. Rogers Sr. Graduate Department of Electrical and Computer Engineering University of Toronto
c 2002 by Kamran Ahsan Copyright
Abstract Covert Channel Analysis and Data Hiding in TCP/IP Kamran Ahsan Masters Maste rs of Appli Applied ed Scien Science ce Edward Edw ard S. Roger Rogerss Sr. Gradua Graduate te Departmen Departmentt of Elec Electrica tricall and Computer Engineer Engineering ing University of Toronto 2002 This thesis investigates the existence of covert channels in computer networks by analyzing analy zing the transport and the Internet Internet lay layers ers of the TCP/IP protocol suite. Tw Twoo approaches proac hes for data hiding are identifi identified: ed: pac packe kett heade headerr manip manipulatio ulation n and pac packe kett sorti sorting. ng. Each scenario facilitates the interaction of steganographic principles with the existing network security environment. Specifically, we show how associating additional information with IPv4 headers can ease up security mechanisms in network nodes like routers, firewalls firew alls and for service servicess suc such h as authent authenticati ication, on, audit, and billi billing. ng. Furthe urthermore rmore,, use of packet sorting with the IP Sec framework results in an enhanced network security architecture. The packet sorting approach is simulated at the network layer which provides a feasibility of pac sibility packe kett sorti sorting ng under var varying ying netw network ork condition conditions. s. While bridging the areas of data hiding, network protocols and network security, both techniques have potential for practical data hiding at the transport and network layers.
i
Acknowledgements I owe owe my deepe deepest st grati gratitud tudee to my supe supervi rvisor sor Prof Prof.. Dee Deepa pa Kundu Kundurr for givi giving ng me the opportu oppo rtunit nity y to work with her in thi thiss ve very ry excit exciting ing area. I tha thank nk her for her gui guidan dance, ce, subject knowledge, insightfulness and encouragement, without which this thesis would not have have been poss possibl ible. e. I am grate grateful ful to her for all the time and ener energy gy she spent in helping me improve my research and this document. I would also like to thank Prof. Ian Blake and Prof. Shahrokh Valaee for their time, ideas and illuminating discussions, which have all been immensely useful. Thanks to Adrian Sequeira for our stimulating discussions on various aspects of this thesis. I also acknowledge and appreciate the love and support of my life partner, Uzma, and for sharing every moment of this thesis with me. Thanks to my two-year old twins also. Amazingly, they understand what I have been doing ! Many thanks to all my elders for their blessings and prayers.
ii
Contents Abstract
i
Acknowledgements
ii
List of Tables
vii
List of Figures
ix
1 Intro duction
1
1.1 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
2
1.2 Covert Channels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
3
1.3 TCP/IP Protocol Suite . . . . . . . . . . . . . . . . . . . . . . . . . . . .
6
1.4 Problem Formulation . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8
1.4.1
Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8
1.4.2
Framework . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
9
2 Previous Work and Thesis Contribution
12
2.1 2.1 Ex Exis isti ting ng Re Rese sear arcch iin nC Cov over ertt C Cha hann nnel elss in in C Com omm mun unic icat atio ion nN Net etw works orks . . .
12
2.1.1
Covert Channels in LAN Environment . . . . . . . . . . . . . . .
12
2.1.2
Covert Channels in LAN Protoc ocools . . . . . . . . . . . . . . . . .
13
2.1.3
Data Hiding in OSI Model . . . . . . . . . . . . . . . . . . . . . .
14
2.1. 2.1.44
Covert Chann hanneels in TCP/ P/IP IP Pro roto toccol Su Suit itee
15
iii
. . . . . . . . . . . .
2.1.5
Internet Steganography . . . . . . . . . . . . . . . . . . . . . . . .
16
2.1. 2.1.66
Covert Chann hanneel An Anal aly ysi siss in Net etw works orks so far . . . . . . . . . . . .
16
2.1. 2.1.77
Add ddit itiion onal al Info Inforrma mati tion on in Ne Nettwork ork Flo Flows . . . . . . . . . . . . . .
17
2.2 Contributions of this Thesis . . . . . . . . . . . . . . . . . . . . . . . . .
17
2.2.1
The Complete Picture . . . . . . . . . . . . . . . . . . . . . . . .
18
2.2.2
The New Dimension of Security Analysis . . . . . . . . . . . . . .
20
3 Packet Header Manipulation
21
3.1 3.1 Co Cov ver ertt Ch Chan anne nels ls in Trans ranspo port rt and and Ne Nettwork ork La Lay yers ers . . . . . . . . . . . . .
21
3.1. 3.1.11
TCP (Tra rans nsmi miss ssio ion n Co Con ntrol trol Prot Protoc ocol ol)) . . . . . . . . . . . . . . . .
21
3.1. 3.1.22
IG IGMP MP (In (Inte tern rnet et Gr Grou oup p Ma Mana nage geme men nt Prot Protoc ocol ol)) . . . . . . . . . . .
23
3.1. 3.1.33
IC ICM MP (In (Inter erne nett Cont ontro roll Mes essa sage ge Prot Protoc ocol ol)) . . . . . . . . . . . . .
26
IC ICMP MP ec echo ho re requ ques estt and and IC ICMP MP ec echo ho repl reply y me mess ssag ages es . . . . . . . .
26
ICMP address mask request . . . . . . . . . . . . . . . . . . . . .
26
Router solicitation . . . . . . . . . . . . . . . . . . . . . . . . . .
27
3.2 3.2 Da Data ta Hi Hid ding ing thr through ough Pac ack ket He Head ader er Man anip ipul ulat atio ion n. . . . . . . . . . . . .
27
3.2. 3.2.11
Da Data ta Hidi Hiding ng in IP IPv4 v4 head header er:: Ge Gene nera rall Co Cons nsid ider erat atio ions ns . . . . . . .
27
Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
28
3.2.2
Data Hiding Scenario 1 . . . . . . . . . . . . . . . . . . . . . . . .
30
3.2.3 3.2.4
Data Hiding Scenario 2 . . . . . . . . . . . . . . . . . . . . . . . Data Hiding Scenario 3 . . . . . . . . . . . . . . . . . . . . . . . .
32 34
Encoding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
35
Decoding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
37
Ge Gene nera rati tion on of Sequ Sequen ence cess - Toral oral Au Auto tomo morp rphi hism smss . . . . . . . . . .
38
Toral Automorphism Systems . . . . . . . . . . . . . . . . . . . .
38
Gene Ge nera rati tion on of Sequ Sequen ence ce;; Co Con ntrol trolle led d bu butt Irre Irregu gula larr . . . . . . . . .
41
Data-Hiding Scenario 4
. . . . . . . . . . . . . . . . . . . . . . .
42
Alice’s End . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
43
3.2. 3.2.55
3.2.6
iv
Bob’s End . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
44
Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
44
3.3 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
46
Transparency to Network Filters . . . . . . . . . . . . . . . . . . .
46
Channel Capacity Estimation . . . . . . . . . . . . . . . . . . . .
48
3.4 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
51
4 Data Hiding through Packet Sorting
53
4.1 Packet Sorting / Resorting - Where? . . . . . . . . . . . . . . . . . . . .
53
4.2 IPSec - Internet Protoc ocool Security . . . . . . . . . . . . . . . . . . . . . .
54
4.2.1
Ob jectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
55
4.2.2
Salient Features . . . . . . . . . . . . . . . . . . . . . . . . . . . .
55
4.2.3
Typical Usage Scenarios . . . . . . . . . . . . . . . . . . . . . . .
56
4.2.4
IPSec Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
56
4.2.5
Security Technologi giees used by IPSec . . . . . . . . . . . . . . . .
56
4.2.6
The Protocols of IPSec . . . . . . . . . . . . . . . . . . . . . . . .
57
4.2.7
Various Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . .
59
4.3 Packet Sor ortting/Resorting Technique . . . . . . . . . . . . . . . . . . . . .
61
4.4 Sorting / Resorting Algorithm . . . . . . . . . . . . . . . . . . . . . . . .
63
4.5 Algorithm Details . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.5.1 Sorted Sequence Generation . . . . . . . . . . . . . . . . . . . . .
66 66
4.5.2
Resorting Process . . . . . . . . . . . . . . . . . . . . . . . . . . .
68
4.5.3
Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
69
4.6 4.6 Be Best st Sequ Sequen ence ce Es Esti tima mati tion on - Pac ack ket Sort Sortin ingg Ap Appr proa oacch . . . . . . . . . . .
71
4.6.1
Internet Packet Dynamics . . . . . . . . . . . . . . . . . . . . . .
72
4.6.2
Paxson’s Findings . . . . . . . . . . . . . . . . . . . . . . . . . . .
72
4.6.3
Mogul’s Findings . . . . . . . . . . . . . . . . . . . . . . . . . . .
74
4.6. 4.6.44
Sm Smal alll Scal Scalee Re Reor orde deri ring ng - A Favo vora rabl blee Ne Nettwork ork Be Beha havi vior or . . . . .
74
v
4.7 The Longest Subsequence . . . . . . . . . . . . . . . . . . . . . . . . . . 4.7. 4.7.11
74
Ba Basi siss -T -The he Mi Mini nima mall Lo Long nges estt As Asce cend ndin ingg Su Subs bseq eque uenc ncee . . . . . . .
75
4.8 Estimation of the Received Sequence . . . . . . . . . . . . . . . . . . . .
75
4.8.1
Assumptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
75
4.8.2
The Resorting Process . . . . . . . . . . . . . . . . . . . . . . . .
76
Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
76
4.8. 4.8.33
Proce rocess ss and and Ca Catteg egor orie iess of Rec eceeived ived Se Seq quenc uencees . . . . . . . . . . .
76
4.8.4
Simulation and Testing . . . . . . . . . . . . . . . . . . . . . . . .
81
Setting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
81
Gene Ge nera rall D Dis iscu cuss ssio ion n ; Favorab orable le Ne Nettwork ork B Beh ehaavior vior . . . . . . . . .
82
Position Error Threshol shold d Scenarios . . . . . . . . . . . . . . . . .
83
Why improved Why improved 6-Packet Sequence? . . . . . . . . . . . . . . . . .
84
3-Position Error or less Scenario . . . . . . . . . . . . . . . . . . .
85
4-Position Error or less Scenario . . . . . . . . . . . . . . . . . . .
86
5-Position Error or less Scenario . . . . . . . . . . . . . . . . . . .
87
6-Position Error or less Scenario . . . . . . . . . . . . . . . . . . .
88
Willy as “somewhat” Active Warden! . . . . . . . . . . . . . . . .
89
4.9 Analysis with respe pecct to Network Be Beh havior . . . . . . . . . . . . . . . . .
90
4.8.5
4.9.1
Interope perrability with Firewalls . . . . . . . . . . . . . . . . . . . . 90 Operation of an Outgoing Packet Packet at the IPSec Implemented Firewall Firewall 90 Operation Operat ion of an Incoming Pac Packe kett at the IPSec Impleme Implemente nted d Firewall Firewall 91
4.9. 4.9.22
Com ompa pattibil ibilit ity y with ith the the Antii-Re Repl plaay Attac ttack k. . . . . . . . . . . . .
92
4.9.3
Complexity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
92
4.9.4
Value Addition to IP Sec Environ onm ment . . . . . . . . . . . . . . .
93
4.10 4.10 Co Cov vert Chann hanneel Cap apac acit ity y in Pac ack ket Sort Sortin ingg . . . . . . . . . . . . . . . . .
94
4.10.1 4-Packet Sequences . . . . . . . . . . . . . . . . . . . . . . . . . .
95
4.10.2 5-Packet Sequences . . . . . . . . . . . . . . . . . . . . . . . . . .
95
vi
4.10.3 6-Packet Sequences . . . . . . . . . . . . . . . . . . . . . . . . . .
97
4.10.4 6-Packet (improved) Sequences . . . . . . . . . . . . . . . . . . .
97
4.10.5 7-Packet Sequences . . . . . . . . . . . . . . . . . . . . . . . . . .
99
4.10.6 8-Packet Sequences . . . . . . . . . . . . . . . . . . . . . . . . . .
99
4.11 S Su ummary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101
5 Application
104
5.1 5.1 Us Usag agee S Sce cena nari rios os - P Pac acke kett H Hea eade derr M Man anip ipul ulat atio ion nT Tec echn hniq ique ue . . . . . . . . . 10 1044 5.2 Usage Scenarios - Packet Sorting . . . . . . . . . . . . . . . . . . . . . . 105
6 Combining the Two Approaches
107
6.1 The IPSec Scenario . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 6.1.1 6.1.2
Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Assumptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
6.1.3
Sou ourrce Router to Destination Router . . . . . . . . . . . . . . . . 110
6.1.4
At Destination Host . . . . . . . . . . . . . . . . . . . . . . . . . 112
7 Conclusions and Future Work
115
7.1 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 7.2 Further Research . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116
Bibliography
117
vii
List of Tables 1.1 The TCP/ TCP/IP IP protoc protocol ol stac stack k sho showin wingg gen genera erall pro protoco tocols ls on the respe respecti ctive ve layers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
7
3.1 3.1 Th Thee TCP fl flag agss fi fieeld. ld. A po poss ssib ible le re redu dund ndan anccy co cond ndiition tion . . . . . . . . . . .
22
3.2 IGMP eencapsu ncapsulated lated iin n IPv4 he header ader w with ith rou router ter ale alert rt opti option; on; host to ro router; uter; membe berrship report message . . . . . . . . . . . . . . . . . . . . . . . . .
25
3.3 3.3 Re Resp speecti tiv ve rows rows of 16 16X X16 matri atrix x; rep epor ortt mess messag agee . . . . . . . . . . . . .
26
3.4 Suspicious datagram header . . . . . . . . . . . . . . . . . . . . . . . . .
31
3.5 3.5 Da Data tagr gram am head headeer app appro ropr pria iatte fo forr da data ta hid idin ingg . . . . . . . . . . . . . . . .
31
3.6 3.6 Da Data tagr gram am head headeer app appro ropr pria iatte fo forr da data ta hid idin ingg . . . . . . . . . . . . . . . .
32
3.7 IPv4 head header; er; iden identific tification ation fiel field d manipul manipulation ation;; letter “A “A”” is embedd embedded ed in the identification field . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
37
3.8 Gen Genera eratio tion n of iden identifi tificat cation ion field with ch chaot aotic ic mix mixing ing struc structur ture; e; (no (nott all alphabets are shown) . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
45
3.9 3.9 Ca Capa paci citty eest stim imat atio ion n ooff Et Ethe hern rnet et at vario arious us net network ork spe speed edss . . . . . . . .
51
4.1 The six possibl possiblee permut permutation ationss of 3 packe packett seque sequences nces and co cover vertt message messagess bea bearing 3-bit information each . . . . . . . . . . . . . . . . . . . . . . . . 4.2 Base Based d on WI WISIW SIWIR, IR, rrec eceiv eived ed seque sequence nce is ma mapped pped ttoo the ori origin ginal al se seque quence nce
70 70
4.3 The so sorted rted seque sequence nce aagainst gainst the or original iginal Seque Sequence; nce; K is is 8; k is 1 and S (i) is S (1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . viii
70
4.4 4.4 Th Thee origi origina nall se sequ quen ence ce as reco recov vered ered thro throug ugh h reso resort rtin ingg pr proce ocess ss . . . . . . .
70
4.5 4.5 Ra Rand ndom om beh behav avio iorr of warde arden; n; per perce cent ntag agee of co comm mmon on sequ sequen ence cess . . . . . .
90
4.6 4.6 Da Data ta hi hidi ding ng ca capa paccity ity in bits bits;; 44-pa paccket sequ sequeenc nces es . . . . . . . . . . . . . .
95
4.7 4.7 Da Data ta hi hidi ding ng ca capa paccity ity in bits bits;; 55-pa paccket sequ sequeenc nces es . . . . . . . . . . . . . .
96
4.8 4.8 Da Data ta hi hidi ding ng ca capa paccity ity in bits bits;; 66-pa paccket sequ sequeenc nces es . . . . . . . . . . . . . .
97
4.9 4.9 Da Data ta hidi hiding ng ca capa paci city ty in bi bits ts;; 66-pa paccke kett (imp (impro rov ved ed)) sequ sequen ence cess . . . . . . .
98
4.10 4.10 Dat Dataa hidi hiding ng ca capa paci citty in bits bits;; 77-pa paccket sequ sequen ence cess . . . . . . . . . . . . . .
99
4.11 4.11 Da Data ta hidi hiding ng ca capa paci citty iin n bits bits;; 88-pa paccket sequ sequen ence cess . . . . . . . . . . . . . . 100 100 6.1 Destination router; SPD entries . . . . . . . . . . . . . . . . . . . . . . . 110 6.2 Destination router; SADB; inbou bound . . . . . . . . . . . . . . . . . . . . . 110 6.3 Destination host; SPD entries . . . . . . . . . . . . . . . . . . . . . . . . 112 6.4 Destination host; SADB; inbo bou und . . . . . . . . . . . . . . . . . . . . . . 112
ix
List of Figures 1.1 1.1 Sc Scop opee of co cov vert ert cha hann nnel el an anal alys ysis is an and d data data hidi hiding ng in TC TCP/ P/IP IP . . . . . . .
3
1.2 Overt and covert channels . . . . . . . . . . . . . . . . . . . . . . . . . .
5
1.3 1.3 Th Thee ge gene nerral covert ert chann hannel el fra rame mew wor ork k in TCP/ P/IP IP . . . . . . . . . . . . .
9
3.1 The TCP header . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
22
3.2 The IP header . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
29
3.3 The bloc ock k diagr graam of data hiding scenario 1 . . . . . . . . . . . . . . . .
30
3.4 The bloc ock k diagr graam of data hiding scenario 2 . . . . . . . . . . . . . . . .
33
3.5 The bloc ock k diagr graam of data hiding scenario 3 . . . . . . . . . . . . . . . .
35
3.6 The bloc ock k diagr graam of data hiding scenario 4 . . . . . . . . . . . . . . . .
44
4.1 The AH header . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
57
4.2 The ESP header . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
58
4.3 End-to-end security be bettween two hosts. . . . . . . . . . . . . . . . . . . .
60
4.4 IP VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
60
4.5 The comple complete te end-to end-to-end -end scena scenario rio inv involvin olvingg IPSec impleme implemente nted d interm intermeediate nodes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
61
4.6 Pac Packe kets ts gener generated ated fro from m IP Sec implem implement ented ed node having having sorted se sequenc quencee numbers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
62
4.7 4.7 Bloc Block k diag diagra ram m of so sort rtin ingg and and reso sorrti ting ng pro roccess . . . . . . . . . . . . . . .
63
4.8 3 po possition error or less scenario . . . . . . . . . . . . . . . . . . . . . . .
86
x
4.9 4 po possition error or less scenario . . . . . . . . . . . . . . . . . . . . . . .
87
4.10 5 po possition error or less scenario . . . . . . . . . . . . . . . . . . . . . . .
88
4.11 6 po possition error or less scenario . . . . . . . . . . . . . . . . . . . . . . .
89
4.12 4.12 De Dete tect ctab abil ilit ity y ooff ccoovert ert ccha hann nnel el thro throug ugh hfi fire rew wall all sys syste tem m . . . . . . . . . .
91
4.13 4.13 4-pa 4-paccket se sequ quen ence ce agai agains nstt diffe differe ren nt pos posit itio ion n erro errors rs . . . . . . . . . . . . .
95
4.14 4.14 5-pa 5-paccket se sequ quen ence ce agai agains nstt diffe differe ren nt pos posit itio ion n erro errors rs . . . . . . . . . . . . .
96
4.15 4.15 6-pa 6-paccket se sequ quen ence ce agai agains nstt diffe differe ren nt pos posit itio ion n erro errors rs . . . . . . . . . . . . .
97
4.16 4.16 6-Pa 6-Paccket (imp (impro rov ved ed)) sseq eque uenc ncee aagai gains nstt d diff iffer eren entt po posi siti tion on erro errors rs . . . . . .
98
4.17 4.17 7-pa 7-paccket se sequ quen ence ce agai agains nstt diffe differe ren nt pos posit itio ion n erro errors rs . . . . . . . . . . . . .
99
4.18 4.18 8-Pa 8-Paccket Sequ Sequen ence ce agai agains nstt diffe differe ren nt pos posit itio ion n erro errors rs . . . . . . . . . . . . . 10 1000 6.1 AH in transpo porrt mod odee and ESP in tunnel mod odee . . . . . . . . . . . . . . 108 7.1 The longest subsequence method . . . . . . . . . . . . . . . . . . . . . . 118
xi
Chapter 1 Introduction Comput Com puter er net netwo works rks hav havee beco become me par partt and par parcel cel of our live lives. s. The prese presence nce of the these se networks can be felt in every aspect of communication; commerce, industry, education, homes, hom es, ban banks ks and what not not.. At cert certain ain leve level, l, the tec techno hnolog logy y and infra infrastr struct ucture ure are approp app ropria riate te eno enough ugh for the their ir suc succes cesss in the these se are areas. as. Add Additi itiona onally lly,, the cur curren rentt tre trends nds in research and development lead to more sophisticated applications of these networks. Computer networks were basically meant for communication, connectedness and collaboratio ora tion. n. The no notio tion n of openness openness behind this revolution however, does not address the securit secu rity y aspect in suc such h env environme ironments nts.. Secur Security ity issues thus finally emer emerged ged out with the pace more than the rate at whic which h Interne Internett has gotte gotten n in to our lives. lives. Beside Besidess softw software are solutions, the wedding of cryptography and cryptography and network security provides concrete foundations to this active resear research ch area. Secu Securit rity y has now become ever everyon yone’s e’s need, dire directly ctly or indirectl indir ectly y relat related ed with netw network ork env environm ironment ent.. This work atte attempts mpts to int integrat egratee net networ work k security with another emerging technology, data technology, data hiding ; primarily associated with oblivious communication or more recently protecting copyright in digital media appearing on the Internet. One of the subdisciplines of this broad concept is covert channels which which is investigated and accordingly tied with security aspects of computer networks. In this thesis, we attempt to identify the existence of covert channels in the TCP/IP 1
Chapte Cha pter r 1.
Intro Introduc ductio tion n
2
protocol suite. We commence by giving introductory descriptions of covert channels, data hidingg conce hidin concepts pts associated with these chan channels nels and TCP/IP suite. Basic frame framewor work k is then formulate formulated. d. A survey of previous work in the area of data hiding in communi communicatio cation n networks is then made. A general covert channel analysis is performed on protocols like Transmission Control Protocol (TCP), Internet Group Management Protocol (IGMP) and Internet Control Message Protocol (ICMP). For each one of these, potential cases for covert cov ert channel existen existence ce are iden identified tified.. The in-depth cover covertt cha channel nnel analysis focuses on the Internet Protocol (IP) and its security mechanism, IP Security (IP Sec). Accordingly, two novel data hiding approaches are proposed; the first one is based on IPv4 packet headerr manipu heade manipulatio lation; n; the secon second d sch scheme eme employs packe packett sorti sorting ng and resor resorting ting processes in order to send cov covert ert message messages. s. Brief detai details, ls, salient featu features res and func functions tions of IP Sec are also presented in order to associate these fundamentals with the second data hiding approach. The packet sorting mechanism is then analyzed with respect to its effect on the network as well as how the network would affect the covert message related with a specific sorted packet sequence. Furthermore, a list of application scenarios is also presented for each one of the mechanisms. Being connected with IP and its security architecture, the two approaches are then integrated and an interesting covert communication scenario is presente prese nted. d. Iden Identifica tification tion of areas for futur futuree wor work k follo followe wed d by final remar remarks ks concl conclude ude the thesis.
1.1
Scope
Networ Net work k Secur Security ity is of the most activ activee resea researc rch h areas today today.. To addre address ss secur security ity issues, one needs to have a comprehensive understanding of the available framework as well as all the aspects connected with the same. This thesis attempts to cover a comprehensive pictur pic ture. e. The bread breadth th of the wo work rk inc includ ludes es dat dataa com commu munic nicati ation on in net netwo works rks,, rel relati ating ng data hiding concepts (mainly associated with digital images) to network packets, the
Chapte Cha pter r 1.
Intro Introduc ductio tion n
3
TCP/IP protocols’ analysis, network security mechanisms like firewalls and the security architecture of the Internet Protocol. It primarily aims to provide some security means to standard network protocols and security procedures by effectively utilizing the available but hidden but hidden bandwidth as as identified in these standard network processes. Figure 1.1 gives a clear picture of the scope of our thesis topic.
Figure 1.1: Scope of covert channel analysis and data hiding in TCP/IP
1.2 1. 2
Co Cov vert ert Ch Chan anne nels ls
The notion of a covert channel was first introduced by Lampson [1]. Lampson’s definition describes a covert channel as one that is used for information transmission, but that is not designed desig ned nor int intended ended for communi communicatio cations. ns. This basic definition is furt further her analyzed in [2, 3, 4, 5, 6]; these analyses elaborate on the concept by associating covert channels with resource allocation policies, shared resources at different system security levels, resource state variables and resource management implementations. These parameters are linked
Chapte Cha pter r 1.
Intro Introduc ductio tion n
4
with communication taking place within a system. A resource state variable, for instance, is any system variable that can be used by a covert channel to signal information from one point to ano anothe therr wit within hin that syste system m e.g e.g.. a vari ariabl ablee sho showin wingg file status at status at several pointss (states) in a syste point system. m. In [7], a more compl complete ete definit definition ion is prov provided ided that include includess the possibility of covert channels involving access control policy and its implementation. A covert channel is described in [7] as a communication link between two parties that allows one party to transfer information to the other in a manner that violates the system’s security policy. policy. Cove Covert rt channels are classified into into covert covert storage channels and covert timing channels . Communication in a covert storage channel entails the writing of hidden data into a storage location (not meant for communication) by the transmitting party,, and the subsequent retriev party retrieval al of that information by the receiving party party.. In contrast, communication in a covert timing channel requires that the transmitting party signal information by modulating its own system resources such that the manipulation affects the response time observed by the receiving party. Figure Fig ure 1.2 belo below w sho shows ws the conce conceptu ptual al exi existe stence nce of the cov covert ert chan channel nel.. An ov overt ert channel can be utilized to act as a covert channel by having embedding and detection processes proces ses incorporat incorporated ed at the source and the rece receive iver, r, respec respectiv tively ely.. By definitio definition, n, the existence of covert channels must be non-detectable. Covert Cov ert chan channels nels can be regar regarded ded as one of the main sub-dis sub-discipli ciplines nes of data hiding hiding.. In data hiding, the two communicating parties are allowed to communicate with each other based on the security policy of the system while exploiting the features as associated with covert channel definition; there is piggy-backing of undetectable data on the legitimate content. This led to an emerging discipline, st discipline, steganogr eganography aphy , which is the Greek for covered writing. Steganography is therefore about concealing the existence of the message when secret information is hidden into an innocent cover innocent cover data. data. The simplest example usually referred to, is the usage of the low order two or three bits of each pixel in a digital image for the secret secret data to be com commu munic nicate ated. d. The last tw twoo or three bit bitss are less lik likely ely to
Chapte Cha pter r 1.
Intro Introduc ductio tion n
5
Figure 1.2: Overt and covert channels
affect the content of the cover the cover image image and will conceal the existence of the secret content. This scenario would, therefore, facilitate the smuggling the smuggling of of information from one point to another. The science of steganography thus avails covert channels in order to have secret information transfer. From a network communication point of view, these covert channels can therefore also, make use of network packets as the cover object. These network packets are shared by network nodes while traversing different network topologies before they reach their intended destination. A comprehensive approach to data hiding in the network environment should encompass network behavior as well as address data hiding aspects. The covert channel by definition is associated with the violation of system security policy. Such channels therefore pose threat to system security. The other side reflects the availability of unutilized bandwidth on account of the existence of these covert channels. We aim to investigate cover covertt channels in order to inv investigate estigate the av availability ailability of this unused bandwidth and to associate it with the usage scenarios thereby supplementing various network processes and mechanisms.
Chapte Cha pter r 1.
1.3 1. 3
Intro Introduc ductio tion n
6
TC TCP/ P/IP IP Pr Prot otoc ocol ol Su Suit ite e Protocols provide the syntactic and semantic rules for communication. They contain the details of message formats, describe how a computer responds when a message arrives and specify how a computer handles errors or other abnormal abnorm al condi conditions tions.. Most importan importantly tly,, they facili facilitate tate compute computerr comm commuunication nicat ion independen independentt of any parti particular cular netw network ork hardwa hardware. re. Protoco Protocols ls are to communication what algorithms are to computation. [8]
The TCP/IP protocol suite has been designed to provide a simple, open communication infrastructure. The goal is to maximize communication performance, connectedness and collaboration. collaboration. The suite is a hier hierarc archical hical protocol made up of intera interactiv ctivee modules each of which provides a specific functionality. It is based on conventional packet switching technology, but is independent of any particular vendor’s hardware. The significance of this protocol suite lies in its independence from the network topology and its universal interconnection; any pair of computers can communicate if they both employ TCP/IP protocols. The protocol suite provides three sets of services: application-oriented, reliable reliable and connectionless . Relia Reliable ble and connectio connectionless nless infor information mation trans transfer fer fall under the class of network level services whereas whereas application-oriented mechanisms are categorized as applias application level services . The These se lat latter ter serv service icess pro provid videe a set of app applic licati ation on pro progra grams ms tha thatt use the underlying network to carry out useful communication tasks. The most popular Internet application services include: World Wide Web, electronic mail, file transfer and remote login. Connectionless services involve the best-effort delivery of network packets, which is the most funda fundamen mental tal int interne ernett serv service. ice. This entails that a TCP/I TCP/IP-emp P-employ loyed ed net networ work k routes a message from one computer to another based on address information carried in the data. Her Here, e, the pack packet et del deliv ivery ery is not guaran guarantee teed d to the inte intende nded d des destin tinati ation. on.
Chapte Cha pter r 1.
Intro Introduc ductio tion n
7
The Internet Protocol (IP), The (IP), residing on the Internet layer, provides such connectionless services. Reliable transport services allow an application on one computer to establish a connection with another on a different computer to transfer large volumes of data via a seemingly direct direct hardware connection. Therefore reliable transport services ensure packet delivery to the intended destination against transmission errors, lost packets and failure of intermediate nodes along the path between the sender and the receiver. The Transmission Control Protocol (TCP) (TCP) offers these reliable delivery services and forms part of the transport layer of the protocol suite. Appl Ap plic icat atio ion n La Lay yer
FT FTP P, Telne elnet, t, DN DNS, S, SM SMTP TP
Transport Layer
TCP, UDP
Internet Layer
IP, ICMP, IGMP
Data Link Lay Layer er
Net Networ work k In Interf terface ace aand nd De Device vice Driv Drivers ers
Table 1.1: The TCP/IP protocol stack showing general protocols on the respective layers Table 1.1 shows the TCP/IP protocol suite as a stack of protocols (not all the protocols are shown) residing within four different conceptual layers of TCP/IP software. At the top of the hierarchy is the application layer that serves as a window a window for for associated ciate d progra programs ms to acces accesss net networ work k lev level el services. services. The next two laye layers rs p perfo erform rm the main functions func tions of the protocol stack stack.. The transpor transportt laye layerr is responsi responsible ble for the reliable and transparent transfer of data between the two end points; the TCP and User Datagram Protocol (UDP) Protocol (UDP) reside on the transport lay layer. er. The netw network ork laye layerr mainly p perfor erforms ms the addressing and routing operations necessary to move data through the network; the IP, Internet Control Message Protocol Protocol (ICMP) and Internet Group Management Protocol (IGMP) (IGM P) lie on the Inte Internet rnet lay layer er of the protocol stac stack. k. The data link laye layerr is responsi responsi-ble for communicating with the actual network hardware (e.g., the Ethernet card); this is where device drivers drivers for diffe differen rentt interfa interfaces ces reside reside.. Our focus with respect to cov covert ert
Chapte Cha pter r 1.
Intro Introduc ductio tion n
8
channel identification and analysis is on the protocols on the second and the third layers, as they perform the most integral functions of the TCP/IP protocol suite.
1.4 1.4. 1.4.1 1
Pro Proble blem m Form ormula ulatio tion n Moti Motiv vatio ation n
During the development of TCP/IP, little attention was paid to traditional security aspects. For instance, the protocols governing TCP/IP are not designed to ensure integrity of the messages being transferred, nor to authenticate the originating source of the transmitted packet. A formal model of TCP/IP networks in light of some well-known security threats thre ats is prese presente nted d in [9]. This model charac characteriz terizes es the topology of TCP/IP securit security y to enable enable better underst understanding anding of the inheren inherentt vulne vulnerabil rabilities ities.. Simila Similarly rly,, [10] p point ointss out serious security flaws in the TCP/IP protocol suite with details on a variety of attacks. Besides identifying threats, it also presents broad-spectrum defenses such as encryption. In some specific cases, introducing redundancy into the protocol specification can, in part, help prote protect ct against secur security ity vulner vulnerabilit abilities. ies. In addit addition, ion, there are multipl multiplee int intererpretations of the TCP/IP design strategies that require the natural use of redundancy. However, as discussed in [11], redundancy in communication elements is a key enabler for covert covert transmi transmission. ssion. Th Thus, us, in addit addition ion to being open to direct securi security ty threat threats, s, the TCP/IP protocol suite is also susceptible to covert communications in any of its standard implementations. Our work addresses the issue of the existence of covert channels within a TCP/IP environment by presenting various data hiding scenarios. Covert channels are considered as potential threats to system security. However, we consider these as unused bandwidth and accordingly suggest usage scenarios. Covert channels can be made to act as catalyst in various security related application usages.
Chapte Cha pter r 1.
1.4.2 1.4 .2
Intro Introduc ductio tion n
9
Framew ramework ork
In our framework, we assume that Alice and Bob, the famous analogy in cryptology, representing points A and B in an information transfer scenarios, employ data hiding involving inv olving the TCP/I TCP/IP P protoco protocoll suite to cov covertl ertly y comm communicat unicatee infor information mation.. The cove covert rt message C k traver traverses ses generall generally y a non-id non-ideal eal channe channel. l. This non-ide non-ideal al channel is cha characracterized by an incidental an incidental process which which affects the covert message C k . Keeping in view a model of the channel, Bob deciphers the covert message thereby making secret communication possible in the TCP/IP environment. The basic framework is shown in Figure 1.3 and is explained as follows:
Figuree 1.3: The general cove Figur covert rt cha channel nnel framew framework ork in TCP/I TCP/IP P
• Cover object is the network packet P k . The cover object is the data used to mask
or conceal the covert information •
S
The goal of our data hiding is to produce a stego-network a stego-network packet k generated by the stego-algorithm . Alice cov covertl ertly y communic communicates ates the informat information ion C k to Bob by
Chapte Cha pter r 1.
Intro Introduc ductio tion n
10
passingg data through the stego netw passin network ork pack packet. et. She first produce producess this pack packet et S k (from the original packet P k and C k ) which is transferred to Bob. • There exists the possibility of a secret key known only to Alice and Bob for reasons
of security. • As mentioned earlier, the transmission process is modelled as a non-ideal channel
representing the incidental the incidental processing on on the stego network packet that affects the covert information flow to produce S k . From the network network comm communicat unications ions per∗
spective, this processing can introduce position error(s) in the sequence of network packets, thereby affecting the covert message, C k . ∗
• Moreover, the same stego network packet, S k , may be required to pass through
an intermediate node (or multiple intermediate nodes) in order to ultimately reach Bob. As per our defin definiti ition, on, the cov cover ertt chann channel el must not be det detec ected ted by these intermediate nodes. In other words, in order to be non-detectable, any intermediate node finds no difference between P k and S k when processing the packet. • At the intermediate node, a stego network packet, S k may be dropped due to the
non-availability of buffer capacity. However, this possibility is assumed to be nonexistent exist ent in our analysis of the proposed algorithm algorithms. s. We are focussi focussing ng towar towards ds that network traffic which is most unlikely to be dropped due to buffer unavailability. Such a condition is possible as we have QoS mechanisms through which network traffic tra ffic can be cat catego egoriz rized ed as a pre prefer ferred red clas class. s. In addit addition ion,, we assu assume me there is a remote possibility that the same stego network packet is corrupted during transmission and consequently be dropped by the data link layer mechanisms. • If the packet S k reaches Bob, an extraction/detection algorithm is applied to the
stego packet to estimate the covert information; the extracted covert information which may possibly be affected is denoted as C k . ∗
Chapte Cha pter r 1.
Intro Introduc ductio tion n
11
In the next chapter, we review some previous work in the area of data hiding in communication networks. Many of the scenarios fit a part of the basic framework presented in Figure 1.3
Chapter 2 Previous Work and Thesis Contribution 2.1 2. 1
Ex Exis isti ting ng Resea Researc rch h in Co Cov vert ert Chan Channe nels ls in Communication Networks
2.1.1 2.1 .1
Co Cove vert rt Chann Channels els in LAN LAN Envir Environ onmen mentt
Girling [12] first analyzes covert channels in a network environment. His work focuses on local area networks (LANs) in which three obvious three obvious covert covert channels (two storage channels and one timing channel) are identified. This demonstrates the real examples of the bandwidth widt h possibili possibilities ties for simple cov covert ert channe channels ls in LANs. For a specific LAN environ environmen ment, t, the author introduced the notion of a wiretapper a wiretapper who monitor monitorss the activ activities ities of a specific transmitter on LAN. The covertly communicating parties are the transmitter and the wiretapper. The covert information, according to Girling, can be communicated through any of the following obvious ways:
1. By observin observingg the addre addresses sses as approac approached hed by the transmit transmitter. ter. If total number of addresses, a sender can approach is 16, then there is a possibility of secret commu12
Chapte Cha pter r 2.
Pre Previo vious us Work and Thes Thesis is Contr Contribu ibutio tion n
13
nication nicat ion having 4 bits for the secr secret et message. The author terme termed d this possibil possibility ity as cov cover ertt stor storage age cha chann nnel el as it depen depends ds on wh what at is sen sent (i.e (i.e.. wh whic ich h ad addr dres esss is approached by the sender) 2. In the same way way,, the other obvious storage covert cchannel hannel would depend on the size of the frame sent by the sender. For the 256 possible size sizes, s, the amoun amountt of cov covert ert information infor mation deci decipher phered ed from one size of the frame wou would ld be of 8 bits. Again this scenario was termed as the covert storage channel. 3. The third scenario prese presente nted d is p perta ertaining ining to the existen existence ce of cov covert ert timing channel. The time betw between een the successi successive ve sends can be obser observe ved d by the wireta wiretapper pper to decipher for instance “0” for the odd the odd time time difference and “1” for the even the even time time difference. The scenario transmits covert information through a “when-is-sent” strategy therefore termed as the timing covert channel. The time to transmit a block of data is calculated as a function of software processing time,, net time networ work k speed, net networ work k block sizes and protoco protocoll overh overhead. ead. Assum Assuming ing blocks of various sizes are transmitted on the LAN, the software overhead is computed on average and novel time evaluation is used to estimate the bandwidth (capacity) of the covert channel. cha nnel. Furthe urthermore rmore,, soluti solutions ons for reducing the bandwi bandwidth dth of cov covert ert channel channelss are also presented. The work paves the way for future research. In particular, [12] does not take into account the effect of the existence of covert channels on the overall network performance.
2.1.2 2.1 .2
Co Cove vert rt Chan Channe nels ls in L LAN AN Prot Protocol ocolss
In [13], Wolf presents results that can be regarded as a logical extension of [12], but applied to LAN protocols. Wolf establishes the fact that encryption, the basic mechanism of LAN security, security, cannot ensure the proper blocking of unauthorized information via cov covert ert channels cha nnels.. The work points to the unused bandwid bandwidth th p possibl ossiblee for cove covert rt transmissi transmission on in
Chapte Cha pter r 2.
Pre Previo vious us Work and Thes Thesis is Contr Contribu ibutio tion n
14
most commonly used LAN architecture standards such as IEEE 802.2, 802.3, 802.4, and 802.5. 802 .5. The focus is on LAN imp implem lemen entat tation ionss oppo opposed sed to the arc archit hitect ecture ure itse itself. lf. The work implies that covert channels can be expected in every system in which resources are shared. share d. It also highlight highlightss the relations relationship hip betw between een cove covert rt stora storage ge cha channels nnels and protoco protocoll format, and the link between covert timing channels and protocol procedure elements takingg into account the frame layo takin layouts uts of the LAN protocols. Cov Covert ert storage cha channels nnels utilize the reserved the reserved fields, pad fields and and undefined fields of of the frames. The fields identified, as means to covertly send information, can easily be detected through throu gh the implemen implementation tation of autom automated ated mechan mechanisms. isms. Suc Such h mec mechanism hanismss only monitor such fields, which would discard such frames utilizing these fields irrespective of their purpose.
2.1. 2.1.3 3
Data Data Hidi Hiding ng in OSI OSI Mode Modell
In [11], Handel and Sanford take a broader perspective and focus on covert channels within with in the gener general al design of net networ work k communi communication cation protoco protocols. ls. They emplo employ y the OSI (Open System Interconnection) network model as a basis for their development in which they the y chara characte cteriz rizee sys system tem eleme element ntss havin havingg pote potent ntial ial to be use used d for data hid hiding ing.. The adopted approach has advantages over [12]and [13] because standards opposed to specific network environments or architectures are considered. Foolproof steganographic schemes are not devised. Rather, basic principles for data hiding in each of the seven OSI layers are establis established hed.. Bes Beside idess sugg suggest esting ing the use of the rese reserv rved ed fiel fields ds of pro protoco tocoll hea header derss (that are easily detectible) at higher network layers, Handel and Sanford also propose the possibility of timing channels involving CSMA/CD manipulation at the physical layer. The work identifies covert channel figures of merit such as • Detectability; covert channel must be measurable by the intended recipient only. • Indistinguishability; covert channel must lack identification; must appear as overt
Chapte Cha pter r 2.
Pre Previo vious us Work and Thes Thesis is Contr Contribu ibutio tion n
15
channel. • Bandwidth; number of data hiding bits per channel use.
Moreover the properties of system elements which could likely be the containers for data hiding process are mentioned as • Uncertainty • Redundancy
The covert channel analysis presented here, however, does not consider issues such as in inter teroper operabi abilit lity y of the these se dat dataa hid hiding ing tech techniq niques ues wit with h oth other er net netw work node nodes, s, co cove vert rt channel capacity estimation, effects of data hiding on the network in terms of complexity and compatibility. Moreover, the generality of the techniques cannot be fully justified in practice since the OSI model does not exist per exist per se in in functional systems.
2.1.4 2.1 .4
Co Cove vert rt Chann Channels els in TCP/I TCP/IP P Protoco Protocoll Suite Suite
A more specific approach is adopted by Rowland [14]. Focusing on the IP and TCP headers of TCP/IP protocol suite, Rowland devises proper encoding and decoding techniques by utilizing the IP the IP identification field , the TCP initial TCP initial sequence number and acknowledge and acknowledge sequence number fields . These techniques are implemented in a simple utility written for Linux Lin ux syste systems ms runnin runningg ve version rsion 2.0 ke kernels rnels.. Row Rowland land simply pro provides vides a proof-of proof-of-conc -concept ept of the existence as well as the exploitation of covert channels in TCP/IP protocol suite. This work can, thus, be regarded as a practical breakthrough in this research area. The adopted encoding and decoding techniques are more pragmatic as compared to previously proposed work. These tec technique hniquess are analyzed consider considering ing secur security ity mecha mechanisms nisms like firewall and network address translation. However, the non-detectability of these covert communication techniques is questionable. For ins able. instan tance, ce, a cas casee whe where re seque sequence nce num number ber fiel field d of the TCP heade headerr is man manipu ipu-lated, the encoding scheme is adopted such that every time the same alphabet is covertly
Chapte Cha pter r 2.
Pre Previo vious us Work and Thes Thesis is Contr Contribu ibutio tion n
16
communica comm unicated, ted, it is encoded with the same seque sequence nce num number. ber. More Moreov over, er, the usage of sequence number field as well as the acknowledgement field can not be made specific to the ASCII coding of the English language alphabet as proposed, since both fields take in to account the sent and the receipt of data bytes pertaining to specific network packet(s).
2.1.5
Intern Internet et Steganog Steganograph raphy y
Katzenbeisser and Petitcolas [15] have also observed the potential for data hiding in the TCP/IP protocol suite. The significance of using of TCP/IP stems from the sheer volume of secret communication that can be realized since TCP/IP packets are used to transport thousands thous ands of Int Interne ernett pac packet ketss with each overt commu communicat nication ion link. Katze Katzenbeis nbeisser ser and Petitcolas use the term Internet term Internet steganography for for this potential scenario and indicate that the ongoing research work includes the embedding, recovering and detecting information in TCP/IP packet headers.
2.1.6 2.1 .6
Co Cove vert rt Chann Channel el Analys Analysis is in Net Netw works orks so far
The research publications discussed above: 1. Identify the existence of cover covertt channels in a netw network ork environment. 2. Poin Pointt to devi devising sing satis satisfacto factory ry tec techniqu hniques es for embedding and extr extractio action n process processes es at the source and destination, respectively. 3. Do not consi consider der the affect of emplo employing ying cov covert ert comm communicat unications ions on the ove overt rt communication network as a whole. These publications, though related with networks, address the data hiding processes as isolated isolated cases cases.. Thes Thesee resea researc rch h con contribu tributions tions theref therefore, ore, do not explore the exist existence ence of covert channels by considering their effect on the overall network environment.
Chapte Cha pter r 2.
2.1.7
Pre Previo vious us Work and Thes Thesis is Contr Contribu ibutio tion n
17
Addition Additional al Inform Information ation in Net Netwo work rk Fl Flow owss
As a part of our research in this thesis, we propose to make use of potential covert channels cha nnels in an effec effectiv tivee wa way y. We sugge suggest st to av avail ail these cov covert ert channe channels ls by associating value-added information in the network packets (within either of the TCP or IP headers) so that covert links can have some supplementary value to existing network processes or security mechanisms. Ackermann et Ackermann et al. [16] presents a similar concept, which requires the deviation of the networ net work k arc architec hitecture ture from a stric strictt lay layered ered approac approach. h. Inste Instead ad of having specific header information available to only a specific layer, in order to route, filter, interpret or process data, the accessibility of some additional information can ease certain network processes like like QoS routi routing ng function functionss in netw network ork nodes. The nature of the additional additional informa information tion is defined to be user- or application-specific. Methods of obtaining such information are mentioned. The IP header is proposed as one of the potential packet-marking placement areas. However, the success of placing the additional information in either the IP header or the MAC (OSI (OSI la laye yerr 2) hea header der is not ful fully ly expl explore ored. d. It is bey beyond ond the scope of [16] to investigate the appropriate location within the packets for data hiding, nor consider how this information can be encoded/decoded by the sender/receiver or be utilized by the intermediate intermediate nodes. Refe Referenc rencee [16] therefor thereforee focuses on the net networ work k comm communica unication tion aspect of the data hiding process.
2.2 2. 2
Co Con ntr trib ibut utio ions ns of this this Th Thes esis is
The contribution contributionss of this thes thesis is inclu include: de:
1. the identification of cov covert ert storage channels in popular transport and network layer layer protocols such as TCP, IGMP, and ICMP.
Chapte Cha pter r 2.
Pre Previo vious us Work and Thes Thesis is Contr Contribu ibutio tion n
18
2. the nove novell int introducti roduction on of four storage cha channels nnels in the IPv4 format header header.. 3. the design of a new data hiding sche scheme me based on pac packet ket orde ordering ring under ideal and non-ideal network conditions. 4. the presentation of possible application scenarios of data hiding in TCP/IP for supplementing various security related processes and enhanced network security architecture (IPSec). 5. the surve survey y of the area of stega steganograp nography hy in netwo networks rks by bridging the areas of data hiding (traditionally studied for multimedia at the application layer), communications network protocols and network security. The first three contributions are practical and focus on feasibility of the approaches. The last two contributions provide novel vision and perspective to the overall work.
2.2.1 2.2 .1
The Comp Complet lete e Pictu Picture re
In this thesis, we attempt to provide a more comprehensive scenario. 1. This wor work k can be consid considered ered,, in part, a logical ext extension ension to [11] and [13] in terms of covert channel identification. Covert storage channels in the transport and network layer protocols are investigated by adopting more specific approaches than simply emplo emp loyin yingg the rese reserv rved ed or un unuse used d fiel fields ds in pac packe kett hea header ders. s. The propos proposed ed dat dataa hiding scenarios are more practical since techniques used, are based on redundancies and multiple multiple interp interpretat retations ions of process strategie strategiess of the Interne Internett protocol. This makes these scenarios non-detectable to various automated security mechanisms and intermediate nodes. 2. This research also expands on the w work ork presente presented d in [14] as more specified encoding and decoding techniques are suggested keeping in view their interoperability with netwo net work rk sec securi urity ty mec mechan hanism ismss suc such h as fire firew walls alls and rou router ters. s. The These se mec mechan hanism ismss
Chapte Cha pter r 2.
Pre Previo vious us Work and Thes Thesis is Contr Contribu ibutio tion n
19
would treat the stego network packet, S k as the network packet, P k , thereby letting the same to pass through these without being detected as covert information carrier. The header fields selected for data hiding process seem more appropriate due to the flexibility of sending covert information without interfering with the standard processes. Reference [14] uses sequence number field and acknowledgement number field of TCP which follow the number of bytes sent and acknowledged. These fields are therefore inflexible to send a sequence of encoded covert data. The motivation of utilizing header fields in this work is elaborated in subsequent sections of the data hiding scenarios in chapter 3 and 4. 3. This work can also be consi considered dered a supplemen supplementt to [12], as we estimate the chann channel el bandwidth bandwi dth (capacit (capacity) y) of one of the approac approaches hes along simila similarr lines lines;; the essent essential ial difference is the medium used for data hiding; we propose covert channels one layer above the data link layer. 4. Our proposed algorithm based on packet sorting is also evaluated using figures of merit like interoperability interoperability,, compatibility compatibility,, and complexity complexity.. Furthermore, for resortingg proces sortin process, s, a b best est estimat estimation ion techn technique ique is suggested suggested.. This tec techniqu hniquee would facilitate receiving party to decipher the covert message by detecting the sent sequence of packet since IP layer does not guarantee sequenced delivery of packets at the destination. 5. In addition, addition, we prese present nt vari various ous applicatio application n scen scenarios arios by utilizing the conce concepts pts proposed by Ackermann et Ackermann et al. [16]. 6. A more indistin indistinguisha guishable ble and non-de non-detect tectable able data hiding envi environme ronment nt is also presented in IPSec by combining the two proposed approaches.
Points 1 and 2 deal with improved data hiding schemes as compared to existing research. These points also take into account the network effect on S k covering network
Chapte Cha pter r 2.
Pre Previo vious us Work and Thes Thesis is Contr Contribu ibutio tion n
20
communica comm unication tion perspect perspective ive.. Poin Pointt 3 iden identifies tifies storage cov covert ert cha channel nnel capac capacity ity (number of covert bits per frame) estimation at Internet layer. Point 4 addresses the effect of data hiding process on the network by taking into account various network-related figures of merit. merit. The use of data hiding proc process esses es is men mentio tioned ned in point 5. Thi Thiss use pro provid vides es applications in network environment. Same as the point 6 mentioning the combination of the two approaches approaches for a better netw network ork related data hiding scenar scenario. io. This encompas encompasses ses aspects of improved data hiding processes, consideration of their effect on network and development of application scenarios especially for network security, thereby completing the overall picture.
2.2.2 2.2 .2
The N New ew Dime Dimensi nsion on of Secu Securit rity y Analys Analysis is
The current research trend involving the TCP/IP protocol suite focuses on performance issues as well as the associated security threats and defenses [9],[10] and [17]. From this perspective, we aim to provide a new dimension existing securit security y analysis. Cov Covert ert dimension to existing channel scenarios are proposed utilizing packet headers and sorting of packet sequences. Packet sorting is employed within the IP Sec framework, which opens the door for the interaction between steganography and traditional network security. The importance of IP Sec is evident from the fact that IPv6 has mandatory security service servicess of authentication and confidentiality that can be made possible through the use of the Authentication Header (AH) (AH) and Encapsulating and Encapsulating Security Payload (ESP) (ESP) protocols of IP Sec (see appendix for header format). An enhanced security mechanism is envisioned with the integration of stego principles and existing network security architecture. Various application scenarios are presented to further explain the novelty of this concept. Moreover, the application of such stego principles at the network layer can facilitate security mechanisms in the layer 3 nodes like routers and firewalls.
Chapter 3 Packet Header Manipulation 3.1
Co Cove vert rt Channel Channelss in Transport and Net Netwo work rk L Lay ay-ers
This section contains a general investigation of various protocols on the transport and networ net work k layer layers. s. The list of protoco protocols ls that are ev evaluate aluated d for possible use in cov covert ert communications include the TCP (Transmission Control Protocol), IGMP (Internet Group Management Protocol), ICMP (Internet Control Message Protocol) and Internet Protocol (IP). This does not serve to provide an exhaustive look at possible covert channels but attempts to prove existence of simple storage channels, in mentioned protocols, that might be used later (future research) possibly.
3.1.1
TCP (T (Trans ransmissi mission on Control Control Protocol) Protocol)
At the transport layer, TCP is intended to provide a reliable process-to-process communication service in a multi-network environment. TCP is, therefore, a connection-oriented and reliable transport protocol. The header of the TCP protocol is shown in Figure 3.1. It has a 6-bit field labelled as code bits (URG, ( URG, ACK, PSH, RST, SYN, FIN ). ). These bits determine the purpose and contents of the TCP segment. These six bits tell a network 21
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
22
Figure 3.1: The TCP header node how to interpret other fields in the header. There are 64 possible combinations for these six bits, out of which 29 combinations are considered to be valid as per the rules set forth fort h by the protocol [18]. For the cove covert rt cha channel nnel ident identificat ification, ion, the int intent ent is to expl explore ore any redundancy any redundancy condition condition within these possible code bit com combinat binations. ions. Most of the TCP segments have an ACK bit set (i.e., the value of the ACK bit is 1) because of the full duplex nature of the connection between two hosts. This allows data piggybacking since acknowledgements can be sent with data. One of the redundancy conditions is shown in Table 3.1 below:
URG ACK PSH RST SYN FIN 0
1
1
0
0
1
Table 3.1: The TCP flags field. A possible redundancy condition
Table 3.1 represents one of the valid combinations of the 6-bit code fields. It can be in inter terpre preted ted as fol follo lows: ws: One of the ends of the virt virtual ual conne connecti ction on inten intends ds to fini finish sh the
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
23
connection (FIN =1) from its end and at the same time it sends an acknowledgment (ACK is set). The push flag is also set as the same end requests the receiving transport layer lay er to push the data to its respectiv respectivee applic application ation lay layer er immediate immediately ly.. Since the URG bit is not set, the Urgent pointer field (16 bit) of the TCP header, shown in Figure 3.1, becomes redundant and therefore can be used to have a storage covert channel. Likewise, redundancy conditions exist for all those possible cases wherein the URG bit is not set there thereby by making the urgen urgentt pointer field redund redundant. ant. The SYN bit set can also have possible combinations either with the ACK bit set or the URG/PSH (not both at the same time time)) set to 1. Ther Therefor efore, e, the remai remaining ning bits are meaningle meaningless ss for the protoco protocoll enabling covert data transmission possibilities through TCP header.
3.1.2
IGMP (Intern (Internet et Group Group Manageme Management nt Protocol) Protocol)
IP multicasting (one-to-many communication) follows the paradigm of allowing transmission to a subset of host computers, but it generalizes the concept to allow the subset to spread spread acros acrosss arbit arbitrary rary physic physical al net networ works ks throughout the Interne Internet. t. A giv given en subse subsett is, therefore, known as multicast group. Multicast routers and hosts that implement multicast must use IGMP to communicate group membership information. The two message phases are are report messages (host messages (host to router - joining a group, membership continuation, leaving the group) and query and query messages (router (router to host - monitoring the group). IGMP is encapsulated encapsulated in an IP datagram for transmi transmission. ssion. Here the IP destinat destination ion address is the multicast address. A specific nomenclature of the IP datagram as per RFC 2236 (IGMP v2 message with router alert option), can be defined keeping in view the following values of IPv4 header fields: • Version = 4; • IHL = 6 words; • Total length = 32 octets;
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
24
• TTL = 1 (requires one hop only); • Protocol = 2; • Router alert option (An IP option that causes each intermediate router to examine
a datagram even if the datagram is not destined to the router); • Fragmentation may (DF bit is zero) or may not (DF bit is set) be allowed
The IGMPv2 can have the following two types of messages: 1. Membership report message and a nd leave leave group message - host to router 2. Membership query message - router to host. Based on the nomenclature defined above and the types of IGMP messages, following IP datagrams are possible:
a Host to Router; Membership report, refer Table 3.2 and leave group messages; Fragmentation allowed
b Host to Route Router; r; Mem Membership bership report and lea leave ve group messag messages; es; Fragme ragmenta ntation tion not allowed
c Router to Host; Membership query messages; Fragmentation allowed d Router to Host; Membership query messages; Fragmentation not allowed By having a 16-bit arrangement of the complete IP datagram, a 16X16 matrix is obtained. The intent is to use the unused bits (8 bits; actually set to zero by sender and ignored by receiver (for report messages - host to router) and 16 bits; actually set to zero by the sender (for query messages - router to host) in order to have some secret data transferred transferr ed betwe between en host to router and router to hosts hosts.. This can b bee combine combined d with other fixed values of other fields as defined in the nomenclature above.
Chapter Chapt er 3.
4-bit Ver. 4-bit IHL 0100
Packe acket t Header Man Manipula ipulation tion
0110
8-bit TOS
16-bit Tot. Len.
XXXXXXUU
0000000000100000
16-bit Ident.
3-bit flags
13-bit Frag.Off.
XXXXXXXXXXXXXXXX
UOX
XXXXXXXXXXXXX
8-bit TTL
8-bit Protocol
16-bit Checksum
00000001
00000010
XXXXXXXXXXXXXXXX
25
32-bit Source Address XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 32-bit Destination Address XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 8-bit type
8-bit Length
16-bit Data
10010100
00000100
0000000000000000
8-bit type
8-bit Max.Resp. Time
16-bit Checksum
00010000
UUUUUUUU
XXXXXXXXXXXXXXXX
32-bit Source Address XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Table 3.2: IGMP encaps encapsulate ulated d in IPv4 heade headerr with route routerr alert option option;; host to route router; r; membership report message
Therefore Ther efore,, by consideri considering ng 16X16 matrix’ row rowss 2,5,11 2,5,11,12,13 ,12,13 for for report messages (frag (fragmentation allowed) table 3.3 refers, rows 2,4,5,11,12,13 for report messages (fragmenta (fragmentation not allowed), rows 2,5,11,12,15,16 for for query messages (fragmentation (fragmentation allowed) and for query message (fragmentation for (fragmentation not allowed)rows 2,4,5,11,12,15,16 of the 16X16 matrix, we can attain possible covert communication scenarios through proper embedding / extraction processes at the two communicating ends, respectively.
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
Row # 1 2 3 4 5 6 7 8
26
9
10 11 12 13 14 15 16
2
0 0 0 0 0 0 0 0
0
0
1
0
0
0
0
0
5
0 0 0 0 0 0 0 1
0
0
0
0
0
0
1
0
11
1 0 0 1 0 1 0 0
0
0
0
0
0
1
0
0
12
0 0 0 0 0 0 0 0
0
0
0
0
0
0
0
0
13
0 0 0 1 0 0 0 0 U
U
U
U
U
U
U
U
Table 3.3: Respective rows of 16X16 matrix; report message
3.1.3
ICMP ICMP ((In Intern ternet et Control Control Message Message Protocol) Protocol)
The ICMP is the mechanism used by hosts or routers to send notification of IP datagram problems back to the sende problems sender. r. ICMP pac packe kets ts are encap encapsulat sulated ed inside of IP datagrams. The ICMP sends query sends query and and error reporting reporting messages. With query messages, ICMP can also diagnose diagnose some netw network ork proble problems. ms. In this class of ICMP messages messages,, a node sends a messag mes sagee tha thatt is answ answere ered d in a spec specific ific form format at by the dest destina inatio tion n node node.. The deta details ils of ICMP can be found in [19]. The following highlights examples of covert storage channels.
ICMP echo request and ICMP echo reply messages
The Optional data field allows The Optional allows having a variable a variable length data to to be returned to the sender. IP options like router router alert , recor recordd route route and time time stam stampp can be used encapsulating ICMP echo request message. This provides a possibility to have covert channel between the communicating parties. Moreover, network devices usually do not filter the contents of ICMP echo traffic if ICMP echo traffic is allowed.
ICMP address mask request
The ICMP address mask request is meant from host to the specific router on the LAN or broadcast message to all the routers on the LAN. The request is filled with zeros in
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
27
the 32-bit address mask field. This can b bee used to have cov covert ert commu communicat nication ion from host to router(s) on the same LAN.
Router solicitation A host sends a solicitation after booting to request that routers on the local net immediately diate ly respond with an ICMP messa message ge router adve advertise rtisemen ment. t. It has a 32 bit reserv reserved ed word. wo rd. The These se res reserv erved ed bits can be mad madee to use for co cove vert rt comm communi unicat cation ion for a spec specific ific scenario.
3.2 3. 2
Da Data ta Hid Hidin ing g thro throug ugh h Pac ack ket Hea Header der Ma Mani nipu pula la-tion
3.2.1 3.2 .1
Dat Data a Hiding Hiding in IPv4 IPv4 heade header: r: Gen Genera erall Conside Considerat ration ionss
The possibilities of covert channels in transport and Internet layer protocols are identified and briefly explained explained in cha chapter pter 3. This sectio section n specifically deals with data hiding possibilities in the IPv4 header. Four scenarios are discussed that make use of flags of flags and and identification fields identification fields of the header. The layered architecture requires the IP datagram to encapsulat enca psulatee data receiv received ed from the transport laye layer. r. Simil Similarly arly,, IP datagr datagram am heade headers rs encapsulate ICMP messages as well as IGMP’s report and query messages. Covert channels in the IPv4 header can, therefore also, be associated with those identified in the TCP, ICMP or IGMP headers. This facilitates an increased amount of covert information tied with any of these messag messages. es. Ther Therefore efore,, flexib flexibilit ility y of associating addition additional al infor information mation with ICMP, IGMP and TCP traffic through IP header, is achieved, once covert channels are explored in IP header. As depicted earlier, redundancies and multiple interpretations of the design strategy give rise to possible covert channels, which are exploited in the following IPv4 header manipulation schemes.
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
28
In identifying covert channels, one could argue that it depends on the fashion in which the specific TCP/IP software is implemented in a specific environment especially with regards to the user interface. We address this by considering only those functional in inter terfac faces es tha thatt are requi required red in all IP imp implem lemen entat tation ions. s. Som Somee of the these se inter interfac faces es are well we ll sta state ted d in [20] [20].. Ano Anothe therr fac factor tor is the desi design gn con consid sidera eratio tions ns on whi which ch a TCP TCP/IP /IP implemen imple mentatio tation n is based upon. One of the design strategi strategies, es, the pac packet ket fragm fragment entation ation strategy, explained below, is followed in the identification of covert channels in the IPv4 header.
Setting As per RCF 791 elaborating on IP [20], the implementat implementation ion of the protocol must be robust. In general, an implementation must be conservative in its sending behavior and liberal in its receiving behavior i.e. it must be careful to send well-formed datagrams but must accept any datagram that it can interpret. Fragmentation of an Internet datagram is necessary when it originates from a network that allows a large packet size and must traverse a network that limits these datagrams to a smalle smallerr size to reac reach h the destinat destination. ion. Refe Referenc rencee [20] also state statess that the fragm fragment entation ation strategy of the Internet protocol is designed so that an un-fragmented datagram has all zero fragmentation information i.e. MF = = 0 (one of the three flags fields of IP header, first bit is Reserved is Reserved , second bit is is DF , i.e. Do not Fragment and the third bit is is MF i.e. i.e. More Fragment) and fragment and fragment offset = = 0 (13 bit IP header fie field). ld). Refe Referr Figure 3.2 for the respectiv respec tivee fields of IPv4 header header.. It implies that the fragme fragmentat ntation ion policy does not put forth any condition on the value of identification field, which carries the identifying value assigned by the sender to aid in assembling the fragments of a datagram. So the design aspect of the Internet Protocol makes identification field of the IP header independent from fro m the proces processs of fra fragme gment ntati ation. on. Her Heree it wo would uld be app approp ropria riate te to men mentio tion n tha thatt the
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
29
sender chooses the identifier (value in the identification field of the IP header) to be unique for the specific source - destination pair and protocol for the time the datagram (or any fragment of it) could be alive in the Internet.
Figure 3.2: The IP header The above discussion implies the following: 1. For all un-fragmente un-fragmented d datagrams, [20] requires that that MF MF (More (More Fragment) and fragand fragment offset must must be zero. 2. The identification The identification field though though associated with fragmentation process is not bound to carry any specific range of value for the un-fr un-fragmen agmented ted datagra datagrams. ms. It requires only a unique value assigned to the identification field for the specific source, destination and protocol fields. Point 1 gives rise to a redundancy condition i.e. DF (Do (Do not Fragment) can carry either “0” or “1” subject to the knowledge of the maximum size of the datagram that could cou ld be sen sentt wit withou houtt fra fragme gment nting ing the sam same. e. Thi Thiss aspe aspect ct is exp exploi loited ted in dat dataa hid hiding ing scenario scen ario 1. Data hiding scena scenarios rios 3 and 4 are based on the gene generation ration of ident identificat ification ion field uti field utiliz lizing ing point 2. Dat Dataa hid hiding ing scen scenari arioo 2 av avail ailss both the point pointss and dev develo elops ps a one-to-many secret secret communication environment.
Chapter Chapt er 3.
3.2. 3.2.2 2
Packe acket t Header Man Manipula ipulation tion
30
Data Data Hidi Hiding ng Sc Scen enar ario io 1
Consider two workstations on the same network having users Alice users Alice and Bob and Bob.. Both decide to have a cov covert ert commun communicati ication on by emplo employing ying protocol suite of the netw network. ork. They are well aware of the fact that the network administrator is very security cautious and the TCP/IP software is configured properly as per the security policy of the organization. Alice and Bob have knowledge of the MTU MTU (maximum transmission unit) 1 of their network and they are aware of the fragmentation strategy, which follow the standard design considerations of IP [20].
Figure 3.3: The block diagram of data hiding scenario 1 Figure 3.3 shows the block diagram of scenario 1 in context of the framework presented in Figure 1.3 of Chapter 1. The embedding algorithm avails the fragmentation strategy of the Internet Internet protocol and DF bit is used to send cov covert ert bit to Bob. Bob accordi accordingly ngly reads the DF bit and gets the covert message from Alice sitting on the same network. Keeping in view the design strategy of fragmentation process, the following datagrams (only those fields are shown, which are of interest) of IPv4 header bear the same meaning in terms of ove overt rt commun communicati ication. on. In each of the cases cases,, cov covert ert data is imperceptible 1
The MTU can either be known through social engineering or estimated by sending test datagrams to find out whether they are segmented or not
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
31
because of treating the stego network packet S k as network packet, P k by the network or the net networ work k administra administrator. tor. Here tw twoo sets of datagrams are shown: suspicious suspicious and non-suspicious . Suspicious are those that can catch the eye of the network administrator as posses p ossessing sing abnormal data or message as compa compared red to norma normall pac packe kets. ts. Non-s Non-suspic uspicious ious would be those that are engineered well in order to deceive the network monitoring automated devices. From the covert communication point of view, non-suspicious datagrams would be termed as as appropriate for for data hiding process. Datagram Datagr am #1 Complete datagram; minimal data; small size datagram; fragmentation not allowed since DF bit is set; set; Suspicious since since the size is too small and even then , it is instructed, not to fragment it. Table 3.4 refers. Data Da tagr gram am # 16 16-b -bit it Id. Id. fiel field d 33-bi bitt Fl Flag agss 13 13-b -bit it Fra rag. g.Off Offse sett 16 16-b -bit it Total otal Leng Length th 1
XXX..XX
010
000...0
21
Table 3.4: Suspic Suspicious ious datagram header Datagram Datagr am #2 Complete datagram; moderate size; fragmentation not allowed since DF bit is set; Appropriate for data hiding . Table 3.5 refers. Data Da tagr gram am # 16 16-b -bit it Id. Id. fiel field d 33-bi bitt Fl Flag agss 13 13-b -bit it Fra rag. g.Off Offse sett 16 16-b -bit it Total otal Leng Length th 2
XXX..XX
010
000...0
472
Table 3.5: Datagram header appropriate for data hiding Datagram Datagr am #3 Comple Com plete te dat datagr agram; am; mode moderat ratee siz size; e; fra fragme gment ntati ation on is possi possible ble,, sin since ce DF bit is not set; but fragmentation will not take place since both Alice and Bob know the MTU of their network and they have agreed to send the datagram of size smaller than MTU;
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
32
Appropriate for data hiding . Table 3.6 refers. Data Da tagr gram am # 16 16-b -bit it Id. Id. fiel field d 33-bi bitt Fl Flag agss 13 13-b -bit it Fra rag. g.Off Offse sett 16 16-b -bit it Total otal Leng Length th 3
XXX..XX
000
000...0
472
Table 3.6: Datagram header appropriate for data hiding Datagrams 2 and 3 in Tables 3.5 and 3.6, can therefore communicate “1” and “0” respectiv respec tively ely to Bob. So DF bit (middle bit of the 3 bit flags field) can either be set to one or to zero whenever “1” or “0” is required to be covertly communicated. The constraint is however, however, require required d to be met i.e. prior knowl knowledge edge of MTU. The netw network ork administrator administrator who is keeping a cautious eye would not have the slightest indication that if Alice and Bob make this communication communication not so frequently . Thu Thus, s, this scenario pres present entss a simpl simplee data-hiding datahiding scheme by utili utilizing zing the redu redundan ndantt condi condition tion iden identifie tified d in the IPv4 heade header. r.
3.2. 3.2.3 3
Data Data Hidi Hiding ng Sc Scen enar ario io 2
In continuation with Scenario 1, we consider the other IPv4 field, the identification field. Datagrams 2 and 3 of Tables 3.5 and 3.6 enable Alice and Bob to communicate covertly. The identifier value could also be associated with this covert communication. Thus, for a single datagram communicating either “1” or “0” through the respective datagrams 2 and 3, more information could also be sent through the identification field; this can further add to the information being communicated through ”1” or ”0.” The only rule to be followed is to maintain the uniqueness of the identification value for each respective datagram specific to sender-destination pair and protocol field. So each datagram could represent unique multiple bit covert information if Alice and Bob agree to use the combination of the DF bit with identification field. The fact that the DF bit and the identification field are independent also implies that this scenario entails multiple covert channels within a single packet. The covert information can easily be decoupled from the respective fields
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
33
of the header through proper algorithms. The conceptual block diagram of scenario 2 can be shown in Figure 3.4. The embedding algorithm makes use of the DF bit of the flags field and identification field for the covert transfer of information, from Alice to Bob. Accordingly, Bob deciphers the covert message from the respective fields through a proper decoding algorithm.
Figure 3.4: The block diagram of data hiding scenario 2
Moreover, the 16-bit identification field (655, 536 unique values) facilitates hosts to use the unique identifiers independent of destination encourages Alice and Bob to have more parties involved in secret communications. Alice can send an engineered datagram to Bob as well as Carol as Carol and Dave and Dave , representing points C and D for secret communication, having the same identification value plus the DF bit (either “0” or “1”). Therefore, this scenario of data hiding facilitates multiple recipients of a single covert message from Alice i.e. i.e. th thee one-to-many covert covert communication scenario, provided that they are connected to the same network and have prior knowledge of MTU.
Chapter Chapt er 3.
3.2. 3.2.4 4
Packe acket t Header Man Manipula ipulation tion
34
Data Data Hidi Hiding ng Sc Scen enar ario io 3
So far the data hiding schemes are restricted to communicating parties on the same network and it is also assumed that each party knows the MTU of the transmission medium involved in the complete network. Scenario Scena rio 3 is independen independentt of the prior knowl knowledge edge of the MTU. It aims to use the identification field with the consideration that the datagrams generated by communicating parties must not contain options contain options in in the IP header. IP headers without options are are usual for Internet communication and most of the analysis often does not consider these in the IPv44 hea IPv header der.. If the opt option ionss fiel field d is not con consid sidere ered d to be pre presen sentt in the IPv IPv44 hea header der,, it would wo uld mak makee the leng length th of the head header er as 5 i.e i.e.. 5 wo words rds (eac (each h wo word rd compr comprise isess 32 bit bits) s) These two considerations would set the values in the very first two fields (4 bit each) of IPv4 header as: 1. Version field field as 4 (binary equivalent: 0100) and 2. Internet header length field field as 5 (binary equivalent: 0101). This scenario can also be applied to hosts who intend to communicate with each other covertl cov ertly y acros acrosss an Int Interne ernett subject keepin keepingg in view the frame framewor work k as detai detailed led in cha chapter pter 1. In the following two sub-sections, we discuss steganographic encoding and decoding schemes. It is encouraged to refer to Figure 3.2 for better understanding. This scenario utilizes the combination of identification field and the version & Internet header length fields fiel ds of the IPv4 head header. er. The res result ulting ing head header er forma formatt wo would uld be appropriate for data hiding since since the network would not be able to detect irregularities in any of the fields. The network or the network administrator is assumed to be ignorant of the encoding techniqu tec hnique, e, detailed below. This fact can b bee justified as numerous automa automated ted netw network ork monitoring mechanisms only check the data in the respective fields, not in the combination. Also the selected fields do not pose any threat to network security as the attention
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
35
is focussed on IPv4 header fields like source address (IP spoofing), destination address, total length, and protocol fields [21]. A bloc block k dia diagra gram m of data hid hiding ing scen scenari arioo 3 is sho shown wn in Fig Figure ure 3.5. The embe embeddi dding ng block states the various header fields employed in the scheme. The XOR operator is used to encode and decode the cov covert ert inform information. ation. Bob extract extractss the secre secrett informatio information n only by having the prior knowledge of the encoding scheme.
Figure 3.5: The block diagram of data hiding scenario 3
Encoding Alice needs to do the following at her end: 1. The 4-bit versi version on field and the 4-bit Inter Internet net header field are fixed to hav havee value valuess 0100 and 0101 respectively. This would constitute the first 8 bits of the first word of the IPv4 header as shown in Figure 3.2. Let us denote these bits as [ h1 , h2 ,. . . ,h8 ]. 2. The Ident Identificat ification ion field constitu constitutes tes the first 16 bits of the secon second d word of the IPv4 Cons nsid ider er the firs firstt 8 bits bits of th thee fir first st and header and is denoted as [ i1 ,i2 ,. . . ,i16 ]. Co the second word of the header namely, [ h1 , h2 ,. . . ,h8 ] and [i1 ,i2 ,. . . ,i8 ] respectively.
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
36
The first 8 bits shall have [ h1 , h2 ,. . . ,h8 ] = 01000101 and the second word 8 bits [c1 ,c2 ,. . . ,c8 ] can contain the covert data to transmit (say any ASCII character). This means that c1 is a covert data bit and the 8 bits c1 ,c2 ,. . . ,c8 are formed from il = hl ⊕ cl .
3. Per Perform form bit-w bit-wise ise XOR operati operation on on both first eight bits of first and second word of the header. Therefore, il = h l ⊕ cl , l = 1, 2,. . . , 8 where ⊕ is the XOR operator. ∗
4. The rest of the 8 bits of the identification field can be generated randomly and combined with the first eight bits to assure the uniqueness for a specific sourcedestin des tinati ation on and protoc protocol ol fiel fields ds com combin binati ation. on. Tha Thatt is, il for l = 9, 10,. . . , 16 is ∗
randomly generated and concatenated to form [i1 , i2 ,. . . ,i16 ]as the new identification ∗
∗
∗
field for covert communication. 5. The datagra datagram m of Table 3.7 , can then be trans transmitte mitted d across the Int Interne ernett and ther theree would be no worries if the datagram gets fragmented because at the destination, reassembling would be done based on the same identification field. Referring to Table 3.7, letter “A” has ASCII value as 65, the binary equivalent of which is 01000001. Thus [c1 ,c2 ,. . . ,c8 ]= [01000 [01000001]. 001]. Therefore il = hl ⊕ cl , l = 1, 2, .... ....8 ∗
would be [i1 ,i2 ,. . . ,i8 ] = [01000101] ⊕ [01000001] ∗
∗
∗
resulting in [i1 ,i2 ,. . . ,i8 ]= [00000100] ∗
∗
∗
as the identification field value of Table 3.7.
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
4-bit Ver. 4-bit IHL 0100
0101
8-bit TOS
16-bit Tot. Len.
XXXXXXUU
XXXXXXXXXXXXXXX
16-bit Ident.
3-bit flags
13-bit Frag.Off.
0000 0100 RRRRRRRR
XXX
XXXXXXXXXXXXX
8-bit TTL
8-bit Protocol
16-bit Checksum
XXXXXXXX
XXXXXXXX
XXXXXXXXXXXXXXXX
37
32-bit Source Address XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX 32-bit Destination Address XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Table 3.7: IPv4 header; identification field manipulation; letter “A” is embedded in the identification field
Decoding At the receiving end: 1. Bob obtains the pac packe kett with corres corresponding ponding vers version ion & Int Interne ernett heade headerr length fields bits and the identification field bits 2. He performs the XOR operatio operation n to obtain the cov covert ert data stream as: [c1 ,c2 ,. . . ,c8 ]= [h1 , h2 ,. . . ,h8 ] ⊕ [ il ,i2 ,. . . ,i8 ] ∗
∗
Putting respective bits: [c1 ,c2 ,. . . ,c8 ]=[01000101]⊕ [00000100] To get the binary equivalent of ASCII, “A” [c1 ,c2 ,. . . ,c8 ]=[01000001]
∗
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
38
Due to the manipulation of identification field, this data-hiding scenario is resistant to packet filtering firewalls [21]. Moreover the stateful inspection firewalls do not detect this same scenario because of the randomness introduced in the last eight bits of the identific iden tification ation field. Also referr referred ed to as dynamic pack packet et filtering filtering,, state stateful ful inspection is a firew firewall all archite architecture cture that works at the network network layer layer.. Unlik Unlikee stati staticc pac packet ket filter filtering, ing, which examines a packet based on the information in its header, stateful inspection tracks each connection traversing all interfaces of the firewall and makes sure they are valid. It examines the content of the packet up through the application layer in order to determine more about its source and destination. It also monitors the state of the connection and complies the information in a state table. Besides packet header information criteria, the filtering decisions are based on the context that has been established by prior packets passed through the firewall. For this case, this ensures that with low probability i.e. 0 .4% (eight bits of identification field are encoded as per stego algorithm and the rest of the eightt are randomly genera eigh generated. ted. These random eight bits would ensure the uniqu uniquenes enesss of the encoded data even if the encoded covert letters are similar. The probability of having the same identification field for the similar data to be covertly sent would therefore be 1 256 )
no two similar data to be covertly communicated would have the same identification
field value.
3.2.5
Generatio Generation n of S Seque equences nces - Toral Toral A Autom utomorph orphisms isms
Before explaining the fourth data hiding scenario, a concept of toral automorphisms is described [22].
Toral Automorphism Systems Toral Automorphisms are strongly chaotic (mixing) systems [23], which find applications in digital images these days especially for the embedding of watermarks (copyright protectio tec tion). n). The wo word rd chao chaoss has both a gen genera erall mea meanin ningg and a sci scien entifi tificc meani meaning. ng. As is
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
39
usually the case, the general meaning tends to convey little of the strict definition that scienti scie ntists sts and mathe mathematic maticians ians apply to the word. The dictiona dictionary ry defines the wor word d cha chaos os as, a condit condition ion or place of total disorder or confusion. What scien scientists tists and mathemat mathematiicians mean by chaos is very much related to the spirit of the dictionary definition stated above. Systems are chaotic if they: • are deterministic through description by mathematical rules. • have mathematical descriptions which are nonlinear in some way.
Considering digital images as a set of pixels which form a two dimensional integer lattice, toral automorphism systems are characterized by special properties when they act on such lattices. A two dimensional Toral automorphism is a spatial transformation of planar regions which whic h belong in a square two two-- dimension dimensional al area. The main struct structure ure in this process is a 2 × 2 matrix with constant elements representing the toral automorphism mapping denoted with A . Matrix A is constrained to have 1. eleme elements nts that belong to the set of p positi ositive ve int integer egerss and 2. a determ determinan inantt of 1. The latter property ensures the existence of the inverse automorphism represented by
A 1 , the inverse matrix. −
Thus a point r , having coordinates as as x and and y , belonging to a specific domain U of the integer lattice can be subjected to iterated actions by a toral automorphism matrix. This iterated action forms a dynamical a dynamical system which which can be expressed with a map.
rn+1 = Arn (mod1)
(3.1)
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
40
where n = 0, 1, 2, . . . It can be shown that ri ∈ U, i= 1, 2, 3, . . . The same dynamical system can be applied to the whole two dimensional integer lattice L of size N . The toral automorphism matrix. A is expressed as: 1
1
k k+1
and for the value of k as 1; A would be: 11 12
The dynamical system pertaining to the complete lattice L can be obtained by having all the points on the lattice subjected to iterated actions of the above toral automorphism matrix, A . Therefore:
AN (1) : L → L
1 1 xn+1 yn+1
=
12
xn (modN ) yn
(3.2)
All the transformed points obtained in each iteration are statistically uncorrelated with each other and depend on the parameters k and N specifically, where N is the size of the lattice. Another corollary from the study of such dynamical systems establishes the periodic nature of these systems and defines the recurrence time i.e. after P iterations, the same pointt wo poin would uld come to its orig origina inall loca locatio tion n in the lat lattic tice. e. A dig digita itall ima image ge subject subjected ed to iterated actions of A matrix matrix woul would d firs firstt enc encoun ounter ter compl complete ete chao chaos, s, i.e. i.e. the latti lattice ce L disperses having its points distributed irregularly and then these points would come back to their original position after a specific number of iterations. This introduces the concept of periodicity. The number of iterations to attain the periodicity depends on: • The size of the lattice i.e. N , • The element k of the matrix A .
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
41
Mathematically, for any integer lattice L of size N , there is an integer P , P = P (k ,N ) such that:
P
AN (k )r = r(modN ), r ∈ L
(3.3)
The automorphism as mathematically stated in Equation 3.3 is mixing is mixing . It produces a chaos wherein the points are irregularly distributed and spread all over the lattice. The digital image would be transformed and a a chaotic image is is obtained having no relation with the original original image. This state of the digital image follo follows ws the definitio definition n of cha chaos os (mixing) as defined from mathematicians and scientists point of view. From these fundamentals of toral automorphism, the following can be concluded: 1. Size of the lattice, N defines a domain of the lattice which restricts all sorts of irregulari irreg ularities ties and chaos within its limits. In equation 3.3, (mod N ) performs this funct fun ction ion.. Th Thus us all trans transfor format mation ion of poin points ts wo would uld be con confine fined d to a spec specific ific set, defined as the size of the two dimensional integer lattice. 2. The eelemen lementt k of the toral automorphism automorphism matrix has its role in the itera iterated ted actions of the matrix on each point in the lattice. This element is associated with recurrence time, P . 3. Recu Recurrenc rrencee time, P is the number of iterations after which the system comes back to its ori origin ginal al posi positio tion. n. Eac Each h ite iterat ration ion befor beforee the recu recurre rrence nce time has a set of transformed points in which all the points are highly uncorrelated with each other; thus occupy unique locations within the lattice.
Generation of Sequence; Controlled but Irregular From the chaotic transformation of digital images and phenomenon of periodicity of this transformation, when an integer lattice is subjected to iterated actions by Equation 3.3, a structure of sequence generation is devised. The details of this structure are as follows:
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
42
1. The structu structure re in consi considerat deration ion is a tw two-dime o-dimensiona nsionall diagon diagonal al integer integer-latt -lattice. ice. This provides that only diagonal elements will be subjected to iterated actions of the toral automorphism matrix.
N as above) and defined to 2. Size of the de defined fined lattice is represent represented ed as K (instead (instead of N be the main the main key . This main key would therefore determine the number of elements
in a sequence. 3. The el elemen ementt k is defined as the sub-key. As mentioned earlier, it affects the period of the seque sequence. nce. Ther Therefor eforee given main key K , choosing specific k would generate specific number of sequences. 4. From these tw twoo keys, a specific nu number mber of unique sequen sequences ces are obtaine obtained. d. Thes Thesee sequences can rightly be termed as sorted sequences of the original sequence. The third key specifies which unique sequences is selected from that specific number of sorted sequences. 5. Ther Therefore efore,, once these key keyss are establis established, hed, one could gener generate ate a specific seque sequence nce whose who se num number ber of ele elemen ments ts woul would d depe depend nd on the main key key.. The sub ke key y wo would uld determine the total number of sequences and the third key specifies, a specific sequence out of that total number of sequences obtained. That is how, chaotic mixing concept is applied to provide a structure for sequence genera gen eratio tion n whi which ch has chaot chaotic ic pro propert perties ies,, ens ensuri uring ng ran random domnes nesss and at the sam samee tim timee facilitates the application of this structure under defined conditions as affixed by key values.
3.2.6 3.2 .6
Dat Data-H a-Hidi iding ng Sce Scenar nario io 4
This scenario of data hiding utilizes the same identification field but the generation of an identifier is based on chaotic mixing which provides a structure for the generation of
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
43
sorted sorte d sequ sequence encess from an original sequenc sequence. e. The eleme elements nts of a specific sorte sorted d seque sequence nce are statistically statistically uncorr uncorrelate elated d with each other based on diffe differen rentt initi initial al condi conditions. tions. The strength of a data hiding scheme depends on its non detectability either by the administrator minist rator or by any autom automated ated netw network ork monitoring scheme scheme.. Chaot Chaotic ic mixin mixingg pro provides vides such a structure and enables Alice and Bob to perform the following operations at their respective ends. It is assumed that Alice and Bob have a suitable method of exchanging keys before hand and both have information of all the keys involved in the embedding and extraction processes. Before explaining the encoding and decoding schemes at Alice’s and Bob’s ends respectively, Figure 3.6 shows the conceptual block diagram of scenario 4 in context of the framewor frame work k expresse expressed d in Figur Figuree 1.3 in chapte chapterr 1. The keys infor information mation is jointly shared by Alice and Bob in embedding and extraction of covert data based on chaotic mixing process proc ess.. The iden identifi tificat cation ion field is use used d for the em embedd bedding ing of sec secret ret info informa rmatio tion. n. Bob deciphers the covert message by having knowledge of all the three key parameters.
Alice’s End Alice performs the following operations to encode: 1. Selec Selectt the val value ue of K from from the set of positive integers. 2. Sel Selec ectt k.
sequence num number ber from the sorted 3. Sel Selec ectt the spec specific ific sort sorted ed sequ sequenc encee i.e. the sequence sequences seque nces as obtai obtained ned from K and k . 4. Let the data to be communicated covertly be the capital letters of the English language; languag e; the sorte sorted d sequence has to have eit either her 26 elemen elements ts or more. Eac Each h one of the elements (numbers) of the selected sequence is put against each one of the letters. lette rs. The num number ber is then encoded in 8-bit binary equiv equivalen alents. ts. Append the other
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
44
Figure 3.6: The block diagram of data hiding scenario 4 8 bits to be randomly generated. This would make the 16-bit identification field of IPv4 header.
Bob’s End
To decode, Bob generates the encoding scheme with the information of all the keys. From K and k , he gets all the possible sorted sequences and from the sequence number, he choose ch oosess the specifi specificc sor sorted ted seque sequence nce sele selecte cted d by Alice for enc encodin oding. g. In thi thiss wa way y, Bob genera gen erates tes the sam samee enc encodin odingg mec mechan hanism ism.. By look looking ing at the iden identifi tificat cation ion field of the received packet, Bob would decipher the covert information being sent by Alice.
Example If we work on English letters i.e. K =26, =26, then based on the toral automorphism technique, refer equation 3.3, having k =1, the total number of sorted sequences would be 42.
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
45
Taking any of these sequences, say sequence number as 8 would give us specific integer int eger va value lue against each one of the capit capital al English letters. Its decimal equiv equivalen alentt is inserted in the identification field such that it would cover the first 8 bits and rest of the 8 are randomly generated or vice versa, as shown in table 3.8. Sr Sr.. # Alph Alphabe abets ts Seq. Seq.fo forr 8th 8th it iter er.. Bi Bina nary ry Eq Equ. u. En Encod coded ed in 4-bi 4-bitt Iden Ident. t.Fi Fiel eld d 1
A
1
0000 00001
01
01XX
2
B
14
0000 1110
0E
0EXX
3
C
9
0000 1001
09
09XX
4
D
22
0001 0110
16
16XX
5
E
4
0000 0100
04
04XX
6 7
F G
17 25
0001 0001 0001 1001
11 19
11XX 19XX
8
H
12
0000 1100
0C
0CXX
24
X
24
0001 1000
18
18XX
25
Y
6
0000 0110
06
06XX
26
Z
19
0001 0011
13
13XX
Table 3.8: Gene Generatio ration n of identifi identificatio cation n field with chaoti chaoticc mixing structure structure;; (not all alphabets are shown)
Table 3.8 describes the data hiding scenario 4 based on the generation of identification field fiel d bas based ed on tor toral al aut automo omorph rphism ism proces processs of sor sorted ted seque sequence nce gene generat ration ion.. The third column represents the 8th sorted sequence of the possible 42 sorted sequences based on K as 26 and k as 1. The four fourth th colum column n rep repres resen ents ts the bin binary ary equi equiv vale alent nt of the third column. Conse Consequen quently tly,, the fifth colum column n expr expresses esses the binar binary y equiv equivalen alentt in 4-bit form. The last column of Table 3.8 represents the identification field value of the header. Rather than generating the covert information based on some fixed structure like ASCII
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
46
values, as in Scenario 3, we make use of mixing concept for having sorted sequences of an original sequence. A specific sorted sequence is then pitched against the covert data, capital capit al letters here, to gener generate ate binary equiv equivalen alents. ts. This provid provides es randomnes randomnesss as code of “A” would be totally uncorrelated with code of “B” as 01XX and 0EXX in our case. Moreover, if “B” is required to transmit again then it would carry different code because of the random num numbers bers (last eigh eightt bits) bits).. So by select selecting ing differen differentt sorte sorted d seque sequences, nces, we could have different encoding schemes for the same 26 capital letters. This method of utilizing the identification field of IPv4 header through the generation of uncorrelated sequences would not require Alice and Bob to be on the same network; they could communicat communicatee across the Int Interne ernett as well. The IP heade headerr can hav havee an option field fiel d als also. o. The rando randomne mness ss in the iden identifi tificat cation ion fiel field d valu alues es wo would uld make this schem schemee non-detectable against the detection of secret data through packet filtering and stateful inspection type firewalls.
3.3
Dis isccus ussi sio on
Transparency to Network Filters The four packet header manipulation scenarios follow the basic context presented in Chapter Chapt er 1. This framew framework ork measure measuress the differe difference nce in behav behavior ior of the non-idea non-ideall ov overt ert channel for both types of network packets (i.e., network packet, P k and stego network packet, S k ). The cov covert ert comm communica unication tion cannot be detected so long as P k and S k seem similar to the network or the network administrator or any of the intermediate nodes. The non ideal channel possesses the properties as explained in basic framework of Chapter 1. The four data hiding scenarios employ technique such that the stego network packet, S k appears as a network packet, P k and therefore exhibits transparency to network filters
combating covert communication. This transparent behavior is justified on the following
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
47
counts: 1. The first data hiding scena scenario rio is based on the fragm fragment entation ation strate strategy gy of Int Interne ernett Protocol as detailed in [20]. As long as the covertly communicating parties have the knowledge of the MTU and they are on the same network, the covert information transfer cannot be detected. Tables 3.4, 3.5 and 3.6 refer. 2. The second data hiding scen scenario, ario, besides making use of the first scenario uses the identifica iden tification tion field. The iden identifica tification tion field is only used to re-a re-assem ssemble ble the datagrams at the destination due to fragmentation caused by intermediate networks. The packet filtering mechanisms do not check the contents of this field as part of their packet filtering criteria [21]. The only rule to be followed in its generation is to allot a unique number that is specific to a source-destination pair and protocol field. So the iden identifica tification tion field provide providess an excelle excellent nt ven venue ue to place a cov covert ert bit stream strea m in a non detec detectable table fashi fashion. on. Scena Scenario rio 2 only talks about the com combinat bination ion of the DF bit of flags field and the identification field in order to have a one-to-many covert communication scheme. 3. The third data hiding scheme proposes a one time pad for encoding and decoding of cov covert ert inform information ation.. The sche scheme me also incorporate incorporatess random number numberss in the generation of the identification field in order to make the covert information transfer less evident. It combines the identification field with version field and Internet header length field to make the structure hard to detect. The only limitation is that the IPv4 header does not have the option field, which is quite normal in Internet communication as the option field is used for network monitoring and debugging purposes. 4. The last scena scenario rio offers the most secure struct structure ure for cov covert ert informat information ion transfer since it comprises three keys to encode the covert data. Again the idea is to make the identification field non-detectable to any of the intermediate nodes like firewall
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
48
or to the netw network ork administr administrator. ator. The chaoti chaoticc mixing pro provides vides such a struc structure ture of generating gener ating sorted seque sequences nces from an origin original al sequence sequence.. The ident identificat ification ion field so generated, would have two parts. One based on chaotic mixing as explained in data hiding scenario scenario 4 and other comprises random num numbers. bers. Chaot Chaotic ic mixing, offering controlled randomness (based on selection of keys) combined with randomness in rest of the eight bits therefore ensures a robust coding structure. Based on the selection of the specified fields of the IPv4 header, employed techniques and proposed embedding/extraction schemes, it can be implied that stego network pac packet, ket, S k would be treated as network packet, P k and therefore would appear transparent to
network filters. Moreover, the covert communication, like overt communication, can also be subjected to the incidental processing by the non-ideal overt channel. Both types of packets can be subjected subjecte d to incid incident ental al process with equal probabil probability ity.. Ther Therefor efore, e, from the perspect perspective ive of the stego network packet, S k , the non-ideal over overtt chan channel nel exhi exhibits bits the same b beha ehavior. vior.
Channel Capacity Estimation Capacity Capac ity is one of the most signific significant ant perfor performance mance measur measures es of cov covert ert chan channels. nels. The capacity estimation relates the cost of data hiding, both in terms of the time taken by the TCP/IP software to process a stego-network packet and protocol header overheads with the total time, T to transmit a stego-network packet S k from a sourc source. e. Cov Covert ert chan channel nel capacity is the number of bits used for data hiding per packet which, for our case, can be evaluated from the total time taken to transmit a stego network packet, S k from the network layer. The capacity of covert channels at the network layer is a function of the following three elements [24]: 1. The quant quantity ity of informat information ion that can be trans transmitte mitted dp per er execut execution ion of a scenario.
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
49
2. The time requir required ed to exer exercise cise the scenar scenario, io, and 3. The effec effectt of perf perform ormanc ancee enh enhanc anceme ement nts. s. Sin Since ce upg upgrad rading ing a sys syste tem m wit with h fas faster ter components is common and can have significant effects. The four data hiding scenarios require crafted packets generated from the network laye layerr as per alg algori orithm thmss defi defined ned.. The capac capacit ity y est estima imatio tion n of the these se sce scenar narios ios wo would uld be equivalent to Girling’s estimation [12] as our scenarios are also applicable to a LAN environment. Based on this, capacity can be estimated in terms of logical extension of Girling [12] expression for the time to transmit a frame of data (seconds). 8( B + N ) T = S + +
V
(3.4)
Where: • T = Time to transmit a block of data (seconds) • S = Time used in software; independent of block size (seconds) • B = Size of transmitted block or frame [Ethernet] (bytes) • N = size of network protocol overhead (bytes) • V = Network Speed (bits per second)
For the schemes incorporated in the network layer, time used in software (S) as well as siz sizee of net netwo work rk pro protoco tocoll ov overh erhead ead (N) nee need d to be chang changed ed acc accord ording ingly ly.. The abov abovee model expresses the covert channel capacity (or bandwidth) in bits/second as:
C =
1 T
(3.5)
For all those scenarios, wherein more than one bit is used for data embedding, capacity of data hiding scheme can be expressed in bits per second, as:
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
C =
BDH T
50
(3.6)
where BDH is the number of data hiding bits per frame. In order to arrive at some common ranges of the capacity estimation of our algorithms based on Girling’s [12] expression; following are the considerations made: • Ether Ethernet net LAN is con consid sidere ered. d. We mak makee use of the fact that Ethe Etherne rnett dat dataa siz sizee
ranges from 46 octets to 1500 octets. The header and trailer constitute another 18 octets to make the frame size ranging from 64 octets (minimum size of the block i.e. Bmin) to 1518 octet octetss (maxim (maximum um size of the bloc block k i.e. Bmax.) Bmax.).. The abov abovee range provides us two extreme ends of channel capacity keeping other factors fixed like S , N and V . • Size of the protocol overhead, N , as 38 octets.(20 bytes for IP and 18 bytes for
data link layer). • Three network speeds are considered i.e. 10 Mbps, 100 Mbps and 1 Gbps
An assumption is made regarding the time taken by the software to ultimately make a fra frame. me. Gir Girlin lingg [12] comp compute uted d thi thiss tim timee as 4 .38 m sec and Internet layer is considered which is one above the data link layer, we consider the same time delay in processing the packe pac kett at Int Interne ernett layer layer.. Thu Thuss the total soft softwar waree time wou would ld then b bee 8.76 m sec (i.e (i.e.. S = 8.76 m sec). Results shown in Table 3.9 give a feel of data hiding capacity at Internet layer. It has been observed that the channel capacity decreases with the increase in the size of the frame. Data hiding scenar scenarios ios 1 and 2 (one(one-to-man to-many) y) offers single bit of data hiding per frame. For the case of 8 bits per frame, data hiding scenarios 3 and 4 , the capacity will be about 8 times the case where is one bit per frame is hidden. Moreover, it can also
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
51
Netwo Net work rk Speed Speed ((V) V) Fram ramee S Size ize (B) Cap Capaci acity ty (C (C)) 10 Mbps
64 octets
113 bits/sec
100 Mbps
64 octets
114 bits /sec
1 Gbps
64 octets
114 bits /sec
10 Mbps
1518 octets
100 bits/sec
100 Mbps
1518 octets
113 bits /sec
1 Gbps
1518 octets
114 bits/sec
Table 3.9: Capacity estimation of Ethernet at various network speeds be seen that ten folds increase in network speeds does not make considerable increase in the capacity. Detectability, with respect to nodes other than the intended recipient of the covert communication, is increased if the capacity of the covert channel is increased. However if the encoding and decoding scheme is such that makes the hidden information imperceptible then these covert channels provide excellent way of having secret communications. Moreover probability of being detectable could also be controlled by making the “usage frequency” of this high capacity covert channel to be very low.
3.4
Summary
This chapter can be summarized as follows: • Data hiding scenarios are developed based on packet header manipulation of IPv4
header. • Previous work is also analyzed and compared with the proposed data hiding sce-
narios. • A general covert channel analysis of TCP, ICMP and IGMP is also made, pin-
Chapter Chapt er 3.
Packe acket t Header Man Manipula ipulation tion
52
pointing pointi ng poten potential tial scena scenarios rios wher wheree proper embedding and extr extractio action n tec techniqu hniquee could be employed. • Data hiding scenarios for IPv4 header employ the redundancies and multiple inter-
pretations as observed under specific cases, affecting various header fields. • In order to make covert channels non detectable, data hiding scenario 4 employs
chaotic mixing concept, providing structure for the generation of sorted sequences based on thre threee keys. This ensure ensuress con controll trolled ed randomne randomness ss in the encoding sche scheme me making the scheme hard to detect. • The proposed schemes are not optimal as they are aimed to establish feasibility of
data hiding process at the transport and Intern Internet et laye layers. rs. Coding theory prov provides ides optimal solution for such schemes and this is proposed as one of the future works related to this thesis. • It has also been found that overt channel exhibits similar behavior to both types
of packets,thereby points towards the non detectability of stego packet. • Covert channel capacity is also estimated based on Girling’s work [12]. The results
provide prov ide a range of the capac capacities ities of such cove covert rt channe channels. ls. The chann channel el capacit capacity y decreases decrea ses wit with h the inc increa rease se in the siz sizee of the frame frame.. It has als alsoo been foun found d out that ten folds increase in network speeds does not make considerable increase in the covert channel capacity. • These data hiding scenarios, therefore, establish the existence of covert channels in
transport and Internet layers of TCP/IP.
Chapter 4 Data Hiding through Packet Sorting In the previous chapter, we presented the use of packet packet header manipulation for for data hiding. This section deals with the use of packet ordering to convey covert information. The possible ways to arrange objects in a set is surprisingly complex and offers a correspondingly large opportunity opportunity for steganogr steganography aphy.. Chang Changing ing the order of the pack packets ets require requiress no ch change ange in the pack packet et cont conten entt (i. (i.e. e. the payl payload oad and the heade headers rs are not affe affecte cted). d). Therefore no major modifications are expected either in the protocol definition/design or in the overall system in order to implement a data-hiding scenario. The sorting/resorting process holds a surprisingly large amount of information; n ob object jectss can store log 2 n! bits. Based on these facts, data hiding feasibility is explored in the TCP/IP protocol based on packet sorting and resorting processes at source and destination, respectively.
4.1 4. 1
Pac ack ket S Sor orti ting ng / Reso Resort rtin ing g - Wh Wher ere? e?
The packet sorting and resorting processes require some reference in order to relate packet numbers num bers to their actua actuall order. The natural pac packe kett ordering is neede needed d so that the stego packe pac kett order ordering ing (sorting) can b bee undone (resor (resorting) ting).. This refere reference nce is not ava available ilable at the transport layer using TCP. Sequence TCP. Sequence number field and acknowledgement and acknowledgement number field point to the number of octets of data and are not directly related to the packet number.
53
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
54
Moreover, the data packetized at the transport layer can be broken down into fragments at the Internet layer and would further complicate the notion of a packet order. Similarly, if we look at the IP, the Identification field (16 bit) of the IPv4 header, as mentioned in the previous section, is unique to the specific source-destination and protocol fields and cannot be associated with a packet sequencing mechanism. In contrast, within the IP Sec environment, the two protocol headers, ESP and AH headers provide a 32-bit sequence 32-bit sequence number field . The primary aim of this field is to detect replay attacks ; hence it is directly related to packet numbers. Anti-replay mechanism is intended to determine whether a packet received is a duplicate or not. When a Security Association (SA) Association (SA) is first first est estab abli lish shed ed for a flow flow of dat data, a, th this is fiel field d is set to ze zero ro.. Th Thee sequence number of each packet under this SA is incremented by 1 during outbound processing. Thus, this replay protection identifies a natural ordering of the packet stream that can be used for packet sorting and resorting processes at both ends.
4.2 4. 2
IP IPSec Sec - In Inte terne rnett Pr Prot otoco ocoll Se Secu curi ritty
The term IPSec refers to a set of mechanisms designed to protect the traffic at the IP level, lev el, suited for both ve versions rsions of IP i.e. IPv4 and IPv6. The secur security ity serv services ices afford afforded ed by this security protocol are: • Connectionless Integrity, • Data origin authentication • Protection against replays and • Confidentiality
IPSec implementation is optional in IPv4. It is however, mandatory for any implementation of IPv6, therefore can rightly be regarded as the security architecture for the current
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
55
as well as the futu future re IP tra traffic. ffic. The kind of sec securi urity ty ser servic vices es it offe offers rs made this set of mechanisms an industry standard in December 1998. A brief introduction of IPSec would be as follows:
4.2. 4.2.1 1
Object Objectiv ives es
As mentioned above, IPSec fulfills the following:
1. Encry Encryption ption and/or Authe Authentic ntication ation of all traffic at IP lev level. el. 2. Supports all vari varied ed distributed distributed applica applications. tions. Thu Thuss remote log on, Client/ Client/Serv Server, er, e-mail, file transfer, Web access can be secured.
4.2.2 4.2 .2
Sal Salien ientt Feature eaturess
The following are relevant features of IPSec: • IPSec is meant for off site traffic. Therefore traffic within a company or work group
does not incur the overhead of security related processing. • IPSec in a firew firewall all is resistan resistantt to byby-pass pass if all incom incoming ing traffic must use IP Sec and
firewall is the only means of entrance from the Internet into the organization. • The IPSec implementation in a firewall or router or end system, requires no change
in the software on a user or server system. • The architecture does not need keys specific to users.
• IPSec is useful for off site workers and for setting up a secure virtual sub network
within an organization for sensitive applications.
Chapter Chapt er 4.
4.2.3 4.2 .3
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
56
Ty Typic pical al Usa Usage ge Sce Scenar narios ios
Several possible ways to utilize IPSec are outlined: • IPSec protocols operate in networking devices like routers or firewalls that connect
each eac h LAN to the outsi outside de worl world. d. The These se route routers rs or firew firewall allss (IP Sec net netwo worki rking ng device) will typically encrypt and compress all traffic going into the WAN and decrypt and decompress traffic coming from the WAN. The above operations are transparent to work stations and servers on the LAN. • For individual users who dial into the WAN (connected directly), they must imple-
ment the IP Sec protocols to ensure security.
4.2. 4.2.4 4
IPSe IPSecc Serv Servic ices es
IP Sec provides security services at the IP layer by: 1. Enabli Enabling ng a syste system m to selec selectt required secu securit rity y protocols 2. Dete Determinin rminingg the algori algorithms thms to use for the service servicess 3. Putti Putting ng in place any cryptog cryptographic raphic key keyss requ required ired to pro provide vide the requ requested ested servic services es
4.2.5
Securit Security y Tec Technol hnologie ogiess used used by by IPSec IPSec
The following are a list of key security technologies enabling IPSec: • The Diffie Hellman key exchange to deliver keys between systems on the public
network.
• Public key cryptography for signing the Diffie Hellman exchanges, which guarantees
both sides of the negotiation.
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
57
• Support for standard keyed hash algorithms for authenticating packets. The stan-
dard authenticators are HMAC-MD5-96 (RFC 2403) and HMAC-SHA-96 (RFC 2404).
• Support for a variety of encryption algorithms. Mandatory to implement cipher is
DES-CBC (with an explicit Initialization Vector) (RFC 2405). After the standardization of AES (Advanced Encryption Standard) by the US Government in Fall 2001, the current status of the standard cipher is not yet known. • Support for X.509 digital certificates for validating public keys.
4.2. 4.2.6 6
The The Pro Protoc tocol olss o off IPS IPSec ec
The objectives of IPSec are met through the use of two security mechanisms, the AH (Authentication header) and the ESP (Encapsulating Security Payload).
Authentication Header (AH) is conceived to ensure integrity and authentication of IP datagr datagrams, ams, without data encrypt encryption ion i.e. witho without ut confiden confidentialit tiality y. AH adds an additional header to the traditional IP datagram; this header makes it possible for the receiver receiver to check check the authen authenticit ticity y of the data included in the datagram datagram.. The header can be shown as per figure 4.1
Figure 4.1: The AH header
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
58
Encapsulating Security Payload (ESP) is designed for ensuring confidentiality, but can also provide data authenticity. It generates from a traditional IP datagram, a new datagram having additional ESP header, in which the data and eventually the original header are encrypted. The ESP header is shown in figure 4.2.
Figure 4.2: The ESP header
These protocols can be made to operate in either of the following modes, [25]:
Transport Mode : In transport transport mode, AH and ESP protec protectt the transpor transportt header header.. In this mode, AH and ESP intercept the packets flowing from the transport layer into the network layer and provide the configured security.
Tunnel Mode : IPSec in tunnel mode is normally used when the ultimate destination of the packet packet is differ different ent from the securi security ty termi termination nation point point.. Tunnel mode, by adding an additional IP header, protects the complete IP datagram i.e. data with TCP header and the IP header.
Chapter Chapt er 4.
4.2.7 4.2 .7
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
59
Various arious Concep Concepts ts
Security Association (SA) is a one way connection that affords security services to the traffic carried by it. A SA is unidirectional, therefore a typical bi-directional communication requires two SAs. The security services are provided either by the use of either AH or ESP (not both both). ). If both of them are appli applied ed to the tra traffic ffic in que questi stion, on, then tw twoo (or more) SAs are expected expected to prote protect ct the traffic. Suc Such h a situa situation tion woul would d be term termed ed as security bundle . Each security association is uniquely identified by the following triple: 1. Pack Packet’s et’s Destination Address 2. Secur Security ity Protoco Protocoll Identifi Identifier er (AH or ESP) and 3. Secur Security ity Pa Paramet rameter er Index (SPI) (SPI);; A SPI is a 32 bit block transmi transmitted tted in clear in the header of each exchanged packet; the receiver chooses it.
Security Association Database (SADB); IPSec stores active security associations in a datab database ase called securit security y association database. database. It contain containss all the parame parameters ters relate related d to each SA and is con consul sulted ted to kno know w how how to treat eac each h rec receiv eived ed or sen sentt pac packe ket. t. The SADB is maintained with SAs either manually or via an automatic key management system such as IKE (Internet Key Exchange).
Security Policy Database (SPD); IPSec policy is maintained in the security policy database. Each entry of the SPD defines the traffic to be protected, how to protect it and with whom the protection protection is share shared. d. For each pack packet et enter entering ing or leav leaving ing the IP stack, the SPD must be consulted for the possible applications of security. Based on the descriptions of IPSec protocols, their respective modes and security association, associat ion, a typ typical ical IPSec scen scenario ario could have the follo following wing SA com combinat binations: ions: The case of ensuring end-to-end security between the two hosts across the Internet is depicted in Figure 4.3. The case of Virtual Private Networks (IP VPNs) either between two intermediate nodes like routers or between one host and one intermediate node, is shown in Figure
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
Figure 4.3: End-to-end security between two hosts.
Figure 4.4: IP VPN
60
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
61
4.4.
Figure 4.5: The complete end-to-end scenario involving IPSec implemented intermediate nodes Combin Com bining ing the abo above ve tw twoo cas cases es as end end-to -to-en -end d sec securi urity ty bet betwe ween en tw twoo hos hosts ts acr across, oss, say,, the Interne say Internett inv involving olving the edge routers of the respectiv respectivee net networ works ks hav having ing VPNs incorporated. Figure 4.5 explains the situation.
4.3
Pac acke kett Sorti Sorting/R ng/Resorti esorting ng Tec echnique hnique
This technique technique employ employss pac packet ket orderi ordering ng to con convey vey cov covert ert informat information. ion. As men mentione tioned d earlier, this does not require changes either in the header or in the process of the system. The potential of holding information by sorting n objects would be log2 (n)! bits. Our suggested packet sorting technique, as mentioned earlier, utilizes the sequence number field of AH and ESP headers (IP Sec Protocols). Before discussing the technique, let us consider three packets generated from an IP Sec implemented implemented node hav having ing pac packet ket-sort -sorting ing algori algorithm thm incorporate incorporated. d. Figur Figuree 4.6 sho shows ws these packets, only indicating their sequence numbers (original and sorted both): Here there are two types of ordering:
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
62
Figuree 4.6: Pac Figur Packe kets ts generated from IP Sec impleme implemente nted d node having sorted sequenc sequencee numbers 1. Origi Original nal Orderin Ordering; g; the sequenc sequencee numbers assigne assigned d to the pack packets ets by the standa standard rd IPSec process.
2. Sorted Ordering; the sequence num numbers bers assigned to the packets by any “structure” “structure” which would sort the original ordering by any set “criteria”. The covert information intended to be communicated is the difference between these two orderings. Referring to Figure 4.6, for three packets, there can be six possible permutations (i.e. 123, 132, 231, 213, 321, 312). Generally speaking, the packet-sorting algorithm generates specific sorted sequence of packets from six possible permutations based on some structure (as defined in the algorith algorithm, m, b belo elow). w). Figur Figuree 4.6 show showss the gener generated ated pack packets, ets, from left to right, having sorted sequence as 132 against the original 123. These packets traverse the network network and reac reach h the destinat destination ion b bearin earingg the same num numbers. bers. The pack packet et resortin resortingg process at the destination node, recovers the original sequence from the received sorted sequence seque nce based on some “stru “structur cture”. e”. The differen difference ce b bet etwee ween n the original sequenc sequencee and the sorted sequence carries the covert information for the destination. Ideally speaking, for packet sequence comprising three packets, there would be six possible covert messages bearing covert information of 3 bits, as expressed in Table 4.1. So far we have discussed the basic concept of packet sorting and how this process
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
63
would transmit covert information. We have also identified the reference, providing the original sequence of packets which would be sorted according to a “structure” detailed in the next section.
4.4 4. 4
So Sort rtin ing g / Re Reso sort rtin ing gA Alg lgor orit ithm hm
A block diagram of sorting and resorting resorting is shown in Figure 4.7. It shows an IPSec implemented host, Alice who intends to have covert communication with IPSec implemented host, Bob through a packet sorting/ resorting process.
Figure 4.7: Block diagram of sorting and resorting process The sorting procedure is based on chaotic mixing concept, detailed in chapter 3, emplo emp loyin yingg thr three ee ke keys ys at Ali Alice’ ce’ss end end.. The proces processs tak takes es a pac packe kett seq sequen uence ce,, O, as its input.The three keys define the way that packet sequence is to be sorted. The three keys are K , k and the sequence number. The sorted packet sequence, S , the output of the chaotic mixing based sorting process then traverses the network cloud and reaches Bob’s side.
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
64
The received sorted sequence, R is either identical to the sent sorted sequence, S or gets reordered. The former represents the ideal network network behavior, what-is-sent-is-whatis-received (WISIWIR) and the latter represents the non-ideal network behavior. Sorting (as well as resorting) is performed using the fixed size of data blocks i.e. the number of packets generated must be a multiple of the main key, K . If th this is is not th thee cas casee the then n padding packets must be used. Any data recovery between Alice and Bob will have the sorted sequence numbers. At Bob’s end, the received sequence, R passe passess through the resorting proces process. s. Othe Otherr inputs to the process are the keys, K a and nd k known to Bob. Thus Alice has the knowledge of all the keys and Bob only knows the two keys. The resorting process resorts the received sequence, R back to the original sequence, O with the help of the two keys known to Bob. The resort resorting ing deciphe deciphers rs the third key i.e. sequence number and this would be the covert information,C k transmitted to Bob. Based on this initial desc descripti ription, on, the sorting/re sorting/resorti sorting ng algor algorithm ithm would compr comprise ise the following: • At Alice’s End
1. Alice selec selects ts the thre threee keys in order to generate a sorte sorted d seque sequence nce of pack packets ets from her end. (a) The first k key ey is a main k key ey K , from the set of positive int integers egers.. This main key determines the number of elements in the sequence to be sorted. For our case, these elements are the number of packets in a packet sequence. It is to be noted that the main key, K would either be the total number of packets in a sequence or the total number of packets would be the multiple of the main key. For instance, if K K is 8, then either total number of packets in a packet sequence to be sorted, would be 8 or that total number would be 16, 24, 32, 40 or so on.
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
65
(b) The next key is k, the sub-key, which is first the element of row 2 and part of the second element of row 2 of 2 × 2 Toral Automorphism matrix,
A. (c) Third key is the sequence number. So for a spec specifi ificc main k key ey K and a sub-key k , there will be a specific number of unique sorted sequences and it is required to mention which unique sequence is to be considered. This creates a sorted but controlled generation of sequence numbers till the value of main key. 2. Alice therefore assigns ne new-sorted w-sorted sequence n numbers umbers to the data pac packets kets (based on the abo above ve thre threee par parame ameter terss i.e i.e.. the main key K , the sub-key k and the
sequence number) instead of following the order of stored data. • The Network Behavior:
– The ideal behavior of the network makes no change in the sorted sequence of the packets (WISIWIR).
– The non ideal netw network ork behavior resul results ts in an out or order deliver delivery y of packe packets. ts. Packets received in a sequences that is different from the one in which these were sent. This behavior is also analyzed later in this chapter. • At Bob’s End
1. The rece receive iverr is requ required ired to know the first tw twoo keys, i.e. the main key key,,K and the sub-key k . Based on this knowle knowledge, dge, Bob generate generatess all the possible v valid alid sequences. 2. Bob then maps the received sequence on any one of these valid sequences. Thiss map Thi mappin pingg res result ultss in the sort sorted ed seq sequen uence ce that wa wass act actual ually ly sent i.e. the third key. This deciphering of the third key constitute the covert information
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
66
being trans transmitte mitted d throu through gh pac packe kett sorti sorting ng process process.The .The third key would be the covert information, C k as per the basic framework as explained in chapter 1.
The receiver could have have key information information through means like manual delivery or delivery livery through one of the scen scenarios arios suggested in pac packe kett heade headerr manipu manipulation lation approac approach. h. From cov covert ert comm communica unication tion perspect perspective ive,, the main key K dictates the amount of information to be communicated in bits i.e. log2 K ! bits, ideally. For main key as 8, there would be 8! possible order permutations and ideally each permutation represents a covert message, intended to be transmitted, as explained in figure 4.6. The sub-key, k and the
sequence number determi determine ne the specific permut permutation ation i.e. the specific sequ sequence ence.. The network communication perspective requires the original recovery of sequence numbers at the inte intende nded d des destin tinati ation. on. If we assum assumee the perfe perfect ct rec recov overy ery of the sent sequ sequenc encee (WISIWIR), the resorting process would just be the opposite of the sorting procedure.
4.5 4. 5 4.5.1 4.5 .1
Al Algo gori rith thm m De Deta tail ilss Sor Sorted ted Sequen Sequence ce Gener Generati ation on
The three keys are utilized to generate a specific sorted sequence based on the structure as developed from chaotic mixing concept. The knowledge of the main key, K determine total packets in a sorted sequence that need to be best estimated at the receiving end. The knowle knowledge dge of the tw twoo ke keys ys i.e. the main ke key y K and the sub-key k facilitates the genera gen eratio tion n of all the possi possible ble sorte sorted d seq sequen uences ces.. The kno knowle wledge dge of all the thr three ee keys specifies the specific sorted sequence out of all the possible sorted sequences. The algorithm requires that Bob only knows the first two keys and therefore have some mechanism to estimate the third key, sequence sequence num number ber, which would be the covert message, C k . At the source side, Alice has all the three keys and therefore generates a specific
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
67
sorted sequence of K packets. packets. So we have, the original sequence comprising K pack packets ets to be sorte sorted. d. It could hav havee more than K packets packets in a sequence as well. The original sequence is represented by O :
O = (X 1 X 2 X 3 X 4 ........X K K )
(4.1)
where K is the main key and X i , for i = 1, 2, 3, 4, .... ...... ..,, K , represents the ith packet of the packet sequence. Referring to chapter 3, we know that after specific number of iterations, N , all the points in integer lattice come back to their initial locations (i.e. periodicity exists in such dynamical systems). The value of N is the function of the main key, K and and the sub-key k . Since eac each h iteration produce producess a specific sequ sequence ence,, we can establi establish sh that there are N
sequences for a specific main key and sub-key pair. The total number of unique sequences are therefore represented as:
P = S (1), S (2) (2), S (3) (3), ...... ........S ..S (N )
(4.2)
P is therefore the set of valid sorted sequences generated from the chaotic sequence structure . The chaotic mixing structure does not generate all the permutations and hence N = K !. !. To transmit a cov covert ert symbol symbol,, we selec selectt the appro appropriat priatee sequence from the set P.
Thus to transmit the covert symbol of the N possible sorted sequences, the sent sequence is one of the sorted sequences from set P represented by S (i) and shown as:
S(i) = (X 1 X 2 X 3 X 4 ........X K )
(4.3)
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
68
where S (i) ∈ P and i = 1, 2, . . . , N .
Here X j , for j = 1, 2, 3, 4, . . . , K , represents the j th packet of the pack packet et sequence.Also
S(i) represents the ith valid sequence out of the N sequences; so that i = 1, 2, 3, . . . , N . i th sequen This ith sequence ce is the cove covert rt symbol communic communicated ated by Alice to Bob i.e. the third key key,,
sequence number. It has been previously mentioned in the description of the main key, K that main key would either be a total number of packets in a packet sequence to be sent or the total number of packets would be a multiple of the main key K . So pac pack kets ets coul could d be greater than the main key, K . For packet sequences having more than K packets in their sequence, the sorting process follows :
S(X(M
)K+x )
−1
= (M − 1)K + + O(x) ; x ≤ K
(4.4)
Here M represents the multiple of K , therefore if the packet lies within the first multiple of K , then M would be 1 and likewise 2 for second multiple and so on. Ox represents the original sequence packet either equal to or less than the main key K . X K K +x is the packet in a sequence which is greater than the main key, K .
That is how the sorted sequences are generated having sorted sequence numbers in either AH or ESP header’s sequence number field.
4.5. 4.5.2 2
Reso Resort rtin ing g Proce Process ss
Let us assume that, what is sent is what is received (WISIWIR) i.e. the channel is ideal. We can define the received sequence as R , shown as:
” ) R = (X 1” X 2” X 3” X 4” ........X K
(4.5)
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
69
where K is is the main key. As per our WISIWIR assumption, the received sequence is perfectly estimated to be the sorted sent sequence (i.e. R = S (i)), hence the cov covert ert chann channel el is ideal ideal.. The receiv receiver er then generates a Mapping Table as shown below: For the packet sequences having packets more than K , the resorting process would be as follows:
R(X (”M
−
1)K +x )
= ( M − 1)K + + O(X (”M
1)K +x
−
− (M − − 1)K ); ); x ≤ K
(4.6)
That is how the received packet is resorted to its original sequence, provided that its sequence number is more than the main key, K .
4. 4.5. 5.3 3
Exam Exampl ple e
Based on the gener general al discussio discussion n above, let us consid consider er an exam example. ple. Assum Assumee the main key K is is 8 and there are 16 frames (packets) to be generated. Let k be 1 and the sequence
number also be 1. The sorted sequence numbers of 16 packets will be as per Table 4.3. Consider the received packet with a sorted sequence number 15 i.e. R(X i” ) = R (15). The original sequence number can be recovered as:
R(15) = K + + O (15 − K ) = 8 + O(15 − 8) = 8 + O(7) = 8 + 3 = O (11)
(4.7)
In this way, the received packet recovers the original sequence number in the resorting process, through the knowledge of the two parameters, the main key K and k . Teruji et Teruji et al. [26] presented similar kind of sorting and resorting process. The packet scrambling process was meant to avoid the illegal use of multicast data and unauthorized participation in multicast groups and was not intended for having covert communications.
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
70
Sr. No. Pe Perm rmuta utatio tions ns Po Possi ssible ble Mes Messag sages es 1
123
001
2
132
010
3
231
011
4
213
100
5
321
101
6
312
110
Tabl ablee 4.1 4.1:: The six possi possible ble permu permutat tation ionss of 3 pac packe kett seq sequen uences ces and co cove vert rt mes messag sages es bearing 3-bit infor informatio mation n eac each h
O X 1 X 2 X 3 X 4 .. .... XK R X 1” X 2” X 3” X 4” .. . ..
” XK
Table 4.2: Based on WISIWIR, received sequence is mapped to the original sequence
O; X i 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1
S(1);
X i
1144 11 16 13 10 15 12 9 6 3 8 5 2 7 4 1
Table 4.3: The sorted sequence against the original Sequence; K is is 8; k is 1 and S(i) is
S(1)
R; X i” 14 11 16 13 10 15 12 9 6 3 8 5 2 7 4 1 O; X i 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 Table 4.4: The original sequence as recovered through resorting process
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
71
Their algorithm did not provide any key generation procedure. The system is only meant for just defining a key to the intended user of a multicast group like a customer of pay per view or cable TV. Moreover, it suggested the use of one key. Our sorting / resorting procedure has different application since we intend to transfer a covert message within a sorting process. We have suggested three parameters for sorting process and resorting needs the information of two parameters in order to regain the original sequence of data packe pac kets ts at the receiv receiving ing end and finally gets the cov covert ert data. Our sorting and resortin resortingg process therefore offers more security and provides a structure to allow the other side of the network to decide which sequence was sent based on two keys and thus deciphers the covert information. In the next chapter, a mechanism is suggested for the best estimation of of the received sequence including the fact that the network may itself impose a shuffling of the packets thus creating a non ideal covert communication channel.
4.6 4. 6
Be Best st Seq Seque uenc nce e Esti Estima mati tion on - Pac ack ket So Sort rtin ing g Approach
In this section we relax our WISIWIR assumption; there is no guarantee that packets take specific routes. In a network, packet transmission is done by packet switches, which deal with each packet individually to forward it along the most appropriate and available path. There exist many switches and routers and interconnecting links over which a given packe pac kett migh mightt tra trave vel, l, ther theree are many possible routes through the net networ work. k. Pac Packe kets ts thus experience varying levels of latency (or delays) as they progress through the network. The major contributing factors of packet latency are:
1. Route length; as longer route increases the time it takes the packet to traverse the network.
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
72
2. Hop count; as the greater number of switches (nodes) involved the more times the packet needs to be analyzed, acted upon and sent to the next node. 3. Congestion; as the more congested network is the more time packets may wait in various queues. Even though Internet routers (switches) generally employ FIFO queuing, any time a route change, if the new route offers a lower delay than the old one, then reordering can occur.
4.6.1 4.6 .1
In Inter ternet net Pack acket D Dyna ynamic micss
Given the non-ideal nature of overt communication channel (i.e the possibility of the receipt of out of order delivery of packets in a sequence), there is a need to investigate the extent to which a network introduces position errors in a given sequence of packets at the net networ work k layer layer.. It is difficu difficult lt to measu measure re a plausi plausibly bly represe representa ntativ tivee cross sect section ion of network network behavio behaviorr in these ter terms ms since there is no global infor informatio mation n of route routes. s. The Internet protocol just offers a best effort delivery mechanism and packets take any of the routes based on employed routing algorithms. Internet packet dynamics are studied and analyzed in [27] and [28]. Paxson’s work [28] considers a measurement framework in which a number of sites ran special measurements daemons to facilitate the measurement of various network parameters in addition to the existe exi stence nce of out of ord order er pac packe kett del deliv ivery ery.. The next sec sectio tion n det detail ailss Pa Paxso xson’s n’s find finding ingss which facilitate the design of an estimation to map the received sequence with any of the possible sorted sequences, given a non-WISIWIR environment.
4.6.2 4.6 .2
Paxs axson on’s ’s Fin Findin dings gs
Paxson [28] in his analysis considered 35 sites and performed two experimental runs. The sites were educational institutes, research labs, network service providers and commercial
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
73
companies, compa nies, in 9 coun countrie tries. s. The first run was conducte conducted d during Decembe Decemberr 1994 and the second secon d durin duringg Nov Novembe ember-Dec r-December ember 1995. The measu measureme rements nts were made by instr instructi ucting ng daemons running at two of the sites to send or receive a 100Kbyte TCP bulk transfer and results were traced using tcpdump tcpdump.. Acco According rding to Pax Paxson’s son’s work, pack packet et reorderi reordering ng is usually caused by packet latency (delay), which emphasizes late arrival late arrival rather than premature arrival. arrival. For example, if in a flight of ten packets, the first eight packets arrive in sequence, followed by the tenth packet and finally the ninth packet; then the ninth packet would be considered as delayed ; the tenth packet would not be interpreted as premature . The analysis establ establishes ishes the following following charact characterist eristics ics of out of order rece receipt ipt of packets: • Out of order delivery is fairly prevalent in the Internet. • In the first run, 36% of the connections included at least one packet delivered out
of order, while in the second run only 12% did. • Overall, 2% of all the first run data packets and 0.6% of the ACKs arrived out of
order, whereas for the second run the percentages are 0.3% and 0.1% respectively. Data packets are no doubt more often reordered than ACKs because they are frequently sent closer together (due to ACK-every-other policy), so their ordering requires less of a difference in transit times. • Re-ordering is highly asymmetric as only 1.5% of the data packets sent to one of
the sites in the first run arrived out of order. • Internet paths are sometimes subject to a high incidence of re ordering, but the
effect is strongly site dependent dep endent and correlated with route fluttering (route changes). • Re-ordering only rarely has significant impact on TCP performance since generally
the scale scale of reord reorderi ering ng is jus justt a fe few w pac packe kets. ts. ReRe-ord orderi ering ng some tim times es occurs in groups as large as dozens of packets, it usually involves only one or two packets.
Chapter Chapt er 4.
4.6. 4.6.3 3
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
74
Mogu Mogul’ l’ss Find Findin ings gs
Similarly, Mogul [27] establishes the same observation of small scale re-ordering showing that very few connections suffer from out of order delivery of packets; only one packet is received out of order in almost 90 connections; only 2 packets received out of order in only 10 connections and 2757 connections have no out of order segments.
4.6.4
Small Small Scale Re Reorde ordering ring - A Fav Favorab orable le Net Netwo work rk Beha Behavior vior
Based on the above findings, the non-ideal channel can be characterized as introducing “a few” position errors (defined later) in the sent sequenc sequencee con containi taining ng the cove covert rt data. The assumption of small scale re-ordering (of the order of one, two or three packets received out of order) therefore seems valid for such network behavior.
4.7 4. 7
Th The e Lo Long nges estt Sub Subse sequ quenc ence e
Our resorting algorithm maps the received sequence to one of the possible valid sent sequences (derived from the information of two out of three keys). Chaoti Cha oticc mix mixing ing sc schem hemee allow allowss a sma small ll sub subset set of possi possible ble perm permuta utatio tions ns for co cove vert rt communica comm unication. tion. The non-idea non-idealit lity y of the net networ work k will shuffle this a bit (up to 3 pack packets ets out of order). We map this result back to estimate what the covert data is. Because we are not using all permutations there is room for the packets to be shuffled yet recover the sorted sequence. Since small scale reordering is assumed, there exists a “Longest Subsequence” as described in the section, in a received sequence, which can be matched to one of the possible valid sent sequences.
Chapter Chapt er 4.
4.7.1 4.7 .1
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
75
Bas Basis is -The Minim Minimal al Longest Longest Ascen Ascendin ding g Subs Subsequ equen ence ce
The concept of minimal longest subsequence is derived from [29]. The algorithm with the name, “Minimal Longest Ascending Subsequence MLAS ” is implemented in QoS measurement device called cnode called cnode developed developed and marketed by CQOS by CQOS Inc., Inc., Irvine CA. CQOS provides IP measurement solutions in terms of QoS metrics measurements or network performance data at network layer. One of the QoS matrices of the IP network which cnwhich cnode measures measures is the number of packets received in order (or out of order). The algorithm, from the received sequence of packets, searches for the minimal longest ascending sub sequence. The minimal longest ascending sub sequence is the number of packets received in order. It is subtracted from the total number of packets that were sent to determine the number of out of order delivered packets.
4.8 4. 8
Es Esti tima mati tion on of of th the e Re Rece ceiv ived ed Se Sequ quen ence ce
4.8. 4.8.1 1
Assu Assump mpti tion onss
1. Both the transmitter and the receiver know the main key K and the sub-key k which enables the receiver to generate all the possible valid sorted sequences. 2. The sender trans transmits mits the covert covert data by using it as the third ke key y using the ch chaotic aotic mixing structure (the third key is the specific valid sorted sequence that is transmitted). 3. The recei receiver ver esti estimates mates the third key (i.e. the cov covert ert data) assumin assumingg (based on the brief findings of Paxson and Mogul) that:
a. Small scale reordering (due to favorable netw network ork conditions) is encountered when the packet sequence traverse a network
b. Each packet is of the size of 100 Kbytes each.
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
76
c. The duration of each connection is not more that 10 minutes.
4.8. 4.8.2 2
The The Res Resor orti ting ng Pr Proce ocess ss
The sequence is estimated by working out the longest sub-sequence of the received sequence que nce and the then n map the sam samee to any any of the valid alid sub sequ sequenc ences. es. The clos closest est matc match h therefore is the sorted sequence that was generated and in this way the receiver estimates the third key, the covert message, through packet sorting/resorting algorithm.
Example • Main Key = K = 5 (known to Alice and Bob)
• Sub key = k = 1(known to Alice and Bob) • Valid Sorted Sequences = 4 i.e. 13524 ; 12345 ; 15432 ; 14253 • Transmitted Sorted Sequence = 1 i.e. 13524 (known only to Alice) • The Received Sequence = 35142 (three position errors; maximum possible) • Longest Sub Sequence (from the received sequence) = 352
4.8.3 4.8 .3
Proc Process ess and and Cate Categor gories ies of Rec Receiv eived ed Sequen Sequences ces
The resorting process is based on the longest sub-sequence estimation of the received sequence matched matched to one of the valid sequences. The receive receiverr can generate these sequences with the information of the first two keys (i.e. the main key and the sub key). The longest sub-sequence estimation of the received sequence with each one of the valid sequences involves the following steps: First Fir st ste step p find findss out the nu numbe mberr of posi positio tion n err errors ors.. Thi Thiss is ac achie hieve ved d by havi having ng the absolute absolu te differen difference ce of the receiv received ed and the vali valid d seque sequence. nce. The numbe numberr of zeros wou would ld telll loca tel locatio tions ns whe where re the pac packe kets ts oocc ccup upy y the same locati location on in both the seq sequen uence ces. s. By
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
77
subtracting the number of zeroes with that of the total number of packets in the sequence (the main key), key), number of position error errorss i.e. out of order pack packets ets can be obtai obtained. ned. If the number of position errors is more than what has been fixed as a threshold, depending on the behavior of the network, that specific received sequence would not be considered for further subsequence estimation. The same process is repeated with other valid sequences and the received sequence would only be considered against the valid sequences if number of position errors is either equal or less than what has been assumed keeping in view the channel behavior and the network conditions. The process terms such sequence that falls out of the threshold value as Impossible Sequence. For aall ll K packet sequences, we have defined earlier the received sequence as equation 4.5 and one of the sent sequences as equation 4.3. Let the indication function be defined as:
0 () )= 1
I (Rx” , S i
: if Rx” = S (i)x ;No Position Error; Defined as I 0
x
(4.8)
:
if R x” = S (i)x ;Position Error; Defined as I 1
Let the position error threshold value be represented as z ; for the condition
I 1 (R”x , S (i)x ) > z
(4.9)
the received sequence is termed as an Impossible Sequence with respect to specific S (i)x where i = 1, 2, 3, . . . , N . For the condition: N
I 1 (Rx”, S (i)x ) > z
i=1
the received sequence would be termed as Impossible Sequence with respect to all the valid sent sequences. Second, it is possible that of all the valid sequences, only one would have the acceptable number number of swa swaps ps with that of the receiv received ed sequenc sequence. e. In such a case case,, the recei received ved sequence is mapped to that valid sequence being the only Evident Sequence. Mathematically, if only one of the all the possible sent sequences fulfills the following condition,
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
78
then it is be termed as evident sequence:
I 1 (R”x , S (i)x ) < z
(4.10)
Third, for all those cases wherein the more than one valid sequence have acceptable number of position errors with that of the received sequence, longest sequence, longest sub sequences estimation process process would be employed. Fourth, the estimation of the longest sub-sequence involves the process of finding out the longest sub sequence, the received sequence would make with each one of the valid sequences. seque nces. This inv involv olves es the right shift absolu absolute te subtrac subtraction tion process. Consi Considerin deringg the first possible sent sequence, we take the absolute difference with that of the received sequen seq uence ce.. Fin Findin dingg out the locatio locations ns whe where re the two seq sequen uence cess have have no diff differe erence ncess e.g e.g.. if any packet occupies the same location in both the sequences, then the difference is zero. Mathematically, an indication function is defined, as Equation 4.8. In addition, the received and the sent sequence are expressed as:
” R = (X 1” X 2” X 3” X 4” ........X K )
S(i) = (X 1 X 2 X 3 X 4 ........X K ); S(i) ∈ P
(4.11)
(4.12)
For absolute subtraction of these sequences, indicative function expresses the result where 1 indicates when the corresponding packets of the sequences do not occupy the same position i.e. the position err error. or. The other possibi possibilit lity y express expresses es 0, the location locationss in the sequences sequences having pack packets ets having the same seque sequence nce number number.. Coun Countt the number of zeros i.e. all such conditions of zeros.
a. The valid sequence is then shifted towards right in order to find out the absolute difference differ ence and the num number ber of zero zeross thereaft thereafter. er. This right shift trunc truncates ates the last
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
79
packe pac kett of the val valid id seq sequen uence ce and the firs firstt pac packe kett of the rece receiv ived ed seq sequen uence. ce. The packets corresponding to zeros in the absolute subtraction result are those packets that would form the sub sequence. Right shift absolute subtraction eliminates the first packet from the received sequence and the last packet from sent sequence. The resultant expressions are:
” R = (X 2” X 3” X 4” ........X K )
(4.13)
S(i) = ( X 1 X 2 X 3 ........X K 1); S(i) ∈ P −
(4.14)
For the same indicative function, count the number of zeros. The resultant number of ze zero ross are are this this val alue ue plus plus the the prev previo ious us.. Th Thee righ rightt shif shiftt is th then en repea repeate ted d till till the first packet of the valid sequence got subtracted from the last packet of the receive rece ived d seque sequence. nce. For each one of the steps of right shift subtracti subtraction, on, the location of no-difference is identified and the corresponding packets are included in the sub sequence. Finally a sub sequence is formed and that has to be conformed to either of the sequences in order to be termed as ’valid longest sub sequence’, the received sequence seque nce could make with that specifi specificc valid sequen sequence. ce. The num number ber of elem element entss (packets) in the valid longest sub sequence would depend on the number of zeros resulting in all the steps of right shift absolute subtraction. Repeat this right shift subtraction process for K -2 -2 times. and count the nu number mber of zeros for ever every y step, add these these to the pre previo vious us total total.. The final coun countt of the nu numbe mberr of zeros wou would ld be the total number of zeros in all the K steps. steps. For the num number ber of ze zeros ros,, spot the corresponding corre sponding pack packets ets in the sent sequence in consid considerat eration. ion. A subse subsequenc quencee of the sent sequence is thus obtained.
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
∗
∗
∗
∗
L = (X 1 X 2 X 3 ........X m ); m < K
80
(4.15)
b. A check is performed in order to find out the validity validity of the longest sub sequence.Match this subsequence, L, to the received sequence; packets must exist in the same order. If it matches, then this subsequence,L , is termed as Longest subsequence (LSS) pertaining to this received sequence - specific sent sequence pair. The same process is repeated with other possible sent sequence- received sequence pairs. The number of such valid longest sub sequences would depend on the number of possible sent sequences; the main key would posses, which would in turn depend on the sub- key as well.
i. If the match does not exist with the received sequence, then total number of zeros is deleted by one and till that step corresponding packets in the sent sequence seque nce are spotted to form a subse subsequenc quence. e. This subseq subsequenc uencee would have less number of packets than the one previously obtained.
∗
∗
∗
∗
L = (X 1 X 2 X 3 ........X m); n < m
(4.16)
ii. In cas case, e, the resul resultin tingg lon longes gestt sub seq sequen uence, ce,L , still still pro prove vess inv invalid, alid, the then n the process would not go further on and this possibility would be termed as ’valid longest subsequence does not exist’ for that specific received sequence-valid sequence pair.
c. Consequently, the longest sub sequences are obtained pertaining to each one of the receive rece ived d seque sequence-pos nce-possible sible sent seque sequence nce pairs. The number of elemen elements ts of eac each h of the lon longes gestt seq sequen uences ces is cou count nted. ed. The one havi having ng the max maxim imum um num number ber of
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
81
elements would term as the ”longest sub sequence.” The possible sent that corresponds to that longest sub sequence would then be termed as the LSS (longest
subsequence) based Best Sequence of that specific received sequence. d. For the case where any two of the longest sub sequences have same number of elements, the process would term that case as an Error Sequence.
4.8.4 4.8 .4
Sim Simula ulatio tion n and and Testing esting
Setting The process is simulated for different values of the main key i.e. packet sequences having 4 pac packet kets, s, 5 pac packet kets, s, 6 pac packet kets, s, 7 pac packet ketss and 8 pac packe kets. ts. How Howeve ever, r, these cases are valid for all those packet sequences that will be the multiple of these main keys. It involves the consideration of all permutations of these sequences and pitching each one of the permutations, i.e. the received sequence, against all the possible valid sequences pertaining to that main key. key. This conside consideration ration accoun accounts ts for all the possibil possibilities ities of reord reordering ering whic which h truly reflects the unpredictable network behavior. So for 4-packet sequence, there are 24 permutatio perm utations. ns. Eac Each h one of the 24 p perm ermutati utations ons is trea treated ted as one of the possible receiv received ed sequences. Each one of these received sequences then undergoes right shift absolute subtracti tra ction on proc process ess with each one of the 2 valid alid seq sequen uences ces.. The best est estima imate te proces processs as detailed above then finds out the best estimate sequence for that received sequence. A received sequence would be categorized as any of the following:
Impossible Seque Sequence nce; nu 1. Impossible numbe mberr of posit position ion error errorss for each one of the rece receiv ived ed sequences falls out of the assumed threshold-position error value
2. Evident Evident Seque Sequence nce; only only one rec receiv eived ed seq sequen uence ce has the acc accept eptabl ablee nu numbe mberr of position errors as per assumption
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
82
3. Error Sequence; either all the calculated longest sub sequences are invalid subsequences or two or more than two longest sub sequences have the same number of elements 4. LSS based Best Estimate Sequence ; the longest subsequence as a result of the best estimate process based on right shift subtraction process.
General Discussion ; Favorable Network Behavior The process is simulated under the above setting and results are analyzed according to different position error-threshold scenarios as 3-position error or less, 4-position error or less, 5-position 5-position error or less and 6-position error or less. These diffe differen rentt p positi osition on error scenarios can be visualized as network behaviors as 3-position error being the favorable network behavior as found out by Paxson [28] and Mogul [27] in their respective findings and analysis. As the number of position error-threshold is increased, the network would treat the sequences worse until 6-position error scenario, which, for this analysis could be termed as the worst network behavior for the packet sequences in consideration. From covert communication perspective , the intent is to have the best estimate sequence (of the sent sequence) to be almost be almost perfect . Natur Naturally ally,, impossib impossible le sequence sequencess are not consider considered ed and err errors ors are not requi required red.. The domin dominanc ancee of the ignor ignored ed seq sequen uence cess would leave lesser number of sequences to be mapped into one of the three received sequence categories. The mapping of the received sequence to either as an evident sequence or as LSS based best estimate sequence is therefore highly desirable for parties involved in covert covert commun communicati ication. on. For each one of the position error scenar scenarios, ios, the analys analysis is focuses on the availability of these desirable categories in somewhat higher percentages and otherss to exist in low profile. Beside other Besidess this, it also point pointss to the cases where wherein in the ignor ignored ed sequences exist in large numbers but either the error sequences appear in low percentage or the evident sequences have higher percentages. In light of above discussion, the desirable categories of received sequences for covert
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
83
communication would be: 1. Evide Evident nt Seque Sequences nces 2. LSS based Best Estima Estimate te Seque Sequences nces 3. Any of the abov abovee sequence sequencess present only with Impossible Sequenc Sequences es
Position Error Threshold Scenarios Figures 4.8 - 4.11 4.1 1 show the different threshold position error scenarios for packet sequences sequences (i.e. the main key key)) ranging from four to eight. The respec respectiv tivee percent percentages ages of receiv received ed sequence categories are shown against the packet sequences (the main key). Figure 4.8 depic Figure depicts ts the 3-positi 3-position on error or less scenar scenario. io. For 8-pack 8-packet et sequenc sequence, e, for example, this threshold value would mean that almost all the received sequences would fall out of the limit and would theref therefore ore be consi considere dered d as impossib impossible le sequenc sequences. es. As we go from 4-packet sequence to 8-packet sequence, an increasing percentage trend of the impossible sequences is observed ranging from 17% to 99% 99 % respectively respectively.. Consequently the sequences received in errors rate would fall down as we move from 4-packet sequence to 8-packe 8-pac kett seque sequence, nce, since more and more seque sequences nces are impossib impossible le to exist exist.. The resulti resulting ng percentages are found to be from 8% to 0% for 4-packet sequence to 8-packet sequence respectively.This relation between the impossible and error sequences follows the same nature nat ure as posit position ion error error-th -thres reshol hold d valu aluee is inc increa reased sed i.e. fro from m 3-pos 3-positi ition on err error or to 6position error. However the intensities of the percentages for both the sequences become mild for 4 and 5-position error network behavior and then finally behave almost as the opposit oppo sitee for 6-posit 6-position ion err error or net netwo work rk sce scenar nario. io. Acc Accord ording ing to 4.1 4.11, 1, ign ignore ored d seq sequen uence cess make just 1% of the total possibilities of the received 7-packet sequences if 6 or less position errors errors are consider considered ed valid valid.. For this behav behavior ior the error seque sequences nces consti constitute tute 23% of the total received sequences. The more the received sequences are impossible to exist,, the less would be the chanc exist chances es of rece receiving iving error errors. s. For the case when majority of
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
84
the received sequences are ignored, in the range from 75% - 99%, the other category of the received received sequence sequence,, whic which h is only prese present, nt, is the eviden evidentt seque sequences. nces. This would be a desirable situation for covert communication, which requires every sorted sequence to be successfully decoded into rightful manner.
Why improved 6-Packet Sequence? 6 packet sequences, a case where the main key is six, have 8 valid sequences as generated from fro m chaot chaotic ic mix mixing ing con conce cept. pt. The pac packe kett seq sequen uences ces exh exhibi ibited ted a con consid sidera erably bly hig higher her percen perc entag tagee of error errorss for eac each h one of the swa swap p sce scenar narios ios.. By analyz analyzing ing the pat patter tern n of the valid sequences, it turned out that out of eight valid sequences, two pairs of three sequences have same terminal elements. This would cause the generation of the longest sequences seque nces havin havingg the same number of elem element ents. s. The best estim estimate ate process would term such cases i.e. longest subsequences having the same number of elements, as errors and therefore the percentage of error sequences was higher. It has been found that allowing only those valid sequences, which have unique terminal elements, would improve the receipt rece ipt of erro errorr sequ sequence ence percen percentage. tage. The analysis is ther therefor eforee comprised of b both oth types of 6-packet sequences, the one having eight valid sequences and the ’improved’ 6-packet sequences having four valid sequences which are also unique in terms of their last element (packet) of the sequence. The eight valid sequences of 6 packet sequences are:
a. 153426, b. 145263, c. 135246, d. 123456, e. 165432,
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
85
f. 135462, g. 1436 143625 25 and and h. 153642 For the improved version, the six valid sequences are:
a. 153426, b. 145263, c. 1654 165432 32 and and d. 143625
3-Position Error or less Scenario Based on the desirable characteristics for covert communication, figure 4.8 indicates: 1. 4-pack 4-packet, et, 5-packet and 6-pack 6-packet et (improve (improved) d) sequences exhibit considerably less percentage cen tage of sequence sequencess rece receive ived d in error errors. s. 4-pac 4-packe kett has 8% but it constitu constitutes tes only 2 packets out of 24 packets. 2. 6-pac 6-packet ket sequ sequence ence has a highe higherr error percent percentage, age, of the order of 10%. 3. 7-pac 7-packet ket and 8-pack 8-packet et sequenc sequences es can also be desir desirable able since they exhibit no error sequences. Although ignored sequences have dominant percentage, the only possible sequences besides these are the evident sequences. If the network exhibits a general behavior of making three position errors with in a sequence, then 4-packet, 5-packet & 6-packet (improved) provide scenarios of data hiding through packet sorting with less percentage of sequences received in errors.
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
86
Figure 4.8: 3 position error or less scenario
4-Position Error or less Scenario In the same context, figure 4.9 shows the following: 1. 4,5 and 6 pac packet ket sequ sequence encess hav havee a large percen percentage tage of sequence sequencess rece receive ived d in error errorss and hence not desirable for having covert communication. 2. 6-pac 6-packet ket (impr (improv oved) ed) also shows the erro errorr sequence percen percentage tage of the order of 10. 3. 7-pac 7-packet ket seque sequences nces have dominan dominantt percen percentage tage of ignor ignored ed sequ sequence ences. s. The eviden evidentt sequences as well as sequences based on LSS together constitute a portion of 26% (1346 sequences) against the 2% error sequences (82 sequences). Since the channel response in terms of out of order receipt of packets can be generalized as making 4-position error or less, any of the packet sequences can be selected for hav having ing cov covert ert comm communica unication tion throu through gh pack packet et sorti sorting/re ng/resorti sorting ng process process.. How Howeve everr 6-
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
87
Figure 4.9: 4 position error or less scenario packet (improved) offers least percentage of sequences received in errors and therefore could be made the appropriate choice.
5-Position Error or less Scenario The 5-position error or less scenario, figure 4.10, depicts the following: 1. 5-pack 5-packet et and 6-pack 6-packet et sequences exhi exhibit bit a large portion of errors sequences i.e. 42% and 49% respectively. 2. The perce percent ntage age of err error or for 7-pac 7-packe kett seq sequen uence ce is the leas leastt of all with ignore ignored d sequences amount to only 26%. Evident and best estimate sequences together comprise pri se of 66% of all the possib possible le seq sequen uences ces i.e i.e.. 504 5040. 0. The re resor sortin tingg proces processs can therefore be applied with only 376 sequences out of 5040 to be received in error.
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
88
Figure 4.10: 5 position error or less scenario
6-Position Error or less Scenario The worst network behavior making 6-position error or less, figure 4.11 in the sent sequences has: 1. Consid Considerabl erably y highe higherr percen percentage tage of seque sequences, nces, catego categorize rized d as erro errors. rs. 2. The 7-pac 7-packe kett sequenc sequencee would hav havee only 1% of ignored sequ sequence ence i.e. 48 out of 5040 and desirable conditions (LSS based best estimate sequences & Evident sequences) constitute 76% (3849 out of 5040). 7-packet sequences for network making 6 swaps would therefore be an appropriate choice for Alice and Bob to communicate cov covertly ertly.. By having known the channel behavior of delivering out of order sequences to the destination, the suggested resorting scheme of best estimation as described above indicates low error packet sequences (main key values showing low percentage of sequences, received in errors) for each one of the position error scenarios considered in our analy-
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
89
Figure 4.11: 6 position error or less scenario sis. How Howev ever er Alice and Bob could choose any of the pack packet et sequenc sequences. es. The data-hid data-hiding ing scheme requires the first two keys to be known to both of them. This provides a structure and therefore enables them to generate valid sequences and make use of the resorting scheme sch eme (best estimate proces process) s) to resor resortt the seque sequence nce at the destina destination. tion. This makes Bob to know the sent sequences, which would be the covert message. This kind of network condition can be visualized as the famous prisoner’s problem involving Willy, the warden who is introducing position errors in the sequence of packets by the same number, every time Alice and Bob communicate with each other [30].
4.8.5 4.8 .5
Wil Willy ly as “so “some mewh what” at” A Acti ctiv ve Ward Warden en!!
Assuming Willy as making either 3 or 4 position errors or less randomly thereby playing a ’some ’somewhat’ what’ activ activee war warden. den. The analysis compris comprises es of consideri considering ng differ different ent pack packet et sequences quen ces and makin makingg them run for 3-swap and 4-sw 4-swap ap scena scenarios. rios. Those sequen sequences, ces, which
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
90
have the same valid sequences being mapped into, would be the desired result. The simulations are performed for 4-packet and 5-packet sequences, each one of them is run for 3-position error or less and 4-position error or less scenarios. Following is the result: Main Mai n Key
Mix Mixed ed Po Posit sition ion Err Errors ors
Com Common mon Seq Sequen uence cess % of Com Common mon Seq Sequen uences ces
4-packet
2 and 3 position errors
10
42%
5-packet
3 and 4 position errors
42
35%
Table 4.5: Random behavior of war warden; den; percent percentage age of commo common n seque sequences nces It is therefore found out that even if Willy is making random swaps for different packet sequences, the percentage of those received sequences which would be mapped to the same val valid id sequence is quite significan significantt i.e. 42% for 4-pac 4-packe kett sequence sequencess (2 and 3 packet swaps) and 35% for 5-packet sequences (3 and 4 packet swaps).
4.9 4. 9
An Anal alys ysis is wit with h respe respect ct to Ne Nettwor ork k Beha Behavi vior or
The suggested sorting/resorting covert communication algorithm is evaluated under the following figures of merit:
4.9.1
Intero Interoperabi perabilit lity y with Firewalls Firewalls
Here operational compatibility with standards-compliant existing network nodes like firewalls and routers is judged. Since the sorting scheme is proposed in the IP Sec infrastructure, all these intermediate nodes are also expected to be IPSec implemented / compliant.
Operation of an Outgoing Packet at the IPSec Implemented Firewall The user packet is examined for a match to an outbound security policy (SPD). Each entry of the SPD defines the traffic to be protected, how to protect it and with whom
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
91
the protection is shared. For each packet entering or leaving the IP stack, the SPD must be con consul sulte ted d for the poss possibl iblee app applic licati ation on of sec securi urity ty.. The matc match h can be mad madee on on IP and port [31]. Ther Theree is ther therefor eforee no inv involv olvemen ementt addresses, the IP Protocol ID and port numbers [31]. of sequence numbers in the match of an outbound packet with an outbound security policy in the firewa firewall. ll. A pac packe kett hav having ing sorted sequence num numbers bers would therefo therefore re make no difference in the processing of an IPSec implemented Firewall. More precisely, S k , the stego network packet would be treated as the original network packet,P k .
Figure 4.12: Detectability of covert channel through firewall system
Operation of an Incoming Packet at the IPSec Implemented Firewall The secured packet arrives at the firewall where it is de- tunnelled (decapsulated). The IP packet is then compared for a match to an inbound SA policy. If a match occurs, based on IP addresses, the IP protocol ID and port numbers, it is subjected to the operation dictated by the inbound security policy, otherwise it is dropped. Likewise, packet bearing sorted sequence numbers makes no difference since the outbound as well as the inbound securit secu rity yp policy olicy do not tak takee in to accoun accountt the seque sequence nce num numbers. bers. The basic framew framework ork shown in chapter 1 can be expressed as non-detectable covert channel shown in figure 4.12. The stego network packet S k is passed undetected through an IP Sec implemented firewall system.
Chapter Chapt er 4.
4.9.2
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
92
Compatib Compatibilit ility y wit with h the Anti-Re Anti-Repla play yA Attac ttack k
The generation of sorted sequence numbers through the use of keys cannot disturb the main function of sequence numbers (i.e. to avoid the replay attack). The packets would get resorted as soon as they reach the receiver and would therefore provide no harm to the anti replay mechanism which combats the receipt of a duplicated packet at some other point of time. For the worst case consideration, where a packet from an unknown sender passes through the Security Association Database Database (SADB, maintaining the list of active SAs for outbound and inbound processing) matching process as well as resorting process i.e. resor resorted ted in to a sequence nu number mber fallin fallingg within the window; the authen authenticat tication ion / decryption processes detect the same at the later stage and thus the same will ultimately be discarded.
4.9. 4.9.3 3
Comp Comple lexi xitty
The sorting procedure is proposed at the SA processing in the source (generation of sequence numbers at the IP Sec level). The resorting procedure is proposed immediately after the SADB match is made (means the security association exists) and before the antii repl ant replay ay chec check. k. The algorith algorithm m ther therefor eforee does not consu consume me consider considerable able processin processingg resources in terms of computing time and memory space. However padding packets need to be gen genera erated ted whi which ch wou would ld matte matterr for shor shortt dat dataa tra transm nsmiss ission ion.. Let the data to be transmitted is of 200 K bytes and 1 Kbyte packet be the size of each packet; for the value of K=75; instead of sendi sending ng 200 pac packet kets, s, we wou would ld be requ required ired to send 225 packe packets. ts. The overhead of sending dummy packets would seem relatively small when 1 Mbyte file is required to be sent. For the same value of K=75, 50 more packets would be sent.
Chapter Chapt er 4.
4.9.4 4.9 .4
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
93
Value alue Additi Addition on to IP Sec Envir Environ onmen mentt
A packet packet not mapped with within in the size of the window will be dropped dropped.. This woul would d allow only authenticated hosts to communicate with each other. The packet-dro packet-drop p throu through gh this initial check i.e. resor resorting ting the origi original nal seque sequence nce would thus avoid the processing overhead of authentication by HMAC MD5 96 or HMAC SHA 96 and decryption by DES CBC or AES. The resorting is suggested once the SA is matched in the SADB of the receiver (the matching parameters are SPI (from AH or ESP header), the source and destination IP addresses and Protocol (from IP header)) and before the sequence number check is made through the window maintained by the receiver. Now there could be two possibilities: 1. The resort resorting ing process result resultss in the sequen sequence ce num number ber that is fallin fallingg in the windo window w and thus being accepted. Now this packet could be:
a. Genuine and therefore would pass the ICV (Integrity ( Integrity Check Value ) check thereafter.
b. Not ge genu nuin ine, e, bu butt ab able le to pass pass thro through ugh th thee SA SADB DB ma matc tchi hing ng an and d fall fall in th thee window having correct sequence number after resorting, then the packet would be detected by the ICV (Integrity Check Value) check and would not get authenticated. 2. Non-v Non-valid alid seque sequence nce num number ber is found out after resor resorting. ting. The pack packet et would then discarded in the very beginning. The implementation of this sorting/resorting algorithm at the network layer can also be justified by the fact that TCP has built in retransmission capabilities and it is better to drop fraudulent / not authorized packet well before TCP could see the packet and in this case, before the cryptographic mechanism could process the same, way before the TCP.
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
94
So packet-sorting algorithm ensures that TCP would get an appropriate authenticated packet for further processing. The ESP in the tunnel mode is used to coun counter ter traffi trafficc analysis. This mode of the ESP protocol provides additional outer IP header encapsulating the entire block containing ESP header header plu pluss cip cipher her text plus aut authen hentic ticati ation on dat data, a, if pre presen sent. t. By havin havingg a sor sorted ted sequence number in the ESP header (which is not encrypted), a reinforced counter traffic mechanism nism is obtain obtained. ed. So besides hiding the origi original nal source and destinati destination on analysis mecha addresses, addre sses, sorte sorted d sequ sequence ence number schem schemee incor incorporated porated in ESP (operating in tunne tunnell mode) would also hide the original sequence number of the packet.
4.10 4.1 0
Co Cov vert Ch Chann annel el Cap Capaci acitty in Pac Pack ket Sor Sortin ting g
It has been mentioned in chapter 5 that ordering objects in to specific sequences has potential poten tial of storing large amount of informati information. on. Ideall Ideally y speaking, n objects can store log2 n! bits. The main key determines the total number of possibilities of sending packet sequences. The longest subsequences estimation however provides error sequences as well as impossible sequences keeping in view the behavior of the network.This could reduce the ideal capacity capac ity of storing informat information ion in bits. The pack packet et sequenc sequences es comprisin comprisingg 4 pac packe kets, ts, 5 packets, 6 packets, 7 packets and 8 packets are analyzed in terms of capacity of covert informatio infor mation n each one of thes thesee cases exhibit. The capaci capacity ty refe refers rs to the num number ber of bits used in sending a covert message. The sequences considered in capacity computation are evident sequences and best estimate sequences based on LSS. This data hiding capacity is then compared with the ideal capacity in bits.
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
95
Figure 4.13: 4-packet sequence against different position errors
4.10.1 4.1 0.1
4-Pac 4-Pack ket Seque Sequence ncess
From figu figure re 4.6 4.6,, dat dataa hid hiding ing (DH (DH)) cap capaci acity ty of 4-p 4-pac acke kett seq sequen uences ces (ma (main in ke key) y) und under er different network behaviors (position errors, PE)would be: Main Ma in Ke Key y Idea Ideall D DH HC Cap apac acit ity y 3P PE ED DH HC Capa apaci citty 4 P PE ED DH HC Cap apac acit ity y 4
5 bits
5 bits
5 bits
Table 4.6: Data hiding capac capacity ity in bits; 4-pack 4-packet et seque sequences nces
4.10.2 4.1 0.2
5-Pac 5-Pack ket Seque Sequence ncess
From figu figure re 4.7 4.7,, dat dataa hid hiding ing (DH (DH)) cap capaci acity ty of 5-p 5-pac acke kett seq sequen uences ces (ma (main in ke key) y) und under er different network behaviors (position errors, PE)would be:
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
Figure 4.14: 5-packet sequence against different position errors
Main Ideal DH 3 PE DH 4 PE DH 5 PE DH Key Ke y
Cap apac acit ity y
Ca Capa paccity ity
Capac apacit ity y
Capac apacit ity y
5
7 bits
7 bits
7 bits
7 bits
Table 4.7: Data hiding capac capacity ity in bits; 5-pack 5-packet et seque sequences nces
96
Chapter Chapt er 4.
4.10.3 4.1 0.3
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
97
6-Pac 6-Pack ket Seque Sequence ncess
Figure 4.15: 6-packet sequence against different position errors From figure 4.8, data hiding (DH) capacity of 6-packet sequences (main key) under different network behaviors (position errors, PE)would be: Main Ideal DH 3 PE DH 4 PE DH 5 PE DH 6 PE DH Key Ke y
Cap apac acit ity y
Capac apacit ity y
Capac apacit ity y
Ca Capa paccity ity
Capac apacit ity y
6
10 bits
8 bits
9 bits
9 bits
9 bits
Table 4.8: Data hiding capac capacity ity in bits; 6-pack 6-packet et seque sequences nces
4.10.4 4.10 .4
6-P 6-Pac acke kett (imp (impro rove ved) d) Sequence Sequencess
From figure 4.9, data hiding (DH) capacity of 6-packet sequences, improved, (main key) under different network behaviors (position errors, PE)would be:
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
Figure 4.16: 6-Packet (improved) sequence against different position errors
Main Ideal DH 3 PE DH 4 PE DH 5 PE DH 6 PE DH Key Ke y
Cap apac acit ity y
Capac apacit ity y
Capac apacit ity y
Ca Capa paccity ity
Capac apacit ity y
6
10 bits
8 bits
9 bits
9 bits
9 bits
Table 4.9: Data hiding capacity in bits; 6-packet (improved) sequences
98
Chapter Chapt er 4.
4.10.5 4.1 0.5
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
99
7-Pac 7-Pack ket Seque Sequence ncess
Figure 4.17: 7-packet sequence against different position errors From figure 4.10, data hiding (DH) capacity of 7-packet sequences, improved, (main key) under different network behaviors (position errors, PE)would be: Main Ideal DH 3 PE DH 4 PE DH 5 PE DH 6 PE DH Key Ke y
Cap apac acit ity y
Capac apacit ity y
Capac apacit ity y
Ca Capa paccity ity
Capac apacit ity y
7
13 bits
9 bits
11 bits
12 bits
12 bits
Table 4.10: Data hiding capacity in bits; 7-packet sequences
4.10.6 4.1 0.6
8-Pac 8-Pack ket Seque Sequence ncess
From figure 4.11, data hiding (DH) capacity of 8-packet sequences, improved, (main key) under different network behaviors (position errors, PE)would be:
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
Figure 4.18: 8-Packet Sequence against different position errors
Main Ideal DH 3 PE DH 4 PE DH 5 PE DH 6 PE DH Key Ke y
Cap apac acit ity y
Capac apacit ity y
Capac apacit ity y
Ca Capa paccity ity
Capac apacit ity y
8
16 bits
9 bits
12 bits
14 bits
15 bits
Table 4.11: Data hiding capacity in bits; 8-packet sequences
100
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
101
From each one of these packet sequences, it boils out that data hiding capacity experiencess an incre ence increase ase with the incre increase ase in position error thres threshold. hold. This result is int interes eresting. ting. It reflects that whenever the position error threshold is increased, more and more sequences will be transformed from impossible to either evident sequences or best estimate sequences based on LSS. For packet sorting approach employing the longest subsequences matching technique, the data hiding capacity experiences an increase as the network behavior gets worse. The more the network introduces position errors, the more will be the capacity of hiding data in terms of number of bits.
4.11
Sum umm mary
Follo ollowing wing point pointss can summar summarize ize the data hiding techniq technique ue emplo employing ying pac packet ket sorting approach: • Packet sorting offers a surprisingly huge amount of data to be hidden in the order
of packets. Ideally n objects can store log2 n! bits. • Packet sorting is proposed based on chaotic mixing concept. • The difference between the sent sequence and the original sequence carries the
covert cov ert informat information. ion. For our case, specific specifically ally,, the estimati estimation on of the sent sequence with the help of two keys, k and sequence number and the received sequence would wou ld reveal the third key infor information mation.. This informat information ion constitut constitutes es the cov covert ert message intended to be transferred by Alice to Bob. • The simulations cover the estimation of the sent sequence as the technique is pro-
posed on the Internet layer which offers best effort delivery of packets. • Small scale reordering is considered by the network, of the order of one, two or
three position errors in the packet sequence.
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
102
• Lik Likewise ewise,, the position error scenario scenarioss are consi considered dered.. For each one of the possible
permutations of the number of packets in a sequence i.e. the main key, K , received sequences are categorized as impossible sequence, evident sequence, error sequence and best estimate sequence based on longest subsequence (LSS) • Each scenario specifically categorizes received sequence, therefore enabling Alice
and Bob to know the corre corresponding sponding percen percentages tages of the seque sequence nce categor categories. ies. This facilitates Alice and Bob to know which specific sequence has more percentage of being mapped correctly under a known behavior of network. For cov covert ert comm communica unications, tions, evide evident nt seque sequences nces and best estim estimate ate seque sequences nces are • For desirable. • A mixed behavior of network, as Willy as somewhat active warden, has also been
analyzed. analyz ed. Consid Considerabl erablee p perce ercenta ntages ges of seque sequences nces are found to have the common result. • Sorting scheme is also analyzed with respect to intermediate nodes, compatibility,
complexity and value addition to IPSec environment. The scheme is found to be in line with all the standard network processes thereby offering no hindrances in any of thes thesee standa standards. rds. • The covert channel capacity is also estimated for different packet sequences and
compar com pared ed wit with h the ideal capac capacit ity y. It boils out tha thatt dat dataa hid hiding ing capac capacit ity y expe expe-rience rie ncess an inc increa rease se wit with h the incre increase ase in posi positio tion n err error or thr thresh eshold old i.e. i.e. inc incre rease asess as the network network behavi behavior or gets worse. This can be attri attributed buted to more num numbers bers of received sequences being treated as either “evident sequences” or “best sequences” by longest subsequence estimation technique. • The packet sorting technique therefore finds considerable potential with respect to
data hiding process at network layer.
Chapter Chapt er 4.
Da Dat ta Hiding throug through h Pa Packet cket Sor Sorting ting
103
• There There exi exists sts no chann channel el mode modell for the reo reorde rdered red pack packets ets.. The pack packet et ord orderi ering ng
based algorithm algorithm on accou account nt of this fact has an ad hoc natur nature. e. Optim Optimalit ality y therefor thereforee cannot be considered. Basically in this thesis, we were looking at a feasibility study. Future work will look at optimization of the algorithms.
Chapter 5 Application
5.1 5. 1
Us Usag age e Sc Scena enari rios os - Pac ack ket Hea Header der Man Manip ipul ulat atio ion n Technique
The two approaches utilized in covert channel identification are focused on the network (Inter (In ternet net)) laye layer. r. The proof of the exist existenc encee of the cov cover ertt chann channels els through through the these se algorithms points to the possibility of associating additional information in the network packe pac kets. ts. These data hiding scen scenarios arios provid providee flexib flexibilit ility y to explo explore re this possibil possibility ity both in the IP Sec and non IP Sec environments. Associating Associat ing addit additional ional infor information mation through the pac packet ket header manipu manipulation lation algorithms find the following application scenarios:
1. Enhanc Enhanced ed filtering crite criteria ria in pac packe kett filter filtering ing routers (firew (firewalls). alls). If the addit additional ional information pertains to a user or an application, a more reinforced filtering policy can be b e defi defined ned.. The Theref refore ore,, in additi addition on to perf perform orming ing filte filterin ringg on the basi basiss of source and destination addresses, source and destination ports and protocol, the router can have enhanced criteria of filtering packets based on user and application information.
104
Chapte Cha pter r 5.
Applic Applica atio tion n
105
2. A client server architecture wherein several clients make a request to the FTP serve ser ver, r, sa say y of a lib librar rary y. A log file can be mai maint ntain ained, ed, for audit purpos purposes, es, based on the requests sent by various users (based on their user information tied to their ”request packets”). Moreover, serving the request like transferring a digital image to the user can have the same user information or library information tied to the conten con tentt packe packets. ts. This scenar scenario io of of security security tied to the content avoids the violation of digital copyrights by the specific user. 3. A logging process to the above application scenario based on the user or application specific information will complete the picture (i.e. logging of valid user), maintaining the record of user requests based on user information and ultimately serving the user requests by having either the user information or the server / source (library) information tied to the content packets to avoid the copyright violation. 4. Adding val value ue to con conten tentt deliv delivery ery netw networks. orks. Con Conten tentt deliv delivery ery netw network ork is an ov overerlay network to the public Internet or private networks, built specifically for the high performance delivery of content. This concept adds intelligence to networking wherein the network makes path decisions based on more than simple labels such as IP address. Having specific information tied to the content itself would ease up the process of content delivery networking. Decisions based on specific information with in the content can incorporate smart routing mechanism within the networks. The same information can also be used for the accounting and billing processes of the same networks.
5.2 5. 2
Us Usag age e Sce Scena nari rios os - P Pac ack ket S Sor orti ting ng
The packet sorting technique in the IP Sec environment finds following applications:
1. Preli Preliminar minary y (adde (added) d) authe authentic ntication ation in IP Sec environ environmen ment. t.
Chapte Cha pter r 5.
Applic Applica atio tion n
106
2. A mec mechanism hanism to facil facilitate itate enhance enhanced d ant anti-tra i-traffic ffic analy analysis sis by having packe packets ts with sorted sequence numbers. 3. Enhanc Enhanced ed securit security y mechani mechanisms sms for IP Sec protocol protocolss especially for ESP operating in tunnel mode, which enables enriched security for virtual private networks (VPNs).
Chapter 6 Combining the Two Approaches The two suggested techniques of data hiding in a network environment through the use of TCP/IP protocols find an interesting scenario when combined together.
The packet header manipulation identifies various techniques wherein IPv4 packet header can be utilized to hide either a single bit or multiple bits in various network topolog topo logies ies.. The str streng ength th of non non-de -detec tectab tabili ility ty lie liess in the wa way y, the co cove vert rt inf inform ormati ation on is em embedd bedded. ed. The Data Hid Hiding ing Sce Scenar nario io 4, emp emplo loyin yingg ch chaot aotic ic mix mixing ing based seq sequen uence ce genera gen eratio tion, n, has been est establ ablish ished ed to be the robus robustt of all in terms terms of det detect ectabi abilit lity y. As mentioned earlier, it provides controlled randomness, achieved through the use of three keys. This chaos combined with randomness, present in the last eight bits provide highly uncorrelat uncor related ed associat association ion of alphabet alphabet encodin encoding, g, Figur Figuree 3.8 refe refers. rs.
Packet sorting mechanism can be utilized as a means for authenticating a specific userr havin use havingg kno knowle wledge dge of all the three keys. keys. Otherw Otherwise ise,, the recei receive ved d seq sequen uence ce wo would uld be resor resorted ted improperly improperly.. Altho Although ugh improperly resort resorted ed pack packets, ets, if they fall within the window, can be authenticated or decrypted satisfactorily by IPSec security mechanisms, the application layer would receive an out of sequence data, which might result in getting some garbage.Moreover the knowledge of all the three keys would also avoid the
best estimation estimation tec techniqu hnique. e. It provide providess the structu structure re of gener generating ating the same sequenc sequences es 107
Chapte Cha pter r 6.
Com Combin bining ing the Two App Appro roac aches hes
108
and choosing the “right “right one” by both the “keys holders holders.” .” If either of the cove covertly rtly communicating parties does not have the right key information, then both of them can not authenticate each other, through this way.
6.1 6. 1
Th The e IP IPSe Secc Sc Scen enar ario io
Let us consider an IPSec end-to-end security scenario between the hosts involving their respective IPSec implemented routers. The scenario can be visualized by referring Figure 4.5. By detailed analysis of the combination of security associations, it has been found out that for this case, the following is the best security association combination: • For host to host communication, the SA must afford AH in transport mode and • For router to router communication across an Internet, ESP must be afforded in
tunnell mode. tunne This combination provides authentication before encryption making authenticated data further protected protected by encrypt encryption. ion. This facilitat facilitates es stori storing ng the authent authenticati ication on infor infor-mation with the message till the final destination. The entire inner authenticated packet is therefore encrypted, as shown as in the figure 6.1
Figure 6.1: AH in transport mode and ESP in tunnel mode
The security security com combinati bination on has two IPSec headers. AH header serves the end ttoo end
Chapte Cha pter r 6.
Com Combin bining ing the Two App Appro roac aches hes
109
hosts whereas the ESP header affords security services to the respective routers at the edge of the two networks.
6.1.1 6.1 .1
Co Consi nsider derati ations ons
• There exists a packet sorting/resorting mechanisms at both the nodes (host and
router) at source and destination. • The Source intends to covertly send a secret information through the use of packet
headerr manipu heade manipulation lation approac approach; h; data hiding scen scenario ario 4. • The packet sorting mechanism is used here for authenticating the receiver as in-
tended destination of the secret communication. • The key information comprises the three keys. • These keys are used for:
1. Authe Authenti nticatin catingg the desti destination nation route routerr as the inte intended nded recipi recipient ent of this sessi session on of covert communication. 2. Authe Authenti nticatin catingg the destinat destination ion host as the intend intended ed destinati destination on of this cov covert ert session of covert communication. 3. Deciphering the covert message placed in the Identification field of the IP datagrams sent by the sender. The receiver would generate the sequences and thereafter the lookup table, as table 3.8, in order to decrypt what was actually sent.
6.1. 6.1.2 2
Assu Assump mpti tion onss
• For simplicity, let the keys information be the same for both pair of nodes i.e. host
- host and router - router.
Chapte Cha pter r 6.
Com Combin bining ing the Two App Appro roac aches hes
110
• Let the IP addresses of the nodes are as follows:
– Source Host as 1.1.1.1 – Source Router as 5.5.5.5 – Destination Host as 2.2.2.2 – Destination Router as 6.6.6.6
6.1.3 6.1 .3
Sou Source rce Rou Router ter to to Destin Destinati ation on Route Routerr
Thiss SA is affo Thi afforde rded d wit with h ESP prot protocol ocol in tun tunnel nel mode. The Dest Destina inatio tion n Rou Router ter SPD would be look like as Table 6.1 From To Protoc ocool Port Policy Tunnel Entry 2.2.2.2 1.1.1.1 Any Any 33D DES 5.5.5.5 Table 6.1: Destination router; SPD entries Likewise, the inbound Security Association Database (SADB) at destination router would be Table 6.2 Source Destination Protoc ocool SPI 5.5.5.5
6.6.6.6
ESP
11
SA Record 168 bit 3DES key
Table 6.2: Dest Destinatio ination n route router; r; SADB; inbound Following are the sequence of events at the destination Router: 1 1. Router receiv receives es a packe packett from source 5.5.5.5 with tunnelled ESP using 3DES ha having ving an SPI value of 11. (All these info from the packet header) 2. The lookup in the SADB yield yieldss an SA p poin ointer. ter. 1
These steps are as per reference [32] as detailed in [25]
Chapte Cha pter r 6.
Com Combin bining ing the Two App Appro roac aches hes
111
3. Howe However ver when the policy engine is invoke invoked, d, the source and destination address will be th that at of the the inne innerr IP head header er.. Th Thee value aluess in th this is ca case se are 1.1. 1.1.1. 1.11 and and 2.2. 2.2.2. 2.22 respectiv respec tively ely.. The look up in the SPD matc matches hes the entr entry y whose ”from” and ”to” fields are network network prefixes 2.2.2.2 and 1.1.1.1. They also indicate that the pac packe kett was tunnelled by 5.5.5.5, which is also true in this case. 4. Once the va valid lid SA is identi identified, fied, it is used to process the packe packett as follo follows: ws:
a. The res resort orting ing mech mechani anism sm is perf perform ormed ed her here. e. If the route routerr kno knows ws the corr correct ect keys then the resorting would be done perfectly thereby facilitating the right packet pac ketss fall into the windo window. w. Othe Otherwise rwise the packe packett wou would ld get discarded and there would be no further processing.
b. Since ESP authenticates the cipher text and not the plain text, the next thing to do is authenticate the packet. The entire ESP packet, minus the authentication data is passed with the appropriate key to the authenticator algorithm from the SA.
c. If the resulting digest matches the data contained in the authentication data field, the packet is authenticated.
d. The nest step is decryptio decryption. n. The ESP pack packet, et, from the b beginn eginning ing of the payload data to the next header field, is decrypted using the key and the cipher algorithm from the SA.
e. After the above processes, a preliminary validity check of the resulting packet can be mad made. e. If the SA use used d to proc process ess the pac packe kett dicta dictates tes tha thatt only ESP packets in particular mode, either transport or tunnel mode (tunnel is our case) cas e) can be proc process essed, ed, the pac packe kett mu must st be ch chec ecke ked d for compl complian iance ce.. If the packet does not correspond to the required mode it must be dropped.
f. The packe packett ca can n now now be rebu rebuil iltt wi with thou outt th thee ES ESP P he head ader er.. For tu tunn nnel el mod mode, e,
the outer IP header and the ESP header can merely be thrown away, the de
Chapte Cha pter r 6.
Com Combin bining ing the Two App Appro roac aches hes
112
capsulated packet is what we need.
g. At this point another validity check has to be made. The IP Sec SA may require that packets it processes may be only for a particular host, if tunnel mode, and/or for a particular port or protocol. If the packet does not correspond to the required address and / or port and / or protocol dictated by SA, it must be dropped.
h. A reconstructed and validated packet can now be forwarded for further processing. cessi ng. For tunnel mode, it is re inser inserted ted into the IP processing stream and forwarded on to its ultimate destination.For our case the same would be forwarded war ded to the destina destination tion host. The pack packet et would now hav havee the origin original al IP header along with the AH header having sorted sequence numbers.
6.1. 6.1.4 4
At Des Desti tina nati tion on Host Host
The non-tunnel case would be processed here. Consider the following table 6.3: From
To
Protocol Port
1.1. 1.1.1. 1.11 2. 2.2. 2.2. 2.22
Any
An Any y
Policy Tra rans nspo port rt AH wit with HMAC-M -MD5 D5
Table 6.3: Dest Destinatio ination n host; SPD ent entries ries The SADB for the destination host would be, table 6.4 Source Destination Protoc ocool SPI 1.1.1.1
2.2.2.2
AH
10
SA Record HMAC-MD5 key
Table 6.4: Destination host; SADB; inbound The sequence of events are as follows: 1. The IP Sec lay layer er extracts extracts the SPI from the AH header and the sourc sourcee and desti destinana-
tion IP addresses and protocol from the IP header. For our case, the AH header has
Chapte Cha pter r 6.
Com Combin bining ing the Two App Appro roac aches hes
113
an SPI value of 10 with source and destination addresses being 1.1.1.1 and 2.2.2.2 respectively. 2. The IP sec componen componentt then fetche fetchess the SA from the SADB using the destinat destination ion (2.2.2.2), protocol (AH) and SPI (10). 3. If the SADB does not find the SA, an error is logged and the pack packet et is dropped. 4. If the SADB retur returns ns the SA, the IP Sec lay layer er processes the pack packet et as follo follows: ws: • Resorting process is done here. If the host has correct keys information, then
perfect resorting would be done and packets would fall in the window accordingly. If the packet is duplicated, it would be thrown off. • The ICV (integrity check value) must now be checked. • First, the ICV value in the authentication data field of the AH header is saved
and that field is zeroed then. • The mutable fields in the IP are also zeroed. • The authenticator algorithm is then applied to the entire packet and the re-
sulting digest is compared to the saved ICV value. • If they match, the IP packet has been authenticated; if they do not, the packet
is discarded. 5. Once the ICV has been verifi verified, ed, the sequence num number ber of the sliding rece receive ive wind window ow can be advanced if necessary. 6. This concl concludes udes the AH processin processing. g. The IPSec inbound processing at destination router and host is done in this way. The purpose of showing these sequence of steps at the respective nodes is to show that: 1. Resor Resorting ting process is interoper interoperable able with the IPSec processing. processing. It is not in any wa way y,
disturbing the standard processes of IPSec architecture.
Chapte Cha pter r 6.
Com Combin bining ing the Two App Appro roac aches hes
114
2. Pac Packe kett resor resorting ting process with the corre correct ct knowle knowledge dge of ke keys ys would enable the respective nodes to correctly resort the packets, thereby providing preliminary authentication as described in application scenarios. The destination host would decipher the covert message with the help of the keys. Since the key information is similar for all the three cases (two authentication and one deciphering of covert info.), host would only map the decoded content with the generated lookup table table.. In this way the combination of the two approaches provides a covert communication scenario having robust structure as far as detectability is concerned. The same environment can facilitate such type of communication among multiple hosts working on some secret project.
Chapter 7 Conclusions and Future Work
7.1 7. 1
Co Conc nclu lusi sion onss
This thesis is a step forward in the analysis of the existence of covert channels in the networ net work k env environm ironment ent.. Pac Packet ket header manipulat manipulation ion expl exploits oits the cha charact racterist eristics ics of the TCP/IP protocol suite like redundancy, multiple interpretations of design strategy, reserved and unused fields in headers to identify covert channels. Association of additional information with network packets finds applications, foreseen in logging processes, digital copyright mechanisms at network layer, content delivery networks and associated billing and accounting services. The novel packet novel packet sorting mechanism mechanism points to the integration of stego principles principles with the IPSec archit architectu ecture. re. Cov Covert ert channel ident identificat ification ion and analy analysis sis at network and transport layers provide an excellent potential to integrate the science of steganograp stega nography hy with the netwo network rk secur security ity archi architect tecture. ure. Besid Besides es finding its applic application ation in the existing security mechanisms of network nodes like routers and firewalls, this new security paradigm allows integration of steganographic principles with the security policies of the network (using cryptographic tools). Network security can therefore be reinforced by integrating steganography with cryptographic tools.
Based on this work, a research paper has been submitted for acceptance in the fifth 115
Chapte Cha pter r 7.
Con Conclu clusio sions ns and Fut Future ure W Work ork
116
International Workshop on Data Hiding in October, 2002.
7.2 7. 2
Fur urth ther er Re Resea searc rch h
This work introduces a new dimension of network security analysis by investigating the TCP/IP protocol suite for the existence of hidden communication channels. As explained, these covert channels find interesting applications in network security and in facilitating variou ariouss net networ work k proces processes ses which are inlin inlinee with modern conc concepts. epts. The cove covert rt channel exploration in TCP/IP suite therefore has much potential in network environment. This exploratory research is not complete in the sense that all protocols are not evaluated. The analysis analysis does not co cove verr IPv IPv66 whi which ch can be ano anothe therr pote potent ntial ial aven avenue. ue. Sim Simila ilarly rly,, UDP (user datagram protocol) protocol) has also not been cov covered ered.. Pac Packet ket heade headerr manipulati manipulation on approach can also be applied on routing protocols like RIP (routing information protocol), BGP (border gateway gateway protocol, OSPF (open shortest path first). In the gener general al cove covert rt channel analysis as detailed in Chapter 3, we have only identified the possibility of covert channel cha nnel existenc existence. e. All these potenti potential al scena scenarios, rios, furtherm furthermore, ore, require proper embed embedding ding / extraction techniques on the respective header formats in order to ensure the non detectability of covert channels in TCP/IP environment. For the sorting/resorting based covert communication scenario, our proposed technique niq ue is not optim optimal al wit with h res respect pect to codi coding ng and dec decodin odingg schem schemes. es. It is sugg suggest ested ed to make use of coding theory in order to devise an optimal solution of this sorting/resorting process. Regard Reg arding ing com comput putati ation on of co cove vert rt chann channel el cap capaci acity ty,, the there re is no ch chann annel el mode modell for packet ordering technique that we know of and it is beyond the scope of the work to determine dete rmine one. Thu Thuss for data hiding approac approach h based on pac packe kett sorting and resorting, we have not optimized for computing capacity. This could be another avenue for further
researc rese arch h and study study.. For data hiding approa approach ch based on pac packe kett heade headerr manip manipulatio ulation, n, we
Chapte Cha pter r 7.
Con Conclu clusio sions ns and Fut Future ure W Work ork
117
made use of expression as presented by Girling [12]. It has been found that the resulting capacity capac ity v values alues do not increase with the increase in the netw network ork speed. This requir requires es redefining the capacity estimation expression for the storage covert channels existing in LAN topology. Connected to covert channels, further research in the area of network communication requires identification of processes which need to be refined either in terms of their securit secu rity y aspects or for havin havingg some added funct functionali ionalities. ties. The use of cov covert ert chan channels nels provides pro vides an effectiv effectivee mechani mechanism sm as the hidden bandwi bandwidth dth would be utili utilized. zed. In some cases, it might avoid additional hardware/software routines in order to achieve the same objective. objectiv e. The existen existence ce of cov covert ert channe channels ls is a pheno phenomenon menon that exists almost every every-where. Perhaps we are not aware of some of our hidden qualities , though we make use of them in our daily affairs.
Chapte Cha pter r 7.
Con Conclu clusio sions ns and Fut Future ure W Work ork
118
Figure 7.1: The longest subsequence method
Bibliography [1] B. W. Lampson, “A note on the confinmen confinmentt problem, problem,”” in in Proc. Proc. of the Communications of the ACM , no. 16:10, pp. 613–615, October 1973. [2] S. B. Lipne Lipner, r, “A comme comment nt on the confinmen confinmentt problem, problem,”” Operating System Review , vol. 9, pp. 192–196, November 1975. [3] M. Schae Schaefer, fer, B. Gold, R. Linde, and J. Scheid Scheid,, “Program confinem confinement ent in kvm/370, kvm/370,”” Annual ACM Conference, October 1977. [4] J. C. Husk Huskamp, amp, Covert Covert Channels in Timesharing System . PhD thesis, University of California, Berkeley, California, 1978. [5] D. E. Denni Denning, ng, Cryptography Cryptography and Data Security . Reading, Massachusetts: AddisonWesley, reprinted ed., 1983. [6] R. A. Kemme Kemmerer, rer, “Share “Shared d resource matri matrix x methodology methodology:: An approac approach h to iden identifytifying storage and timing channels,” vol. 1 of of 3 , pp. 256–277, ACM Transactions on Computer Compu ter Syste Systems, ms, August 1983. [7] “Depa “Departmen rtmentt of defe defence nce trust trusted ed compu computer ter syste system m ev evaluati aluation on crite criteria,” ria,” Tec ech. h. Rep. DOD 5200.28-ST, 5200.28-ST, Depar Departmen tmentt of Defe Defence, nce, Decembe Decemberr 1985. Superse Supersedes des CSC-STD001-83. [8] D. E E.. Co Comer, mer, Internetworking Internetworking with TCP/IP, Principles, Protocols and Architectures .
New Jersey 07458: Prentice Hall, Upper Saddle River, fourth ed., 2000. 119
Bibliography
120
[9] G. Vigna Vigna,, “A topologi topological cal char characte acterizat rization ion of TCP/I TCP/IP P secu securit rity y.” Dipart Dipartmen mento to di Elettronica e Informazione, Politecnico di Milano, Piazza Leonardo da Vonci, 20133 Milano, Italy, December 1996. [10] S. M. Bello Bellovin, vin, “Secur “Security ity probl problems ems in the TCP/IP protocol suite suite,” ,” Computer Computer Communication Review , vol. 19, pp. 32–48, April 1989. [11] T. Handel and M.Sandfor M.Sandford., d., “Hiding data in the OSI netw network ork model,” (Cambr (Cambridge, idge, U.K.), First International Workshop on Information Hiding, May-June 1996. [12] C. . G. Girling, “Co “Cover vertt channel channelss in LAN’s LAN’s,” ,” vol. SE-13 of 2 2 , IEEE Transactions on Software Engineering, February 1987. [13] M. Wol Wolf, f, “Cove “Covert rt channe channels ls in LAN protoco protocols,” ls,” in Proceedings of the Workshop on Local Area NetworK Security (LANSEC’89) (T.A.Berson (LANSEC’89) (T.A.Berson and T.Beth, eds.), pp. 91 – 102, 1989. [14] C. H. Rowland, “Covert cchannels hannels in the TCP/IP protocol suite,” Tech. Rep. 5, First Monday, Peer Reviewed Journal on the Internet, July 1997. [15] S. Katzen Katzenbeisser beisser and F. Petitcolas, Petitcolas, Information Information Hiding Techniques for Steganography and Digital Watermarking . Computer Securiy Series, 685 Canton Street, Norwood, MA 02062: Artech House, Inc., 2000. [16] R. Ack Ackerman ermann, n, U. Roedig, M. Zink, C. Griwodz Griwodz,, and R. Stein Steinmetz metz,, “Associa “Associating ting network flows with user and application information,” in Eight ACM International Multimedia Conference , (Los Angeles, California), 2000. [17] M. deVivo, G. O. deVivo, R. Koeneke, and G. Isern, “Internet v vulnerabilities ulnerabilities realted to TCP/IP and T/TCP,” SIGCOMM Computer Communication Review , vol. 29,
January 1999.
Bibliography
121
[18] U. S. C. Informatio Information n Scie Science nce Institute Institute,, “T “Transmi ransmission ssion contr control ol protoco protocol, l, darpa inter inter-net program, protocol specification,” 1981. Prepared for Defense Advanced Research Projects Agency. [19] J. Postel, “Int “Interne ernett con control trol message protocol protocol,” ,” Sept September ember 1984. Protoc Protocol ol Specifi Specificacations, DARPA Internet Program. [20] U. S. C. Informati Information on Scie Sciences nces Institut Institute, e, “Intern “Internet et protocol, darpa int interne ernett progr program am , protocol protocol specificatio specification,” n,” Septem September ber 1981. Specific Specification ation prepa prepared red for Defense Advanced Research Projects Agency. [21] D. B. Chapman and E. D. Zwic Zwicky ky,, Building Internet Firewalls . O’Reilly and Associates, Inc., 1st ed., 1995. [22] I. Pitas and G. Voyatzis, “Chaotic mixing of digital images and applications to watermarking,” in European Conference on Multimedia Applications Services and Techniques (EMAST’ 96), 96), vol. 2, pp. 687–695, 1996. [23] D. Arro Arrowsmit wsmith h and C. M. Place, Place, An An Introduction to Dynamical Systems . Cambridge University Press, 1990.
[24] J. McHugh, “Covert Channel Analysis,” T Technical echnical Memorundum 5540:080A, Naval Researc Rese arch h Laborato Laboratory ry,, Washing ashington ton D.C., 1995. A Chapt Chapter er of the Handbook for the Computer Security Certification of Trusted Systems. [25] N. Dorasw Doraswamy amy and D. Harkin Harkins, s, IPSec; IPSec; The New Security Standard for the Internet, Intranets and Virtual Private Networks . Int Interne ernett Infrastr Infrastructur ucturee Series, One Lake Street, Upper Saddle River, NJ 07458: Prentice Hall, 1999. [26] T.Shi T.Shiroshit roshita, a, O. Tak akahashi, ahashi, and M. Yamashi amashita, ta, “In “Integra tegrating ting lay layered ered securit security y int intoo reliable multicast,” in in IEEE Third International Workshop on Protocols for Multi-
media Systems , 1996.
Bibliography
122
[27] J.Mo J.Mogul, gul, “Observi “Observing ng TCP dynami dynamics cs in real netw networks, orks,”” in SIGCOMM in SIGCOMM ’92 Symposium on Communications Architectures and Protocols , pp. 305–317, August 1992. [28] V. Paxson, “End-to-end in internet ternet pack packet et dynamics,” in in IEEE/ACM IEEE/ACM Transactions on Networking , vol. 7(3), pp. 277–292, 1999. [29]] D. I. Pul [29 Pullin lin,, R. Man Mander dervil ville, le, and A. Cor Corlet lett, t, “On the pac packe kett ord orderi ering ng pro proble blem,” m,” tech. tec h. rep rep., ., CQ CQoS oS Inc Inc., ., Irv Irvine ine,, CA, Augus Augustt 200 2001. 1. Pre Presen sented ted to the IPPM work working ing group in the 51st IETF meeting in London, U.K. [30]] G. J. Sim [30 Simmon mons, s, “Th “Thee pri prison soner’ er’ss pro proble blem m and the subli sublimin minal al ch chann annel, el,”” in Crypto’ in Crypto’ 83 , 1984. [31] P.Sris .Srisuresh uresh,, “Secur “Security ity mode modell with tunne tunnell mode IPSec fo forr NA NAT T domains domains,” ,” October 1999. RFC 2709, Lucent Technologies. [32] S. Kent and R. Atkinson, “Security archite architecture cture for the Internet Protocol,” November 1998. RFC 2401.
