A Practical Approach to Identifying Storage and Timing Channels

Abstract

Prior to the presentation of this paper twenty years ago the covert channel analysis that took place was mostly ad hoc. Methods for discovering and dealing with these channels were mostly informal, and the formal methods were restricted to a particular specification language. This paper presents a methodology for discovering storage and timing channels that can be used through all phases of the software life cycle to increase confidence that all channels have been identified. In the original paper the methodology was presented and applied to an example system having three different descriptions: English, formal specification, and highorder language implementation. In this paper only the English requirements are considered. However, the paper also presents how the methodology has evolved and the influence it had on other work.

An Entropy-Based Approach to Detecting Covert Timing Channels

“…The detection of covert timing channels is accomplished using statistical tests to differentiate covert traffic from legitimate traffic. While the focus of earlier work is on disrupting covert timing channels [9], [10], [11], [12], [13] or on eliminating them in the design of systems [14], [15], [16], more recent research has begun to investigate the design and detection of covert timing channels [1], [2], [3], [4], [17], [5], [18]. In the following subsections, we give an overview of recent research on covert timing channels and detection tests.…”

Least Privilege in Separation Kernels

“…This is contrary to the principle of least privilege required in high assurance systems. The least privilege separation model builds on the traditional separation abstraction by extending the granularity of described elements to the subjects [9] and resources within the partition. An orthogonal flow control policy can then be expressed relative to subjects and resources, thus providing all of the functionality and protection of the traditional separation kernel, combined with a high level of confidence that the effects of subjects' activities may be minimized to their intended scope.…”

“…The kernel will have a static runtime resource configuration and its security policy regarding access to resources will be based on process/resource access bindings, via offline configuration (e.g., via an access matrix, such as are shown in Figures 1, 2 and 4). The static nature of resource allotment will provide predictable processing behavior, as well as limit the covert channels based on shared resource utilization [10]; [9]; [13]. Simple process synchronization primitives will also be provided, that can be implemented to be demonstrably free of covert channels (Reed, 1979).…”

A VMM security kernel for the VAX architecture

“…Total 12408 8704 We are doing a formal covert channel analysis using a new tcchniquc for automating the Shared-Resourcc Matrix approach [20] using code-level flow analysis tools.…”