Building covert timing channels by packet rearrangement over mobile networks

Covert timing channels (CTCs) can transmit covert messages by modulating the timing behavior of an entity in overt network communication. In majority of existing solutions, the covert messages are hidden in inter-packet delays (IPDs) of legitimate traffic. These proposals are not suitable for voice over LTE (VoLTE) as IPDs of VoLTE traffic are sensitive to modulation and easy to be detected if changed. In order to build CTCs in such scenario, we propose a robust and undetectable CTC by packet rearrangement which can modulate covert message into number of packets between RTCP packets of VoLTE traffic. To improve the robustness, we employ Gray code to encode the covert message for mitigating the packet loss and reordering. To remain undetectable, we design the variable code length scheme to modulate the number of packets for fitting the distribution of overt traffic. Moreover, the design ensures tunability of different parameters, so that optimum trade-off between robustness and undetectability can be achieved at run-time. To the best of our knowledge, this work is the first to build a CTC using RTCP packet rearrangement suitable for VoLTE traffic. The experimental evaluation proves that the proposed CTC is statistically undetectable and outperforms the IPD-based CTCs in terms of robustness.