Cover Image

Applying covert channel in TCP Fast Open (TFO) / Mohamed Azran Aziz

Covert channel is one of the techniques that is used in information hiding. It uses communication channel as a medium for transmitting hidden information. There are two main categories in covert channel namely storage covert channel and timing covert channel. Storage covert channel basically mani...

Full description

Saved in:
Bibliographic Details
Main Author: Mohamed Azran , Aziz
Format: Thesis
Published: 2019
Subjects:
QA75 Electronic computers. Computer science
Online Access:http://studentsrepo.um.edu.my/11799/1/Mohamed_Azran.pdf
http://studentsrepo.um.edu.my/11799/2/Mohamed_Azran.pdf
http://studentsrepo.um.edu.my/11799/
Tags: Add Tag
No Tags, Be the first to tag this record!
id my.um.stud.11799
record_format eprints
spelling my.um.stud.117992020-11-03T01:41:53Z Applying covert channel in TCP Fast Open (TFO) / Mohamed Azran Aziz Mohamed Azran , Aziz QA75 Electronic computers. Computer science Covert channel is one of the techniques that is used in information hiding. It uses communication channel as a medium for transmitting hidden information. There are two main categories in covert channel namely storage covert channel and timing covert channel. Storage covert channel basically manipulate existing data and/or encode hidden messages within legitimate data. Whereas, timing covert channel intentionally manipulate timing behaviour of resources e.g. delaying between packets to create codes. There are many implementations of covert channel in TCP that use various fields in the TCP header such as Sequence Number, Urgent Pointer and reserved fields. Techniques such as field replacement, create intended delays and manipulating random values are used in implementing covert channel in TCP. Moreover, covert channel implementations also extended to optional fields such as Maximum Segment Size (MSS) and Timestamps. From time to time these optional fields (TCP Options) get evolved (e.g. Quick-Start Response - 2007, TCP Authentication Option – 2010 and TCP Fast Open -2014) and thus more potential covert channel implementations can be discovered. TCP Fast Open (TFO) is one of the latest TCP options that offers faster transmission performances between nodes. It utilises up to 16 bytes in allocated options field in TCP header as its message authentication code (MAC). Previous covert channel implementations cover various fields in the TCP header but not TFO. The aim of this study is to introduce covert channel in TFO by manipulating allocated options field in the TCP header known as TFO cookie. Subsequent to this, observation on performances are investigated as to detect any changes in semantic as well as syntax of TFO transactions. To conduct this study, tools are built to manipulate incoming and outgoing packet transactions and create covert content in allocated options field in TCP header. Further, performance test is conducted to observe any changes in transactions between implemented covert channel TFO and ordinary TFO. The results of the tests show covert content is transferred successfully between receiver and sender without breaking TFO transaction. Moreover, the results also show there are no significance performance degradation when applying covert channel into TFO. These results indicate that covert channel can be created in TFO and works normally as ordinary TFO. On this basis, it would make covert channel in TFO as one of latest alternative methods in implementation of covert channel in TCP. 2019-04 Thesis NonPeerReviewed application/pdf http://studentsrepo.um.edu.my/11799/1/Mohamed_Azran.pdf application/pdf http://studentsrepo.um.edu.my/11799/2/Mohamed_Azran.pdf Mohamed Azran , Aziz (2019) Applying covert channel in TCP Fast Open (TFO) / Mohamed Azran Aziz. Masters thesis, University of Malaya. http://studentsrepo.um.edu.my/11799/
institution Universiti Malaya
building UM Library
collection Institutional Repository
continent Asia
country Malaysia
content_provider Universiti Malaya
content_source UM Student Repository
url_provider http://studentsrepo.um.edu.my/
topic QA75 Electronic computers. Computer science
spellingShingle QA75 Electronic computers. Computer science
Mohamed Azran , Aziz
Applying covert channel in TCP Fast Open (TFO) / Mohamed Azran Aziz
description Covert channel is one of the techniques that is used in information hiding. It uses communication channel as a medium for transmitting hidden information. There are two main categories in covert channel namely storage covert channel and timing covert channel. Storage covert channel basically manipulate existing data and/or encode hidden messages within legitimate data. Whereas, timing covert channel intentionally manipulate timing behaviour of resources e.g. delaying between packets to create codes. There are many implementations of covert channel in TCP that use various fields in the TCP header such as Sequence Number, Urgent Pointer and reserved fields. Techniques such as field replacement, create intended delays and manipulating random values are used in implementing covert channel in TCP. Moreover, covert channel implementations also extended to optional fields such as Maximum Segment Size (MSS) and Timestamps. From time to time these optional fields (TCP Options) get evolved (e.g. Quick-Start Response - 2007, TCP Authentication Option – 2010 and TCP Fast Open -2014) and thus more potential covert channel implementations can be discovered. TCP Fast Open (TFO) is one of the latest TCP options that offers faster transmission performances between nodes. It utilises up to 16 bytes in allocated options field in TCP header as its message authentication code (MAC). Previous covert channel implementations cover various fields in the TCP header but not TFO. The aim of this study is to introduce covert channel in TFO by manipulating allocated options field in the TCP header known as TFO cookie. Subsequent to this, observation on performances are investigated as to detect any changes in semantic as well as syntax of TFO transactions. To conduct this study, tools are built to manipulate incoming and outgoing packet transactions and create covert content in allocated options field in TCP header. Further, performance test is conducted to observe any changes in transactions between implemented covert channel TFO and ordinary TFO. The results of the tests show covert content is transferred successfully between receiver and sender without breaking TFO transaction. Moreover, the results also show there are no significance performance degradation when applying covert channel into TFO. These results indicate that covert channel can be created in TFO and works normally as ordinary TFO. On this basis, it would make covert channel in TFO as one of latest alternative methods in implementation of covert channel in TCP.
format Thesis
author Mohamed Azran , Aziz
author_facet Mohamed Azran , Aziz
author_sort Mohamed Azran , Aziz
title Applying covert channel in TCP Fast Open (TFO) / Mohamed Azran Aziz
title_short Applying covert channel in TCP Fast Open (TFO) / Mohamed Azran Aziz
title_full Applying covert channel in TCP Fast Open (TFO) / Mohamed Azran Aziz
title_fullStr Applying covert channel in TCP Fast Open (TFO) / Mohamed Azran Aziz
title_full_unstemmed Applying covert channel in TCP Fast Open (TFO) / Mohamed Azran Aziz
title_sort applying covert channel in tcp fast open (tfo) / mohamed azran aziz
publishDate 2019
url http://studentsrepo.um.edu.my/11799/1/Mohamed_Azran.pdf
http://studentsrepo.um.edu.my/11799/2/Mohamed_Azran.pdf
http://studentsrepo.um.edu.my/11799/
_version_ 1738506529815920640
score 13.211869

Similar Items