A Practical Covert Channel Identification Approach in Source Code Based on Directed Information Flow Graph
Secure System Integration and Reliability Improvement (2011)
Jeju Island, Korea
June 27, 2011 to June 29, 2011
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/SSIRI.2011.17
Covert channel analysis is an important requirement when building secure information systems, and identification is the most difficult task. Although some approaches were presented, they are either experimental or constrained to some particular systems. This paper presents a practical approach based on directed information flow graph taking advantage of the source code analysis. The approach divides the whole system into serval independent modules and analyzes them respectively. All the shared variables and their caller functions are found out from the source codes and modeled into directed information flow graphs. When the information flow branches are visible and modifiable to the external interface, a potential covert channel exists. Contributions made in this paper are as follows: a modularized analysis scheme is proved and reduces the workloads of identifying, a directed information flow graph algorithm is presented and used to model the covert channels, more than 30 covert channels have been identified in Linux kernel source code using this scheme, and a typical channel scenario is constructed.
covert channel identification, directed information flow graph, source code analysis, modularized analysis, prune algorithm, alias analysis
L. Ding, Y. Wang, J. Wu and W. Han, "A Practical Covert Channel Identification Approach in Source Code Based on Directed Information Flow Graph," Secure System Integration and Reliability Improvement(SSIRI), Jeju Island, Korea, 2011, pp. 98-107.