The present invention relates generally to a method and apparatus for blocking access to an information processing system by an unauthorized user, and more particularly to such a method and apparatus where a channel boundary is employed to allow access just by legitimate users.
For purposes of the present invention and its background, we consider situations where there is an information flow boundary that is intended to prevent unwanted outward flow of information from one or more information technology products while allowing desired information flows. The information flow boundary is enforced by one or multiple information technology products acting as a boundary controller. One possible function of a boundary controller is to prevent or mitigate covert channels. In information theory, a covert channel is a parasitic communications channel that draws bandwidth from another channel in order to transmit information without the authorization or knowledge of the latter channel's designer, owner, or operator. A covert channel is so called because it is hidden within the medium of a legitimate communications channel. The detection of a covert channel can be made more difficult by using characteristics of the communications medium for the legitimate channel that are never controlled or examined by legitimate users. For example, a file can be opened and closed by a program in a specific, timed pattern that can be detected by another program, and the pattern can be interpreted as a string of bits, forming a covert channel. Since it is unlikely that legitimate users will check for patterns of file opening and closing operations, this type of covert channel can remain undetected for long periods.
A storage channel, e.g. as defined in Ira S. Moskowitz and Myong H. Kang, Covert channels—here to stay?, In Proc. COMPASS '94, pp. 235-243 (Gaithersburg, Md., June 1994) (hereinafter “Moskowitz1”), is a covert channel where the output alphabet consists of different behaviors whose timing is irrelevant. Moskowitz defines a timing channel as a covert channel where the output alphabet is made up of different time values corresponding to the same response. For purposes of the present invention and its background, we are interested in a class of covert channels where the output alphabet consists of different values of a statistic S defined on behavior or timing, hence both the timing and the behavior per se are not used as the alphabet. As defined in Ira S. Moskowitz and Myong H. Kang, Discussion of a statistical channel, In Proc IEEE-IMS Information Theory Workshop on Information Theory and Statistics (Alexandria, Va., October 1994) (hereinafter “Moskowitz2”, and incorporated herein by reference), we call this kind of channel a statistical covert channel. Moskowitz2 identified the statistical covert channel that is present in the NRL Pump. The NRL Pump is a boundary controller that blocks storage and timing covert channels but could possibly have a timing-based statistical covert channel: that is, the covert channel is based on varying a statistic defined over the timing of an event. This differs from event-based statistical covert channels; that is, covert channels based on varying a statistic defined over the occurrence of an event. The problem of statistical channels is that they can be present in systems that have minimal or no storage or timing channels, either inherently or because of boundary controllers that block or minimize them. In systems that lack measures to prevent storage or timing channels, statistical covert channels are of little interest. In systems that implement effective measures against storage and timing channels, statistical channels are significant. This is particularly of concern in systems where events happen at Giga Hertz rates.
An early work on covert channels in local area networks described in C. G. Girling, Covert channels in LAN's, IEEE Transactions on Software Engineering, SE-13(2):292-296 (February 1987), identifies and analyzes storage and timing channels that can be constructed on events visible outside a host on the LAN. Secure networks and their protocols usually consider all of the channels analyzed by Girling. B. Venkatraman and R. Newman-Wolfe, Performance analysis of a method for high level prevention of traffic analysis using measurements from a campus network, In Proc. Tenth Annual Computer Security Applications Conference, pages 288-297 (Orlando, Fla.) December 1994, and B. Venkatraman and R. Newman-Wolfe, Capacity estimation and auditability of network covert channels, In Proc. IEEE Symposium on Security and Privacy, pp. 186-198 (Oakland, Calif.) describe systems for preventing covert channels in local area networks (in fact any information technology product for which we can define the traffic matrix). Their notion of temporal neutrality exemplifies strong defense against information flow.
Moskowitz2 was the first to discuss covert channels based on varying statistics. It focused on statistics for the timing of replies, as the timing of those replies is managed by the NRL Pump information flow security mechanism. It is interesting to note that the Pump, at least in principle, does not have event-based covert channels because a “high” process connected to a Pump is not capable of causing distinguishable events.
Moskowitz2 and others address sophisticated timing-related covert channels that exist in systems with strong information flow boundaries. The approach is another example of a channel that would be of no significance, if there were no defenses against less sophisticated channels. While their work is focused on anonymity mechanisms, the results apply to many forms of strong information flow boundaries. The channels addressed by their work are not timing channels per se, but they do relate to time, so they are distinct from event-based channels, which do not exploit time.
Event-based covert channels exploit neither storage contents nor timing, and can happen in networks with temporal neutrality. Instead, the occurrence of events is counted. Consider a system with strong information-flow boundaries in which there are at least two classes of externally visible events: the distinguished event used to form the statistical channel, which we denote by x, and the other events, which we denote by y. Both classes of events are visible outside of the system's information flow boundary. An insider, referred to as Alice for purposes of discussion, wishes to transmit a message to Eve but Eve is outside the system's information flow boundary, as shown in FIG. 1. In practice, Alice is not a person but one or more information technology devices that are being exploited by a Trojan horse or other malicious program. Alice cannot control any bit patterns associated with either class of event, nor can she affect the order or timing of the events. What Alice can do is cause event x or y to happen, outside the information flow boundary. In theory, events x or y could be delayed indefinitely, but in practice, the system Alice is using most probably will provide best effort service and the events will happen shortly after Alice requests them.
The events used to form these channels can be any phenomenon that might be found or used in information technology including not only electrical, mechanical, radio, and infrared signals but also computation events such as creation, communication, receipt, storage, or destruction of message or database record.