Systems and methods for creating covert channels using packet frequencies

• US 20030091064A1
• Filed: 10/07/2002
• Published: 05/15/2003
• Est. Priority Date: 11/15/2001
• Status: Abandoned Application

• Current Assignee: BBN Technologies (Rtx Corporation)
• Original Assignee: BBN Technologies (Rtx Corporation)
• Inventors: Partridge, Craig, Cousins, David B.
• Application Number:
  US10/265,961
• Publication Number:
  US 20030091064A1
• Time in Patent Office: Days
• US Class Current: 370/465
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A system (130) receives a covert message from a transmit device (110). The system (130) monitors the transmission of packets from the transmit device (110) to a receive device (120). The transmit device (110) transmits the packets using a transmission pattern that is unknown to the receive device (120). The system (130) receives a covert message from the monitored transmission using the transmission pattern.

Claims

1. In a network comprising a first device, a second device, and a third device, a method for sending a message between the first device and the third device, comprising:

transmitting packets from the first device to the second device at a fixed interval, the fixed interval being known by the third device;

monitoring, via the third device, the transmitting of packets from the first device to the second device; and

detecting, via the third device, a message from the first device when packets are detected at the fixed interval.

2. The method of claim 1 wherein a value of the fixed interval is communicated to the third device prior to the first device transmitting packets to the second device at the fixed interval.

3. The method of claim 1 further comprising:

performing frequency analysis on the monitored-transmission.

4. The method of claim 3 wherein the detecting includes:

detecting spikes in a frequency graph at the fixed interval.

5. The method of claim 1 wherein the fixed interval includes an uncommon packet transmission interval.

6. The method of claim 1 wherein the message includes a single bit.

7. The method of claim 1 wherein the message includes more than one bit.

8. The method of claim 1 wherein the fixed interval includes a plurality of fixed intervals.

9. The method of claim 8 wherein the transmitting includes:

transmitting packets from the first device to the second device at a first one of the plurality of fixed intervals for a first time period, and

transmitting, after the first time period, packets from the first device to the second device at a second one of the plurality of fixed intervals for a second time period.

10. The method of claim 9 wherein the first time period and the second time period are equal.

11. The method of claim 8 wherein at least one of the plurality of fixed intervals includes an uncommon packet transmission interval.

12. The method of claim 1 wherein the packets transmitted by the first device include encrypted packets.

13. In a network comprising a first device, a second device, and a third device, the third device comprising:

a memory configured to store instructions; and

a processor configured to execute the instructions to;

monitor packets transmitted from the first device to the second device, the packets being transmitted at a fixed interval known by the third device, and

detect a message from the first device when packets are detected at the fixed interval.

14. The third device of claim 13 wherein the processor is further configured to:

perform frequency analysis on the monitored transmission.

15. The third device of claim 14 wherein, when detecting a message, the processor is configured to:

detect spikes in a frequency graph at the fixed interval.

16. The third device of claim 13 wherein the fixed interval includes an interval that is unlikely to occur in normal traffic.

17. The third device of claim 13 wherein the message includes a single bit.

18. The third device of claim 13 wherein the message includes more than one bit.

19. The third device of claim 13 wherein the fixed interval includes a plurality of fixed intervals.

20. The third device of claim 19 wherein, when detecting, the processor is configured to:

detect packets transmitted from the first device to the second device at a first one of the plurality of fixed intervals for a first time period, and

detect, after the first time period, packets from the first device to the second device at a second one of the plurality of fixed intervals for a second time period.

21. The third device of claim 19 wherein at least one of the plurality of fixed intervals includes an interval that is unlikely to occur in normal traffic.

22. A computer-readable medium containing instructions for controlling one or more processors to perform a method for receiving a covert message from a transmit device, the method comprising:

monitoring packets transmitted from the transmit device to a receive device, the packets being transmitted at a fixed interval, and

receiving a message from the transmit device when packets are detected at the fixed interval.

23. The computer-readable medium of claim 22 wherein the fixed interval includes an uncommon transmission interval.

24. A system for transmitting a covert message, comprising:

a memory configured to store a value set to a fixed interval; and

a transmitter configured to;

receive the value, and

transmit two or more packets, each packet transmission being separated in time by the fixed interval, where a different device detects a covert message from the system when the encrypted packets are transmitted at the fixed interval.

25. In a network comprising a first device, a second device, and a third device, a method for sending a message between the first device and the third device, comprising:

transmitting a plurality of packet streams from the first device to the second device at a plurality of corresponding intervals;

monitoring, via the third device, the transmitting of packets from the first device to the second device; and

receiving, via the third device, a message from the first device when packets are detected at the plurality of corresponding intervals during a time period.

26. The method of claim 25 wherein the third device receives a first value representing the number of intervals and second values corresponding to durations of the plurality of intervals prior to the first device transmitting the plurality of packet streams.

27. The method of claim 25 wherein each of the plurality of intervals is different.

28. The method of claim 25 further comprising:

performing frequency analysis on the monitored transmission.

29. A computer-readable medium containing instructions for controlling one or more processors to perform a method for receiving a covert message from a transmit device, the method comprising:

monitoring a transmission of a plurality of packet streams from the transmit device to a receive device, the plurality of packet streams being transmitted at different intervals; and

receiving a message from the first device when packets are detected at the different intervals during a time period.

30. The computer-readable medium of claim 29 wherein the receiving includes:

performing frequency analysis on the monitored transmission.

31. A system for receiving a covert message, comprising:

a memory configured to execute instructions; and

a processor configured to execute the instructions to;

monitor a transmission of a plurality of packet streams from a transmit device to a receive device, each of the plurality of packet streams being transmitted at different intervals; and

receive a covert message from the transmit device when packets are detected at the different intervals during a time period.

32. The system of claim 31 wherein, when receiving the covert message, the processor is configured to:

perform frequency analysis on the monitored transmission.

33. In a network comprising a first device, a second device, and a third device, a method for sending a message between the first device and the third device, comprising:

transmitting packets from the first device to the second device based on a varying transmission pattern, the varying transmission pattern including varying the transmission of packets from a first transmission interval to a second transmission interval over a predetermined time period;

monitoring, via the third device, the transmitting of packets from the first device to the second device; and

receiving, via the third device, a message from the first device when packets are detected at the varying transmission pattern.

34. The method of claim 33 wherein the transmitting includes:

encrypting the packets, and

transmitting the encrypted packets based on the varying transmission pattern.

35. The method of claim 33 wherein the varying transmission pattern includes a frequency modulated sweep.

36. The method of claim 33 wherein the varying transmission pattern includes two frequency modulated sweeps that sweep in opposite directions.

37. A system for receiving a covert message, comprising:

a memory configured to execute instructions; and

a processor configured to execute the instructions to;

monitor a transmission of packets from a first device to a second device, the first device varying the transmission of packets from a first transmission interval to a second transmission interval over a predetermined time period, and

receive a covert message from the first device when packets are detected at an interval that varies from the first transmission interval to the second transmission interval over the predetermined time period.

38. A computer-readable medium containing instructions for controlling one or more processors to perform a method for receiving a covert message from a transmit device, the method comprising:

monitoring a transmission of packets from the transmit device to a receive device, the transmit device varying the transmission of packets from a first transmission interval to a second transmission interval over a predetermined time period, and

receiving a covert message from the transmit device when packets are detected at an interval that varies from the first transmission interval to the second transmission interval over the predetermined time period.

39. In a network comprising a first device, a second device, and a third device, a method for sending a message between the first device and the third device, comprising:

transmitting packets from the first device to the second device using a spread spectrum transmission pattern;

monitoring, via the third device, the transmitting of packets from the first device to the second device; and

receiving, via the third device, a message from the first device when packets are detected at the spread spectrum transmission pattern.

40. The method of claim 39 wherein the spread spectrum transmission pattern includes a frequency hop spread spectrum (FHSS) hopping pattern.

41. The method of claim 40 wherein the FHSS hopping pattern is transmitted to the third device prior to the first device transmitting packets to the second device.

42. The method of claim 41 wherein the FHSS hopping pattern is unknown to the second device.

43. The method of claim 40 further comprising:

synchronizing, via the third device, to the FHSS hopping pattern.

44. A system for receiving a covert message, comprising:

first logic configured to monitor a transmission of packets from a first device to a second device, the first device transmitting the packets so that an interval between packet transmissions creates a set of frequencies, the set of frequencies being managed to achieve a spread spectrum transmission pattern; and

second logic configured to receive a covert message from the monitored transmission using the spread spectrum transmission pattern.

45. The system of claim 44 wherein the spread spectrum transmission pattern includes a frequency hop spread spectrum (FHSS) hopping pattern.

46. The system of claim 45 further comprising:

third logic configured to receive the FHSS hopping pattern prior to the first device transmitting packets to the second device.

47. The system of claim 44 further comprising:

fourth logic configured to synchronize the system to the FHSS hopping pattern.

48. A computer-readable medium containing instructions for controlling one or more processors to perform a method for receiving a covert message from a transmit device, the method comprising:

monitoring a transmission of packets from the transmit device to a receive device, the transmit device transmitting the packets using a spread spectrum transmission pattern that is unknown to the receive device; and

receiving a covert message from the monitored transmission using the spread spectrum transmission pattern.

49. In a network comprising a first device, a second device, and a third device, a method for sending a message between the first device and the third device, comprising:

transmitting packets from the first device to the second device using a transmission pattern that is unknown to the second device;

monitoring, via the third device, the transmitting of packets from the first device to the second device; and

receiving, via the third device, a message from the monitored transmission using the transmission pattern.

50. The method of claim 49 wherein the transmission pattern includes a spread spectrum transmission pattern.

51. The method of claim 49 wherein the transmission pattern includes transmitting packets at one or more fixed intervals.

52. The method of claim 49 wherein the transmission pattern includes transmitting a plurality of packet streams at a plurality of corresponding intervals.

53. The method of claim 49 wherein the transmission pattern includes varying the transmission of packets from a first transmission interval to a second transmission interval over a predetermined time period.

54. A system for receiving a covert message, comprising:

means for monitoring a transmission of packets from a first device to a second device, the transmission of packets being based on a transmission pattern unknown to the second device; and

means for receiving a message from the monitored transmission using the transmission pattern.

55. In a network comprising a first device, a second device, and a third device, a method for sending a covert message between the first device and the third device, comprising:

transmitting packets from the first device to the second device using a transmission pattern that represents, based on a timing of individual packet transmissions, a portion of a frequency spectrum, the first device using a spectrum-based transmission technique to covertly transmit the message to the third device in the transmission of packets to the second device;

monitoring, via the third device, the transmission of packets from the first device to the second device; and

receiving, based on the monitoring, the covert message from the first device when the first device transmits packets using the transmission pattern.

56. The method of claim 55 wherein the spectrum-based transmission technique includes an optical spectrum-based transmission technique.

57. The method of claim 55 wherein the spectrum-based transmission technique includes a radio spectrum-based transmission technique.

58. A system for receiving a covert message, comprising:

a memory configured to store instructions; and

a processor configured to execute the instructions to;

monitor a transmission of packets from a first device to a second device, the first device transmitting the packets using a transmission pattern that represents, based on a timing of individual packet transmissions, a portion of a frequency spectrum, the first device using a spectrum-based transmission technique to covertly transmit a message to the system in the transmission of packets to the second device, and

receive, based on the monitoring, the covert message from the first device when the first device transmits packets using the transmission pattern.

59. The system of claim 58 wherein the spectrum-based transmission technique includes an optical spectrum-based transmission technique.

60. The method of claim 58 wherein the spectrum-based transmission technique includes a radio spectrum-based transmission technique.