Covert channels in LAN protocols

Abstract

Encryption is generally understood as being the basic mechanisms for LAN security. However, usage of encryption finds its limitations in case of an unauthorized information flow via covert channels. Some covert storage and timing channels inherent in a LAN's architecture are already described in the literature. This paper takes a more general approach. It shows, that there is a potential of unused bandwidth in commonly used LAN protocols (IEEE 802.2, 802.3, 802.4, 802.5), which might be exploitable as covert channel. The key point is, that exploitation of this potential of unused bandwidth is not a question of a LAN's architecture, but is strongly dependent on the design of its internal interfaces and on its implementations. The paper describes how these channels may be blocked and emphasizes the necessity to investigate the design and implementation of the protocols as part of an evaluation of a LAN.