Abstract We explore strategies for manipulating the topology of a network to promote increased and pragmatic high assurance systems. Topology matters to network threats and security, and the relative distance between nodes can impact the rate of dispersion of viruses, as well as access times in denial of service, probing, and insider threat attacks. We suggest methods to separate threatening and threatened nodes with enough hops to reduce and degrade risks. This work provides network analysts with an option to include other measures such as risk assessments to the construction and management of high assurance systems. We consider a scaled down model to demonstrate the proof of concept using artificial data. Specifically, we explore the efficacy of ring networks and the structure that occurs on k‐hop networks when there are a prime number of nodes. We introduce techniques for the randomization of network topologies to manage real‐time risk and provide a dynamic means to improve network security by increasing technical debt to a potential attacker.

We study the minimum latency broadcast scheduling problem, in which a single source has a quantity of data that must be transmitted to all other nodes in a multi-hop network in minimum time. Aside from the obvious application to classical communications, this problem also relates to some more general problems in the field of network science. Previous approaches to scheduling have assumed a simplistic collision model of interference, while others have studied the more realistic physical model of total received interference power. Existing suboptimal approaches for transmitting the data typically assume a collision-free, fixed-rate, single packet transmission. In this work, we devise an optimal approach for broadcast under a physical interference model with fixed-rate, single packet transmission by converting it to a shortest path problem for an unweighted, undirected graph. Since this optimal approach does not scale well, we also consider a suboptimal layered approach which separates the routing and scheduling functions, but relaxes the fixed-rate, single packet assumption. This goes beyond the signal-to-interference-plus-noise (SINR) threshold model to allow for rate adaptation as a function of SINR. We include improvements on previous routing approaches, and we formulate a linear programming approach to the variable-rate scheduling for broadcast. Simulations show that in some special cases, this variable-rate layered approach can even outperform the optimal fixed-rate, single packet approach.

Botnets continue to threaten the security landscape of computer networks worldwide. This is due in part to the time lag present between discovery of botnet traffic and identification of actionable intelligence derived from the traffic analysis. In this article we present a novel method to fill

The Naval Research Laboratory (NRL) Network Pump, or Pump, is a standard for mitigating covert channels that arise in a multilevel secure (MLS) system when a high user (HU) sends acknowledgements to a low user (LU). The issue here is that HU can encode information in the "timings" of the acknowledgements. The Pump aims at mitigating the covert timing channel by introducing buffering between HU and LU, as well as adding noise to the acknowledgment timings. We model the working of the Pump in certain situations, as a communication system with feedback and use then this perspective to derive an upper bound on the capacity of the covert channel between HU and LU in the Pump. This upper bound is presented in terms of a directed information flow over the dynamics of the system. We also present an achievable scheme that can transmit information over this channel. When the support of the noise added by Pump to acknowledgment timings is finite, the achievable rate is nonzero, i.e., infinite number of bits can be reliably communicated. If the support of the noise is infinite, the achievable rate is zero and hence a finite number of bits can be communicated.

The NRL Network Pump®, or Pump, is a standard for mitigating covert channels that arise in a multi-level secure (MLS) system when a high user (HU) sends acknowledgements to a low user (LU). The issue here is that HU can encode information in the “timings” of the acknowledgements. The Pump aims at mitigating the covert timing channel by introducing buffering between HU and LU, as well as adding noise to the acknowledgment timings. Here, for the first time, we model the workings of the Pump in certain situations, as a communication system with feedback and use then this novel perspective to derive a upper bound on the rate of the covert channel between HU and LU in the Pump, in specific situations. This upper bound is presented in terms of a directed information flow over the dynamics of the system.

A theoretical channel to communicate covertly through mix-firewalls has been discussed in previous work. This paper describes implementing this theoretical construction in an actual system. Practical issues involved in implementation are analyzed, and an actual design is given here. Suggested parameters for concatenated codes for the experimental channel are also provided, based on experimental results. We compare our numerically computed information theoretic results for the data rate of covert channels through timed mix-firewalls to the data rate obtained by our actual construction of these covert channels.

This paper traces the ten plus year history of the Naval Research Laboratory's Pump idea. The Pump was theorized, designed, and built at the Naval Research Laboratory's Center for High Assurance Computer Systems. The reason for the Pump is the need to send messages from a "low" enclave to a "high" enclave, in a secure and reliable manner. In particular, the Pump was designed to minimize the covert channel threat from the necessary message acknowledgements, without penalizing system performance and reliability. We review the need for the Pump, the design of the Pump, the variants of the Pump, and the current status of the Pump, along with manufacturing and certification difficulties.

We propose an inference prevention agent as a tool that enables each of the databases in a distributed system to keep track of probabilistic dependencies with other databases and then use that information to help preserve the confidentiality of sensitive data. This is accomplished with minimal sacrifice of the performance and survivability gains that are associated with distributed database systems.

At present, "capacity" is the prevailing paradigm for covert channels. With respect to steganography, however, capacity is at best insufficient, and at worst, is incorrect. In this paper, we propose a new paradigm called "capability" which gauges the effectiveness of a steganographic method. It includes payload carrying ability, detectability, and robustness components. We also discuss the use of zero-error capacity for channel analysis and demonstrate that a JPEG compressed image always has the potential to carry hidden information.

We discuss how steganography, in contrast to similar disciplines, requires a new paradigm based upon discontinuities and the absence of noise as a detection deterrent. Keywords: information hiding, steganography

Golomb analyzed the Z-channel, a memoryless channel with two input symbols and two output symbols, where one of the input symbols is transmitted with noise while the other is transmitted without noise, and the output symbol transmission times are equal. We generalize to the timed Z-channel, where the output symbol transmission times are not equal. The timed Z-channel appears as the basis for a large class of covert (communication) channels appearing in multilevel secure computer systems. We give a detailed mathematical analysis of the timed Z-channel and report a result expressing the capacity of the timed Z-channel as the log of the root of a characteristic equation. This generalizes Shannon's work on noiseless channels for this special case. We also report a new result bounding the timed Z-channel's capacity from below. We show how an interesting observation that Golomb reported for the Z-channel also holds for the timed Z-channel.

As computer systems become distributed and heterogeneous, there is strong movement in the commercial sector to ease the problems of interoperability and security. Many standards have been proposed for these problems. However, the commercial sector has not shown strong interest in providing cost effective high assurance multilevel security (MLS) solutions to the relatively small communities (e.g., intelligence, military) that require them. We introduce a practical, cost effective, and high assurance secure solution for multilevel distributed and heterogeneous environments using COTS components. The solution is based on an MLS architecture that consists of commercial single level hardware and software, and a few specialized security devices. We show how an MLS CORBA can be constructed from single level CORBAs and two security devices; the NRL Pump and the Starlight Interactive Link. We also introduce the concept of MLS cooperative computing which is a way to semi automate distributed computing among organizations at different security levels.

We examine a new way of looking at security violations, called insecurity flow.We express our new paradigm via a formal mathematical model that combines elements of graph theory and discrete probability.Prior work by Moore and Shannon on building reliable circuits out of unreliable components, and the physics community's interest in dynamical systems, especially percolation theory, motivates our work.

As computer systems become more open and interconnected, the need for reliable and secure communication also increases. The NRL (Naval Research Laboratory) Pump was introduced by Kang and Moskowitz (1993) to balance the requirements of reliability, congestion control, fairness and good performance against those of threats from covert channels and denial-of-service attacks. In this paper, we describe two prototype efforts. One (the event-driven Pump or E-Pump) implements the Pump at the process (top) layer in terms of a 4-layer network reference model, and the other (the DOS-Pump or D-Pump) implements the Pump at the transport layer. We then discuss lessons learned and how these lessons are to be used in deciding upon the final hardware implementation of the Pump.

Our timed Z-channel (a general case of the Z-channel) appears as the basis for a large class of covert channels. Golomb (1980) analyzed the Z-channel, a memoryless channel with two input symbols and two output symbols, where one of the input symbols is transmitted with noise while the other is transmitted without noise, and the output symbol transmission times are equal. We introduce the timed Z-channel, where the output symbol transmission times are different. Specifically, we show how the timed Z-channel applies to two examples of covert timing channel scenarios: a CPU scheduler and a token ring network. We then give a detailed analysis of our timed Z-channel. We report a new result expressing the capacity of the timed Z-channel as the log of the root of a trinomial equation. This changes the capacity calculation from an optimization problem into a simpler algebraic problem and illustrates the relationship between the noise and time factors. Further, it generalizes Shannon's (1948, 1949) work on noiseless channels for this special case. We also report a new result bounding the timed Z-channel's capacity from below. Finally, we show how an interesting observation that Golomb reported for the Z-channel also holds for the timed Z-channel.

A designer of reliable multi level secure (MLS) networks must consider covert channels and denial of service attacks in addition to traditional network performance measures such as throughput, fairness, and reliability. We show how to extend the NRL data Pump to a certain MLS network architecture in order to balance the requirements of congestion control, fairness, good performance, and reliability against those of minimal threats from covert channels and denial of service attacks. We back up our claims with simulation results.

A designer of reliable MLS networks must consider covert channels and denial of service attacks in addition to traditional network performance measures such as throughput, fairness, and reliability. We show how to extend the NRL data Pump to a certain MLS network architecture in order to balance the requirements of congestion control, fairness, good performance, and reliability against those of minimal threats from covert channels and denial of service attacks. We back up our claims with simulation results.>

We discuss the different ways of defining channel capacity for certain types of illicit communication channels. We also correct some errors from the literature, offer new proofs of some historical results, and give bounds for channel capacity. Special function techniques are employed to express the results in closed form. We are interested in a specific type of covert channel, a timing channel. A timing channel exists if it is possible for High to interfere with the system response time to an input by Low. Therefore, a timing channel is a communication channel where the output alphabet is constructed from different time values. However, the thrust of the paper is the analysis of timing channels that are discrete, memoryless, and noiseless. We call such a timing channel a simple timing channel (STC).>

Communication from a low- to a high-level system without acknowledgements will be unreliable; with acknowledgements, it can be insecure. We propose to provide quantifiable security, acceptable reliability, and minimal performance penalties by interposing a device (called the Pump) to push messages to the high system and provide a controlled stream of acknowledgements to the low system.

Using classical automata theory the authors show how noninterference can be viewed as a relatively simple phenomenon. They also give direction for future work concerning probabilistic security problems using classical automata theory.>

An optimization problem in calculating the bandwidth of a covert timing channel is discussed. In particular, the question of how dependent the bandwidth is on the magnitude of the modulation is addressed. A generalization of that covert channel is presented and its bandwidth (capacity) is studied. Attention is given to how the delay that HIGH uses to signal LOW affects the bandwidth. Increasing the delay lessens the noise but increases the time required to pass a symbol along the channel. What the optimal delay should be and how it influences the security of the system was studied. Because of the complicated nature of the formulas involved, closed-form solutions for some of the terms of interest cannot be given. Instead, numerical techniques and plotted results are used.>

The effect of noise on a simple covert timing channel is investigated. Shannon's information theory is used to quantify the resulting information flow across the channel. In particular, how a probabilistic response time to a query by the receiver affects the mutual information and channel capacity is studied. The channel capacity is expressed in terms of the critical probability for the mutual information function which is given in closed form in terms of Wright's hypergeometric function.>

The authors discuss how a noisy storage channel arises in the two phase commit protocol. The analysis is done through Shannon's information theory. They discuss how large the channel is and offer suggestions on how to diminish the channel capacity.>

Investigates the effects of noise upon a simple timing channel. Shannon's information theory (C. Shannon et al., 1949) is used to quantify the resulting information flow across the channel. In particular the author studies how a probabilistic response time to a query by a low user affects the mutual information and channel capacity. He claims that we will never eliminate all covert channels in a multi-user computer system without serious degradation of performance. Therefore, it is important to know how 'bad' the covert channels are. One way to do this is through an information theoretic capacity analysis.>

Restrictiveness is interpreted in terms of a quotient set of the states of a machine. Consideration is given to how restrictiveness can still allow certain probabilistic effects to open up a communication channel between high and low users of a computer system. Specifically, assigning probabilities to transitions in order to look for simple probabilistic channels is examined. The theory is then extended to deal with extended transitions. How Shannon's work on information theory can be used to analyze a system that is restrictive but nonetheless has a probabilistic channel is discussed.>