A formal test for detecting information leakage via covert channels

With the emergence of computers in every day activities and with the ever-growing complexity of networks and network communication protocols, covert channels are becoming an eminent threat to the confidentiality of information. We propose a technique to detect confidential information leakage via covert channels. The proposed technique is based on relational algebra. It provides tests to verify the existence of a leakage of information via a monitored covert channel. The technique also provides computations which show how the information was leaked if a leakage exists. Our focus is limited to protocol-based covert channels and instances where the users of covert channels modulate the information that is being sent; either by encryption, or some other form of encoding. We discuss possible applications of the proposed technique in digital forensics and cryptanalysis. We also report on a prototype tool that allows for the automation of the proposed technique.