Methods, systems and computer readable media for detecting covert timing channels

Technology Overview:

The method can detect covert timing channels by:

1. reproducing the timing of every network output;
2. comparing the observed timing to the reproduced timing; and
3. issuing an alert if there is any discrepancy.

Penn researchers have built a time deterministic replay prototype called Sanity. It reproduces timing to within 2% on commodity hardware. It can be used to detect a variety of existing and novel covert timing channels with perfect accuracy.

Advantages:

All detectors can detect IPCTC with perfect accuracy, existing detectors do worse for more sophisticated channels, and existing detectors cannot detect "Needle in a haystack" well.  Sanity detects all channels with perfect accuracy!  No false positives, no false negatives.

 

 

 

 

 

Intellectual Property:

Desired Partnerships:

  • License
  • Co-development

Patent Information:

Contact

Terry Bray

Executive Director, SEAS/SAS Licensing Group
University of Pennsylvania

INVENTORS

Keywords

Docket # 15-7281