The method can detect cover timing channels by
- reproducing the timing of every network output;
- comparing the observed timing to the reproduced timing; and
- issuing an alert if there is any discrepancy.
Penn researchers have built a time deterministic replay prototype called Sanity. It reproduces timing to within 2% on commodity hardware. It can be used to detect a variety of existing and novel covert timing channels with perfect accuracy.
All detectors can detect IPCTC with perfect accuracy, existing detectors do worse for more sophisticated channels, and existing detectors cannot detect "Needle in a haystack" well. Sanity detects all channels with perfect accuracy! No false positives, no false negatives.
Covert Timing Channels with Time-Deterministic Detecting Replay, Ang Chen, W. Brad Moore, Hanjun Xiao, Andreas Haeberlen, Linh Thi Xuan Phan, Micah Sherr, and Wenchao Zhou. 11th USENIX Symposium on Operating Systems Design and Implementation (OSDI '14), Broomfield, CO, October 2014.
Docket # 15-7281