隐蔽信道新型分类方法与威胁限制策略  

Categorization of Covert Channels and Its Application in Threat Restriction Techniques

作　　者：王翀[1,2,3] 王秀利 吕荫润[1,2,3] 张常有[3] 吴敬征 关贝[5] 王永吉[1,3] WANG Chong;WANG Xiu-Li;LüYin-Run;ZHANG Chang-You;WU Jing-Zheng;GUAN Bei;WANG Yong-Ji(Cooperative Innovation Center,Institute of Software,Chinese Academy of Sciences,Beijing 100190,China;University of Chinese Academy of Sciences,Beijing 100049,China;State Key Laboratory of Computer Science(Institute of Software,Chinese Academy of Sciences),Beijing 100190,China;Central University of Finance and Economics,Beijing 100081,China;Qatar Computing Research Institute,HBKU,Doha 999043,Qatar)

机构地区：[1]中国科学院软件研究所协同创新中心,北京100190 [2]中国科学院大学,北京100049 [3]计算机科学国家重点实验室(中国科学院软件研究所),北京100190 [4]中央财经大学,北京100081 [5]Qatar Computing Research Institute,HBKU,Doha 999043,Qatar

出　　处：《软件学报》2020年第1期228-245,共18页Journal of Software

基　　金：国家自然科学基金(U1636213,61772507,61672508);国家重点研发计划(2017YFB1002300)。

摘　　要：隐蔽信道是指恶意通信双方通过修改共享资源的数值、特性或状态等属性,来编码和传递信息的信道.共享资源的选取,由隐蔽信道的类型与具体通信场景所决定.早期,存储隐蔽信道和时间隐蔽信道主要存在于传统操作系统、网络和数据库等信息系统中.近年来,研究重点逐渐拓展到了3类新型隐蔽信道,分别为混合隐蔽信道、行为隐蔽信道和气隙隐蔽信道.对近年来国内外隐蔽信道研究工作进行了系统的梳理、分析和总结.首先,阐述隐蔽信道的相关定义、发展历史、关键要素和分析工作.然后,根据隐蔽信道共享资源的类型以及信道特征,提出新的隐蔽信道分类体系.首次从发送方、接收方、共享资源、编码机制、同步机制、评价指标和限制方法这7个方面,对近年来新型隐蔽信道攻击技术进行系统的分析和归纳,旨在为后续隐蔽信道分析和限制等研究工作提供有益的参考.进而,讨论了面向隐蔽信道类型的威胁限制技术,为设计面向一类隐蔽信道的限制策略提供研究思路.最后,总结了隐蔽信道中存在的问题和挑战.Covert channels are communication channels that allow secret transfer of information between two malicious processes by modifying the value or modulating the timing behavior of shared resources.Shared resources in covert communications vary according to the underlying covert channels.Initially,covert storage channels and covert timing channels are widely existed in information systems.More recently,the focus has shifted towards three new kinds of covert channels,namely,covert hybrid channels,covert behavior channels,and air-gap covert channels.This study surveys existing techniques for constructing covert channels that have been reported in literature,especially the covert channels that are presented in recent years.First,the definition,history,and key elements of covert channels are introduced.Covert channel analysis is also included.Second,a categorization technique is proposed for these covert channels based on the shared resources and channel characteristics.The traditional and new covert channel attack techniques are systematically analyzed based on the seven key elements of the covert channels.Third,the countermeasures for covert channels aforementioned are also demonstrated to restrict the threat brought by covert channels and to provide guidelines for future works.Finally,the challenges and problems on covert channels are provided.

关 键 词：隐蔽通信 隐蔽信道 隐蔽信道分类 信息隐藏 行为隐蔽信道 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]