# Design and Evaluation of Steganographic Channels in Fifth-Generation New Radio +
###### Abstract  
Mobile communication is ubiquitous in everyday life. The fifth generation of mobile networks (5G) introduced 5G New Radio as a radio access technology that meets current bandwidth, quality, and application requirements. Network steganographic channels that hide secret message transfers in an innocent carrier communication are a particular threat in mobile communications as these channels are often used for malware, ransomware, and data leakage. We systematically analyze the protocol stack of the 5G-air interface for its susceptibility to network steganography, addressing both storage and timing channels. To ensure large coverage, we apply hiding patterns that collect the essential ideas used to create steganographic channels. Based on the results of this analysis, we design and implement a network covert storage channel, exploiting reserved bits in the header of the Packet Data Convergence Protocol (PDCP). the covert sender and receiver are located in a 5G base station and mobile device, respectively. Furthermore, we sketch a timing channel based on a recent overshadowing attack. We evaluate our steganographic storage channel both in simulation and real-world experiments with respect to steganographic bandwidth, robustness, and stealthiness. Moreover, we discuss countermeasures. Our implementation demonstrates the feasibility of a covert channel in 5G New Radio and the possibility of achieving large steganographic bandwidth for broadband transmissions. We also demonstrate that the detection of the channel by a network analyzer is possible, limiting its scope to application scenarios where operators are unaware or ignorant of this threat. Keywords:information hiding; network steganography; mobile networks; 5G +
Footnote †: These authors contributed equally to this work. via a network covert channel [1]. Because of the richness of 5G, the attacker has a wealth of protocols to choose from. While the possibilities for covert channels in 4G (also known as long-term evolution (LTE))-air interface protocols were investigated in the past [2], its successor, 5G, introduced new features and protocols for the air interface, called 5G New Radio [3], to address usage scenarios like enhanced mobile broadband, ultra-reliable and low-latency communication, and massive machine-type communication. Therefore, new possibilities for covert channels could arise. Although 5G is a widespread communication medium, it has not been investigated systematically for covert channels, which are often used for malicious purposes, which is a notable research gap and motivated us to investigate 5G New Radio protocols to investigate the possibility of using covert channels to close this gap. Our research expands upon the state of the art, which is discussed in Section 2.3. As an innovation over the prior methods, we provide the first systematic analysis of the protocols in 5G New Radio with respect to the possibility of using covert channels. As another novelty over the prior method, we perform this systematic analysis with the help of hiding patterns [4] to find as many potential covert channels as possible. To the best our knowledge, this is the first study that has applied hiding pattern analysis to 5G New Radio protocols. We extend the analysis of storage covert channels in our previous work [5], and, as another innovation, we provide the first systematic analysis of 5G New Radio protocols with respect to timing covert channels, again by applying hiding patterns. Building on the analyses above, we provide another innovation in the design and implementation of the first network storage covert channel in the Packet Data Convergence Protocol (PDCP). Compared to our previous work [5], the implementation is extended from simulation to real-world equipments.