# Design and Evaluation of Steganographic Channels in Fifth-Generation New Radio +
## 4 Protocol Analysis and Covert Channel Design
### Sketch of a Timing Covert Channel  
An example scenario of the attack from [6] is controlling the flight of a drone with a virtual reality (VR) headset. Both drone and headset have mobile 5G connectivity, and they are normally in different cells. The VR headset is the sender (in the context of covert channels: the overt sender), which turns headset movements into flight commands that are sent to the drone, which is the receiver (in the context of covert channels: overt receiver and possibly covert receiver). The commands arrive with regular distances. The drone follows the commands and replies with a video stream that is displayed on the VR headset.  
By observing ACK messages from the base station, the attacker (in the context of covert channels: the covert sender), who is in the same cell as the sender, is able to create and send fake negative ACK messages from time to time by overshadowing. This triggers the sender to repeat messages, which in turn delays further messages. Now the distances between command messages arriving at the receiver are varying. In the original attack scenario, the delay of commands may delay the turn of the drone and thus lead to contact between the drone and an obstacle, resulting in the possible loss of the drone.  
In our covert channel scenario, the drone (as covert receiver) can notice the variation in the time intervals between commands and decode them as bits with values 0 and 1 depending on the delay (which can be controlled by the attacker/covert sender via the number of packets that it requests to be retransmitted). Also, some entity external to the drone may notice the change in movements induced by the delays in commands, i.e., the covert receiver could also be external to the drone.  
This covert channel is noisy as there are other reasons for retransmissions. To make the covert channel robust, the secret message must be protected with an error correction code and possibly even with an erasure code, as a retransmission from other causes might be falsely interpreted as the transmission of an additional bit of the secret message.  
The covert channel is not too stealthy, as the covert sender is actively sending, and the increased number of retransmissions might be perceived as an anomaly or at least as a degradation of the communication quality, i.e., the covert channel can have a negative influence on the carrier. Yet, the covert receiver can act in a stealthy manner, as it is not forced to extract data from a communication or correct bits modified by the covert sender: it only observes the arrival times of packets.  
The covert bandwidth cannot be high in order to remain stealthy. Measurement of the covert bandwidth would require implementation of the whole scenario and covert channel, which was outside the scope of the present research.  
The countermeasures could be rather general: any countermeasure against overshadowing attacks would eliminate this covert channel. Also, normalization of packet distances could at least limit the bandwidth of the covert channel, but this might increase the negative impact on the carrier. Further investigation of countermeasures would also necessitate an implementation, which was out of scope here.