## 5 The Proposed Approach
### Formal Description  
In the following, we formally describe our protocol.  
Whenever the publisher wants to send a message \(M\), it generates \(k\) parts \(P_{1},\ldots,P_{k}\) as follows:  
* \(P_{1},\ldots,P_{k-1}\) are randomly extracted of a size equal to the size of \(M\).
* \(P_{k}=M\oplus P_{1}\oplus\ldots\oplus P_{k-1}\), where \(\oplus\) denotes the XOR (exclusive or) operator.  
We observe that the introduction of the XOR operator causes \(P_{k}\) to appear random.  
Next, the publisher and subscribers must choose the broker and topic on which to publish each part. We denote as \(B\) the list of brokers whose size is \(|B|\) and by \(|T_{B}|\) the number of topics for each broker. We denote by \(max_{B}(|T_{B}|)\) the maximum number of topics among all the brokers.  
The topics and the brokers are extracted as follows. The publisher and the subscribers share a seed of a Pseudo-Random Number Generator (PRNG). For each extracted value of the PRNG, the first \(k\log_{2}(|B|)\) bits index the \(k\) brokers to which the parts will be sent. The subsequent \(k\log_{2}(max_{B}(|T_{B}|))\) bits index the \(k\) topics of the previously chosen brokers on which the parts will be published.  
We focus now on a single part \(P_{i}\) to be sent to a single broker on a specific topic. It will be sent over a covert channel that exploits the length field of the MQTT header. We assume that the parts are small and therefore that the message size is small.  
The publisher and the subscribers also share a prime modulus \(n\) and an exponent \(a\). Consider the group \(\mathbb{Z}_{n}^{*}\). The publisher calculates the following:  
\[L=(P_{i}^{a}\mod n)\mod l\]  
where \(l\) is the maximum number of bytes of an MQTT message (i.e., 268,435,456). This value \(L\) will be inserted into the length field of an MQTT packet header. The payload of the MQTT packet will be dummy data satisfying this length.  
To publish the other parts, the publisher will repeat the above operations by extracting the subsequent values from the PRNG.  
Now let us focus on the operations of a subscriber. The subscriber extracts the same value from the PRNG (since it shares the same secret with the publisher). This allows the subscriber to subscribe to the same brokers and topics as the publisher. However, on these topics, external publishers may also be publishing, and the subscriber (in the standard MQTT protocol) cannot identify which publisher owns each message. Therefore, to retrieve the parts \(P_{1},\ldots,P_{k}\), the subscriber performs the following operations for each packet received on that topic and broker.  
Specifically, using the same \(a\) and \(n\), the subscriber verifies all possible values of \(P_{i}^{\prime}\) such that:  
\[L^{\prime}=\left(P_{i}^{\prime a}\mod n\right)\mod l\]  
where \(L^{\prime}\) is the length of the current packet. In other words, the subscriber performs brute force on all possible values of \(P_{i}^{\prime}\). As mentioned above, the length of \(P_{i}^{\prime}\) is sufficiently small to make such brute force feasible. If this equality does not hold for any \(P_{i}^{\prime}\), then that packet does not contain any covert channel and can be ignored. This operation is performed for each broker and topic extracted from the current PRNG value. In this way, the subscriber can retrieve \(k\) parts. This allows them to reconstruct the original message by leveraging the XOR properties as follows:  
\[M=P_{1}\oplus P_{2}\oplus\ldots\oplus P_{k}\]  
We conclude this section by observing that since \(a\) and \(n\) are known, the subscriber can precompute all possible values of \(P_{i}^{\prime}\) in advance. However no rainbow table attacks can be performed, i.e., the transmission of the same message \(M\) is not always related tothe same length \(L\). This is because each time the publisher can choose different parties to represent the same message \(M\).