## 5 The Proposed Approach
### Design Overview  
Consider a publisher and a set of subscribers who wish to communicate secretly. The publisher and the subscribers share a list of public brokers and a list of topics on which they want to publish. Realistically, both brokers and topics can be obtained from Shodan [52; 53]. We do not have specific requirements for topics and brokers, except that topics should be chosen to accommodate payloads of varying sizes (for example, topics such as \"temperature\", in which data are generally very short and fixed in size, should be excluded).  
Suppose \(M\) is the secret message being transmitted to the subscribers. Let \(d\) be its length. The idea is to design a covert channel between the publisher and the authorized subscribers. Indeed, the covert channel can be detected only by those subscribers who own a given secret key. We assume that this key is pre-shared among the authorized parties.  
The covert channel is based on a combination of the transmission of \(k\) messages generated on the basis of \(M\), which we call _parts_, with the reverse of \(k\) modular exponentiations, feasible only with the knowledge of the secret key.  
Specifically, the \(k\) parts are obtained first by generating \(k-1\) random messages of the same size as \(M\). Then, the \(k^{th}\) part is obtained as the bit-wise exclusive or between the \(k-1\) random parts and the message \(M\). Consider that, thanks to the properties of the exclusive or (denoted by \(\oplus\)), for which \(A\oplus A=0\) and \(0\) is the null element for the operator, if a subscriber receives the \(k\) parts, they can easily reconstruct \(M\) simply by computing the exclusive or between all the \(k\) parts. But, this would be a very weak covert channel. Therefore, the \(k\) parts cannot be sent clearly. They are sent in an indirect way. For each them, first, a modular exponentiation, whose exponent is the secret key, is applied. Then, a random message whose length is equal to the above exponentiation is sent. Thus, the subscriber can detect a part among all the received messages by identifying the MQTT message \(x\) for which there exists a string \(y\) of length \(d\) such that the modular exponentiation of this string with the secret key has a length equal to the length of \(x\). The identified part is just such a string, \(y\). Once the subscribers have received \(k\) parts, they can compute \(M\), then the hidden transmission is achieved. Observe that only the authorized subscribers (owing the secret key) are able to identify the \(k\) parts and then to receive \(M\). For the other subscribers, there is no way to obtain \(y\), because they do not know the exponent. To make this infeasible, it suffices to set \(d\) to a small value and the length of the key to a large value. This way, the authorized subscribers have to perform only \(2^{d}\) attempts (in the worst case) per received message. \(d\) should be fixed in such a way that the computation is feasible. Instead, an unauthorized subscriber should perform \(2^{d}\cdot 2^{s}\) attempts, where \(s\) is the length of the key. Therefore, the standard size of cryptographic keys (for example, 128 bits) is enough to make the above operation infeasible, which is also burdened by the multiplicative factor \(2^{d}\).  
\begin{table}
\begin{tabular}{l c c c} \hline \hline
**Approach** & **Data Content** & **Sender Identity** & **Sender Activity** \\ \hline Encryption-based & yes & no & no \\ Anonymous & yes & yes & no \\ communication & yes & yes & yes \\ Covert channel & yes & yes & yes \\ \hline \hline \end{tabular}
\end{table}
Table 1: Security feature comparison of encryption-based, anonymous communication, and covert channel approaches.