# Trends and Challenges in Network Covert Channels Countermeasures
## 5 Covert Channel Limitation, Elimination and Prevention
### Elimination and Limitation  
One of the first ideas to tame covert channels is the Network Pump, theorized and designed by [PERSON], [PERSON] and [PERSON] in a paper published in 1996 [53; 54]. The Pump has been originally designed to prevent the possibilities of using a fraction of the traffic (e.g., ACKs) to build covert channels between processes with different security levels (i.e., high and low in the original work). In essence, it can be used to connect different portions of the networks and data are \"pumped\" upon proper queuing and ACKs are sent in a probabilistic manner as to reduce the possibility that an attacker can create a covert channel. An important contribution of the Pump is making clear that it is only capable of limiting the risk of setting up a covert channel. In general, the complete elimination of the chance that a network can be used for setting up a covert channel is an inefficient and unrealistic goal [55]. For instance, guaranteeing that HTTP will not be used to tunnel information can be only achieved by completely blocking its utilization in a given scenario, which is mostly unfeasible. Instead, it would be possible to design a countermeasure to pursue a _tradeoff_ between the security risk and the functioning of the network both in terms of performances and functionalities. Always referring to the HTTP case, a possible approach tries to \"sanitize\" the various flows in order to reduce the carriers that can be used to contain secret information [56]. In this case, the semantic of the protocol is evaluated and restored as close as possible to the one prescribed by the RFCs. Thus, the countermeasure mainly acts by reducing the ambiguities (e.g., the use of capitalized strings within the protocol to encode data) to make the channel less attractive by the attacker or limiting its bandwidth. Alas, objects exchanged via HTTP can still contain hidden data. In this case, ad-hoc proxies can be deployed to check inline objects against steganographic contents and sanitize them [57]. This requires a non-negligible amount of computing resources and also accounts for the presence of specific detectors/sanitizers for each considered inline object (e.g., protocol headers, images, audio, video and additional plugins). Similar consideration can be done for other applications, e.g., for the VoIP. For instance, network-related protocols can be restored, whereas random noise can be added to the voice information as to disrupt or reduce the performances of the covert channel [37]. The examples allow to underline the magnitude of the problem space to be faced for completely eliminating a channel, especially when there is the need of operating at higher levels of the protocol architecture. We point out that, this sort of pseudo-proxying could break the end-to-end semantics of the overt traffic flow, thus leading to additional security and privacy issues. For the case of storage channels, classical approaches aim at restoring unused fields within header to default values whenever possible or to insert specific padding sequences to overwrite manipulation attempts [9]. An interesting aspect to be considered regards how protocols designed decades ago now behave in the modern Internet. Taking as a paradigmatic example IPv6, the investigation in [30] highlights that the diffuse lack of networks supporting Quality of Service guarantees permits an attacker to use the Traffic Class to embed data. Instead, in some circumstances, the network could protect itself. In fact, the presence of transitional mechanisms or middleboxes (e.g., network address translation) account for manipulations of the header and buffering operations, which can disrupt the most fragile covert channels. A further aspect to consider is the increasing use of encryption and secure variant of protocols. This multiplies the opportunities for an attacker to have additional carriers but also boost the design of \"more secure\" implementations to mitigate the risks of being abused to set covert channels.