# Design and Evaluation of Steganographic Channels in Fifth-Generation New Radio +
## 6 Conclusions  
We analyzed the protocols of the 5G-air interface, called New Radio, to assess whether they are potentially suitable for a covert storage or timing channel. The analysis identified possibilities for the transmission of hidden information in all considered protocol layers. However, hiding information in these protocols would probably affect their functionality in most cases. Only the reserved bits in the protocol header can be used without any limitations for a covert storage channel. With five reserved bits, the PDCP offers the highest covert capacity. The covert parties are located in the 5G base station and in the mobile device. Thus, a leak by an insider, e.g., an employee of the base station operator, seems the most likely deployment scenario. In general, the proposed covert channel is suitable for the hidden transmission of arbitrary text encodings or binary data. However, both the theoretical and the practical proof of concept demonstrated the secret transmission of ASCII characters. Due to the limited covert capacity of the PDCP header in a packet, the one-byte characters are divided into two covert transmissions each. The covert channel was successfully implemented in a test setup with open source software. In the experimental tests, it was demonstrated that the covert capacity grows proportionally with the bandwidth of the overt traffic as it accounts for a fixed although small percentage of the data transmission bandwidth. The covert bandwidth also depends on the interval between the covert transmissions. Finally, it was shown that it is easy to detect the covert channel and to eliminate it with traffic normalization. However, this requires the network analyzer to have direct access to the protocol layer.  
Additionally, a timing channel in 5G New Radio was sketched based on an existing attack that employs fake status reports to trigger retransmits via overshadowing.  
Overall, the feasibility of implementing a covert channel in the 5G-air interface was demonstrated both theoretically and practically. Therefore, it is necessary to design and test more information hiding methods in the 5G domain based on our results. In particular, it would be important to verify whether the proposed hiding method has an impact on the quality of mobile connections with commercial 5G network equipment and mobile devices. Other future work could comprise implementing and evaluating the sketched timing covert channel based on the experimental scenario in [6] to explore AI-based anomaly detection countermeasures and to explore extensions of the presented storage channel to multiple malicious users.  
Conceptualization, M.W. and J.K.; methodology, M.W. and J.K.; software, M.W.; validation, M.W.; formal analysis, J.K.; investigation, M.W. and J.K.; resources, M.W.; data curation, M.W.; writing--original draft preparation, M.W. and J.K.; writing--review and editing, M.W. and J.K.; visualization, M.W.; supervision, J.K.; project administration, M.W. All authors have read and agreed to the published version of this manuscript.  
This research received no external funding.  
The data presented in this study are available on request from the corresponding author. The data are not publicly available due to privacy restrictions.  
We thank the editor and the anonymous reviewers for their constructive comments that helped improve our article.  
The authors declare no conflicts of interest.