# A Novel Covert Channel for IEEE 802.11 Networks Utilizing MAC Address Randomization
## 2 State of the Art  
Over the years, extensive research has been conducted to develop various covert channel techniques by leveraging different aspects of the MAC and PHY. The primary objective of these studies is to enhance the effectiveness, transparency and improve the undetectability of covert channels. Two reconnection-based covert channel methods are presented in the research paper [10]. The first method involves transmitting covert data by manipulating the behavior of STAs, without direct communication between the covert sender and receiver. Each STA denoted as \(S_{i}\), is associated with a secret message \(M_{i}\). To encode the secret message, the sender induces a reconnection in \(STA_{i}\), and the covert receiver monitors the network to detect the reconnection event and subsequently decodes the secret message \(M_{i}\). In the second method, the covert sender and the STAs are directly interconnected through physical wires, with one wire dedicated to downlink communication and another for uplink communication. To transmit the secret message \(M_{i}\), the sender triggers a reconnection in \(STA_{i}\) by sending a high-voltage level pulse through the corresponding wire. The research paper [11] introduces a covert channel that utilizes the order of frame transmissions to encode secret messages. In this covert channel scheme, if Station \(STA_{1}\) transmits a data frame before \(STA_{2}\), it is interpreted as the transmission of bit 0. Conversely, if the transmission occurs in the reverse order, it represents the encoding of bit 1. This approach requires a minimum of two STAs, and each transmission encodes a single secret bit of information. The paper [12] introduces a ternary timing covert channel. This covert channel operates by leveraging statistical analysis of the free time intervals within the channel, which both the sender and receiver collect. The information derived from this analysis is then utilized to conceal and decode secret messages. The time interval is divided into three subsets in the ternary timing covert channel. For the sender, these subsets are denoted as \(H_{S}^{0}\), \(H_{S}^{1}\), and \(H_{S}^{2}\), corresponding to the time intervals used to encode trits 0, 1, and 2, respectively. Similarly, for the receiver, the subsets are denoted as \(H_{R}^{0}\), \(H_{R}^{1}\), and \(H_{R}^{2}\), representing the time intervals used to decode trits 0, 1, and 2, respectively. For instance, to transmit a trit 0, the receiver selects a slot \(s\) from the subset \(H_{S}^{0}\) and waits for \(s\) time slots before initiating the transmission. In essence, the sum of the waiting time between consecutive transmissions must be equal to the chosen slot \(s\). The research presented in [13] presents a covert channel that utilizes the interarrival time of PR or beacon frames. This covert channel enables the encoding of hidden messages in two distinct forms. In the first method, the sender and receiver establish a shared lookup table, where each time interval is associated with a secret message. The sender generates frames with a matching time interval from the lookup table to encode a particular message. The second encoding method in this covert channel involves introducing variations in the time intervals between consecutive frames. Similar to the first method, each variation corresponds to a secret message in the lookup table. The sender encodes the data by generating frames with different time intervals that align with the appropriate message from the lookup table. The study [14] introduces a practical timing covert channel that leverages the beacon interval (BI). This covert channel enables the encoding and transmission of a secret message from an access point (AP) to a station (STA). The AP encodes the secret message in this method by intentionally introducing a time delay, denoted as \(\delta\), in the BI. Specifically, a delay of \(\delta\) is employed to encode a bit value of 0, while an acceleration of \(\delta\) is used to encode a bit value of 1.