# Covert Channel Communication as an Emerging Security Threat in 2.5D/3D Integrated Systems
## 3 Types of Physical Covert Channels
### Temperature-Based Channels  
Modern electronic devices feature easily accessible temperature sensors that are typically used for dynamic thermal management [48; 49]. These sensors were recently shown to be a potential security threat, since otherwise isolated applications can exploit them to establish a thermal covert channel (TCC) and leak restricted information. Temperature can be used as a covert channel within the same core of a processor (via leveraging multiple threads) [37], between different cores of a multicore processor [37], or even between adjacent desktop computers [33].  
The threat model of a TCC in a multicore processor is as follows: the application at the transmitting core controls the power consumption (and, consequently, the temperature) of that core, resulting in the temperature of the transmitting core being encoded with the secret data, as shown in Figure 4. An application running on the receiving core has access to the temperature sensor and reads the encoded temperature profile and decodes the signal to retrieve the secret data [37]. This type of attack can be accomplished fully remotely since the attacker does not need direct physical access to probe or measure the IC [50].  
The bandwidth of TCCs varies widely, depending upon the location of transmitter and receiver. For example, if the communication is between discrete desktop computers, the bandwidth is, typically, a few bits an hour [33]. The upper bound of the capacity of a temperature covert channel is, theoretically, estimated as 300 bps for the same core, and on the order of 50 bps for two adjacent cores [37]. Additionally, the TCCs are verified experimentally with Manchester encoding on a laptop, server, and cellphone, where the bandwidth reaches up to 90 bps at a cost of 10% BER [37]. TCCs are highly practical for attackers who prefer a fully remote attack, enabled by thermal sensor information. An important disadvantage to TCCs is their relatively low bandwidth, compared to power and electromagnetic covert channels.  
Figure 4: Temperature-based covert channels in spatially separated cores of a processor [51].  
BitWhisper is a methodology that allows two nearby computers to communicate with each other, even if both computers are air-gapped [33]. It is possible to transmit data to another computer that is located in close proximity by measuring and analyzing the temperature changes generated by running a GPU stress tester, such as FurMark [52] and prime65 [53], and a CPU stress tester, prime95 [53], which calculates Mersenne primes.  
The exchange of data between two computers is demonstrated within a distance of 1-40 cm from each other utilizing the Bitwhisper covert channel [33]. The communication channel between the computers can be bidirectional. BitWhisper has a relatively low bandwidth, of only 8 bits per hour, compared to other physical covert channels [33]. This work observed that a normal workload did not effect temperature of a desktop significantly, thus making it possible to use a computer as a receiver during normal operation. While BitWhisper does propose a novel attack that requires no additional hardware, it is impractical, due to both the very low bandwidth and the required close proximity (tens of centimeters) of the devices.