Integrated Covert Channel Countermeasure Model in MLS Networks

Our country needs specially appointed data transmission between different security level networks in government. In this paper, we put forward a model of warden, which is deployed between these networks and used to counteract the overall covert channels. We use 2-type Turing machine to handle input and unrestricted grammar to generate output, this will eliminate all covert channels in packet header. We use union of automata to filtrate and modify application content. Four kinds of filters are described for different aspects. We then propose a 3-host prototype to testify our model. The two side hosts strip packet header. The centre host uses policy configured in advance to do limited-output filtration on content. For the practical access emulation by file transfer protocol, the prototype successfully reduced the overall covert channel capacity and the anticipated result is achieved.