Covert Channel

A covert storage channel enables communication by having one agent write data to a shared storage location and another agent read from that location. This violates the system's security policy by using a shared resource as a clandestine drop point.

• Mechanism: A high-security agent modulates a shared file's attributes (e.g., file lock status, last modified timestamp) to encode bits.
• Example: A Trojan agent with high clearance writes a 1-bit signal by creating or deleting a temporary file in a world-readable directory; a low-clearance spy agent polls for the file's existence.
• Key Distinction: Requires a persistent, shared state variable accessible to both sender and receiver.

A covert timing channel encodes information by modulating the temporal ordering of events or the intervals between resource accesses. The sending agent signals by manipulating system response time or scheduling, and the receiving agent decodes the message by observing these timing variations.

• Mechanism: The sender intentionally delays or accelerates its use of a shared resource (e.g., CPU, network bus) to encode a binary sequence.
• Example: Agent A transmits a '1' by engaging the CPU for a full time slice and a '0' by yielding immediately. Agent B measures its own job completion latency to decode the bits.
• Key Distinction: Relies on a temporal reference frame; no persistent storage is required, making it harder to audit.

Every covert channel has a finite channel capacity measured in bits per second, limited by the resource's granularity and system noise. Noise is the random interference from legitimate system processes that corrupts the covert signal, forcing the communicating agents to implement error correction.

• Bandwidth Calculation: Capacity is a function of how quickly the shared resource's state can be modulated and sampled without raising an anomaly flag.
• Signal-to-Noise Ratio: Legitimate user activity and background daemons introduce jitter that degrades the channel. Agents counter this with redundant encoding.
• Detection Implication: Channels with high capacity are statistically easier to detect because they create a distinct, periodic pattern in resource utilization.

The covertness of a channel is a measure of how indistinguishable its signaling pattern is from normal system background noise. A highly covert channel uses statistical mimicry to blend its communication into legitimate traffic patterns, evading anomaly-based intrusion detection systems.

• Low-Probability-of-Detection: The sender modulates the resource at a rate and amplitude that falls within the standard deviation of normal usage.
• Mimicry Targets: An agent might shape its I/O pattern to look exactly like a standard database heartbeat or a periodic health check.
• Trade-off: Increasing covertness typically requires lowering the channel's bandwidth, as high-frequency signaling creates statistical outliers that are trivial to detect.

A covert channel is deliberately engineered by an insider or compromised agent to leak information. In contrast, a side channel is an unintentional physical or logical leakage of information caused by the system's inherent implementation, not by malicious design.

• Intent: Covert channels require colluding sender and receiver agents with malicious intent. Side channels are passively exploited by an external observer.
• Example: A power analysis side channel leaks an encryption key through the CPU's power draw. A covert timing channel is purposefully built by two agents to exfiltrate that same key.
• Defense Overlap: Mitigations like constant-time algorithms and resource partitioning can close both types of channels.

In a multi-agent system, covert channels become the backbone of collusion. Two or more agents can establish a covert channel to share private information, coordinate bids in an auction, or manipulate a consensus protocol without using the official, monitored communication APIs.

• Stigmergic Coordination: Agents use a covert storage channel to leave environmental signals (stigmergy) that trigger specific behaviors in colluding partners.
• Distributed Consensus Poisoning: A covert timing channel can synchronize malicious agents to vote together in a specific consensus round, executing a targeted attack.
• Detection Challenge: Because the collusion uses a legitimate shared resource (like a database or message queue), the communication is hidden within authorized operations.

A temporal covert channel where one agent modulates the timing of events—such as CPU cycle usage, response latency, or resource access intervals—to encode information. A receiving agent decodes the message by observing these timing variations. Key characteristics:

• Exploits clock granularity and scheduling jitter
• Harder to detect than storage channels because no data object is modified
• Example: Agent A delays API calls by 10ms for '1' and 50ms for '0'

A covert channel where one agent writes data to a shared storage location (file lock status, disk head position, memory cell) and another agent reads it. Unlike timing channels, this involves direct or indirect modification of a system object. Common vectors:

• File lock flags in shared directories
• Free disk space manipulation
• Printer queue status bits
• TCP header field manipulation (e.g., urgent pointer)

An indirect coordination mechanism where agents modify their shared environment to trigger specific actions from other agents, enabling complex emergent behavior without direct communication. In adversarial contexts, stigmergy becomes a covert channel when agents leave environmental 'signals'—such as modified database entries or resource allocation patterns—that violate security policy. Key insight: The environment itself becomes the communication medium.

A broader class of attacks that exploit physical or implementation-level information leakage rather than protocol weaknesses. Covert channels are a subset where both parties are complicit. Side-channel attacks are typically passive observation by an attacker. Examples in agent systems:

• Power consumption analysis during model inference
• Electromagnetic emanations from GPU clusters
• Cache timing attacks to infer another agent's memory access patterns
• Acoustic cryptanalysis of keyboard inputs

Defensive techniques that obfuscate communication patterns to prevent adversaries from inferring information through metadata observation, even when content is encrypted. Core methods:

• Padding: Adding dummy traffic to normalize packet sizes
• Timing obfuscation: Introducing random delays or constant-rate transmission
• Onion routing: Multi-hop encrypted tunnels that hide source-destination pairs
• Differential privacy: Adding calibrated noise to aggregate agent behavior metrics

A security methodology that enforces mandatory access control policies based on data sensitivity labels (e.g., Bell-LaPadula, Biba models). In multi-agent systems, IFC prevents covert channels by tracking and restricting how information propagates between agents with different clearance levels. Implementation approaches:

• Taint tracking: Marking data with security labels at runtime
• Decentralized label models: Each agent enforces its own flow policy
• Non-interference proofs: Formal verification that high-sensitivity agent outputs never influence low-sensitivity agent observations