Storage Channel
Definition
A covert channel that encodes information in the value of a protocol field, such as the IP Identification field or a DNS label. The hidden data persists until the packet is processed, making storage channels amenable to capture-and-replay analysis.
- Mechanism
- Encodes data in a protocol field value
- Example fields
- IP Identification field, DNS label
- Persistence
- Data persists until the packet is processed
- Analysis approach
- Amenable to capture-and-replay analysis
Common questions
How does a storage channel differ from a timing covert channel?+
A storage channel hides data in the actual value written into a field, which can be captured and read back later from a packet dump, while a timing channel encodes information in the pattern or delay of events, which leaves no persistent artefact and must be observed as it happens.
Why is capture-and-replay analysis effective specifically against storage channels?+
Because the hidden value sits in a field that is preserved intact until something processes it, an investigator can capture the traffic, replay it offline, and repeatedly inspect the field values without needing to catch the covert transmission in real time.
Related terms
- Covert Channel
- Any communication path that was not intended by the system designer and that bypasses access-control or monitoring policies. Network covert channels are...
- DNS Tunnelling
- Encoding data inside DNS queries and responses to exfiltrate information or carry command-and-control traffic through a network that permits DNS but blocks...
- Entropy Analysis
- A statistical technique that measures the randomness of data in a field or stream. Protocol fields that should contain low-entropy predictable values...
- Protocol Anomaly Detection
- A detection method that compares observed network traffic against the formal specification of each protocol (its RFC or standard) and flags fields...
- Timing Channel
- A covert channel that encodes information in the intervals between network events, such as inter-packet delays, rather than in packet content. Timing...