🚀 go-pugleaf

In article <1992Aug13.214823.19173@fx.com> franco@fx.com (Frank Minjarez) writes:
>The definition in "Computer Security Basics" [published by O'Reilly & 
>Associates] is a good one:
>
>	"A communication channel that allows a process to transfer information
>	in a way that violates a system's security policy."

That definition is missing the "covert" aspect.  A "covert" channel is
one which is not a commonly thought of communications mechanism.  A
traditional communications channel, such as disk or serial device, would
have some policy associated with it.  If that policy is violated, it is
either a human error (that is, you hook up a serial port with a top secret
label to the laptop computer you smuggled in) or a bug (the secret label
on that port wasn't checked when a top secret document was output.)

A "covert" channel is some mechanism whose usual purpose is not the
communication of data.  For example, sending data by modulating the system
load.

>I think the key points here are "communication channel" and "violates
>security policy."  Some process has to communicate (eg write to disk, send
>over phone line, etc.) data to another process, and that communication 
>has to violate the security poilicy of the system (eg not to write out
>classified data to processes that are not trusted to read it).

Except that disk files and phone lines aren't "covert."
-- 
John F. Haugh II                   | Life's Little Instruction Book:
Ma Bell: (512) 251-2151            | "#138.  Learn Spanish.  In a few years,
UUCP: ...!cs.utexas.edu!rpp386!jfh |  more than 35% of all Americans will speak
Domain: jfh@rpp386.cactus.org      |  it as their first language."