[Paper Review] A Covert Queueing Channel in Round Robin Schedulers

AmirEmad Ghassami, Ali Yekkehkhany+1 more|arXiv (Cornell University)|Jan 31, 2017

Internet Traffic Analysis and Secure E-voting24 references3 citations

TL;DR

This paper proposes an information-theoretic framework for modeling and analyzing a covert queueing channel (CQC) in round-robin schedulers, where two users communicate by modulating their job arrival patterns to infer each other's delays. The authors derive a capacity of approximately 0.6942 bits per time slot in the noiseless case and provide finite-length code constructions that asymptotically achieve this limit.

ABSTRACT

We study a covert queueing channel (CQC) between two users sharing a round robin scheduler. Such a covert channel can arise when users share a resource such as a computer processor or a router arbitrated by a round robin policy. We present an information-theoretic framework to model and derive the maximum reliable data transmission rate, i.e., the capacity of this channel, for both noiseless and noisy setups. Our results show that seemingly isolated users can communicate with a high rate over the covert channel and demonstrate the possibility of significant information leakage and privacy threats brought by CQCs in round robin schedulers. Moreover, we propose practical finite-length code constructions, which achieve the capacity limit.

Motivation & Objective

• To model and analyze a covert queueing channel (CQC) that emerges in round-robin schedulers due to interdependent service delays between users.
• To determine the maximum reliable data transmission rate (capacity) of such a CQC under both noiseless and noisy conditions.
• To design practical finite-length coding schemes that approach the theoretical capacity limit.
• To evaluate the impact of packet loss on channel capacity and derive capacity expressions as a function of drop probability.

Proposed method

• Formulates a system model where Alice and Bob share a round-robin scheduler, and information is encoded in the timing of job arrivals, which induces observable delays.
• Uses an information-theoretic framework based on mutual information and the data processing inequality to derive upper bounds on the channel capacity.
• Applies Stirling’s approximation and binary entropy function $ h(p) $ to analyze the asymptotic behavior of codebook sizes and derive the capacity expression $ C = \max_p \frac{h(p)}{1+p} $.
• Proposes a finite-length coding scheme using binomial codebooks with $ \binom{l}{\lfloor lp \rfloor} $ codewords, where the rate converges to capacity as $ l \to \infty $.
• Models the noisy CQC as a Z-channel with packet loss, deriving capacity as $ \max_p \frac{h((1-\delta)p) - p h(\delta)}{(1-p) + \delta p + 2(1-\delta)p} $, where $ \delta $ is the packet drop probability.
• Establishes achievability and converse proofs using Fano’s inequality and random coding arguments to validate the derived capacity.

Experimental results

Research questions

• RQ1 What is the maximum reliable data transmission rate (capacity) of a covert queueing channel in a round-robin scheduler under noiseless conditions?
• RQ2 How does the presence of packet loss affect the capacity of the covert queueing channel?
• RQ3 Can practical finite-length coding schemes be constructed that asymptotically achieve the theoretical capacity of the CQC?
• RQ4 How does the CQC capacity compare to that of other scheduling policies like FCFS or TDMA in terms of information leakage and privacy risk?
• RQ5 What is the optimal signaling strategy for Alice to encode messages in her job arrival pattern such that Bob can decode them via observed delays?

Key findings

• The capacity of the covert queueing channel in a noiseless round-robin scheduler is approximately 0.6942 bits per time slot, derived as $ \max_p \frac{h(p)}{1+p} $.
• The finite-length coding scheme based on binomial codebooks with $ \binom{l}{\lfloor lp \rfloor} $ codewords achieves a rate that asymptotically converges to the theoretical capacity as the number of messages $ l \to \infty $.
• In the presence of packet loss, the channel capacity is given by $ \max_p \frac{h((1-\delta)p) - p h(\delta)}{(1-p) + \delta p + 2(1-\delta)p} $, where $ \delta $ is the packet drop probability.
• The proposed coding scheme achieves reliable communication with arbitrarily low error probability as block length increases, confirming the achievability of the derived capacity.
• The results demonstrate that round-robin schedulers, despite being throughput-optimal, are vulnerable to significant information leakage via CQCs, posing serious privacy threats.
• The CQC capacity in round-robin scheduling is higher than in TDMA (which is privacy-optimal but not throughput-optimal), highlighting a trade-off between performance and security.