Which choice below MOST accurately describes a Covert Storage Channel?
A.
A process that manipulates observable system resources in a way that affects response time
B.
An information transfer that involves the direct or indirect writing of a storage location by one
process and the direct or indirect reading of the storage location by another process
C.
A communication channel that allows a process to transfer information in a manner that violates
the systems security policy
D.
An information transfer path within a system
Explanation:
A covert storage channel typically involves a finite resource (e.g., sectors on a disk) that is shared by
two subjects at different security levels. One way to think of the difference between covert timing
channels and covert storage channels is that covert timing channels are essentially memoryless,
whereas covert storage channels are not. With a timing channel, the information transmitted from
the sender must be sensed by the receiver immediately, or it will be lost. However, an error code
indicating a full disk which is exploited to create a storage channel may stay constant for an
indefinite amount of time, so a receiving process is not as constrained by time. *Answer “A process
that manipulates observable system resources in a way that affects response time” is a partial
description of a covert timing channel. A covert timing channel is a covert channel in which one
process signals information to another by modulating its own use of system resources (e.g., CPU
time) in such a way that this manipulation affects the real response time observed by the second
process. *Answer “An information transfer path within a system” is a generic definition of a channel.
A channel may also refer to the mechanism by which the path is effected. *Answer “A
communication channel that allows a process to transfer information in a manner that violates the
systems security policy” is a higher-level definition of a covert channel. While a covert storage
channel fits this definition generically. Source: DoD 5200.28-STD Department of Defense Trusted
Computer System Evaluation Criteria and NCSC-TG-030, A Guide To Understanding Covert Channel
Analysis of Trusted Systems [Light Pink Book].