Timing side channels for traffic analysis

Traffic analysis often requires direct observations of network connections at local vantage points. In this work, we show that traffic analysis can be performed remotely by taking advantage of a timing side channel. The timing side channel results from a shared resource, namely, the scheduler between two users. Utilizing Shannon equivocation as a privacy metric, we prove that one user can learn the complete traffic pattern of the other user if the scheduler employs a first come first serve (FCFS) policy. Moreover, we show the feasibility of a real system attack exploiting the timing side channel inside a home digital subscriber line (DSL) router. This demonstrates the magnitude of the threat timing side channels pose for traffic analysis.