Directed information and the NRL Network Pump

The NRL Network Pump^®, or Pump, is a standard for mitigating covert channels that arise in a multi-level secure (MLS) system when a high user (HU) sends acknowledgements to a low user (LU). The issue here is that HU can encode information in the “timings” of the acknowledgements. The Pump aims at mitigating the covert timing channel by introducing buffering between HU and LU, as well as adding noise to the acknowledgment timings. Here, for the first time, we model the workings of the Pump in certain situations, as a communication system with feedback and use then this novel perspective to derive a upper bound on the rate of the covert channel between HU and LU in the Pump, in specific situations. This upper bound is presented in terms of a directed information flow over the dynamics of the system.