An Empirical Bandwidth Analysis of Interrupt-Related Covert Channels

We empirically evaluate interrupt-related covert channels, in short IRCCs, a type of covert channel that leverages hardware interrupts for communication. The evaluation is based on an exploit of IRCCs that we implemented as a proof-of-concept. We use a combination of experimental evaluation and information-theoretic analysis to compute the bandwidth of the channel on a concrete system. Our analysis shows a channel bandwidth of IRCCs based on interrupts of network interface cards (NICs) of approximately 5 bit/s. Besides the channel bandwidth, our experiments revealed previously unnoticed properties of IRCCs based on interrupts of NICs. While side channels based on hardware interrupts have been discussed before, this is the first experimental evaluation of covert channels based on hardware interrupts.