History covert channels with relative timing pointers: Design, error resilience, and detectability
Christoph Weissenborn, Steffen Wendzel · Journal of Information Security and Applications · 2026
A Covert Channel (CC) exploits legitimate communication mechanisms to stealthily transmit information, often bypassing traditional security controls. Within this domain, History Covert Channels (HCC) leverage past network events as reference points to embed covert messages. Unlike traditional timing- or storage-based CCs, which directly manipulate traffic patterns or packet contents, HCCs minimize detectability by encoding information through small pointers to historical data. This approach enables them to amplify the size of transmitted covert data by referring to more bits than are actually embedded. Recent research has explored the feasibility of such methods, demonstrating their potential to evade detection by repurposing naturally occurring network behaviors as a covert transmission medium. However, existing timing channels rely heavily on precise absolute timing and centralized clock synchronization, limiting their robustness in real-world distributed environments. In this paper, we introduce the Silent History Protocol (SHP), a robust HCC architecture that utilizes relative pointers to network timing patterns. By referencing time deltas rather than absolute timestamps, SHP minimizes reliance on centralized timekeeping and enhances resilience against network jitter. We present a prototype implementation using ARP signaling and conduct a trace-based feasibility analysis for WAN environments. Furthermore, we explore error correction mechanisms to tailor SHP for noisy channels. Our experiments demonstrate improved bitrate and robustness compared to previous HCC implementations, while maintaining statistical undetectability against standard network monitoring tools.