Abstract: Systems, methods, and devices for decoy routing and covert channel bonding are described. The decoy routing system includes a client computing device, a decoy router, and a decoy proxy such that packets addressed to a decoy destination are re-routed by the decoy router to a covert destination via the decoy proxy. The decoy routing method may be applied to a covert channel bonding process, in which a plurality of packet data streams are sent to one or more decoy destinations, re-routed appropriately via one or more decoy routers and/or decoy proxies, and assembled together into a single packet data stream at either a decoy proxy, or a final covert destination.

Abstract: A packet is classified into a class. A priority value is assigned to the packet wherein packets in a flow are assigned priorities according to some probability distribution within some band. A determination is made, at a network device for a highest latency class, whether a sum of queued packet sizes of previously received packets having an equal or smaller latency class than the packet and larger or equal priority than the packet is larger than a threshold value. When the sum is larger, the packet is dropped, otherwise a determination is made whether a latency class of the packet is less than the latency class of the network device. When the latency class is not less, the packet is stored in a queue for the latency class. When the latency class is less, then the process is repeated until the packet is dropped or stored in a queue.

Abstract: Systems, methods, and devices for decoy routing and covert channel bonding are described. The decoy routing system includes a client computing device, a decoy router, and a decoy proxy such that packets addressed to a decoy destination are re-routed by the decoy router to a covert destination via the decoy proxy. The decoy routing method may be applied to a covert channel bonding process, in which a plurality of packet data streams are sent to one or more decoy destinations, re-routed appropriately via one or more decoy routers and/or decoy proxies, and assembled together into a single packet data stream at either a decoy proxy, or a final covert destination.