Editing Covert channel (section)

==Eliminating covert channels==
The possibility of covert channels cannot be eliminated,<ref name="anderson72"/> although it can be significantly reduced by careful design and analysis.

The detection of a covert channel can be made more difficult by using characteristics of the communications medium for the legitimate channel that are never controlled or examined by legitimate users.
For example, a file can be opened and closed by a program in a specific, timed pattern that can be detected by another program, and the pattern can be interpreted as a string of bits, forming a covert channel.
Since it is unlikely that legitimate users will check for patterns of file opening and closing operations, this type of covert channel can remain undetected for long periods.

A similar case is [[port knocking]].
In usual communications the timing of requests is irrelevant and unwatched.
Port knocking makes it significant.