Port Knocking is an important concept to secure services provided by the servers. By a predefined port knocking sequence server identify whether the request is a legitimate request for a service. This paper presents an improved authentication scheme over the existing port knocking methods. The existing port knocking methods are prone to reasonable attacks and vulnerabilities. The paper addresses those vulnerabilities, and accordingly provides mechanism to circumvent on the port knocking mechanism. In a client-server communication, request for services from the clients is done by providing them connection to a specific port on the server. For security concerns, all the ports on the server are initially closed and no connection is possible. Port knocking permits a user to request for a port to open for network services. This request takes the form of a sequence of authentication packets across closed ports on the server. Many port knocking schemes have been proposed earlier but all of them suffer from the problems like sequence replay attack, man in the middle attack, use of spoofed packets in knocking sequence and out of order delivery of packets. The proposed algorithm addresses all the above mentioned issues by implementing a secure knock sequence with AES encryption scheme, which cannot be detected or disturbed by the sniffing and use of spoofed packets. The algorithm also addresses the problem of out of order delivery of knock sequence packets as the knock sequence is determined when all the packets are received at the server end.

Advanced port knocking authentication scheme with QRC using AES

Towards port-knocking authentication methods for mobile cloud computing

Port knocking is a first technique introduces to prevent attackers from discovering and exploiting potentially vulnerable service on a network host, while allowing authenticated users to access these services. Despite being potentially useful tool, it suffers various vulnerabilities such as TCP replay, port scanning and etc. This project proposes a new approach over the existing Port Knocking by employing the Source Port sequences that will simplify a technique for port knocking system. Source port is automatically generated by operating system and is pre-assigned to generate a sequence. A technique to control when certain service start and stop was introduced to mitigate problem with TCP replay attack and port scanning. The performance of the proposed method was evaluated by measuring the authentication time to knock the server. As a result, the proposed method worked faster than other methods like basic port knocking and Fwknop + SPA. This has shown that the proposed method was simple and at the same time against the TCP replay attack and port scanning.

Simple port knocking method: Against TCP replay attack and port scanning

In recent years, there has been an increasing interest in the authentication process due to the key role that it has in the network security Port Knocking (PKn) is an authentication method in which data transmits through the closed ports This method is prone to attacks when attackers sniff the network This paper proposes a new method which is called “Secure Port Knock-Tunneling” to eliminate both DOS-Knocking and NATK-nocking attacks The possibility of implementation of this method is investigated on the Mikrotik devices

SPKT: Secure Port Knock-Tunneling, an enhanced port security authentication mechanism

Port Knocking is a method for authenticating clients through a closed stance firewall, and authorising their requested actions, enabling severs to offer services to authenticated clients, without opening ports on the firewall. Advances in port knocking have resulted in an increase in complexity in design, preventing port knocking solutions from realising their potential. This paper proposes a novel port knocking solution, named Crucible, which is a secure method of authentication, with high usability and features of stealth, allowing servers and services to remain hidden and protected. Crucible is a stateless solution, only requiring the client memorise a command, the server's IP and a chosen password. The solution is forwarded as a method for protecting servers against attacks ranging from port scans, to zero-day exploitation. To act as a random oracle for both client and server, cryptographic hashes were generated through chaotic systems.

/pdf/an-authentication-protocol-based-on-chaos-and-zero-knowledge-4thltr775i.pdf

An authentication protocol based on chaos and zero knowledge proof.

This paper presents an improved scheme over the existing Port-Knocking and Single Packet Authorization by employing One-Time Password to generate the authorization tokens for the server to verify the authenticity of client before allowing the deployment of dynamic firewall rules. This One-Time Knocking framework utilizes mobile networks such as GSM or CDMA network as an out-out-band channel to create a 2-factor authentication. Our improved scheme protects against off-line and on-line dictionary and brute-force password attack. It also provides a strong association between Port-Knocking or Single Packet Authorization and the post-authentication connectivity between the client and server thus stopping adversaries from hijacking the session by Man-In-The-Middle attacks.

One-Time Knocking framework using SPA and IPsec

This paper presents a pseudo-random shuffling (PRS) method as an enhancement that can be added to many of the block ciphers by exploiting the Strict Avalanche Criterion (SAC) effect. We then analyze and post the result from comprehensive statistical testing for randomness using Diehard battery of tests to show that the shuffling sequence is indeed random. Finally, we include the performance comparison for AES against AES with PRS. This enhancement can be used to protect block cipher encrypted data and make them more resilience from existing cryptanalysis that is based on known-plaintext and chosen-plaintext.

Block Cipher Enhancement Using Pseudo-random Block Shuffling

Lim et al. proposed a Hybrid Group Key Management scheme for Hierarchical Self-Organizing Sensor Network in 2008 to provide a secure way to pass down the group key for cluster-based communication. This paper presents two practical attacks on the scheme proposed by Lim et al. by tampering sensor nodes of a cluster to recover necessary secret keys and by exploiting the IDS employed by the scheme. The first attack enables a long-term but slow data fabrication while other attack causes more severe DoS on the access to cluster sensor nodes.

/pdf/practical-attacks-on-hybrid-group-key-management-for-sohan-3lqu3us1up.pdf

Jiun-Hau Liew

Papers

One-Time Knocking framework using SPA and IPsec

Block Cipher Enhancement Using Pseudo-random Block Shuffling

Practical Attacks on Hybrid Group Key Management for SOHAN