1. Authors Universitatea Politehnica București Facultatea de Automatică și Calculatoare Catedra de Calculatoare Extension of a port knocking client- server architecture with NTP synchronization Traian Popeea, Vladimir Olteanu Laura Gheorghe, R ă zvan Rughiniș { traian.popeea,vladimir.olteanu}@cti.pub.ro {laura.gheorghe,razvan.rughinis}@cs.pub.ro

2. Outline Introduction Key words Objectives Architecture Technologies Solution Testing Problems Encountered Conclusions Questions 14.06.2016RoEduNet Conference 20112

3. Introduction Port knocking is a method of externally opening ports on a firewall by generating a connection attempt on a set of prespecified closed ports. It has many disadvantages, as the server is left defenseless if the knock sequence is determined by the attacker 14.06.2016RoEduNet Conference 20113

4. Key words Networking Security Port-knocking One-way functions NTP Client-server architecture 14.06.2016RoEduNet Conference 20114

5. Objectives Implement a software application that will meet the following requirements: – Will provide dynamic knock sequences. – Will synchronize server and clients through NTP. – Will generate strong knock sequences through the use of one-way functions. – Will provide different knock sequences for different ports to be opened. 14.06.2016RoEduNet Conference 20115

6. Architecture 14.06.2016RoEduNet Conference 20116

7. Technologies C OpenSSL NTP 14.06.2016RoEduNet Conference 20117

8. Solutions Using an external NTP client (available on every *nix system) for time synchronization at the initialization of the server and clients A pre-shared initial key generated through the OpenSSL library using user-generated entropy A hash function based on PSK, time, source IP address, destination port A sequence of ports determined based on the hash function (splitting the 512-bit hash in 16-bit numbers representing ports) 14.06.2016RoEduNet Conference 20118

9. Testing Generating 1 million keys 14.06.2016RoEduNet Conference 20119 Function512 bits2048 bits md51.163s3.744s sha2563.765s13.197s sha5122.759s8.823s

10. Problems Encountered Public NTP servers are DoS-proof not allowing repeated requests at small time intervals => one initial synchronization followed by system clock queries The sharing of the PSK must be made out-of- program Determining the knock sequence lifespan Clients behind NAT do not have access (source address) 14.06.2016RoEduNet Conference 201110

11. Conclusions Another layer of security is added with the help of synchronization and cryptography. The number of attacks that can be performed is reduced. Using hash functions does not imply a significant latency. 14.06.2016RoEduNet Conference 201111

12. References M. Krzywinski, “Port Knocking: Network Authentication Across Closed Ports”. SysAdmin 2003. Magazine 12: pp 12-17 S. Krivis, “Port Knocking: Helpful or Harmful? – An Exploration of Modern Network Threats”, GIAC Security Essentials Certification, 2004, unpublished M. Doyle, “Implementing a Port Knocking System In C”, An Honors Thesis submitted in partial fulfillment of the requirements for Honors Studies in Physics, J. William Fulbright College of Arts and Sciences, The University of Arkansas, 2004 14.06.2016RoEduNet Conference 201112

13. Thank you! Questions? 14.06.2016RoEduNet Conference 201113