One-Time Knocking framework using SPA and IPsec

This paper presents an improved scheme over the existing Port-Knocking and Single Packet Authorization by employing One-Time Password to generate the authorization tokens for the server to verify the authenticity of client before allowing the deployment of dynamic firewall rules. This One-Time Knocking framework utilizes mobile networks such as GSM or CDMA network as an out-out-band channel to create a 2-factor authentication. Our improved scheme protects against off-line and on-line dictionary and brute-force password attack. It also provides a strong association between Port-Knocking or Single Packet Authorization and the post-authentication connectivity between the client and server thus stopping adversaries from hijacking the session by Man-In-The-Middle attacks.