Pairing methods in zero-trust networks
AssigneeLenovo (Singapore) Pte. Ltd.
InventorsIgor Stolbikov, Sergei Rodionov, Rod D Waltermann, Scott Li
Life of this patent
Estimating the term…
Abstract
A method for communications in a network can include performing a pairing between a first device and a second device in the network. The method can include deriving a port knocking sequence from identification information of the pairing. The method can include providing port knocking according to the port knocking sequence. The method can include authorizing a connection between the first device and the second device responsive to detecting the port knocking sequence. Other devices and methods are described.
Claims16
A method performed for communications in a network, the method comprising:
- performing a pairing between a first device and a second device in the network;
- deriving, during the pairing, a dynamic cryptographic identity for at least one of the first device and the second device using a key-negation function based on a Password-Authentication Key Exchange (PAKE) protocol;
- deriving a port knocking sequence from the dynamic cryptographic identity identification information of the pairing;
- providing port knocking according to the port knocking sequence;
- and
- authorizing a connection between the first device and the second device responsive to detecting the port knocking sequence;
- detecting a connection attempt from a third device that does not include the port knocking sequence;
- marking the connection attempt as a malicious attempt responsive to the detection;
- and
- refraining from transmitting the signals to the third device;
- wherein the port knocking sequence specifies port numbers in an order that the port numbers should be knocked.
A device comprising:
- communication circuitry;
- and
- processing circuitry coupled to the communication circuitry and configured to:
- provide a cryptographic identity over the communication circuitry to pair with a second device;
- derive, during the pairing, a dynamic cryptographic identity for at least one of the first device and the second device using a key-negation function based on a Password-Authentication Key Exchange (PAKE) protocol;
- derive a port knocking sequence from the dynamic cryptographic identity identification information of the pairing;
- encode signals for port knocking according to the port knocking sequence in a subsequent communication with the second device;
- and
- transmit the signals using the communication circuitry;
- detect a connection attempt from a third device that does not include the port knocking sequence;
- mark the connection attempt as a malicious attempt responsive to the detection;
- and
- refrain from transmitting the signals to the third device;
- wherein the port knocking sequence specifies port numbers in an order that the port numbers should be knocked.
A non-transitory machine-readable medium including instructions that, when executed on processing circuitry, cause the processing circuitry to perform operations including:
- performing a pairing between a first device and a second device in a network;
- deriving, during the pairing, a dynamic cryptographic identity for at least one of the first device and the second device using a key-negation function based on a Password-Authentication Key Exchange (PAKE) protocol;
- derive a port knocking sequence from the dynamic cryptographic identity identification information of the pairing;
- encoding a signal to provide port knocking according to the port knocking sequence;
- and
- authorizing a connection between the first device and the second device responsive to detecting the port knocking sequence;
- detecting a connection attempt from a third device that does not include the port knocking sequence;
- marking the connection attempt as a malicious attempt responsive to the detecting;
- and
- refraining from transmitting the signals to the third device;
- wherein the port knocking sequence specifies port numbers in an order that the port numbers should be knocked.
Dependencies are inferred from the claim text.