Honeykeys: deception mechanisms in single packet authorization

Single packet authorization is a technique that allows shielding a protected network service from an outside world. The protection is achieved by hiding the respective transport layer port until cryptographically protected packet received by another service authorizes port opening. The technique has a known weakness related to the key leakage. If secret key is known to the attacker, the shield can be removed by one message. The paper proposes to use a novel Honeykeys authorization scheme that is aimed at deceiving the attacker by storing decoy cryptographic keys on both server and client sides along with the actual keys. In such scheme, if keys are compromised it will not lead to the full-scale system compromise. In addition to that, Honeykeys scheme allows establishing segregation of duties in the authorization process and enables early detection of compromised keys. Apart from presenting theoretical concept of Honeykeys the paper shows preliminary implementation results from the pilot project. These results show acceptable authorization delay times imposed by additional security mechanism