Single Packet Authorization (SPA)

SPA implements a default-drop firewall policy where all ports are closed by default. The service remains invisible to unauthorized scanners. A client must send a single cryptographically signed and encrypted UDP packet containing authentication credentials, requested service, and a timestamp before the firewall even considers opening a port.

• Firewall rules are created dynamically and ephemerally
• No TCP/IP stack interaction occurs until authentication succeeds
• Eliminates the attack surface exposed by open ports

Every SPA packet contains a monotonically increasing timestamp and a random nonce. The SPA server maintains a cache of previously seen packet hashes. If an attacker captures a valid packet and attempts to replay it, the server rejects it based on stale timestamps or duplicate hash detection.

• Uses HMAC-based One-Time Passwords (HOTP) or similar constructs
• Prevents passive eavesdropping attacks
• Each packet is valid for a configurable time window, typically seconds

SPA solves the fundamental weaknesses of traditional port knocking. Classic port knocking relies on a sequence of connection attempts to closed ports, which is fragile, susceptible to packet reordering, and observable by passive network monitors. SPA condenses all information into a single, encrypted payload.

• Eliminates sequence-based denial-of-service vulnerabilities
• No reliance on TCP packet ordering
• Single UDP packet reduces latency and complexity

The primary operational goal of SPA is service concealment. Before a valid SPA packet is received, the protected service (e.g., SSH, VPN) is indistinguishable from a host with no services running. Network scanners like Nmap receive no response, making the host effectively invisible at the network layer.

• Defeats reconnaissance scanning entirely
• Protects against zero-day exploits on the protected service
• Commonly used to protect bastion hosts and administrative interfaces

SPA functions as a Policy Enforcement Point (PEP) at the network perimeter. It aligns with zero-trust principles by enforcing least privilege access—a client is only granted connectivity to the specific service requested, on the specific port requested, for a limited time window. No standing access is ever granted.

• Complements Software-Defined Perimeters (SDP)
• Acts as a pre-authentication gate before Identity-Aware Proxies
• Enforces just-in-time network access at the transport layer

A security framework that dynamically creates one-to-one network connections between users and resources, making infrastructure invisible to unauthorized parties. SDP controllers authenticate users and devices before granting access to specific services.

• Implements a dark network that drops all packets by default
• Uses SPA as the initial authentication knock before any TCP connection
• Replaces traditional VPNs with application-specific tunnels
• Eliminates broad network exposure and lateral movement risks

A predecessor to SPA that dynamically opens firewall ports after receiving a predefined sequence of connection attempts to closed ports. Unlike SPA, traditional port knocking transmits authentication data in plaintext packet headers.

• Uses TCP SYN or UDP packets to specific port sequences
• Vulnerable to replay attacks and sequence sniffing
• SPA improves on this with cryptographic signatures and single-packet delivery
• Provides no payload encryption or identity binding

A cryptographic protocol where both client and server authenticate each other using X.509 certificates, ensuring bidirectional identity verification. mTLS operates at the transport layer after a connection is established.

• Provides encrypted channels for data in transit
• Requires a functioning TCP handshake before authentication
• SPA complements mTLS by hiding the port until after authentication
• Used extensively in service mesh architectures for east-west traffic

A privileged access management practice where administrative permissions are granted for a limited, specific time window on an as-needed basis. JIT eliminates standing privileges that attackers can exploit.

• Access requests require business justification and approval
• Credentials are ephemeral and automatically revoked after the window expires
• SPA provides the network-layer equivalent by opening ports only for authenticated sessions
• Both follow the least privilege principle

The ongoing process of re-authenticating and re-authorizing a user or device's identity and security posture throughout an active session, not just at initial login. This eliminates the assumption that an authenticated session remains trustworthy.

• Monitors device posture, geolocation, and behavior patterns
• Revokes access mid-session if risk signals change
• SPA initiates the first verification; continuous verification sustains it
• Core principle of zero-trust architecture (ZTA)

The architectural component in a zero-trust network that evaluates access requests against policy and attributes to issue an allow or deny decision. The PDP acts as the logical brain of the authorization system.

• Consults attribute-based access control (ABAC) policies
• Evaluates user identity, device health, and environmental context
• SPA gateways function as a specialized PDP for initial port access
• Communicates decisions to the Policy Enforcement Point (PEP) for execution