Secure tunneling mechanism and data handling protocol for peer-to-peer decentralized networking
This disclosure describes a secure tunneling mechanism with DoS mitigation operating in a VPN-based mesh network. The mechanism uses a combination of static and temporal cookies to enable a server to identify peers while still retaining anonymity, and without requiring the server to perform expensive asymmetric cryptography (D-H) operations. In this approach, peers are identifiable by just performing hashes and using symmetric cryptography. The mechanism implements a generalized method of packet handling that provides for data scattering and gathering, thereby enabling encrypted frames conforming to a packet format and communicated by a peer to be spread across multiple physical packets both during a handshake, as well as during the exchange of data (between peers) during the session.
1 . A method of peer-to-peer networking in a network operating environment, comprising:
at a server peer:
receiving a registration request from a first peer, the first peer being one of a set of first peers;
generating a static secret shared by the first peer and the server peer; and
using the static secret to precompute a set of one or more hashes saved to a hash table;
following the registration:
receiving a session request packet purporting to originate from an initiator peer;
determine, using the hash table, whether the initiator peer is recognized as one of the set of first peers;
upon a determination that the initiator peer is recognized as one of the set of first peers, performing a message check using the static secret previously associated to the initiator peer during a registration to the server peer to verify that the session request packet actually originates from the initiator peer;
when the message check succeeds, enabling initiation of a handshake protocol between the initiator peer and the server peer; and
upon successful completion of the handshake protocol, receiving encrypted Internet Protocol (IP) packet delivery from the initiator peer;
wherein the handshake protocol and the encrypted IP packet delivery utilize a data protocol over which encrypted frames are spreadable across multiple physical packets.
2 . The method as described in claim 1 , wherein data involved in the handshake protocol or the encrypted IP packet delivery is data of an arbitrary size and that the data protocol has scattered into one or more encrypted frames.
3 . The method as described in claim 2 , wherein upon receipt of the one or more encrypted frames, the data protocol gathers and reassembles the data that has been scattered.
4 . The method as described in claim 2 , wherein the data is a post-quantum cryptographic (PQC) key.
5 . The method as described in claim 2 , wherein the data is a set of one or more virtual Maximum Transmission Units (MTUs) larger than a physical Maximum Transmission Unit (MTU).
6 . The method as described in claim 1 , wherein the server peer is a relay server.
7 . The method as described in claim 1 , wherein the data protocol has a unified message type.
8 . The method as described in claim 7 , wherein the unified message type comprises a session identification value, an Authenticated Encryption with Associated Data (AEAD) tag, and an encrypted frame.
9 . The method as described in claim 8 , wherein the unified message type also includes an anti-DoS header value.
10 . The method as described in claim 8 , wherein the unified message type supports multi-messages within an encrypted frame.
11 . The method as described in claim 1 , wherein the handshake protocol includes the initiator peer and the server peer generating an ephemeral common shared secret.
12 . The method as described in claim 1 , wherein when the message check fails, the server peer takes a mitigation action.
13 . The method as described in claim 12 , wherein the mitigation action is a rejection of a session request.
14 . The method as described in claim 1 , wherein the data protocol prefixes an Authenticated Encryption with Associated Data (AEAD) tag before each encrypted frame.
15 . The method as described in claim 1 , wherein an encrypted frame supports a multi-message header and one or more state machine operation codes.
16 . The method as described in claim 15 , wherein the information in the encrypted frame is structured as a set of encoded data structures having a compact representation.
17 . A method of peer-to-peer networking in a network operating environment, comprising:
at a server peer:
receiving a session request packet purporting to originate from an initiator peer;
determining, using a hash table of one or more hash values, whether the initiator peer is recognized as one of a set of first peers that have previously registered with the server, a hash value in the hash table having been computed in a registration process that occurs prior to receipt of the session request packet;
upon a determination that the initiator peer is recognized as one of the set of first peers, performing a message check using a static secret previously associated to the initiator peer during a registration to the server peer to verify that the session request packet actually originates from the initiator peer;
when the message check succeeds, enabling initiation of a handshake protocol between the initiator peer and the server peer; and
upon successful completion of the handshake protocol, receiving encrypted Internet Protocol (IP) packet delivery from the initiator peer;
wherein the handshake protocol and the encrypted IP packet delivery utilize a data protocol over which encrypted frames are spreadable across multiple physical packets.
18 . An apparatus, comprising:
at least one processor, and
computer memory holding computer program instructions executable by the at least one processor, the computer program instructions comprising program code configured to:
receive a session request packet purporting to originate from an initiator peer;
determine, using a hash table of one or more hash values, whether the initiator peer is recognized as one of a set of first peers that have previously registered with the server, a hash value in the hash table having been computed in a registration process that occurs prior to receipt of the session request packet;
upon a determination that the initiator peer is recognized as one of the set of first peers, perform a message check using a static secret previously associated to the initiator peer during a registration to the server peer to verify that the session request packet actually originates from the initiator peer;
when the message check succeeds, enable initiation of a handshake protocol between the initiator peer and the server peer; and
upon successful completion of the handshake protocol, receive encrypted Internet Protocol (IP) packet delivery from the initiator peer;
wherein the handshake protocol and the encrypted IP packet delivery utilize a data protocol over which encrypted frames are spreadable across multiple physical packets.