Zero-Trust Stealth Authentication for Networked Systems via Port Knocking and TLS Fingerprinting

Modern networked systems are increasingly targeted by automated reconnaissance, exposing services to brute-force, spoofing, and fingerprinting attacks. Conventional defenses such as firewalls and standard TLS authentication, while effective, cannot prevent adversaries from detecting the existence of services. To mitigate this, we present a Zero-Trust Stealth Authentication framework that integrates port knocking with TLS fingerprint validation to achieve two-phase access control. In this design, services remain invisible until a client transmits the correct knock sequence, after which access is conditionally granted based on cryptographic verification of the client’s TLS certificate. This coupling of stealth-based access with certificate-level identity enforces Zero-Trust by eliminating reliance on network location or single-factor authentication. A prototype implemented using Python, iptables, and OpenSSL was tested on Ubuntu, demonstrating negligible latency (35–50 ms) and minimal overhead (3-8% CPU, 130 MB memory) while effectively preventing reconnaissance and brute-force probing. The framework is lightweight and deployable, suitable for securing high-value services in edge gateways, IoT networks, embedded devices, enterprise, and cloud environments.