discover · compare · collections · requirements · contribute · feed · watching · stats · help with your tokens
OpenNHP/opennhp · source
Snapshot 0 · 2026-11-04T12:47:23Z · Go · Apache-2.0
Content fingerprint
a41252e22a2acb4da48fd15934299bad37694c42d6ff7462b54606a85701646bGitHub description at capture
Make your infrastructure invisible to attackers. OpenNHP implements the Network-infrastructure Hiding Protocol (NHP): authenticate before connection, cryptographically. IETF draft.
README at capture
[](https://github.com/OpenNHP/opennhp/blob/main/README.md) [](https://github.com/OpenNHP/opennhp/blob/main/README.zh-cn.md) [](https://github.com/OpenNHP/opennhp/blob/main/README.zh-tw.md) [](https://github.com/OpenNHP/opennhp/blob/main/README.de.md) [](https://github.com/OpenNHP/opennhp/blob/main/README.ja.md) [](https://github.com/OpenNHP/opennhp/blob/main/README.fr.md) [](https://github.com/OpenNHP/opennhp/blob/main/README.es.md) [](https://github.com/OpenNHP/opennhp/blob/main/README.id.md)  # Make the Internet Invisible to Attackers [](https://github.com/OpenNHP/opennhp/actions/workflows/ubuntu-build.yml) [](https://github.com/OpenNHP/opennhp/tags)  [](https://codecov.io/gh/OpenNHP/opennhp) [](https://deepwiki.com/OpenNHP/opennhp) OpenNHP hides your servers, ports, and domains from the public internet. Nothing answers until a client proves who it is with a single encrypted packet, so scanners, bots, and AI-driven attackers find nothing to attack. **OpenNHP** is a lightweight, cryptography-powered, open-source toolkit implementing Zero Trust security for infrastructure, applications, and data. It is the reference implementation of the [**Cloud Security Alliance (CSA)**](https://cloudsecurityalliance.org/) *[Network-infrastructure Hiding Protocol (NHP) specification](https://cloudsecurityalliance.org/artifacts/stealth-mode-sdp-for-zero-trust-network-infrastructure)*, and features two core protocols: - **Network-infrastructure Hiding Protocol (NHP):** Conceals server ports, IP addresses, and domain names to protect applications and infrastructure from unauthorized access. - **Data-content Hiding Protocol (DHP):** Ensures data security and privacy via encryption and confidential computing, making data *"usable but not visible."* **[Website](https://opennhp.org) · [Vision](https://opennhp.org/vision/) · [Live Demo](https://opennhp.org/demo/) · [Documentation](https://docs.opennhp.org) · [Discord](https://discord.gg/CpyVmspx5x)** --- ## Why OpenNHP The modern internet is a [dark forest](https://en.wikipedia.org/wiki/Dark_forest_hypothesis). Attackers — increasingly backed by LLMs that scan, fingerprint, and exploit at machine speed via [Autonomous Vulnerability Exploitation](https://arxiv.org/abs/2404.08144) — treat every reachable service as a target. [Gartner projects](https://www.gartner.com/en/newsroom/press-releases/2024-08-28-gartner-forecasts-global-information-security-spending-to-grow-15-percent-in-2025) AI-driven cyberattacks will rise rapidly. Traditional defenses authenticate users *after* the network lets them in, leaving exposed ports, IPs, and domains as a permanent attack surface. > **In the AI era, VISIBILITY = VULNERABILITY.** OpenNHP inverts that model: **invisible until trusted.** Every port, IP, and hostname sits behind a default-deny gate. Access is granted only after a cryptographically signed knock is authenticated and authorized out-of-band. Attackers can't exploit what they can't discover. ### The third-generation network hiding protocol NHP is the next step in a line of "hide the service first" designs: | Generation | Protocol | Limitations | |---|---|---| | 1 | Port Knocking | Plaintext, replay-prone | | 2 | Single Packet Authorization (SPA) | Shared secrets, one-way, typically hides ports only, typically C/C++ | | **3** | **NHP** | Modern crypto, bi-directional with status, hides domain + IP + ports, stateless and horizontally scalable, memory-safe Go | NHP slots in alongside existing IAM, DNS, FIDO, and Zero Trust policy engines rather than replacing them — it extends your stack instead of forking it. --- ## Architecture OpenNHP follows a modular design with three core components, inspired by the [NIST Zero Trust Architecture](https://www.nist.gov/publications/zero-trust-architecture):  | Core Component | Role | |-----------|------| | **NHP-Agent** | Client that sends encrypted knock requests to gain access | | **NHP-Server** | Authenticates and authorizes requests; runs separately and is architecturally decoupled from the protected host | | **NHP-AC** | Access controller that manages firewall rules on the protected server | | Addon Component | Role | |-----------|------| | **NHP-Relay** | HTTP-to-UDP bridge enabling browser-based agents to send NHP knocks via HTTPS | | **NHP-KGC** | Key Generation Center for Identity-Based Cryptography (IBC) | ### Protocol flow **Registration (once per device).** The agent generates its own key pair, then enrolls the public key: 1. Agent requests a one-time password (`NHP_OTP`); the Server's auth plugin delivers it to the user (e.g. by email). 2. Agent sends the OTP and its public key (`NHP_REG`); the Server binds the key to the user and replies (`NHP_RAK`). The private key never leaves the device. **Knock (every access).** 1. Agent sends an encrypted knock (`NHP_KNK`) to the Server. 2. Server validates the knock and sends an operation request (`NHP_AOP`) to the AC. 3. AC opens the firewall and replies (`NHP_ART`) to the Server. 4. Server returns an acknowledgment (`NHP_ACK`) with access info to the Agent. 5. Agent reaches the protected resource through the AC. Browser agents, which cannot send raw UDP, reach the Server through **NHP-Relay** over HTTPS; the relay forwards each packet inside an authenticated `NHP_RLY` envelope. ### Cryptography OpenNHP ships with two interchangeable cipher suites: - **`CIPHER_SCHEME_CURVE`** — Curve25519 + AES-256-GCM + BLAKE2s - **`CIPHER_SCHEME_GMSM`** — SM2 + SM4-GCM + SM3 Both are driven by the [Noise Protocol Framework](https://noiseprotocol.org/). An Identity-Based Cryptography (IBC) mode is available via the Key Generation Center (KGC). > For protocol details, deployment models, and cryptographic design, see the [documentation](https://docs.opennhp.org). --- ## Repository Structure ``` opennhp/ ├── nhp/ # Core protocol library (Go module) │ ├── core/ # Packet handling, cryptography, Noise Protocol, device management │ ├── common/ # Shared types and message definitions │ ├── keystore/ # Sealed (encrypted-at-rest) private key storage │ ├── ebpf/ # eBPF/XDP programs (AC enforcement, Server ingress filter) │ ├── plugins/ # Plugin handler interfaces │ ├── utils/ log/ metrics/ audit/ etcd/ │ └── ... ├── endpoints/ # Daemons and SDKs (Go module, depends on nhp) │ ├── agent/ # NHP-Agent daemon, plus the iOS/Android SDK (agent/iossdk) │ ├── js-agent/ # JavaScript agent SDK for browsers (via NHP-Relay) │ ├── server/ # NHP-Server daemon │ ├── ac/ # NHP-AC (access controller) daemon │ ├── relay/ # NHP-Relay daemon (HTTPS-to-UDP bridge) │ ├── db/ # NHP-DB (Data Broker for DHP) │ ├── kgc/ # NHP-KGC (Key Generation Center) │ └── keystorecli/ # `seal` / `unseal` key subcommands shared by every daemon ├── examples/ # Server auth plugins and client SDK samples ├── demoapp/ # Example web app with NHP-protected login ├── docker/ # Docker Compose full-stack environment └── docs/ # Documentation site (docs.opennhp.org) ``` --- ## Quick Start ### Prerequisites - Go 1.26+ - `make` - Docker and Docker Compose (for the full-stack demo) ### Build ```bash # Build all components make # Build individual daemons make agentd # NHP-Agent make serverd # NHP-Server make acd # NHP-AC make db # NHP-DB make relayd # NHP-Relay make kgc # NHP-KGC ``` ### Test ```bash cd nhp && go test ./... cd endpoints && go test ./... ``` ### Run with Docker ```bash cd docker && docker-compose up --build ``` Follow the [Quick Start tutorial](https://docs.opennhp.org/nhp_quick_start/) to simulate the full authentication workflow in a Docker environment. ### Register an agent Enroll a device key with a server through the OTP flow. The command prompts for anything you leave out: ```bash ./nhp-agentd register --email you@example.com --asp-id <auth-service-id> --res-id <resource-id> ``` The agent generates its key pair locally, asks the server to send a one-time password, then registers the public key once you enter the code. Use `nhp-agentd seal` to keep the private key encrypted at rest. --- ## Clients, SDKs, and Live Demos | Client | Where | |---|---| | Native agent daemon | `nhp-agentd` from `make agentd` | | iOS / Android SDK | `make iosagentsdk` / `make androidagentsdk` | | JavaScript (browser) SDK | [`endpoints/js-agent`](endpoints/js-agent), sends knocks via NHP-Relay | Try it in the browser: - **[agent.opennhp.org](https://agent.opennhp.org)**: knock a hidden server with the JavaScript SDK - **[reg.opennhp.org](https://reg.opennhp.org)**: walk through device registration (NHP-OTP → NHP-REG) - **[demo.opennhp.org](https://demo.opennhp.org)**: a web app whose login is protected by OpenNHP --- ## Contributing We welcome contributions! Please read [CONTRIBUTING.md](CONTRIBUTING.md) before submitting pull requests. **Note:** All commits must be signed with a verified GPG or SSH key. ```bash git commit -S -m "your message" ``` --- ## Security Found a vulnerability? Please follow the responsible-disclosure process in [SECURITY.md](SECURITY.md) rather than opening a public issue. --- ## Sponsors <a href="https://layerv.ai"> <img src="docs/images/layerv_logo.png" height="40" alt="LayerV.ai logo"> </a> <a href="https://www.atlascloud.ai/"> <img src="docs/images/atlascloud_logo.png" height="40" alt="Atlas Cloud logo"> </a> <a href="https://cloud.tencent.com/"> <img src="docs/images/tencentcloud_logo.svg" height="40" alt="Tencent Cloud logo"> </a> --- ## License Released under the [Apache 2.0 License](LICENSE). ## Contact - Email: [support@opennhp.org](mailto:support@opennhp.org) - Discord: [Join our Discord](https://discord.gg/CpyVmspx5x) - Website: [https://opennhp.org](https://opennhp.org)