Make the Internet Invisible to Attackers

OpenNHP hides your servers, ports, and domains from the public internet. Nothing answers until a client proves who it is with a single encrypted packet, so scanners, bots, and AI-driven attackers find nothing to attack.

OpenNHP is a lightweight, cryptography-powered, open-source toolkit implementing Zero Trust security for infrastructure, applications, and data. It is the reference implementation of the Cloud Security Alliance (CSA) Network-infrastructure Hiding Protocol (NHP) specification, and features two core protocols:

• Network-infrastructure Hiding Protocol (NHP): Conceals server ports, IP addresses, and domain names to protect applications and infrastructure from unauthorized access.
• Data-content Hiding Protocol (DHP): Ensures data security and privacy via encryption and confidential computing, making data "usable but not visible."

Website · Vision · Live Demo · Documentation · Discord

---

Why OpenNHP

The modern internet is a dark forest. Attackers — increasingly backed by LLMs that scan, fingerprint, and exploit at machine speed via Autonomous Vulnerability Exploitation — treat every reachable service as a target. Gartner projects AI-driven cyberattacks will rise rapidly. Traditional defenses authenticate users after the network lets them in, leaving exposed ports, IPs, and domains as a permanent attack surface.

In the AI era, VISIBILITY = VULNERABILITY.

OpenNHP inverts that model: invisible until trusted. Every port, IP, and hostname sits behind a default-deny gate. Access is granted only after a cryptographically signed knock is authenticated and authorized out-of-band. Attackers can't exploit what they can't discover.

The third-generation network hiding protocol

NHP is the next step in a line of "hide the service first" designs:

Generation	Protocol	Limitations
1	Port Knocking	Plaintext, replay-prone
2	Single Packet Authorization (SPA)	Shared secrets, one-way, typically hides ports only, typically C/C++
3	NHP	Modern crypto, bi-directional with status, hides domain + IP + ports, stateless and horizontally scalable, memory-safe Go

NHP slots in alongside existing IAM, DNS, FIDO, and Zero Trust policy engines rather than replacing them — it extends your stack instead of forking it.

---

Architecture

OpenNHP follows a modular design with three core components, inspired by the NIST Zero Trust Architecture:

Core Component	Role
NHP-Agent	Client that sends encrypted knock requests to gain access
NHP-Server	Authenticates and authorizes requests; runs separately and is architecturally decoupled from the protected host
NHP-AC	Access controller that manages firewall rules on the protected server

Addon Component	Role
NHP-Relay	HTTP-to-UDP bridge enabling browser-based agents to send NHP knocks via HTTPS
NHP-KGC	Key Generation Center for Identity-Based Cryptography (IBC)

Protocol flow

Registration (once per device). The agent generates its own key pair, then enrolls the public key:

1. Agent requests a one-time password (NHP_OTP); the Server's auth plugin delivers it to the user (e.g. by email).
2. Agent sends the OTP and its public key (NHP_REG); the Server binds the key to the user and replies (NHP_RAK).

The private key never leaves the device.

Knock (every access).

1. Agent sends an encrypted knock (NHP_KNK) to the Server.
2. Server validates the knock and sends an operation request (NHP_AOP) to the AC.
3. AC opens the firewall and replies (NHP_ART) to the Server.
4. Server returns an acknowledgment (NHP_ACK) with access info to the Agent.
5. Agent reaches the protected resource through the AC.

Browser agents, which cannot send raw UDP, reach the Server through NHP-Relay over HTTPS; the relay forwards each packet inside an authenticated NHP_RLY envelope.

Cryptography

OpenNHP ships with two interchangeable cipher suites:

• CIPHER_SCHEME_CURVE — Curve25519 + AES-256-GCM + BLAKE2s
• CIPHER_SCHEME_GMSM — SM2 + SM4-GCM + SM3

Both are driven by the Noise Protocol Framework. An Identity-Based Cryptography (IBC) mode is available via the Key Generation Center (KGC).

For protocol details, deployment models, and cryptographic design, see the documentation.

---

Repository Structure