Temporal Port Mutation Protocol (TPMP)

Abstract

The proliferation of automated port-scanning tools such as Nmap and Masscan has rendered static listening-port configurations a critical and pervasive attack surface for networked services. This paper introduces the Temporal Port Mutation Protocol (TPMP), a novel cryptographic port-hopping framework that eliminates the concept of a fixed network attack surface at the transport layer. TPMP derives a time-bounded listening port by computing HMAC-SHA256 over a shared secret and a TOTP-style time-window counter, placing the resultant port within the IANA ephemeral range (49152-65535). Both the server and an authorised client independently compute the identical port without any network negotiation, as both possess the shared secret and access to a synchronised clock. The protocol incorporates Elliptic Curve Diffie-Hellman (ECDH) key exchange over P-256 followed by HKDF key derivation for initial secret establishment, TLS 1.3 for all session-layer communication, a NTP-inspired clock-drift compensation algorithm, and a cryptographically authenticated session-migration mechanism (SESSION_RESUME) that allows established TCP sessions to survive port rotations without interruption. A full reference implementation in Python is provided, comprising 58 unit tests, 20 integration tests exercising live TLS sockets and a live port-rotation cycle, and a real-time terminal dashboard. Empirical evaluation demonstrates that the protocol renders ephemeral-range port scanning computationally infeasible within a single rotation window, rejects forged session-resume packets with 100% accuracy, and sustains 50 concurrent messages and eight simultaneous client sessions across port rotations without message loss.