New port knocking using TCP SYN SQN, aka TCP stealth, that's up as a draft IETF and a demo 3.16 kernel patch called Knock over at GNUnet

Sorry for late reply. The reason we use 3.13 is that overlayfs is not yet available for newer kernels (at least it was not at the time helium was feature frozen). If that patch is easily backportable, we sure can integrate it.