# AHC: Advanced Network-Hiding Access Control Framework
## 5 Experiments and Analysis
### Security Analysis of the AHAC Framework  
The AHAC framework provides several key improvements in network security, which are specifically designed to address the limitations of traditional access control mechanisms such as SPA and Port Knocking. Below, we analyze the AHAC framework from various network security angles. By separating the Port Knocking module from the access control module, AHAC enhances security by distributing the attack surface. This separation ensures that even if one module is compromised, the overall system integrity remains intact. AHAC employs a two-way authentication mechanism, ensuring that both parties in the communication process are verified. This mutual authentication minimizes the risk of unauthorized access and provides a robust method to confirm the identity of both users and resources. AHAC uses ECC for creating random key pairs, which provides strong security with smaller key sizes compared to traditional RSA algorithms. ECC's efficiency helps reduce computational overhead while maintaining high security. Additionally, AHAC utilizes ECDH for secure key exchanges, enhancing the security of the communication setup by ensuring that cryptographic keys are exchanged securely over public channels. By introducing the Noise Protocol, AHAC adds randomness to encryption processes, making it difficult for attackers to predict or break encryption patterns. This further secures the communication between parties. The separation of the knocking and access control modules also helps mitigate the risk of DDoS attacks. Since the knocking verification does not consume the host's resources where the protected services are located, the impact of DDoS attacks on the primary service is minimized. The use of advanced cryptographic techniques and the Noise Protocol in AHAC ensures that even if an attacker intercepts the communication, replay attacks are less likely to succeed due to the dynamic nature of the encryption keys and the authentication process. AHAC's design allows for on-demand elastic expansion, which can handle high concurrency and high load conditions without degrading performance. This feature is critical in maintaining availability and performance  
Figure 8: Deployment scenario of FIDO integration with AHAC.  
during peak usage or attack scenarios. By distributing the access control and Port Knocking processes across different network entities, AHAC supports effective load balancing. This ensures that no single point of the network becomes a bottleneck, thereby enhancing overall system resilience.  
AHAC Application Scenario Test  
The Mini Program H5 page accesses a government system. The target defense API server is the application server and its resources. AHAC's JS SDK has been embedded in the Mini Program H5 page. The AHAC access control component has been deployed on the API server (Linux). The scope of the Mini Program Government System scenario diagram is shown in Figure 9.  
The experimental results demonstrate the effectiveness of the AHAC service in enhancing network security. As shown in Figure 10, before enabling AHAC, the scanning tool detected 30 exposed ports on the API server. After activation, no exposed ports were detected, achieving a \"network cable unplugging\" security effect. Figure 10 illustrates that abnormal or invalid network traffic decreased from 37 percent to 2 percent post-AHAC activation. By integrating the AHAC SDK and enabling zero trust, the server address is dynamically returned and no longer exposed in the front-end code, effectively protecting against DDoS attacks. AHAC used in governmental scenarios is shown in Figure 10.  
Figure 10: Comparison of experimental effects of AHAC in governmental scenarios.  
Figure 9: Experimental deployment scenarios.