# AHC: Advanced Network-Hiding Access Control Framework
## 1 Introduction  
In the era of information proliferation, network security has become a critical concern for nations, organizations, and individuals alike. As network technologies evolve rapidly, traditional perimeter-based security models are becoming inadequate in managing increasingly sophisticated and dynamic threats to network integrity. The concept of zero-trust security has gained prominence in response to these challenges. The foundational principle of zero trust [1] is \"never trust, always verify\", which dictates that no entity, whether inside or outside the network, should be automatically trusted; instead, every access request must undergo stringent authentication and authorization. The architectural pillars of mainstream zero-trust implementations include Software-Defined Perimeter (SDP) [2], Identity and Access Management (IAM) [3], and MicroSegmentation (MSG) [4; 5]. SDP has revolutionized network security by surpassing traditional boundaries and establishing access controls based on identities, environmental conditions, and contextual data, introducing a transformative approach to securing networks [6]. Within SDP, the Single Packet Authorization (SPA) protocol [7; 8] is a mechanism used to enable secure communication between components. SPA is an approach that hides services from unauthorized users, allowing access to a specific service or resource only upon the successful authorization of a single packet. SPA aligns with the zero trust principle and fine-grained access control, providing independent authorization information for each packet. It enhances system security by minimizing the trust range and improving access control granularity [9]. This approach significantly reduces the attack surface and enhances security. However, despite its advantages, SPA has shown significant limitations in practical applications. This is particularly true in complex network environments. These limitations include its simplistic single-packet, one-way data transmission model, security vulnerabilities from coupling the knocking and access control modules, substantial computational overhead from using high-level encryption algorithms, and lack of a high-availability design. These issues not only compromise the protocol's effectiveness but also expose network systems to risks such as eavesdropping and Distributed Denial of Service (DDoS) attacks. However, with the continuous development of network technology and more complex scenarios, the SPA protocol has gradually exposed many obvious defects and limitations in practical application, mainly in the following aspects [10]:  
1. Users need to know the IP addresses of resources in advance to access them, which exposes the resource's address. This exposure can lead to security risks such as eavesdropping and DDoS attacks. 2. The SPA protocol's one-way authentication mechanism does not provide enough information for multi-level authentication. In dynamic and real-time changing environments, one-way authentication fails to timely acquire and process dynamic information, resulting in insufficient authentication capabilities. 3. Since the knocking module and protected resources are deployed on the same host, heavy concurrent knocking verification can consume the host's computing and bandwidth resources. This may lead to server crashes, rendering network stealth services and protected resource services unavailable. 4. The SPA protocol often uses encryption algorithms higher than RSA2048 to ensure algorithm security, leading to significant performance overhead. To address these limitations of the SPA protocol, we propose an AHAC framework. Our approach introduces an independent control surface as the access proxy service and combines it with a noise generation mechanism to encrypt the access scheme. This solution effectively mitigates the security issues inherent in SPA and replaces the RSA signature method used in traditional SPA protocols.