# AHC: Advanced Network-Hiding Access Control Framework
## 5 Experiments and Analysis
### High Availability  
One of the implementation goals of AHAC is high availability for secure access. In AHAC, the Port Knocking module and the access control module are designed in a distributed architecture. This not only prevents the Port Knocking verification from consuming the computing and bandwidth resources of the host where the protected resources reside but also allows the Port Knocking module to scale elastically on demand. Similarly, the access control module and the protected resources can also scale elastically on demand to achieve load balancing, meeting the requirements for rapid response under high concurrency and high load conditions. Due to the distributed deployment of the Port Knocking module, even in the event of network failures or data center outages, the data resource requester can quickly and seamlessly switch to other Port Knocking services without affecting functionality or response speed. Therefore, in the high availability architecture design of AHAC, the Port Knocking verification servers and the access control services are deployed on different physical hosts, as shown in the network topology diagram, Figure 5. This strategic layout significantly enhances the system's robustness and effectively reduces the potential impact on overall system availability in the event of a service failure. By deploying in a distributed manner, we ensure service isolation, so that even if one service is attacked or fails, other services can continue to operate normally without being affected by external attacks.  
Figure 5: High-availability network topology in the AHAC framework.  
Additionally, AHAC supports horizontal elastic scaling of the Port Knocking verification services, allowing the system to flexibly and dynamically adjust the number of service instances based on real-time load conditions. This feature endows AHAC with exceptional elasticity and extensibility, ensuring that even under high load challenges, the services can maintain rapid response and stable availability. Each service instance is capable of handling Port Knocking requests and maintaining business sessions. This design not only significantly enhances the system's processing capability but also improves its fault tolerance, thereby ensuring business continuity and stability. The load capacity test results of AHAC high-availability servers under different numbers of Agents are shown in Figure 6. As illustrated in the figure, the distributed server deployment reduces the load on each server, resulting in a significant improvement over SPA and enhanced security.  
The Port Knocking verification service, provided by ASP, not only undertakes the critical tasks of authentication and access control but also manages the dynamic allocation of the IP addresses of the access control systems and their associated hosts. This dynamic allocation mechanism can flexibly adjust the distribution of resources based on real-time network load and resource utilization, thereby significantly enhancing the system's load-balancing capabilities. More importantly, since the IP address allocation is no longer limited to a static mode, our system can more efficiently handle individual server failures by intelligently and automatically redistributing traffic to servers that are functioning normally. This capability significantly improves the overall system's availability and stability.