# AHC: Advanced Network-Hiding Access Control Framework
## 5 Experiments and Analysis
### Extensibility Verification
#### 5.4.1 Integration with DNS  
As a fundamental service on the Internet, DNS has played a vital role in the operation of websites, but its security has long been neglected. DNS uses an unreliable UDP protocol, which has significant security vulnerabilities. Attackers can easily exploit these vulnerabilities to launch attacks, leading to security issues such as DNS hijacking, cache poisoning, denial of service attacks, and random subdomain/non-existent domain name attacks. Therefore, strengthening DNS security risk prevention and control capabilities is crucial. After integrating AHAC, DNS resolution is ensured through the bidirectional encryption channel of AHAC, ensuring confidentiality and tamper resistance. In addition, since only authenticated individuals are allowed to successfully resolve, it can effectively defend against security issues such as DDoS attacks and hijacking. The specific implementation scheme is shown in Figure 7. AHAC can significantly improve the security performance of DNS and provide users with more secure and reliable DNS services. The processing steps are as follows:  
1. The Agent (such as a client, browser, etc.) initiates a request to the Network-Hiding Server (i.e., Server) using a domain name. 2. Once the Server receives the domain name data packet request from the Agent, it immediately sends an authentication query request to the application authentication server to verify the legality and permissions of the request. 3. Upon receiving the authentication request message from the Server, the authentication server undergoes a strict verification process. Once the identity is confirmed to be authentic and valid, it grants access permissions. Subsequently, the authentication server promptly replies to the Server with an authorized access credential containing critical information such as the real IP address and port number of the target resource. 4. After successfully passing the authentication query, the Server quickly initiates an access request to the access control system of the target resource. This request aims to ensure that the Agent can access the required target resource seamlessly, facilitating subsequent operations. 5. Upon receiving the access request from the Server, the access control system immediately performs a rigorous verification procedure. This process ensures that the requested target resource matches the protected resource exactly, thereby ensuring the security and reliability of the system. Once verified, the AC system swiftly establishes a connection channel from the Agent to the protected resource, allowing unobstructed access. 6. Once the AC system successfully grants access to the Agent, the Server promptly confirms this operation and returns the IP address and port information of the target resource. These details are then quickly transmitted to the Agent, enabling it to accurately locate and access the protected resource (i.e., Application). 7. After receiving the IP address and port information of the Application, the Agent immediately initiates normal business access to the Application, achieving efficient and secure resource interaction. Integration with FIDO  
FIDO effectively addresses identity authentication on the web, but server vulnerabilities can still be exploited by hackers to bypass FIDO authentication, directly invade the server, and steal or damage data. By integrating FIDO with AHAC, this shortcoming is well mitigated, providing a more comprehensive solution for internet exposure defense. The implementation scheme is shown in Figure 8, with the specific implementation steps as follows. 1. The User Agent (i.e., Agent) sends a Port Knocking packet to the Network-Hiding Server (i.e., Server) aiming to attempt access to sensitive resources within sessions that have been authenticated but with relatively lower assurance levels. 2. Upon receiving the Port Knocking packet, the Server forwards the resource access request to the Application Provider. 3.