# AHC: Advanced Network-Hiding Access Control Framework
## 4 Methods
### Workflow  
The workflow between the Agent, the Server, the AC as well as the ASP, and the protected resource is shown in Figure 2. This process is designed to ensure that the Agent must pass the authentication and authorization process before accessing the protected resources, to ensure legitimate access to the resources.  
According to the Network-Hiding Access process of AHAC shown in Figure 2, the specific implementation details are as follows:  
1. The Agent (such as client, browser, etc.) initiates access to protected resources by sending a port-knock packet (i.e., KNK packet) to the Network-Hiding Server (i.e., Server). The goal is to obtain authorization to access protected resources, ensuring that Agents have legal and compliant access rights.
2. When the Server receives a KNK packet from the Agent, it quickly parses the PK packet to obtain a series of key pieces of information, including the Agent's identification, device details, ASP that is requesting access, and information about the target resource (hereinafter collectively referred to as the Agent information).
3. The Server will quickly summarize the obtained Agent information and accurately locate the corresponding ASP server (generally an enterprise IAM system) based on the ASP information. Subsequently, the Server will initiate a request authenticate query for the Agent to the ASP server (i.e., QRY message).
4. The ASP server will perform authentication processes on the Agent information submitted by the Agent. Once authenticated, the ASP server will grant the Agent access to the target resource and reply with a message (i.e., AUT message) including  
Figure 2: Network-Hiding Access process.  
key information such as the real IP address and port number of the target resource. Additionally, to ensure secure access, the ASP server will also provide other authorization information, such as tokens, so that the Agent can carry out subsequent operations smoothly.
5. After completing the authentication, the Server initiates an access request (i.e., sends a DOP message) to the AC system where the target resource is located. This step ensures that the Agent can successfully access the target resource after obtaining the necessary authorization.
6. Upon receiving the access request from the Server, the AC verifies to ensure that the requested target resource matches the protected resource. Once authenticated, the AC immediately opens the connection channel from the Agent to the protected resource, allowing the Agent to access it. The AC replies to the Server with the timeliness and security control information (i.e., DRT message) of this access.
7. After the Server confirms that the AC has successfully granted access, it will respond with an ACK packet, providing the Agent with the real address of the protected resource and the valid duration for access.
8. At this point, the Agent has successfully obtained regular access to the target resource. However, it is important to note that this access authorization is not permanent. Before the authorization period expires, the Agent must initiate a new knocking request in advance and repeat steps 1 to 7 to renew resource access permissions, ensuring continuous and stable access.
9. (Optional) The detailed logs generated during the entire interaction and data communication process will be securely and efficiently uploaded to the regulatory authorities for strict compliance audits.