Differentiated protection for desktop and server, layered protection ensuring legitimate calls
Two verification mechanisms covering different deployment forms
SmartSlim adopts differentiated security verification mechanisms based on deployment form: desktop and mobile use a lightweight local verification solution to ensure smooth local calls; Linux server uses an authorization code solution, supporting offline authorization. Both mechanisms provide layered protection, ensuring only authorized parties can invoke compression capabilities.
Lightweight solution ensuring smooth local calls
Verifies caller identity through signature mechanism. Third parties without correct integration cannot pass verification.
Adopts one-time verification mechanism, preventing replay attacks and ensuring uniqueness of each call.
Built-in runtime protection mechanism, preventing unauthorized calls and reverse analysis. Full platform support (macOS / Linux / Windows).
Authorization code solution with offline authorization
Authorization code uses encrypted signature, containing customer name, authorization type, validity period, feature permissions and other fields. Server SDK verifies signature offline at runtime without network.
Authorization code binds to device identifier at generation, re-authorization required for machine change. Supports physical, virtual, and container environments.
Device identifier mechanism is compatible with container and VM environments, ensuring authorization can be properly bound and verified in containerized deployments.
Production security for compression service runtime
Whitelist validation for command parameters calling external tools, detecting and blocking path traversal attacks, verifying file extensions against allowed list.
Computes hash values for input and output files, ensuring files are not tampered before and after compression. Higher security levels add stronger hash algorithms.
Integrates professional antivirus engine, supports pre/post-compression bidirectional scanning. Automatically isolates malicious files, scan results can be cached for efficiency.
Structured recording of each operation's metadata, log entries linked through tamper-proof mechanism, any tampering causes verification failure, ensuring audit records cannot be modified.
Time window based request limiting by IP or user dimension, automatically rejects when threshold exceeded, preventing brute-force calls and DoS.
Temporary files stored in isolated directory, securely erased after task completion. Higher security levels support multi-pass overwrite erasure meeting security standards.
Validates uploaded/input file size, directly rejects oversized requests, preventing resource exhaustion. Different limits for standalone and network editions.
From disabled to maximum security, progressive levels
All security features enabled · Multi-algorithm file integrity · Pre+post-compression bidirectional scanning · Scan cache disabled · Multi-pass secure erasure · Any scan warning aborts task
All security features enabled · File integrity verification · Bidirectional scanning · Scan cache enabled · Multi-pass erasure · Tamper-proof audit · Scan failure aborts
Command parameter validation + input file hash + pre-compression scanning + audit log + rate limiting + temp file management + file size validation · Scan cache enabled
Command parameter validation + audit log + file size validation (no malware scanning, no integrity verification, no rate limiting)
All security features off, for controlled test environments only, prohibited in production
From identity verification to runtime protection, full-chain security