Layered Security Verification Architecture
Differentiated protection for desktop and server, layered protection ensuring legitimate calls
Architecture Overview
Two verification mechanisms covering different deployment forms
SmartSlim adopts differentiated security verification mechanisms based on deployment form: desktop and mobile use a lightweight local verification solution to ensure smooth local calls; Linux server uses an authorization code solution, supporting offline authorization. Both mechanisms provide layered protection, ensuring only authorized parties can invoke compression capabilities.
Desktop / Mobile Verification
Lightweight solution ensuring smooth local calls
Caller Identity Verification
Verifies caller identity through signature mechanism. Third parties without correct integration cannot pass verification.
Anti-Replay Protection
Adopts one-time verification mechanism, preventing replay attacks and ensuring uniqueness of each call.
Runtime Protection
Built-in runtime protection mechanism, preventing unauthorized calls and reverse analysis. Full platform support (macOS / Linux / Windows).
Linux Server Verification
Authorization code solution with offline authorization
Authorization Code Verification
Authorization code uses encrypted signature, containing customer name, authorization type, validity period, feature permissions and other fields. Server SDK verifies signature offline at runtime without network.
Device Binding
Authorization code binds to device identifier at generation, re-authorization required for machine change. Supports physical, virtual, and container environments.
Docker / VM Support
Device identifier mechanism is compatible with container and VM environments, ensuring authorization can be properly bound and verified in containerized deployments.
Server Security Capabilities
Production security for compression service runtime
Command Parameter Validation
Whitelist validation for command parameters calling external tools, detecting and blocking path traversal attacks, verifying file extensions against allowed list.
File Integrity Verification
Computes hash values for input and output files, ensuring files are not tampered before and after compression. Higher security levels add stronger hash algorithms.
Malware Scanning
Integrates professional antivirus engine, supports pre/post-compression bidirectional scanning. Automatically isolates malicious files, scan results can be cached for efficiency.
Audit Log (Tamper-proof)
Structured recording of each operation's metadata, log entries linked through tamper-proof mechanism, any tampering causes verification failure, ensuring audit records cannot be modified.
Rate Limiting
Time window based request limiting by IP or user dimension, automatically rejects when threshold exceeded, preventing brute-force calls and DoS.
Secure Temporary File Management
Temporary files stored in isolated directory, securely erased after task completion. Higher security levels support multi-pass overwrite erasure meeting security standards.
File Size Limit
Validates uploaded/input file size, directly rejects oversized requests, preventing resource exhaustion. Different limits for standalone and network editions.
Multi-level Security
From disabled to maximum security, progressive levels
Maximum Security
All security features enabled · Multi-algorithm file integrity · Pre+post-compression bidirectional scanning · Scan cache disabled · Multi-pass secure erasure · Any scan warning aborts task
High Security
All security features enabled · File integrity verification · Bidirectional scanning · Scan cache enabled · Multi-pass erasure · Tamper-proof audit · Scan failure aborts
Medium Security (Default)
Command parameter validation + input file hash + pre-compression scanning + audit log + rate limiting + temp file management + file size validation · Scan cache enabled
Low Security
Command parameter validation + audit log + file size validation (no malware scanning, no integrity verification, no rate limiting)
Disabled
All security features off, for controlled test environments only, prohibited in production
Security Assurance
From identity verification to runtime protection, full-chain security