Multi-tenant system permission protection and vulnerability repair method and system

Abstract

The invention relates to the technical field of cloud computing, in particular to a multi-tenant system permission protection and vulnerability repair method and system.The method comprises a horizontal unauthorized protection method and a vertical unauthorized protection method which are used for enhancing the security of a multi-tenant system and preventing unauthorized access and permission abuse; the multi-tenant system permission protection and vulnerability repair method and system have the advantages that during implementation, only an sdk packet needs to be introduced, an interceptor is registered, no extra workload exists, and compared with a traditional annotation-based mode, the system invasiveness is small, and the workload is low; adjustment can be carried out at any time through a configuration mode, and additional double reinforcement protection is carried out for key resources; vulnerability repair response is fast, after vulnerabilities are found, only configuration of leaked resources needs to be adjusted, the vulnerabilities can be blocked immediately, and system upgrading does not need to be carried out; the method has good general adaptability, and can be applied to various application subsystems through an interceptor mode; and the vertical and horizontal unauthorized vulnerabilities can be protected and repaired at the same time.

Description

Technical Field

[0001] The present invention relates to the field of cloud computing technology, and in particular to a method and system for protecting and repairing vulnerabilities of multi-tenant system permissions. Background Art

[0002] With the development of cloud computing and multi-tenant technology, application and data security between different users under a multi-tenant architecture has become an important issue in cloud computing architecture.

[0003] In a cloud computing environment, multiple tenants share the same resource pool, so appropriate permission management and isolation measures must be taken to ensure resource isolation between different users. At the same time, a cloud computing environment involves a large number of mutual calls between subsystems, and the architecture, security and permission management measures between subsystems are diverse, and integration is complex and difficult. Security vulnerabilities are very likely to occur between system gaps. Summary of the invention

[0004] The purpose of the present invention is to provide a multi-tenant system permission protection and vulnerability repair method and system to solve the problems raised in the above background technology.

[0005] To achieve the above-mentioned objectives, the present invention provides the following technical solutions: a method for protecting and repairing vulnerabilities in a multi-tenant system's permissions, the method comprising: a horizontal over-authorization protection method and a vertical over-authorization protection method, for enhancing the security of a multi-tenant system and preventing unauthorized access and abuse of permissions.

[0006] Preferably, the horizontal overriding protection method includes:

[0007] Permission configuration, providing authorization.uri configuration items, supporting URL wildcard fuzzy matching and multiple configurations, each of which consists of a URL address and a permission control character; providing user.domain configuration items to specify the user authentication center address; managing permission control characters, names and operation URLs through the database permission configuration table, supporting JSON format storage;

[0008] User authority identification: extract and parse the Authorization attribute from the request header to obtain the user ID. According to the current access resource path and request protocol, the authentication center verifies whether the user has the operation authority.

[0009] Using Java language, protection is achieved through global interceptors.

[0010] Preferably, the vertical overreach protection method includes:

[0011] Permission configuration, providing workspaceAuthCheck.excludeUrls configuration item, allowing configuration of URLs that do not need to be intercepted; workspaceAuthCheck.enabled verification switch, controlling whether verification is performed; workspaceAuthCheck.keys configuration item, specifying URL parameters or request body attributes to be verified;

[0012] Tenant isolation permission cache acceleration, using asynchronous threads to periodically load the access correspondence between users and tenant resources from the user authentication center, and use a memory-optimized global Set collection to store the simplified correspondence;

[0013] Obtain user ID and extract verification value: parse the Authorization attribute from the request header to obtain the user ID, and extract the attribute value to be verified from the URL parameters and request body;

[0014] Permission verification: Combine the user ID with the attribute value to be verified, search in the tenant isolation permission cache, and confirm whether the user has the right to access specific tenant resources;

[0015] Using Java language, protection is achieved through global interceptors.

[0016] Preferably, the method further comprises:

[0017] Users can deploy horizontal or vertical unauthorized access protection methods separately or simultaneously according to actual needs to adapt to different security requirements and multi-tenant environments.

[0018] Preferably, the method further comprises:

[0019] Logging and monitoring: integrated logging and monitoring systems to record key information and abnormal behaviors during permission verification, facilitating subsequent audits and vulnerability repairs;

[0020] Automated repair, combined with security scanning tools, regularly detects potential vulnerabilities in the system and automatically or assists administrators in repairing them, ensuring continuous improvement of system security;

[0021] Scalability: supports adding new authentication strategies and protection mechanisms through plug-ins or extension modules to adapt to possible security threats and business development needs in the future.

[0022] A multi-tenant system permission protection and vulnerability repair system, the system comprising:

[0023] The system integrates horizontal and vertical unauthorized access protection methods to ensure data security and permission control in multi-tenant systems and prevent unauthorized access and data leakage.

[0024] Preferably, the horizontal overreach protection method includes the following modules:

[0025] Permission configuration module: provides the authorization.uri configuration item, allowing users to configure the URL that needs vertical authentication, supporting wildcards and multiple configurations; also provides the user.domain configuration item to specify the authentication center address; and a database-based permission configuration table to store the mapping relationship between permission control symbols, names, and operation URLs;

[0026] User authority identification module: extracts and parses the Authorization attribute from the request header to obtain the user ID, and calls the authentication center to verify the user authority based on the currently accessed resource path and request protocol, combined with the information of the authority configuration module;

[0027] Implementation method: Developed in Java language, the protection logic is automatically executed through the global interceptor.

[0028] Preferably, the vertical overreach protection method includes the following modules:

[0029] Permission configuration module: provides configuration items such as workspaceAuthCheck.excludeUrls, workspaceAuthCheck.enabled, and workspaceAuthCheck.keys, which are used to configure URLs that do not need to be intercepted, enable the verification function, and specify URL parameters or request body attributes that need to be verified;

[0030] Tenant isolation permission cache acceleration module: loads the access relationship between users and tenant resources from the user authentication center regularly through asynchronous threads, and uses memory-optimized data structure storage to improve permission verification efficiency;

[0031] User ID acquisition and verification value extraction module: parse the Authorization attribute from the request header to obtain the user ID, and extract the attribute value to be verified from the URL parameters and request body;

[0032] Permission verification module: combines the user ID with the attribute value to be verified and searches in the tenant isolation permission cache to confirm whether the user has the right to access specific tenant resources;

[0033] Implementation method: Developed in Java language, and integrated with global interceptor to achieve automatic protection.

[0034] Preferably, the system supports separate deployment of a horizontal unauthorized access protection method or a vertical unauthorized access protection method, and simultaneously deploys both methods according to actual needs to adapt to different security policies and multi-tenant environments.

[0035] Preferably, the system also includes the following additional functions:

[0036] Logging and monitoring: Integrate logging and monitoring systems to record key information and abnormal behaviors during permission verification, facilitating subsequent audits and vulnerability repairs;

[0037] Automated repair: Combined with security scanning tools, it regularly detects potential vulnerabilities in the system and automatically or assists administrators in repairing them to ensure continuous improvement of system security;

[0038] Scalability: Supports adding new authentication strategies and protection mechanisms through plug-ins or extension modules to adapt to possible security threats and business development needs in the future.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] The multi-tenant system permission protection and vulnerability repair method and system proposed in the present invention are simple and convenient. When implemented, only the SDK package needs to be introduced and the interceptor needs to be registered without additional workload. Compared with the traditional annotation-based method, the system is less invasive and has a low workload. It can be adjusted at any time through configuration to perform additional double reinforcement protection for key resources. The vulnerability repair response is fast. After the vulnerability is discovered, only the configuration of the leaked resources needs to be adjusted to immediately plug the vulnerability without system upgrades. It has good general adaptability and can be applied to various application subsystems through interceptors. It can simultaneously meet the protection and repair of vertical and horizontal unauthorized vulnerabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 This is a flowchart of the protection process of vertical overreaching of the present invention;

[0042] Figure 2 This is a flowchart of the protection process for horizontal overreaching of the present invention. DETAILED DESCRIPTION

[0043] In order to make the purpose and technical solution of the present invention clearly and completely described, and the advantages more clearly understood, the embodiments of the present invention are further described in detail with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are part of the embodiments of the present invention, rather than all of the embodiments, and are only used to explain the embodiments of the present invention, and are not used to limit the embodiments of the present invention. All other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0044] For example, see Figure 1 to Figure 2 The present invention provides a technical solution: a method for protecting and repairing vulnerabilities of multi-tenant system permissions, the method comprising:

[0045] S1. Provide a global interception measure to perform vertical unauthorized protection and horizontal unauthorized protection in sequence.

[0046] S2. Vertical overreach protection

[0047] The invention provides a vertical over-authorization protection solution based on a global interceptor, which is written in Java language.

[0048] The detailed working steps are:

[0049] S201. Provide a permission configuration module

[0050] S20101. Allow users to configure URLs that need to be intercepted for vertical authentication, support wildcard fuzzy matching, and support comma-separated configuration of multiple items.

[0051] Feature 1: The configuration item name is authorization.uri.

[0052] Feature 2: Each item is divided into two sub-items separated by a colon

[0053] Sample:

[0054] authorization.uri = url address 1: permission control symbol 1, url address 2: permission control symbol 2;

[0055] S20102. Allow the user to configure the authentication center address.

[0056] Feature 1: The configuration item name is user.domain.

[0057] S20103. Provide a permission configuration table based on a database.

[0058] Feature 1: Contains three key attributes: permission control character, name, and operation URL. The permission control character and operation URL in the database need to correspond to those configured in authorization.uri.

[0059] Feature 2: The operation URL supports JSON format, for example:

[0060]

[0061]

[0062] S20104. Provide a user management table, a role management table, a user role association table, and a role and permission configuration association table.

[0063] S20105. Provide a configuration verification module. If the user has not configured or the configuration is empty, no verification is performed and success is returned. If the configuration is not performed in accordance with the above requirements, the user is prompted with a configuration error.

[0064] S202. Provide a user authority authentication module.

[0065] S20201. Extract the token, obtain the Authorization attribute from the request header, parse it as a token, and determine whether the token contains the prefix "bearer+space". If so, remove the prefix. Decode the token using base64 and parse it to obtain the user ID.

[0066] S20202. Perform user authority authentication. Obtain the currently accessed resource path and request protocol from the request header, and determine whether the access path is in authorization.uri. If it exists, extract the corresponding authority control symbol from authorization.uri. Based on the currently accessed resource path, request protocol, user ID, and authority control symbol, call the authentication center address configured in user.domain; the authentication center matches the database to see if the user has the authority to operate.

[0067] S20203. When the authentication center returns that the current user has permission to operate, continue with subsequent processing; when the authentication center returns that the user does not have permission to operate, a prompt is given: "The user does not have permission to operate."

[0068] S3, horizontal overriding protection

[0069] The invention provides a horizontal over-authorization protection solution based on a global interceptor, which is written in Java language.

[0070] The detailed working steps are:

[0071] S301. Provide a permission configuration module

[0072] S30101. Allow users to configure URLs that do not need to be intercepted for horizontal authentication, support wildcard fuzzy matching, support comma-separated configuration of multiple items, and perform global interception by default.

[0073] Feature 1: The configuration item is named workspaceAuthCheck.excludeUrls.

[0074] Sample:

[0075] workspaceAuthCheck.excludeUrls = url address 1, url address 2, ...;

[0076] S30102. Provide a verification switch. Verification is performed only when the switch is turned on.

[0077] Feature 1: The configuration item is named workspaceAuthCheck.enabled

[0078] S30103. Provide verification attribute configuration, support comma-separated configuration of multiple items.

[0079] Feature 1: The configuration item is named workspaceAuthCheck.keys

[0080] Example: workspaceAuthCheck.keys = tenantSpace, tenantCode

[0081] S30104. Same as vertical authentication, allowing users to configure the authentication center address.

[0082] Feature 1: The configuration item name is user.domain.

[0083] S302. Provide a tenant isolation permission cache acceleration module.

[0084] Through the init method of servlet technology, an asynchronous thread is started, and through a timed loop, the access correspondence between the user and the horizontal tenant resources is loaded from the address specified by user.domain at regular intervals.

[0085] A memory-optimized approach is adopted to use a global Set-type data structure to store the horizontal access correspondence between users and tenant resources. The correspondence is simplified to the format of "user ID_@_tenant resource ID" and stored in the set H.

[0086] S303. Provide a user ID acquisition module, obtain the Authorization attribute from the request header, parse it as a token, determine whether the token has a "bearer+space" prefix, and if so, remove the prefix. Decode the token using base64, and parse it to obtain the user ID.

[0087] S304: Provide a verification attribute value extraction module

[0088] S30401. Parse the URL parameters to see if there are any parameter names configured in workspaceAuthCheck.keys that need to be verified. If a verification value is obtained, store it in the list R to be verified.

[0089] S30402. Parse the request body parameters

[0090] Use HttpServletRequestWrapper to copy the current request body.

[0091] Parse the request body to determine whether it starts with "[" and ends with "]", or starts with "{" and ends with "}"; if so, try to convert it into a json object, traverse and extract the values ​​of all attributes configured in workspaceAuthCheck.keys in the json, and store them in the list R to be checked.

[0092] Otherwise, use regular expressions to extract the request body. First, try to decode the request body using base64. Regardless of whether it succeeds, use regular expressions to extract the target value.

[0093] The regular expression extraction method is:

[0094] The attribute Xi configured in workspaceAuthCheck.keys is processed in a loop as follows.

[0095] 1. Match: (?!&)Xi=(.*?)(?=&|$), extract the second matching sub-item of each matching point and store it in the list to be checked R;

[0096] 2. Match: \"Xi\":(\\s?)\"(.*?)\", extract the third matching sub-item of each matching point and store it in the list to be checked R;

[0097] 3. Match: \\[Xi\\] = (.*?)(? = &|$), extract the second matching sub-item of each matching point and store it in the list to be checked R.

[0098] S30403. Provide an outlier exclusion module.

[0099] From the list R to be checked, remove the entries that do not conform to the uuid format, that is, the entries whose length is not 32 or 36, or contain characters other than letters, numbers, and hyphens "-".

[0100] S305: Provide an authority verification module

[0101] If the list R to be checked is empty, the values ​​of the attributes configured in workspaceAuthCheck.keys are obtained from the http header request header in a loop and stored in the list R to be checked.

[0102] Combine each item Yi in the list to be checked R with the user ID in the format of "user ID_@_Yi" and determine whether the combination is in the set H. If so, it is considered to have permission and continue with subsequent processing; otherwise, it is prompted that the user does not have permission to operate.

[0103] Embodiment 2, based on embodiment 1, proposes a multi-tenant system permission protection and vulnerability repair system, the system includes: horizontal overreach protection:

[0104] Permission configuration module: ① Provide authorization.uri configuration item, allowing users to configure the URL that needs to be intercepted for vertical authentication, support wildcard fuzzy matching, and support comma-separated configuration of multiple items; each item is separated by a colon into two sub-items, for example: authorization.uri = url address 1: permission control character 1, url address 2: permission control character 2; ② Provide user.domain configuration item to specify the user authentication center address; ③ Provide a database-based permission configuration table, including permission control character, name, operation url, three key attributes; the permission control character and operation url in the database need to correspond to those configured in authorization.uri; the operation url supports JSON format storage, for example:

[0105]

[0106] User authority identification module: ① The method of extracting userID is to obtain the Authorization attribute from the request header, parse it as a token, and determine whether the token has a "bearer+space" prefix. If so, remove the prefix; decode the token using base64, and parse it to obtain the user ID. ② The method of user authority identification is to obtain the currently accessed resource path and request protocol from the request header, and determine whether the access path is in authorization.uri. If it exists, extract the corresponding permission control symbol from authorization.uri; ③ The method of calling the authentication center is to call the authentication center address configured in user.domain according to the currently accessed resource path, request protocol, user ID, and permission control symbol; the authentication center matches the database to see if the user has the right to operate. 3) It is implemented in Java language and protected by a global interceptor.

[0107] It also includes vertical overreach protection:

[0108] Permission configuration module, ① provides workspaceAuthCheck.excludeUrls configuration item, allowing users to configure URLs that do not need to be intercepted for horizontal authentication, supports wildcard fuzzy matching, supports comma-separated configuration of multiple items, and performs global interception by default. For example: workspaceAuthCheck.excludeUrls = url address 1, url address 2, ...; ② provides workspaceAuthCheck.enabled verification switch configuration item, and verification is performed only when the switch is turned on; ③ provides workspaceAuthCheck.keys configuration item, supports comma-separated configuration of multiple items, for example: workspaceAuthCheck.keys = tenantSpace, tenantCode; 2) provides a tenant isolation permission cache acceleration method, ① through the init method of servlet technology, starts an asynchronous thread, and through a timed loop, loads the access correspondence between users and horizontal tenant resources from the address specified by user.domain at regular intervals; ② adopts a memory optimization method, using a global Set type data structure to store the horizontal access correspondence between users and tenant resources; simplifies the correspondence into the format of "user ID_@_tenant resource ID" and stores it in the set H. 3) Provide a user ID acquisition module, obtain the Authorization attribute from the request header, parse it as a token, and determine whether the token has a "bearer+space" prefix. If so, remove the prefix. Use base64 to decode the token and parse it to obtain the user ID. 4) Provide a verification attribute value extraction module, ① first parse the URL parameters to match whether there is a parameter name that needs to be verified configured in workspaceAuthCheck.keys. If a verification value is obtained, it is stored in the list to be verified R; ② Then parse the request body parameters. 5) Provide a method for extracting specified parameters of the request body, ① Use the HttpServletRequestWrapper method to copy the current request body; ② Parse the request body to determine whether the request body starts with "[" and ends with "]", or starts with "{" and ends with "}"; if so, it will try to convert it into a json object, traverse and extract the values ​​of all attributes configured in workspaceAuthCheck.keys in json, and store them in the list to be verified R. Otherwise, use a regular expression method to extract the request body. First, try to decode the request body using base64. Regardless of whether it succeeds, use regular expressions to extract the target value.6) A method for extracting specified attributes from the request body using regular expressions, and performing the following loop processing on the attribute Xi configured in workspaceAuthCheck.keys: ① Match: (?!&)Xi=(.*?)(?=&|$), extract the second matching sub-item of each matching point and store it in the list to be checked R; ② Match: \"Xi\":(\\s?)\"(.*?)\", extract the third matching sub-item of each matching point and store it in the list to be checked R; ③ Match: \\[Xi\\]=(.*?)(?=&|$), extract the second matching sub-item of each matching point and store it in the list to be checked R. 7) An abnormal noise value exclusion module, which removes entries that do not conform to the uuid format from the list to be checked R, that is, entries whose length is not 32 or 36, or contain characters other than letters, numbers, and dashes "-". 8) A permission verification module, ① if the list to be verified R is empty, then loop through the http header request header to obtain the value of the attribute configured in workspaceAuthCheck.keys and store it in the list to be verified R; ② combine each item Yi in the list to be verified R with the user ID, and combine them into the format of "user ID_@_Yi", and determine whether the combination is in the set H. If it exists, it is considered to have permission and continue with subsequent processing; otherwise, it prompts the user that he has no operation permission. 9) It is implemented in Java language and protected by a global interceptor.

[0109] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for protecting and repairing vulnerabilities in multi-tenant system permissions, characterized by: The method includes: a horizontal unauthorized access protection method and a vertical unauthorized access protection method, which are used to enhance the security of a multi-tenant system and prevent unauthorized access and abuse of authority.

2. According to claim 1, a method for protecting and repairing vulnerabilities of multi-tenant system permissions is characterized by: Horizontal override protection methods include: Permission configuration, providing authorization.uri configuration items, supporting URL wildcard fuzzy matching and multiple configurations, each of which consists of a URL address and a permission control character; providing user.domain configuration items to specify the user authentication center address; managing permission control characters, names and operation URLs through the database permission configuration table, supporting JSON format storage; User authority identification: extract and parse the Authorization attribute from the request header to obtain the user ID. According to the current access resource path and request protocol, the authentication center verifies whether the user has the operation authority. Using Java language, protection is achieved through global interceptors.

3. According to claim 1, a method for protecting and repairing vulnerabilities of multi-tenant system permissions is characterized by: Vertical overreach protection methods include: Permission configuration, providing workspaceAuthCheck.excludeUrls configuration item, allowing configuration of URLs that do not need to be intercepted; workspaceAuthCheck.enabled verification switch, controlling whether verification is performed; workspaceAuthCheck.keys configuration item, specifying URL parameters or request body attributes to be verified; Tenant isolation permission cache acceleration, using asynchronous threads to periodically load the access correspondence between users and tenant resources from the user authentication center, and use a memory-optimized global Set collection to store the simplified correspondence; Obtain user ID and extract verification value: parse the Authorization attribute from the request header to obtain the user ID, and extract the attribute value to be verified from the URL parameters and request body; Permission verification: Combine the user ID with the attribute value to be verified, search in the tenant isolation permission cache, and confirm whether the user has the right to access specific tenant resources; Using Java language, protection is achieved through global interceptors.

4. According to claim 1, a method for protecting and repairing vulnerabilities of multi-tenant system permissions is characterized by: The method further comprises: Users can deploy horizontal or vertical unauthorized access protection methods separately or simultaneously according to actual needs to adapt to different security requirements and multi-tenant environments.

5. According to claim 1, a method for protecting and repairing vulnerabilities of multi-tenant system permissions is characterized by: The method further comprises: Logging and monitoring: integrated logging and monitoring systems to record key information and abnormal behaviors during permission verification, facilitating subsequent audits and vulnerability repairs; Automated repair, combined with security scanning tools, regularly detects potential vulnerabilities in the system and automatically or assists administrators in repairing them, ensuring continuous improvement of system security; Scalability: supports adding new authentication strategies and protection mechanisms through plug-ins or extension modules to adapt to possible security threats and business development needs in the future.

6. A multi-tenant system permission protection and vulnerability repair system according to the multi-tenant system permission protection and vulnerability repair method according to any one of claims 1 to 5, characterized in that: The system comprises: The system integrates horizontal and vertical unauthorized access protection methods to ensure data security and permission control in multi-tenant systems and prevent unauthorized access and data leakage.

7. A method and system for protecting and repairing vulnerabilities of multi-tenant system permissions according to claim 6, characterized in that: The horizontal protection method includes the following modules: Permission configuration module: provides the authorization.uri configuration item, allowing users to configure the URL that needs vertical authentication, supporting wildcards and multiple configurations; and also provides the user.domain configuration item to specify the authentication center address; And a database-based permission configuration table for storing the mapping relationship between permission control symbols, names and operation URLs; User authority identification module: extracts and parses the Authorization attribute from the request header to obtain the user ID, and calls the authentication center to verify the user authority based on the currently accessed resource path and request protocol, combined with the information of the authority configuration module; Implementation method: Developed in Java language, the protection logic is automatically executed through the global interceptor.

8. A method and system for protecting and repairing vulnerabilities of multi-tenant system permissions according to claim 6, characterized in that: The vertical protection method includes the following modules: Permission configuration module: provides configuration items such as workspaceAuthCheck.excludeUrls, workspaceAuthCheck.enabled, and workspaceAuthCheck.keys, which are used to configure URLs that do not need to be intercepted, enable the verification function, and specify URL parameters or request body attributes that need to be verified; Tenant isolation permission cache acceleration module: loads the access relationship between users and tenant resources from the user authentication center regularly through asynchronous threads, and uses memory-optimized data structure storage to improve permission verification efficiency; User ID acquisition and verification value extraction module: parse the Authorization attribute from the request header to obtain the user ID, and extract the attribute value to be verified from the URL parameters and request body; Permission verification module: combines the user ID with the attribute value to be verified and searches in the tenant isolation permission cache to confirm whether the user has the right to access specific tenant resources; Implementation method: Developed in Java language, and integrated with global interceptor to achieve automatic protection.

9. A method and system for protecting and repairing vulnerabilities of multi-tenant system permissions according to claim 6, characterized in that: The system supports the separate deployment of horizontal unauthorized access protection methods or vertical unauthorized access protection methods, and the two can be deployed simultaneously according to actual needs to adapt to different security policies and multi-tenant environments.

10. A method and system for protecting and repairing vulnerabilities of multi-tenant system permissions according to claim 6, characterized in that: The system also includes the following additional functions: Logging and monitoring: Integrate logging and monitoring systems to record key information and abnormal behaviors during permission verification, facilitating subsequent audits and vulnerability repairs; Automated repair: Combined with security scanning tools, it regularly detects potential vulnerabilities in the system and automatically or assists administrators in repairing them to ensure continuous improvement of system security; Scalability: Supports adding new authentication strategies and protection mechanisms through plug-ins or extension modules to adapt to possible security threats and business development needs in the future.

Images