Communication Encryption and Trusted Identity

Communication between the training-side plugin and the server can establish a protected communication channel through secure transport protocols such as TLS. This mechanism encrypts transmitted content and uses integrity checks to reduce the risk of eavesdropping, tampering, or forgery during network transmission.

• Transmission encryption: Encrypts training status, control results, authentication information, and API call content during transmission.
• Certificate validation: Verifies the authenticity, validity period, and certificate chain of the server certificate when establishing a connection, helping prevent connections to forged services.
• Trusted connection: In scenarios with higher security requirements, mutual certificate authentication can be used to restrict access from unauthorized training-side clients or service nodes.
• API Key protection: API Keys are generated and distributed through controlled paths, while authentication uses their hashes. Full values remain only in the tenant-protected credential table, are returned only to authenticated users of the owning workspace, and never enter runtime logs, usage events, or analytics data.

Access Control and Task Isolation

The product applies identity authentication and access authorization mechanisms during access, invocation, and management. The system can configure access control rules based on users, applications, tasks, or tenants, ensuring authenticated entities can access only the APIs, tasks, and alert information they are authorized to use.

• Identity authentication: Confirms the accessing subject through user IDs, API KEYs, tokens, or certificate information.
• Permission separation: Sets access boundaries for different users, tasks, and applications to prevent unauthorized access.
• Illegal request rejection: Rejects requests with unknown identity, invalid credentials, failed certificate validation, or insufficient permissions.
• Multi-task isolation: Maintains monitoring context, alert history, and notification records by task to prevent information from different tasks from being mixed.