Security Audit Gateway System

It includes master account and sub account management, with the user account as the master account, and the original IT system account as the sub account. By separating identity and authorization through master/sub accounts, it enhances the reliability of identity authentication and system authorization, essentially solves the problem of account management confusion, and provides guarantee for authentication, authorization, and audit.

To enhance access security, the system provides high-strength identity authentication, supports connection between local authentication servers and third-party authentication servers (such as AD Domain, LDAP, and RADIUS servers). In addition, it supports OTP dynamic tokens, SMS messages, UsbKey, digital certificates, facial recognition, and other authentication methods for strong two-factor authentication to ensure identity reliability.

The emphasis on "centralized" authorization is logically instead of physically. The system provides a unified authorization interface, which can implement not only coarse-grained authorization based on application boundaries, such as authorizing the assets users can access, but also fine-grained authorization within applications, such as restricting user behavior.

The operations of personnel are recorded as logs, and managers can view relevant audit logs in the system. Operation audit mainly covers personnel's account management, authentication, account assignment, permission assignment, and account usage (login, resource access, and operation behavior). All operations are well documented.