Map service authentication method and related equipment

Abstract

The invention provides a map service authentication method, device and equipment and a readable storage medium, a map service request initiated by a user can be verified through a public key and a private key corresponding to user information so as to verify the map service of the user, and compared with an existing simple application programming interface secret key authentication mode, the method has the advantages that the user experience is improved, and the user experience is improved. The security of map service management is effectively improved, the authentication process of the map service can be simplified, vulnerabilities of developers in the map authentication implementation process can be effectively reduced, the access authority of the user is controlled by adopting a private key and a public key, the map service access request of the user can be more flexibly managed, and the user experience is improved. According to the method, the key management and authority verification strategy can be adjusted more flexibly, dynamically changing service requirements can be met, the access of the user to the application programming interface of the map service can be effectively controlled, the authentication request initiated by the user is signed by using the private key of the user, and the security of data transmission can also be improved.

Description

Technical Field

[0001] The present application relates to the technical field of map service authentication, and in particular to a map service authentication method and related equipment. Background Art

[0002] In today's context of rapid Internet development, map services have become an indispensable key component of many applications, and are widely used in many fields such as navigation, logistics, and social networking. In order to integrate and use map services in various applications, they are usually called through application programming interfaces (APIs). However, the resulting API security issues have become a core concern for users and service providers.

[0003] At present, the authentication methods widely used in the industry mainly include authentication methods based on application programming interface keys and OAuth2.0. Among them, application programming interface keys have obvious security defects, because they are easily exposed in client applications, and are easily stolen and maliciously abused by criminals, which brings great security risks to users and service providers. Although the OAuth2.0 authentication method performs well in terms of security, its implementation process is extremely complicated. For small and medium-sized enterprises and developers, it is not only difficult to develop, but also has high maintenance costs. In actual operations, it is easy to have misconfigurations, which in turn affects the normal operation and security of the system. Existing authentication technologies lack sufficient flexibility in user identity authentication and permission verification, and are difficult to adapt to complex and changing dynamic scenarios, resulting in the verification effect cannot reach the ideal state and cannot meet the diverse needs in actual applications. There is an urgent need for an authentication mechanism that can improve security and simplify the process in order to better meet market demand and ensure the safe and reliable operation of map services. Summary of the invention

[0004] The present application aims to solve at least one of the above-mentioned technical defects. In view of this, the present application provides a map service authentication method and related equipment to solve the technical defect of insecure map service authentication in the prior art.

[0005] A method for authenticating a map service, comprising: determining whether a user is requesting to use a map service for the first time; if the user is requesting to use a map service for the first time, generating a public key and a private key corresponding to the user information for the user, and uploading the public key corresponding to the user information to an authentication server; after determining the private key corresponding to the user information, generating a first target authentication request for the user's request to use the map service based on the user's map service use request, and signing the first target authentication request with the private key corresponding to the user's information to obtain a second target authentication request, wherein the second target authentication request includes the user's identity information, an application programming interface corresponding to the map service requested by the user, and request timestamp information; sending the second target authentication request to an authentication gateway for verification; after the authentication gateway verifies the second target authentication request, receiving the map service data required by the user obtained from the map service server and forwarded by the authentication gateway.

[0006] Preferably, after determining the private key corresponding to the user information, before generating the first target authentication request for the user to use the map service based on the user's map service usage request, it also includes: if this is not the first time the user requests to use the map service, determining the private key corresponding to the user information.

[0007] Preferably, the authentication gateway's verification process for the second target authentication request includes: after receiving the second target authentication request, the authentication gateway reads the stored public key corresponding to the user information to verify the signature of the second target authentication request; based on the public key corresponding to the user information, confirms whether the signature in the second target authentication request includes a private key that matches the public key corresponding to the user information; if it is determined that the signature in the second target authentication request includes a private key that matches the public key corresponding to the user information, then the second target authentication request is confirmed to be legal, and the user's identity information is verified at the same time, and it is checked whether the user has access rights to the application programming interface corresponding to the requested map service; if it is determined that the user's identity information passes the verification and the user has access rights to the application programming interface corresponding to the requested map service, then the second target authentication request is determined to pass the verification; if it is determined that the signature in the second target authentication request does not include a private key that matches the public key corresponding to the user information, then the second authentication request is confirmed to be illegal, and it is confirmed that the second target authentication request cannot pass the verification.

[0008] Preferably, it also includes: if it is determined that the second target authentication request is legal, but the user's identity information has not been verified, then it is determined that the second target authentication request cannot be verified; or, if it is determined that the second target authentication request is legal and the user's identity information has been verified, but the user does not have access rights to the application programming interface corresponding to the requested map service, then it is determined that the second target authentication request cannot be verified.

[0009] Preferably, the authentication gateway obtains the map service data required by the user from the map service server, including: if the authentication gateway determines that the second target authentication request passes the verification, the second target authentication request is forwarded to the map service server to obtain the map service data required by the user from the map service server; after the map service server receives the second target authentication request and analyzes the second target authentication request to determine the map service data required by the user, the map service data required by the user is forwarded to the authentication gateway.

[0010] Preferably, the user identity information includes the user's unique identification, password or other identity authentication information; the verification result of the authentication gateway on the second target authentication request also includes authentication failure and returning a corresponding failure reason when authentication fails.

[0011] A map service authentication system is applied to any of the map service authentication methods described above, the system includes a user terminal, an authentication gateway, an authentication server, and a map service server. When the user terminal determines that a user has a request to access a map service, the user terminal determines whether the user is requesting to use the map service for the first time; if it is determined that the user is requesting to use the map service for the first time, a public key and a private key corresponding to the user information are generated for the user, and the public key corresponding to the user information is uploaded to the authentication server; if it is determined that the user is not requesting to use the map service for the first time, the private key corresponding to the user information is determined; after determining the private key corresponding to the user information, the user terminal uses the map service based on the user's map service usage. The authentication server receives and stores the public key corresponding to the user information uploaded by the user, and regularly updates the public key corresponding to the user information according to the preset update rules; after receiving the second target authentication request, the authentication gateway reads the public key corresponding to the user information from the authentication server. The second target authentication request is verified based on the public key corresponding to the user information, and it is confirmed whether the signature in the second target authentication request includes a private key that matches the public key corresponding to the user information; if it is determined that the signature in the second target authentication request includes a private key that matches the public key corresponding to the user information, the second target authentication request is confirmed to be legal, and the second target authentication request is analyzed at the same time to verify the user's identity information and check whether the user has access rights to the application programming interface corresponding to the requested map service; if it is determined that the user's identity information has passed the verification and the user has access rights to the application programming interface corresponding to the requested map service access rights, it is determined that the second target authentication request has passed the verification; if it is determined that the signature in the second target authentication request does not include a private key that matches the public key corresponding to the user information, it is confirmed that the second authentication request is illegal and that the second target authentication request cannot pass the verification; if it is determined that the second target authentication request is legal, but the user's identity information has not passed the verification, it is determined that the second target authentication request cannot pass the verification; or, if it is determined that the second target authentication request is legal and the user's identity information has passed the verification, but the user does not have access rights to the application programming interface corresponding to the requested map service, it is determined that the second target authentication request cannot pass the verification;If the authentication gateway determines that the second target authentication request passes the verification, it returns the authentication success information to the user terminal, and forwards the second target authentication request to the map service server to obtain the map service data required by the user from the map service server; if the authentication gateway determines that the second target authentication request fails the verification, it returns the authentication failure information to the user terminal, and records the relevant log of the authentication failure event; the map service server receives and analyzes the second target authentication request forwarded by the authentication gateway, determines the map service data required by the user, and forwards the determined map service data to the authentication gateway; after receiving the map service data required by the user forwarded by the map service server, the authentication gateway forwards it to the user terminal. ;

[0012] An authentication device for a map service comprises: a judgment unit for judging whether it is the first time for a user to request to use the map service; a key generation unit for generating a public key and a private key corresponding to the user information for the user when it is the first time for the user to request to use the map service, and uploading the public key corresponding to the user information to an authentication server; a request generation unit for generating a first target authentication request for the user to request to use the map service based on the user's map service use request, and signing the first target authentication request with the private key corresponding to the user's information to obtain a second target authentication request, wherein the second target authentication request comprises the user's identity information, an application programming interface corresponding to the map service requested by the user, and request timestamp information; a verification unit for sending the second target authentication request to an authentication gateway for verification; and a data receiving unit for receiving the map service data required by the user obtained from the map service server and forwarded by the authentication gateway after the authentication gateway has verified the second target authentication request.

[0013] A map service authentication device includes: one or more processors, and a memory; the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the one or more processors, the steps of the map service authentication method described in any one of the above introductions are implemented.

[0014] A readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by one or more processors, the one or more processors implement the steps of the authentication method for the map service as described in any of the above introductions.

[0015] It can be seen from the technical solution introduced above that when a user requests to use a map service, the method provided in the embodiment of the present application can determine whether the user is requesting to use the map service for the first time; if the user is requesting to use the map service for the first time, a public key and a private key corresponding to the user information can be generated for the user, and the public key corresponding to the user information can be uploaded to the authentication server, so that the generated public key and private key can be used to verify whether the user's access request is legal. After determining the private key corresponding to the user information, a first target authentication request for the user's request to use the map service can be generated based on the user's map service use request, and the first target authentication request is signed with the private key corresponding to the user's information to obtain a second target authentication request, wherein the second target authentication request includes user identity information, an application programming interface corresponding to the map service requested by the user, and request timestamp information, and the user information accessed and the specific request information of the access can be understood through the second target authentication request; in order to confirm whether the second target authentication request initiated by the user is legal, the second target authentication request can be sent to the authentication gateway for verification; after the authentication gateway verifies the second target authentication request, it means that the user's second target authentication request is legal and has relevant access rights, and then the map service data required by the user obtained from the map service server forwarded by the authentication gateway can be received.

[0016] From the above, it can be seen that the method provided in the embodiment of the present application can verify the map service request initiated by the user through the public key and private key corresponding to the user information, so as to verify the user's map service. Compared with the existing simple application programming interface key authentication method, the present application effectively improves the security of map service management, and can also simplify the authentication process of map services, which can effectively reduce the vulnerabilities of developers in the process of map authentication implementation, and uses private keys and public keys to control user access rights, which can more flexibly manage users' map service access requests, and can more flexibly adjust key management and permission verification strategies to adapt to dynamically changing service needs. It can effectively control users' access to the application programming interface of the map service, and by signing the authentication request initiated by the user with the private key of the user information, it can also improve the security of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0018] Figure 1A flowchart of a method for implementing an authentication method for a map service provided in an embodiment of the present application;

[0019] Figure 2 A schematic diagram of the system architecture for implementing authentication of map services provided in an embodiment of the present application;

[0020] Figure 3 A schematic diagram of the structure of an authentication device for a map service according to an example of an embodiment of the present application;

[0021] Figure 4 This is a hardware structure block diagram of the authentication device for the map service disclosed in the embodiment of the present application. DETAILED DESCRIPTION

[0022] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0023] In actual application, API keys are easy to be stolen and abused, especially in client applications. After registering for a map service, a user obtains an API key. Each time a map service is requested, the user must include this key in the request. After receiving the request, the map service server checks whether the API key is valid and whether it matches the requested API. This method is simple and easy to use, but it is less secure because the API key may be intercepted or abused.

[0024] Although OAuth2.0 provides strong security, its implementation process is complicated. Users log in through a third-party authentication service, the map service obtains an access token through the OAuth protocol, the map service server verifies the validity of the access token, and provides services based on the permissions in the token. The map service only allows requests from specific IP addresses, or rejects requests from blacklisted IPs. This method is more secure, but requires users to interact with third-party services, and has a high degree of implementation complexity. It is not easy to develop and maintain, especially for small and medium-sized enterprises and developers, and is prone to misconfiguration. The effectiveness of the prior art in user identity authentication and permission verification lacks flexibility, resulting in unsatisfactory verification results in dynamic scenarios. Given that most of the current map service authentication schemes are difficult to adapt to complex and changing business needs, the applicant has studied a map service authentication scheme, which can verify the map service request initiated by the user through the public key and private key corresponding to the user information, thereby verifying the user's map service. Compared with the existing simple application programming interface key authentication method, the method provided by the embodiment of the present application effectively improves the security of map service management, and can also simplify the authentication process of the map service, and uses private keys and public keys to control user access rights, which can more flexibly manage users' map service access requests, effectively control users' access to the map service's application programming interface, and by signing the authentication request initiated by the user with the user's private key, it can also improve the security of data transmission.

[0025] The method provided in the embodiment of the present application can be used in many general or special computing device environments or configurations. For example: personal computers, server computers, handheld devices or portable devices, tablet devices, multi-processor devices, distributed computing environments including any of the above devices or devices, etc. The embodiment of the present application provides an authentication method for map services, which can be applied to various map service management systems, and can also be applied to various computer terminals or smart terminals, and its execution subject can be a processor or server of a computer terminal or smart terminal.

[0026] Combine the following Figure 1 , introduces the process of the authentication method of the map service given in the embodiment of the present application, such as Figure 1 As shown, the process can include the following steps:

[0027] Step S101, determining whether it is the first time for the user to request to use the map service.

[0028] Specifically, in actual application, when a user uses a map service for the first time, the user needs to be clearly informed of the various permissions required by the map service, such as location information, storage permissions, etc., and the user's authorization needs to be obtained. This not only complies with the requirements of relevant laws and regulations, but also allows users to clearly understand how their information will be used and enhances their trust in the service. In addition, if the user is using the map service for the first time, the system may need to configure the user's relevant information or identify the user's information to ensure the security of the map service data.

[0029] Furthermore, users who use map services for the first time may not be familiar with the functions and operations of maps. By determining whether the user is using the map service for the first time, targeted novice guidance and tutorials can be provided to help the user quickly understand the basic functions of the map, such as zooming, panning, and searching for locations, thereby improving the user's initial experience with the map service and lowering the threshold for use. When using it for the first time, some basic preference information of the user, such as frequently used locations and travel methods, can be collected to provide users with more accurate personalized recommendations in the future, such as recommending nearby popular attractions and food stores, and at the same time, default settings are made according to user preferences, such as map display mode and navigation voice, so that users can enjoy services that meet their needs without cumbersome settings. Knowing whether the user is using the map service for the first time is also helpful in analyzing the source channel of the user. If a large number of first-time users come from a specific promotion channel, this indicates that the promotion effect of the channel is significant, and the investment in the channel can be increased; otherwise, the channel with poor promotion effect needs to be adjusted and optimized. For first-time users, their operation behavior and usage habits on the map are of great research value. By analyzing the behavioral paths of first-time users, frequency of function usage, etc., we can discover possible problems in product design, such as which functions are difficult to find or inconvenient to use, thereby providing a basis for product optimization and iteration.

[0030] Furthermore, users who use map services for the first time may face some potential safety risks, such as being unfamiliar with the safety reminder function of the map, which may lead to danger due to improper operation when using navigation. By identifying first-time users, more detailed safety reminders and risk notifications can be provided to them, such as reminding users to pay attention to safety while driving and avoid excessive operation of the phone.

[0031] If the user is requesting to use the map service for the first time, the server may need to allocate more resources to load basic map data, initialize related configurations, etc. For non-first-time users, the server can provide incremental updated data more accurately based on their usage habits and historical data, thereby optimizing the allocation of server resources and improving the response speed and stability of the overall service.

[0032] For first-time users, since there is no relevant map data in the local cache, it is necessary to obtain the entire map data from the server and store it in the local cache. For non-first-time users, the map service can adopt a more flexible cache strategy based on the user's usage history and cache status, such as partially updating the cache, preloading data that may be needed, etc., to reduce the amount of data transmission and speed up map loading.

[0033] Therefore, in actual application, for the sake of security of map service data and to provide users with a better service experience, when a user initiates a map service request, it can be determined whether the user is requesting to use the map service for the first time. If the user is requesting to use the map service for the first time, step S102 is executed. If the user is not requesting to use the map service for the first time, step S103 can be executed.

[0034] Step S102: Generate a public key and a private key corresponding to the user information for the user, and upload the public key corresponding to the user information to the authentication server.

[0035] Specifically, in actual application, public key and private key are asymmetric encryption technology with uniqueness and immutability. When it is determined that the user is using the map service for the first time, a public key and a private key corresponding to the user information can be generated for the user, and the public key corresponding to the user information can be uploaded to the authentication server. By generating the corresponding public key and private key for the user who uses the map service for the first time, the private key can be used to encrypt and sign the user identity information in the subsequent interaction between the user and the map service and related systems, and the authentication server uses the corresponding public key for verification, thereby ensuring the authenticity of the user identity, preventing illegal users from impersonating others to access the map service, and enhancing the security of the system. In today's scenario of using map services on multiple devices and multiple platforms, users may use the same map service on different devices such as mobile phones, computers, and tablets. After generating the public key and private key corresponding to the user information and uploading the public key to the authentication server, the user can use the private key to authenticate the identity on different devices, realize single sign-on, and facilitate users to seamlessly switch between multiple platforms to use map services, while ensuring the consistency and security of the user identity.

[0036] In actual application, map services generally involve a large amount of sensitive information of users, such as user location information, search history, travel preferences, etc. Generate public and private keys corresponding to user information, and use public and private keys to encrypt these data to ensure that only users with corresponding private keys can decrypt and view them. Even if the data is intercepted or stored on the server during transmission, third parties cannot obtain the content, which effectively protects the privacy of users. When users interact with map services, such as uploading personal settings, downloading map data, etc., the data is encrypted with the public key before transmission to ensure the integrity and confidentiality of the data during transmission. At the same time, when storing user data on the server, it can also be stored in ciphertext form after public key encryption to further improve the security of data storage.

[0037] Furthermore, by binding the public key to the user's identity, the map service provider can more accurately track and analyze the user's behavior habits, such as the types of places that users frequently search for, the distribution of travel time, etc. These data are encrypted and transmitted to the authentication server. Under the premise of ensuring user privacy, more accurate data support is provided for personalized recommendations, route planning and other functions of the map service, thereby improving the user experience.

[0038] In actual application, based on the user identity information corresponding to the public key, the map service can also provide customized services and permission management for different users. For example, for paying users or premium members, their identities can be identified based on their public keys, and more advanced map functions, more accurate navigation services or more personalized recommended content can be provided. At the same time, the scope of their access and use of map resources can be finely managed based on user permissions.

[0039] The encryption mechanism of public and private keys can effectively resist various external malicious attacks, such as man-in-the-middle attacks and data tampering attacks. Without the correct private key, attackers cannot decrypt or tamper with the encrypted data, thus ensuring the integrity and reliability of the interactive data between the map service and users and maintaining the normal operation of the map service. In scenarios such as map data updates and user feedback, public and private keys are used to sign and verify data to ensure that the data has not been tampered with during transmission and storage. Once the data is tampered with, the verification will fail, thereby promptly discovering and preventing malicious behavior and ensuring the quality and credibility of map service data.

[0040] Step S103, determining the private key corresponding to the user information.

[0041] Specifically, if this is not the first time that a user uses a map service, it means that a private key corresponding to the user information may have been stored. Therefore, based on security, user experience, and service optimization, when it is determined that this is not the first time that a user has used a map service, it is necessary to determine the private key corresponding to the user information. Each time the user uses the map service again, it is necessary to confirm the legitimacy and authenticity of their identity. The private key is one of the key identifiers of the user's identity. By verifying the private key corresponding to the user information, it can be ensured that the user currently using the map service is the same user who previously registered and legally used the service, preventing others from impersonating the user to perform illegal operations, such as stealing the user's location information, viewing history, etc.

[0042] In a network environment, there is a risk that attackers may intercept the user's previous communication data and perform replay attacks. By requiring the user to provide the private key corresponding to the information for verification, the system can determine whether the request is a legitimate real-time request based on the unique signature generated by the private key and other information, rather than replaying old data, thereby effectively resisting such attacks and ensuring the security of the service.

[0043] For non-first-time users, after determining the private key corresponding to the user information, the system can quickly identify the user and automatically load the user's previous personalized settings, such as map display preferences, frequently used locations, navigation voice, etc., so that the user does not need to manually set them again, achieving seamless service and improving the consistency and convenience of user experience. In scenarios where map services are used on multiple devices or multiple platforms, users may switch between different devices. After determining the private key corresponding to the user information, the user can easily implement single-point login on different devices with the private key, without having to repeatedly enter account passwords and other tedious operations, making it convenient for users to use map services anytime, anywhere, and enhancing user stickiness to the service.

[0044] The map service stores a large amount of sensitive data related to users, such as historical travel records, search records, etc. Only users holding the correct private key can decrypt and access this data, ensuring that access to user data is strictly controlled by the user himself, preventing unauthorized third parties from obtaining and abusing user data, and effectively protecting user privacy.

[0045] When users interact with the map service server, such as querying real-time traffic conditions, updating personal information, etc., the private key is used to encrypt and sign the interactive data to ensure the confidentiality and integrity of the data during transmission. Even if the data is intercepted during transmission, the attacker cannot decrypt and obtain the content without the private key, thus ensuring the security of user data.

[0046] After identifying the user by determining the private key, the map service can provide users with more accurate personalized recommendations based on the user's historical usage behavior and preferences, such as recommending nearby restaurants that suit the user's taste, planning the best route based on the user's travel habits, etc. The private key, as an accurate identifier of the user's identity, helps the system better understand user needs and improve the personalization of services.

[0047] If the private key corresponding to the user information is determined, the system can collect and analyze the user's continuous usage behavior data after confirming the user's identity based on the private key, and further understand the user's satisfaction with the map service and changes in demand. This data can be used to optimize the functions and performance of the map service, such as improving the route planning algorithm, optimizing the map loading speed, etc., so as to continuously improve the service quality and meet the needs of users.

[0048] Therefore, if it is determined that this is not the first time for the user to use the map service, the private key corresponding to the user information can be determined so that the user information can be identified using the private key.

[0049] Step S104, after determining the private key corresponding to the user information, based on the user's map service usage request, generate a first target authentication request for the user's request to use the map service, and sign the first target authentication request with the private key corresponding to the user's information to obtain a second target authentication request.

[0050] Specifically, in the actual application process, in order to ensure the security of user information, when a user initiates a map service access request, a first target authentication request for the user to use the map service can be generated based on the user's map service use request, and the first target authentication request can be signed with a private key corresponding to the user's information, so as to obtain a second target authentication request. Among them, the second target authentication request can include user identity information, the application programming interface corresponding to the map service requested by the user, and the request timestamp information. User identity information may include the user's unique identifier, password or other identity authentication information; by signing the first target authentication request with a private key corresponding to the user information to obtain the second target authentication request, it can be made clear that the request is indeed issued by a legitimate user, rather than a request impersonated or maliciously forged by others.

[0051] After receiving the request, the authentication gateway can use the public key corresponding to the private key corresponding to the user information for verification. Only requests that pass the verification will be considered legal and valid, thus ensuring the authenticity of the user's identity and the legitimacy of the request. During network transmission, data may be tampered with or damaged. After signing the first target authentication request, the generated second target authentication request contains the signature information. The recipient can determine whether the data has been tampered with during transmission by verifying the signature. If the signature verification passes, it means that the data is complete and has not been tampered with. Otherwise, the request will be rejected, thereby ensuring the integrity and security of the user's requested data.

[0052] Furthermore, after signing, the second target authentication request has non-repudiation, that is, the user cannot deny that he has issued the request. This is very important for the operation record and audit of the system. Once a problem or dispute occurs, such as a user objecting to a certain map service operation or a security incident, the system can trace the source and process of the request by verifying the signature, clarify the responsibility, and facilitate subsequent investigation and processing.

[0053] For map service providers, by analyzing a large number of signed authentication requests, they can better understand user usage behaviors and habits, such as the time distribution of user requests for map services, location preferences, frequency of function usage, etc. These data are helpful for accurate user profiling and behavior analysis, providing a basis for service optimization and personalized recommendations, and also facilitate statistics on user usage and activity of map services.

[0054] In some cases, map services may need to interact and integrate with other third-party services or systems, such as sharing user map request information with travel applications, local life service platforms, etc. By signing user requests, the authenticity and integrity of user requests can be guaranteed during cross-platform and cross-system interactions, allowing different systems to share and collaborate data safely and reliably. When external developers use the map service's application programming interface to develop related applications, the signing mechanism for user requests can be used as a security measure to ensure that only authorized applications and legitimate user requests can call the map service's application programming interface, prevent the illegal abuse of the application programming interface, and protect the security and stability of the map service.

[0055] As data security laws and regulations become increasingly stringent, some companies need to take effective measures to protect the security and privacy of user data. Signing user requests and ensuring their legitimacy and integrity can help map service providers meet the requirements of relevant laws and regulations regarding data security, user authorization, etc., and avoid legal risks due to data leakage or illegal operations. Furthermore, in the map service industry, there are also some industry specifications and standards that require companies to strictly authenticate user requests and protect data. By generating and signing authentication requests, map services can comply with industry best practices and standards, enhancing the company's reputation and competitiveness.

[0056] Step S105: Send the second target authentication request to an authentication gateway for verification.

[0057] Specifically, in actual application, the authentication gateway, as a secure entry point to the map service system, bears the key responsibility of verifying the legitimacy of the user's identity. By verifying the signature in the second target authentication request, the authentication gateway can use the public key corresponding to the user's private key for decryption verification, ensuring that the request is indeed issued by a legitimate user holding the correct private key, preventing illegal users from impersonating others to access the map service, thereby effectively avoiding the risk of identity theft.

[0058] Therefore, when a user makes a request to access the map service, the user's private key is used to sign the second target authentication request proposed by the user, and then it needs to be sent to the authentication gateway for verification. Furthermore, during the network transmission process, the data may also be subject to various interferences or malicious tampering. When the authentication gateway verifies the second target authentication request, it will check the validity of the signature. If the signature verification passes, it means that the data has not been tampered with during the transmission process, ensuring the integrity and consistency of the user's requested data, and ensuring that the map service receives the user's true and complete request.

[0059] In actual application, the authentication gateway mainly plays a role in centralized management and control of user authentication in the entire map service system. Therefore, sending the second target authentication request to the authentication gateway for verification can facilitate unified processing and management of all users' authentication requests and achieve standardization and normalization of the authentication process. This helps to effectively monitor and audit user access and promptly discover abnormal requests and potential security threats.

[0060] Furthermore, map services are usually composed of multiple backend services, such as map data storage, path planning, geocoding, etc. Centralizing the authentication process in the authentication gateway allows the backend services to focus on their own business logic without having to worry about the specific details of user authentication. This can reduce the complexity of backend services, improve the maintainability and scalability of the system, and also facilitate independent upgrades and optimizations of authentication functions.

[0061] Furthermore, the authentication gateway can cache the user information and requests that have been verified. When the same user sends a request again, the authentication gateway can quickly compare the information in the cache, reduce the time for repeated verification, and improve the system's response speed and overall performance.

[0062] In addition, the authentication gateway can also perform intelligent optimization based on factors such as user request frequency and geographic location, such as dynamically adjusting authentication strategies or allocating server resources to improve the user experience. Many industries have strict security standards and regulatory requirements, such as data protection regulations and information security management system standards. Sending the second target authentication request to the authentication gateway for verification can also help the map service system meet the requirements of these regulations and standards regarding user identity authentication, data security, etc., ensure the compliance operation of the system, and avoid legal risks due to violations.

[0063] During the verification process, the authentication gateway will record detailed verification information, such as request time, user IP address, verification results, etc. This information is very important for system auditing and tracing. When a security incident or user dispute occurs, the administrator can quickly understand the course and cause of the incident by viewing the audit records of the authentication gateway, clarify the responsibility, and provide a strong basis for subsequent investigation and handling.

[0064] Step S106: After the authentication gateway successfully verifies the second target authentication request, the authentication gateway receives the map service data required by the user obtained from the map service server and forwarded by the authentication gateway.

[0065] Specifically, from the above introduction, it can be seen that the authentication gateway can verify the second target authentication request, and the authentication gateway's verification indicates that the legitimacy of the user's identity has been confirmed. The second target authentication request signed with the private key corresponding to the user information is successfully verified by the authentication gateway, indicating that the user is a legitimate user who has registered in the system and is authorized to use the map service, and is not an illegal intruder or someone who impersonates someone else. This establishes a foundation of trust between the map service system and the user, ensuring that only legitimate users can obtain the corresponding map service data, effectively preventing illegal access and data leakage risks. Verification means that the integrity and authenticity of the user's request are guaranteed during the data transmission process. From the time the user sends the request to the authentication gateway verification, the data has not been tampered with or damaged, thereby ensuring that the subsequent data obtained from the map service server is also safe and reliable when transmitted to the user, and will not cause data errors or malicious modifications due to problems in the transmission link.

[0066] The authentication gateway is a key intermediate link in the map service system, and its verification is an important node in the entire service request processing process. This indicates that the user's request has completed the necessary identity authentication and security checks according to the system's preset authentication process, and meets the access conditions specified by the system, so it can enter the next link, that is, receiving the corresponding data provided by the map service server. Furthermore, the map service system is usually composed of multiple components, and there is a close collaborative relationship between the authentication gateway and the map service server. After the authentication gateway passes the verification, it forwards the request to the map service server. The map service server retrieves and processes the data according to the request content, and returns the result to the authentication gateway, which then forwards it to the user. This collaborative working mechanism ensures the efficient operation of the entire system and the correct transmission of data. Only when the authentication gateway passes the verification can the subsequent data acquisition and transmission process proceed smoothly.

[0067] The map service data obtained after verification by the authentication gateway is accurately retrieved and processed by the map service server according to the user's legitimate request. This ensures that the data received by the user is accurate information that matches their request, including map images, geographic coordinates, path planning, etc., which can meet the user's actual needs for map services and provide users with a high-quality service experience. After the authentication gateway is verified, a stable connection channel is established between the user and the map service system, and data can be efficiently transmitted in this channel. Users do not need to undergo complex identity authentication again or wait for additional confirmation processes, and can receive map service data quickly and stably, which improves the response speed and efficiency of the service and improves user satisfaction with map services.

[0068] Furthermore, in an environment of increasingly stringent regulations on information security and privacy protection, the map service system needs to ensure the legal use of data and the privacy security of users. The process of providing map service data after the authentication gateway passes the verification complies with the requirements of relevant regulations on user identity authentication, data access control, etc., so that the map service provider is in a state of compliance operation at the legal level and avoids legal risks caused by violations. In addition, if any problems occur during data acquisition and use, such as data errors, privacy leaks, etc., the responsible party can be identified because the authentication gateway has completed a strict verification process. If the problem occurs on the map service server side after the verification is passed, the responsibility mainly lies with the back-end service of the map service provider; if the problem occurs during the transmission process, it can also be traced and checked through the system logs and monitoring records, so as to solve the problem in time and clarify the responsibilities of all parties. Therefore, after the authentication gateway verifies the second target authentication request, it can receive the map service data required by the user obtained from the map service server forwarded by the authentication gateway.

[0069] In actual application, suppose a map service provider needs to provide services to different customer groups, including ordinary consumers, business partners, and emergency response teams. Using the authentication mechanism of the present application, the service provider can create different keys and permission settings for each group. Ordinary consumers use standard keys, which only allow access to basic map views and search functions. Business partners use higher-level keys that allow access to custom map styles and geographic analysis tools. In an emergency, the emergency response team can be temporarily granted access to real-time traffic and weather data to assist in rescue work. In this way, the authentication mechanism of the present invention not only improves the security of the system, but also provides a high degree of flexibility, enabling service providers to quickly adjust service strategies based on actual business needs.

[0070] For example, in multiple user usage scenarios, using the traditional API key authentication method, 50 API calls were recorded, and 3 API key abuses were found. However, when the method proposed in this application was used for testing, no key abuse incidents occurred in 50 calls, and security was significantly improved. Under the same network environment, the request response time was tested. The average response time required for traditional OAuth2.0 authentication was 300ms, while the average response time using the method provided by this application was reduced to 150ms, and the system performance was improved. Through user feedback surveys, 92% of users stated that compared to OAuth2.0, the Key-based authentication method is simpler and easier to use, and 92% of users believe that this method increases trust in the service. The above experimental data can prove that this application has obvious security and practical advantages.

[0071] It can be seen from the technical solution introduced above that the method provided in the embodiment of the present application can verify the map service request initiated by the user through the public key and private key corresponding to the user information, so as to verify the user's map service. Compared with the existing simple application programming interface key authentication method, the method provided in the embodiment of the present application effectively improves the security of map service management, and can also simplify the authentication process of the map service, which can effectively reduce the vulnerabilities of developers in the map authentication implementation process, and use private keys and public keys to control the user's access rights, which can more flexibly manage the user's map service access requests, and can more flexibly adjust the key management and permission verification strategies to adapt to dynamically changing service requirements. It can effectively control the user's access to the application programming interface of the map service, and by signing the authentication request initiated by the user with the user's private key, it can also improve the security of data transmission.

[0072] As can be seen from the above introduction, in actual application, the authentication gateway can verify the second target authentication request initiated by the user. Next, the verification process is introduced, which may include the following:

[0073] Step S201: After receiving the second target authentication request, the authentication gateway reads the stored public key corresponding to the user information to verify the signature of the second target authentication request.

[0074] Specifically, in an asymmetric encryption system, public keys and private keys are generated in pairs and have a unique correspondence. The user uses his own private key to sign the first target authentication request and generate a second target authentication request. The authentication gateway can only correctly verify the validity of the signature by using the public key corresponding to the user's private key, just like only a specific key can open the corresponding lock. This matching relationship can ensure the accuracy and reliability of the verification. The private key is the user's secret information, which is only held by the user himself. It is used to sign the request to ensure that the source of the request is the user and has not been tampered with. The public key can be made public. As can be seen from the above introduction, the authentication server stores the public key corresponding to the user information, which can be used to verify the signature request sent by the user. This public-private key feature not only ensures the confidentiality of the user's identity, but also enables the verification process to be carried out under an open mechanism.

[0075] Therefore, after receiving the second target authentication request, the authentication gateway can read the stored public key corresponding to the user information to verify the signature of the second target authentication request. By using the stored public key to verify the signature of the second target authentication request, the authentication gateway can confirm whether the request is indeed issued by a legitimate user. If the signature verification is successful, it means that the user holding the corresponding private key is a legitimate user authenticated by the system and his identity has been verified, thereby preventing illegal users from impersonating others to obtain map services, effectively ensuring the security of the system.

[0076] During network transmission, data may be tampered with or damaged. The signature verification process can not only verify the identity of the user, but also check whether the second target authentication request remains intact during transmission. If the signature verification passes, it means that the data has not been tampered with during transmission, ensuring the integrity and authenticity of the user's request, so that the system can perform subsequent processing based on the correct request.

[0077] As the security core of the system, the authentication gateway centrally stores the public keys corresponding to all user information, which is convenient for unified management and maintenance. When receiving the user's second target authentication request, the corresponding public key can be directly read for signature verification, which improves the efficiency of verification and the overall performance of the system.

[0078] In actual application, if the user's key pair needs to be updated or changed for some reason, it is only necessary to update the corresponding public key at the authentication server without making large-scale modifications to other parts of the entire system. This centralized management method makes key updates and maintenance more convenient, reducing system management costs and complexity.

[0079] In the field of information security, using a public key to verify a request signed by a private key is a widely recognized security verification method that complies with relevant security standards and specifications. Verification in this way can ensure that the map service system meets the industry's security requirements and enhance the security and credibility of the system. The verification process will leave corresponding records in the authentication gateway, including verification time, user information, request content, etc. These records are very important for system auditing and tracing. When security issues or disputes arise, these records can be checked to find out the causes and clarify responsibilities, providing a strong basis for subsequent processing.

[0080] Step S202: based on the public key corresponding to the user information, confirm whether the signature in the second target authentication request includes a private key matching the public key corresponding to the user information.

[0081] Specifically, in an asymmetric encryption system, public keys and private keys are generated in pairs and have a unique correspondence. By using the public key corresponding to the user information to verify the signature, it is actually confirming whether the signature is generated by the private key that uniquely matches the public key. If the verification is successful, it can be highly confident that the request is issued by the user who legally holds the corresponding private key, thereby effectively preventing illegal users from impersonating others to access and ensuring the authenticity of the user's identity.

[0082] There are various risks of identity forgery in the network environment, such as attackers may intercept user requests and try to tamper with or forge signatures. Through this public key-based verification method, only legitimate users with the correct private key can generate a valid signature that matches the public key, making it difficult for attackers to forge a signature that can pass verification, greatly improving the system's ability to resist identity forgery attacks. When a user uses a private key to sign the first target authentication request to generate a second target authentication request, this signature is a unique identifier generated based on the content of the request. During the transmission process, if the request is tampered with, the signature recalculated based on the tampered content will be different from the original signature. By using the public key to verify the signature, it is possible to detect whether the signature matches the request content, and then determine whether the data has been tampered with during the transmission process, ensuring the integrity of the data. If such verification is not performed, the attacker may maliciously modify the user's request during the transmission process, such as changing the requested map service parameters, user access rights, etc., resulting in the user receiving erroneous or unsafe map service data. The public key-based signature verification mechanism can detect such tampering in a timely manner to ensure that the user obtains complete and untampered data.

[0083] When the map service system interacts or integrates with other related systems, following the unified encryption verification specification is the basis for establishing mutual trust between systems. Other systems can trust the map service system's verification results of user identity and data integrity, thereby achieving safe and reliable information interaction and collaborative work.

[0084] By verifying the matching of signatures and public and private keys, the operating subject of each request can be identified. During the operation of the system, if any problems related to user requests occur, such as illegal operations, data leakage, etc., the verification records can be used to quickly determine which user made the request, providing a clear basis for subsequent accountability and problem troubleshooting.

[0085] Within enterprises and organizations, it is often necessary to audit system operations and data access to meet compliance requirements. This public key-based signature verification mechanism can generate clear audit records, record the verification results and related information of each request, facilitate audits and compliance checks, and ensure that the system's operations comply with relevant regulations and corporate policies.

[0086] Therefore, based on the public key corresponding to the user information, it can be confirmed whether the signature in the second target authentication request includes a private key that matches the public key corresponding to the user information; if it is determined that the signature in the second target authentication request includes a private key that matches the public key corresponding to the user information, step S203 can be executed. If it is determined that the signature in the second target authentication request does not include a private key that matches the public key corresponding to the user information, or if it is determined that the second target authentication request is legal, but the user's identity information has not been verified; or if it is determined that the second target authentication request is legal and the user's identity information has been verified, but the user does not have access rights to the application programming interface corresponding to the requested map service, step S205 can be executed.

[0087] Step S203, confirming that the second target authentication request is legitimate, verifying the user's identity information, and checking whether the user has access rights to the application programming interface corresponding to the requested map service.

[0088] Specifically, from the above introduction, it can be seen that the method provided in the embodiment of the present application can determine whether the signature in the second target authentication request includes a private key corresponding to the user information. If it is determined that the signature in the second target authentication request includes a private key that matches the public key corresponding to the user information, it means that the user's access request is legal and has not been tampered with, but it is necessary to further confirm whether the user has access rights to the relevant data; the user's identity information can be further verified, and it can be checked whether the user has access rights to the application programming interface corresponding to the requested map service.

[0089] Verifying user identity information is the basis for ensuring system security. In a network environment, there is a risk that criminals may impersonate others to obtain sensitive information or perform illegal operations. By verifying identity information, such as user name, password, digital certificate, etc., the real identity of the user can be accurately identified, preventing illegal users from using legitimate users' authentication requests to perform malicious acts, thereby avoiding security vulnerabilities caused by identity theft.

[0090] Checking user access rights to map service application programming interfaces is a manifestation of following the principles of permission control and minimization. Different users may have different roles and permissions in the system, and not all users should have unrestricted access to all map service application programming interfaces. Through strict permission checks, users can only access the application programming interface resources they are authorized to use, thereby limiting the potential attack surface and reducing security risks caused by permission abuse. Map services usually involve a large amount of sensitive information, such as geographic data, user location information, etc. Double verification of user identity and permissions helps ensure that these sensitive data are only accessed and used by legally authorized users. If user permissions are not checked, users may cross the boundary to access unauthorized data, resulting in data leakage or abuse, compromising user privacy and data security.

[0091] In some industries and regions, there are strict regulations and compliance requirements for the use and protection of map data. Simultaneous identity authentication and permission checking helps ensure that the system's operation complies with relevant data protection regulations and avoids legal risks due to illegal use of data, such as violations of confidentiality regulations for geographic information data or user privacy protection regulations. The resources of the map service system are limited, including server bandwidth, computing power, etc. By verifying user identity and permissions, it can ensure that only legitimate users use system resources according to their permissions, avoid malicious users or unauthorized users from excessively occupying system resources, thereby ensuring the stable operation of the system and ensuring that efficient and reliable map services are provided to legitimate users.

[0092] Different map service application programming interfaces may correspond to different system functional modules or data resources. Checking user access rights helps to achieve functional isolation of the system architecture, so that each user can only access the functions and data corresponding to their permissions, which is convenient for system management and maintenance, and also reduces the impact of user misoperation or illegal operation on the overall system architecture.

[0093] By verifying the user's identity and permissions, you can provide them with a personalized map service experience based on their specific identity and permissions. For example, provide users with advanced permissions with richer map functions and data, while providing basic map services to ordinary users, to meet the differentiated needs of different user groups and improve user satisfaction with the service. Ensuring that only legitimate users with corresponding permissions can successfully access map services helps improve the stability and predictability of service quality. Avoid service interruptions or anomalies caused by interference from illegal or unauthorized users, provide legitimate users with continuous and stable map services, and improve user experience and loyalty to the service.

[0094] Therefore, if it is determined that the user's identity information has passed the verification and the user has access rights to the application programming interface corresponding to the requested map service, step S204 may be executed.

[0095] Step S204: determine whether the second target authentication request passes verification.

[0096] Specifically, from the above introduction, it can be seen that the method provided in the embodiment of the present application can determine whether the signature in the second target authentication request includes a private key corresponding to the user information; and thereby determine whether the second target authentication request is the user's true intention rather than an authentication request initiated by someone else impersonating the user; when it is determined that the second target authentication request is indeed the user's true intention, if on this basis it can be determined that the user's identity has been verified, and the user has access rights to the application programming interface corresponding to the requested map service, then it can be determined that the user's second target authentication request has passed the verification.

[0097] Step S205, confirming that the second authentication request is illegal, and confirming that the second target authentication request cannot pass verification.

[0098] Specifically, from the above introduction, it can be seen that the method provided in the embodiment of the present application can determine whether the signature in the second target authentication request includes a private key corresponding to the user information; and thereby determine whether the second target authentication request is the user's true intention rather than an authentication request initiated by someone else impersonating the user.

[0099] When determining that the second target authentication request is indeed the user's true intention, if it is determined that the signature in the second target authentication request does not include a private key that matches the public key corresponding to the user information, or when it is determined that the second target authentication request is legal, but the user's identity information has not been verified; or when it is determined that the second target authentication request is legal and the user's identity information has been verified, but the user does not have access to the application programming interface corresponding to the requested map service, then the second authentication request is illegal, and it can be determined that the second target authentication request cannot be verified.

[0100] In actual application, the authentication gateway's verification results for the second target authentication request also include authentication failure and the corresponding failure reason returned when authentication fails. For example, if authentication fails, the authentication gateway will return an error message to the user, such as "Authentication failed" or "No access". Requests that fail authentication will be recorded in the security log for subsequent security audits and exception analysis. For authentication requests that frequently fail, the system may limit the number of retries for the user to prevent brute force attacks. Through these mechanisms, this solution not only ensures authentication security, but also provides flexible permission management and data transmission encryption, thereby improving overall security and reliability.

[0101] It can be seen from the technical solution introduced above that the method provided in the embodiment of the present application can verify the second target authentication request initiated by the user, so that the user's access request can be screened to determine the security and legality of the user's access.

[0102] In actual application, the authentication gateway can obtain the map service data required by the user from the map service server. The following describes the process, which may include the following steps:

[0103] Step S301: If the authentication gateway determines that the second target authentication request passes the verification, the second target authentication request is forwarded to the map service server to obtain the map service data required by the user from the map service server.

[0104] Specifically, in the actual application process, the authentication gateway is only responsible for verifying the access request, and the second map service server is the one that stores the relevant map service data. The authentication gateway is mainly responsible for user identity authentication and request legitimacy verification, while the map service server focuses on providing map service data. This clear division of labor architecture design allows each component to focus on its core functions, improving the overall performance and maintainability of the system. When the authentication gateway completes the verification, it forwards the request to the map service server, realizing the collaborative work between the two and jointly completing the user's need to obtain map service data. Therefore, the authentication gateway strictly verifies the second target authentication request, including verification of user identity information and checking of user access rights to the map service application programming interface. Only when these verifications are passed, it indicates that the request is a legitimate request from a legitimate user and complies with the system security policy. Forwarding such a request to the map service server can ensure that the server receives a safe and reliable request, avoiding malicious attacks on the server or illegal data acquisition by illegal requests.

[0105] The authentication gateway is the middle link between the user and the map service server. Its verification is equivalent to building a bridge of trust between the two. The map service server can trust the request verified by the authentication gateway, and provide the user with the corresponding map service data without repeated verification of the user identity and the legitimacy of the request, which improves the efficiency and security of data interaction.

[0106] In the operation process of the entire system, the verification and forwarding operation of the authentication gateway is one of the standardized links. Through this standardized process, it is ensured that the user request can reach the map service server accurately after the necessary security check, making the operation of the system more stable and predictable, and also convenient for the management and maintenance of the system. The purpose of the user initiating a map service request is to obtain the required map service data. When the authentication gateway passes the verification and forwards the request to the map service server in time, the server can quickly respond to the user's request, provide the user with accurate map service data, meet the user's immediate needs, and improve the user experience.

[0107] The map service server is a professional storage and processing center for map data. Only by forwarding authenticated legitimate requests to it can we ensure that the map service data obtained by users is accurate, complete and in compliance with their permissions. This avoids data errors or incompleteness caused by illegal or erroneous requests, and provides users with high-quality map services. Furthermore, when the authentication gateway forwards the authenticated request to the map service server, this process will leave clear request records and logs. These records are also very important for system auditing and monitoring, which can help administrators track the entire process of user requests, understand user operation behaviors and system responses, and promptly discover abnormal behaviors or potential security risks, so as to take appropriate measures to deal with them.

[0108] In some industries and scenarios, there are strict compliance requirements for data access and use. Through the verification and forwarding operations of the authentication gateway, the legitimacy and responsibility of each request can be clarified to ensure that the operation of the system complies with the requirements of relevant laws and policies. Once a problem occurs, the responsibility can be clearly defined to avoid unnecessary legal risks. Therefore, if the authentication gateway determines that the second target authentication request has passed the verification, the second target authentication request can be forwarded to the map service server to obtain the map service data required by the user from the map service server.

[0109] Step S302: After the map service server receives the second target authentication request and analyzes the second target authentication request to determine the map service data required by the user, the map service data required by the user is forwarded to the authentication gateway.

[0110] Specifically, from the above introduction, it can be seen that the authentication gateway forwards the second target authentication request to the map service server only after determining that the second target authentication request has passed the verification, so as to obtain the map service data required by the user from the map service server. Therefore, after the map service server receives the second target authentication request, it can analyze the second target authentication request to determine the map service data required by the user, and then forward the map service data required by the user to the authentication gateway.

[0111] It can be seen from the technical solution introduced above that the authentication gateway provided in the embodiment of the present application performs verification through the second target authentication request, and forwards the verified second target authentication request to the map service server, so that the map service data required by the user can be obtained from the map service server. Through the verification and forwarding of the authentication gateway, it can be ensured that the map service data obtained by the user is accurate, complete and in compliance with their authority. This avoids data errors or incompleteness caused by illegal requests or erroneous requests, and provides users with high-quality map services. The map service server can trust the request verified by the authentication gateway, thereby providing users with corresponding map service data without the need to repeatedly verify the user identity and the legitimacy of the request, thereby improving the efficiency and security of data interaction.

[0112] Combine the following Figure 2 , introduces an optional system architecture for implementing map service authentication given in an embodiment of the present application, which can be applied to the authentication method of the map service introduced above, such as Figure 2 As shown, the system architecture may include a user terminal, an authentication gateway, an authentication server, and a map service server.

[0113] In the actual application process, when the user end determines that the user has a request to access the map service, the user end can determine whether the user is requesting to use the map service for the first time; if the user end determines that the user is requesting to use the map service for the first time, a public key and a private key corresponding to the user information can be generated for the user, and the public key corresponding to the user information can be uploaded to the authentication server; if it is determined that the user is not requesting to use the map service for the first time, the private key corresponding to the user information is determined. After the user end determines the private key corresponding to the user information, when the user initiates a request to use the map service, a first target authentication request for the user's request to use the map service can be generated based on the user's request to use the map service, and the generated first target authentication request can be signed with the private key corresponding to the user's information, so that a second target authentication request can be obtained, and after the second target authentication request is obtained, the second target authentication request is sent to the authentication gateway for verification, wherein the second target authentication request can include the user identity information, the application programming interface corresponding to the map service requested by the user, and the request timestamp information.

[0114] This application can assign different levels of keys to different users or user groups to control their access rights. For example, for ordinary users, only access to basic map services may be granted; while for advanced users or partners, access to advanced analysis tools may be granted. If a key is leaked or no longer needed, the system can quickly revoke the key's access rights without affecting the normal use of other users. This flexibility helps to respond quickly to security incidents and protect the system from damage. Allow the system to dynamically adjust permissions based on the user's role, geographic location, or other attributes. For example, some APIs may only be open to users in a specific area or available during a specific time period. In the case of temporary access to specific resources, the system can temporarily grant permissions to users. For example, a user may need to temporarily access real-time map data of an emergency event. The system can dynamically grant temporary permissions based on the nature of the event and the needs of the user. As business needs change, system administrators can flexibly adjust permission policies without redeploying the entire system. For example, if new business needs require stricter control over access to specific APIs, administrators can quickly update permission rules to adapt to these changes.

[0115] The authentication server can receive and store the public key corresponding to the user information uploaded by the user, and regularly update the public key corresponding to the user information according to the preset update rules; for example, the public key corresponding to the user information can be updated in real time every month or every week to ensure security. In some cases, it may be necessary to update the key regularly to improve security. This application allows system administrators or users to update public and private keys at any time without changing other parts of the system. For example, if a security risk is detected, the system can automatically prompt the user to change the key, or automatically rotate the key in the background.

[0116] After receiving the second target authentication request, the authentication gateway can read the stored public key corresponding to the user information from the authentication server, so that the second target authentication request can be verified based on the public key corresponding to the user information, and confirm whether the signature in the second target authentication request includes a private key that matches the public key corresponding to the user information; if it is determined that the signature in the second target authentication request includes a private key that matches the public key corresponding to the user information, it means that the second target authentication request initiated by the user is authentic and valid, and it can be confirmed that the second target authentication request is legal. At the same time, in order to further confirm whether the second target authentication request initiated by the user is legal and has access rights, the second target authentication request can be analyzed to verify the user's identity information and check whether the user has access rights to the application programming interface corresponding to the requested map service; if it is determined that the user's identity information has passed the verification, and the user has access rights to the application programming interface corresponding to the requested map service, it can be determined that the second target authentication request has passed the verification.

[0117] If the authentication gateway determines that the signature in the second target authentication request does not include a private key that matches the public key corresponding to the user information, it means that the second target authentication request may be a forged request and is not legal. Then, it can be confirmed that the second authentication request is illegal and that the second target authentication request cannot pass verification.

[0118] If the authentication gateway determines that the second target authentication request is legal, but finds that the user's identity information has not passed the verification, it means that someone else has stolen the user's signature to initiate map service access, and it can be determined that the second target authentication request cannot pass the verification; or, the authentication gateway determines that the second target authentication request is legal and the user's identity information has passed the verification, but the user does not have access rights to the application programming interface corresponding to the requested map service, which means that although the user's access request is legal and is a real access request initiated by the user himself, the user does not have the relevant map service access rights, and therefore the corresponding map service data cannot be provided to it, and it can be determined that the second target authentication request cannot pass the verification.

[0119] In the actual application process, if the authentication gateway determines that the second target authentication request passes the verification, it can return the authentication success information to the user end, and forward the second target authentication request to the map service server to obtain the map service data required by the user from the map service server; if the authentication gateway determines that the second target authentication request does not pass the verification, it can return the authentication failure information to the user end, and record the relevant logs of the authentication failure event so that it can be traced. After the map service server receives the second target authentication request forwarded by the authentication gateway, it means that the map service requested by the user is legal and has the corresponding data access rights, and it can provide the requested map service corresponding data to it. Therefore, after receiving the second target authentication request, the map service server can analyze the second target authentication request forwarded by the authentication gateway so as to determine the map service data required by the user, and can forward the determined map service data to the authentication gateway; and the authentication gateway forwards the map service data required by the user forwarded by the map service server to the user end.

[0120] It can be seen from the technical solution introduced above that the system provided in the embodiment of the present application can verify the map service request initiated by the user through the public key and private key corresponding to the user information, so as to verify the user's map service. Compared with the existing simple application programming interface key authentication method, the method provided in the embodiment of the present application effectively improves the security of map service management, and can also simplify the authentication process of the map service, which can effectively reduce the loopholes of developers in the map authentication implementation process, and use private keys and public keys to control the user's access rights, which can more flexibly manage the user's map service access requests, and can more flexibly adjust the key management and permission verification strategies to adapt to dynamically changing service requirements. It can effectively control the user's access to the application programming interface of the map service, and by signing the authentication request initiated by the user with the user's private key, it can also improve the security of data transmission.

[0121] The following describes the authentication device for the map service provided in the embodiment of the present application. The authentication device for the map service described below and the authentication method for the map service described above can be referred to in correspondence with each other. Figure 3 , Figure 3 This is a schematic diagram of the structure of an authentication device for a map service disclosed in an embodiment of the present application. Figure 3 As shown, the authentication device of the map service may include:

[0122] The judging unit 101 is used to judge whether the user is requesting to use the map service for the first time;

[0123] The key generation unit 102 is used to generate a public key and a private key corresponding to the user information for the user when the user requests to use the map service for the first time, and upload the public key corresponding to the user information to the authentication server;

[0124] The request generating unit 103 is used to generate a first target authentication request for the user to use the map service based on the user's map service use request, and to sign the first target authentication request with a private key corresponding to the user's information to obtain a second target authentication request, wherein the second target authentication request includes the user identity information, the application programming interface corresponding to the map service requested by the user, and the request timestamp information;

[0125] The verification unit 104 is used to send the second target authentication request to the authentication gateway for verification;

[0126] The data receiving unit 105 is used to receive the map service data required by the user obtained from the map service server and forwarded by the authentication gateway after the authentication gateway successfully verifies the second target authentication request.

[0127] It can be seen from the technical solution introduced above that the device of the embodiment of the present application can verify the map service request initiated by the user through the public key and private key corresponding to the user information, so as to verify the user's map service. Compared with the existing simple application programming interface key authentication method, the device provided by the embodiment of the present application effectively improves the security of map service management, and can also simplify the authentication process of the map service, which can effectively reduce the loopholes of developers in the map authentication implementation process, and use private keys and public keys to control the user's access rights, which can more flexibly manage the user's map service access requests, and can more flexibly adjust the key management and permission verification strategies to adapt to dynamically changing service needs. It can effectively control the user's access to the application programming interface of the map service, and by signing the authentication request initiated by the user with the user's private key, it can also improve the security of data transmission.

[0128] The specific processing flow of each unit included in the authentication device of the above-mentioned map service can refer to the relevant introduction of the authentication method of the map service in the previous text, which will not be repeated here.

[0129] The map service authentication device provided in the embodiment of the present application can be applied to map service authentication devices, such as terminals: mobile phones, computers, etc. Optionally, Figure 4 The hardware structure diagram of the authentication device for the map service is shown in FIG. Figure 4 , the hardware structure of the authentication device for the map service may include: at least one processor 1, at least one communication interface 2, at least one memory 3 and at least one communication bus 4. In the embodiment of the present application, the number of processor 1, communication interface 2, memory 3 and communication bus 4 is at least one, and the processor 1, communication interface 2 and memory 3 communicate with each other through the communication bus 4. The processor 1 may be a central processing unit CPU, or a specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiment of the present application; the memory 3 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory; wherein the memory stores a program, and the processor can call the program stored in the memory, and the program is used to: implement the various processing flows in the authentication scheme of the aforementioned terminal map service. The embodiment of the present application also provides a readable storage medium, which can store a program suitable for execution by the processor, and the program is used to: implement the various processing flows of the aforementioned terminal in the authentication scheme of the map service.

[0130] Finally, it should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "including one..." do not exclude the existence of other identical elements in the process, method, article or device including the elements. In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same and similar parts between the embodiments can be referred to each other. The above description of the disclosed embodiments enables professionals and technicians in this field to implement or use the present application. The various modifications to these embodiments will be obvious to professionals and technicians in this field, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. The various embodiments can be combined with each other. Thus, the present application will not be limited to the embodiments shown herein but will be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for authenticating a map service, characterized in that: include: Determine whether the user is requesting to use the map service for the first time; If the user is requesting to use the map service for the first time, a public key and a private key corresponding to the user information are generated for the user, and the public key corresponding to the user information is uploaded to the authentication server; After determining the private key corresponding to the user information, based on the user's map service use request, a first target authentication request for the user's request to use the map service is generated, and the first target authentication request is signed with the private key corresponding to the user's information to obtain a second target authentication request, wherein the second target authentication request includes the user identity information, the application programming interface corresponding to the map service requested by the user, and the request timestamp information; Sending the second target authentication request to an authentication gateway for verification; After the authentication gateway verifies the second target authentication request successfully, the authentication gateway receives the map service data required by the user obtained from the map service server and forwarded by the authentication gateway.

2. The method according to claim 1, characterized in that: After determining the private key corresponding to the user information, before generating a first target authentication request for the user to use the map service based on the user's map service use request, the method further includes: If it is not the first time for the user to request to use the map service, the private key corresponding to the user information is determined.

3. The method according to claim 1, characterized in that The verification process of the second target authentication request by the authentication gateway includes: After receiving the second target authentication request, the authentication gateway reads the stored public key corresponding to the user information to verify the signature of the second target authentication request; confirming, based on the public key corresponding to the user information, whether the signature in the second target authentication request includes a private key matching the public key corresponding to the user information; If it is determined that the signature in the second target authentication request includes a private key that matches the public key corresponding to the user information, then the second target authentication request is confirmed to be legal, and the user's identity information is verified, and it is checked whether the user has access rights to the application programming interface corresponding to the requested map service; if it is determined that the user's identity information has passed the verification, and the user has access rights to the application programming interface corresponding to the requested map service, then it is determined that the second target authentication request has passed the verification; If it is determined that the signature in the second target authentication request does not include a private key that matches the public key corresponding to the user information, it is confirmed that the second authentication request is illegal and that the second target authentication request cannot pass verification.

4. The method according to claim 3, characterized in that: Also includes: If it is determined that the second target authentication request is legitimate, but the identity information of the user has not passed the verification, then it is determined that the second target authentication request cannot pass the verification; or, If it is determined that the second target authentication request is legal and the user's identity information has been verified, but the user does not have access rights to the application programming interface corresponding to the requested map service, it is determined that the second target authentication request cannot be verified.

5. The method according to claim 1, characterized in that The authentication gateway obtains the map service data required by the user from the map service server, including: If the authentication gateway determines that the second target authentication request passes the verification, the second target authentication request is forwarded to the map service server to obtain the map service data required by the user from the map service server; After the map service server receives the second target authentication request and analyzes the second target authentication request to determine the map service data required by the user, the map service data required by the user is forwarded to the authentication gateway.

6. The authentication method for map service according to any one of claims 1 to 5, characterized in that: The user identity information includes the user's unique identification, password or other identity verification information; The verification result of the authentication gateway on the second target authentication request also includes authentication failure and returning a corresponding failure reason when authentication fails.

7. A map service authentication system, characterized in that: The authentication method for the map service according to any one of claims 1 to 6 comprises a user terminal, an authentication gateway, an authentication server, and a map service server. When the user terminal determines that the user has a request to access the map service, the user terminal determines whether the user is requesting to use the map service for the first time; if it is determined that the user is requesting to use the map service for the first time, a public key and a private key corresponding to the user information are generated for the user, and the public key corresponding to the user information is uploaded to the authentication server; if it is determined that the user is not requesting to use the map service for the first time, the private key corresponding to the user information is determined; After determining the private key corresponding to the user information, the user terminal generates a first target authentication request for the user to use the map service based on the user's map service use request, and signs the first target authentication request with the private key corresponding to the user information to obtain a second target authentication request, and then sends the second target authentication request to the authentication gateway for verification, wherein the second target authentication request includes the user identity information, the application programming interface corresponding to the map service requested by the user, and the request timestamp information; The authentication server receives and stores the public key corresponding to the user information uploaded by the user terminal, and regularly updates the public key corresponding to the user information according to a preset update rule; After receiving the second target authentication request, the authentication gateway reads the stored public key corresponding to the user information from the authentication server, verifies the signature of the second target authentication request based on the public key corresponding to the user information, and confirms whether the signature in the second target authentication request includes a private key that matches the public key corresponding to the user information; if it is determined that the signature in the second target authentication request includes a private key that matches the public key corresponding to the user information, then the second target authentication request is confirmed to be legal, and at the same time, the second target authentication request is analyzed to verify the user's identity information and check whether the user has access rights to the application programming interface corresponding to the requested map service; if it is determined that the user's identity information passes the verification and the user has access rights to the application programming interface corresponding to the requested map service, then the second target authentication request passes the verification; if it is determined that the signature in the second target authentication request does not include a private key that matches the public key corresponding to the user information , then it is confirmed that the second authentication request is illegal, and that the second target authentication request cannot pass the verification; if it is determined that the second target authentication request is legal, but the user's identity information has not passed the verification, then it is determined that the second target authentication request cannot pass the verification; or, if it is determined that the second target authentication request is legal, and the user's identity information has passed the verification, but the user does not have access rights to the application programming interface corresponding to the requested map service, then it is determined that the second target authentication request cannot pass the verification; if the authentication gateway determines that the second target authentication request passes the verification, it returns authentication success information to the user terminal, and forwards the second target authentication request to the map service server to obtain the map service data required by the user from the map service server; if the authentication gateway determines that the second target authentication request does not pass the verification, it returns authentication failure information to the user terminal, and records relevant logs of the authentication failure event; The map service server receives and analyzes the second target authentication request forwarded by the authentication gateway, determines the map service data required by the user, and forwards the determined map service data to the authentication gateway; After receiving the map service data required by the user forwarded by the map service server, the authentication gateway forwards it to the user terminal.

8. An authentication device for a map service, characterized in that: include: A determination unit, used to determine whether the user is requesting to use the map service for the first time; A key generation unit, used for generating a public key and a private key corresponding to the user information for the user when the user requests to use the map service for the first time, and uploading the public key corresponding to the user information to the authentication server; A request generating unit, configured to generate a first target authentication request for a user to use a map service based on a user's map service use request, and to sign the first target authentication request with a private key corresponding to the user's information to obtain a second target authentication request, wherein the second target authentication request includes the user's identity information, an application programming interface corresponding to the map service requested by the user, and request timestamp information; A verification unit, configured to send the second target authentication request to an authentication gateway for verification; The data receiving unit is used to receive the map service data required by the user obtained from the map service server and forwarded by the authentication gateway after the authentication gateway successfully verifies the second target authentication request.

9. An authentication device for a map service, characterized in that: include: one or more processors, and memory; The memory stores computer-readable instructions, and when the computer-readable instructions are executed by the one or more processors, the steps of the authentication method for the map service as claimed in any one of claims 1 to 6 are implemented.

10. A readable storage medium, characterized in that: The readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by one or more processors, the one or more processors implement the steps of the authentication method for the map service as described in any one of claims 1 to 6.

Images