A map service access control method and system

Abstract

The application provides a kind of map service access control method and system, it is related to map service technical field, the map service access control method, it includes: obtaining the map service request information initiated by client;Map service request information is parsed to obtain permission request;The priority of permission request is sorted to obtain diagnostic priority list;Diagnostic priority list is sent to permission interceptor in turn to carry out in turn permission diagnosis, obtain diagnostic result, to execute map service access by service interceptor according to diagnostic result.The access control method and system provided by the application can configure the diagnostic priority of permission request before the interception diagnosis of permission request, to improve the access efficiency of map service.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of map service, in particular to a map service access control method and system. BACKGROUND

[0002] In the map service access control process, the access interceptor can be used to confirm the authority of the map service request information, and when the authority requirement is met, the map server is called to continue to provide the map service, and if not, the map service is not executed. The access interceptor of the map service includes an authority interceptor and a service interceptor.

[0003] When the access interceptor is used to diagnose and intercept each authority request of the map service request information, in order to ensure the security of the map service, the corresponding authority of the map service request information is generally checked one by one. However, due to the setting of a large number of diagnostic checking mechanisms, the authority request diagnosis of the map service request information is easily stuck at a certain authority diagnosis node when checked one by one, thereby greatly reducing the response efficiency of the map service access. SUMMARY

[0004] In view of the above-mentioned shortcomings of the prior art, the purpose of the present application is to provide a map service access control method and system, which solves the problem that when the access interceptor is used to diagnose and intercept the authority request, due to the setting of a large number of diagnostic checking mechanisms, the authority request diagnosis of the map service request information is easily stuck at a certain authority diagnosis node when checked one by one, thereby greatly reducing the response efficiency of the map service access.

[0005] To achieve the above-mentioned purpose and other related purposes, the present application provides a map service access control method, comprising: obtaining a map service request information initiated by a client; analyzing the map service request information to obtain an authority request; prioritizing the authority request to obtain a diagnosis priority list; sending the diagnosis priority list to the authority interceptor in turn for sequential authority diagnosis to obtain a diagnosis result, and executing the map service access through the service interceptor according to the diagnosis result.

[0006] In an embodiment of the present application, the map service request information is analyzed to obtain the authority request, comprising: extracting the request type of the map service request information to obtain the request type; calling the diagnosis whitelist corresponding to the authority interceptor according to the request type; and sequentially searching each authority request based on the diagnosis whitelist to obtain the authority request.

[0007] In an embodiment of the present application, the permission request is searched in sequence based on the diagnostic whitelist to obtain the permission request, including: intercepting the coverage field in the map service request information based on the corresponding whitelist request in the diagnostic whitelist; comparing the coverage field with the demand field corresponding to the whitelist request to obtain a comparison result; when the comparison result is comparison passed, taking the whitelist request corresponding to the demand field as the permission request; when the comparison result is comparison failed, ending the map service access.

[0008] In an embodiment of the present application, the coverage field is compared with the demand field corresponding to the whitelist request to obtain a comparison result, including: extracting the key field in the coverage field according to the demand field corresponding to the whitelist request, and judging whether the key field satisfies the following conditions at the same time: no field is missing in the key field; the format order of the key field is consistent with the format order of the demand field; the field length of the adjacent two key fields meets the demand field length requirement corresponding to the whitelist request; the field content of the adjacent two key fields meets the address request requirement; if yes, taking the comparison passed as the comparison result; if no, taking the comparison failed as the comparison result.

[0009] In an embodiment of the present application, in the process of judging whether the field content of the adjacent two key fields meets the address request requirement, including: sequentially performing semantic analysis on the field content of the adjacent two key fields to obtain an analysis result; according to the semantic summary of the field content according to the analysis result, obtaining summary words with different semantic strengths and semantic deviation degrees between each summary word and the field content; splicing the summary words corresponding to each field content to obtain a splicing request; calculating the address request correlation between each summary word corresponding to each splicing request to obtain a request correlation degree; according to the semantic deviation degrees between each summary word and the field content, adjusting the request correlation degrees between each summary word corresponding to the splicing request to obtain a comprehensive correlation degree; judging whether the comprehensive correlation degree meets a set threshold requirement: if yes, the field content of the adjacent two key fields meets the address request requirement; if no, the field content of the adjacent two key fields does not meet the address request requirement.

[0010] In an embodiment of the present application, the permission request is prioritized to obtain a diagnostic priority list, including: according to the request type corresponding to the map service request information, calling the diagnostic whitelist corresponding to the permission interceptor; performing consistency comparison between all permission requests and the diagnostic whitelist; when all permission requests and the diagnostic whitelist are consistent, performing permission analysis on the permission request according to the request type and the diagnostic whitelist to obtain the diagnostic priority corresponding to each permission request; according to the diagnostic priority, obtaining the diagnostic priority list.

[0011] In an embodiment of the present application, the permission analysis is performed on the permission request according to the request type and the diagnostic whitelist to obtain a diagnostic priority corresponding to each permission request, including: searching for a restriction degree of each permission request corresponding to the diagnostic whitelist according to the request type; generating a priority diagnostic weight corresponding to each permission request according to the restriction degree; and obtaining a diagnostic priority corresponding to each permission request according to an initial priority of the permission request and the priority diagnostic weight.

[0012] In an embodiment of the present application, the method further includes: receiving a diagnostic result fed back by the permission interceptor; when the diagnostic result is an abnormal permission request, obtaining an undiagnosed permission request corresponding to the permission interceptor according to the abnormal permission request and the diagnostic priority list; performing a sequential simulation permission diagnosis on the undiagnosed permission request to obtain a simulation diagnostic result; generating a corresponding access frequency limit according to a malicious access degree value corresponding to the simulation diagnostic result; and limiting the sending of the diagnostic priority list to the permission interceptor according to the access frequency limit.

[0013] In an embodiment of the present application, the corresponding access frequency limit is generated according to the malicious access degree value corresponding to the simulation diagnostic result, including: obtaining a comprehensive malicious access degree value according to a malicious access degree initial value corresponding to a failed permission request and an abnormal permission request in the simulation diagnostic result, a malicious access combination weight, a permission request failure amount, a first penalty weight corresponding to the permission request failure amount, an accessed frequency, and a second penalty weight corresponding to the accessed frequency; and generating a corresponding access frequency limit according to the comprehensive malicious access degree value.

[0014] To achieve the above object and other related objects, the present application further provides a map service access control system, including: an obtaining unit configured to obtain a map service request information initiated by a client; an analysis unit configured to analyze the map service request information to obtain a permission request; a sorting unit configured to sort the permission request according to a priority to obtain a diagnostic priority list; and a sending unit configured to sequentially send the diagnostic priority list to a permission interceptor for a sequential permission diagnosis to obtain a diagnostic result, and execute a map service access through a service interceptor according to the diagnostic result.

[0015] As described above, the map service access control method and system of the present application has the following beneficial effects: by analyzing the map service request information before it enters the access interceptor from the client system, determining the legality of the permission request with respect to the permission interceptor and the service interceptor, so as to avoid invalid requests passing through the access interceptor, thereby reducing the diagnostic load of the access interceptor on the map service request information. Then, after the analysis of the permission request is completed, the diagnostic priority analysis of the permission request is performed before it is sent to the permission interceptor, so as to quickly complete the diagnosis through the permission interceptor, and when the diagnostic priority of the permission request is high, the invalid diagnosis of the permission request with low diagnostic priority can be effectively avoided, thereby greatly improving the permission diagnosis efficiency of the permission interceptor, further improving the response efficiency of the map service request information when passing through the access interceptor, and reducing the blindness of the diagnosis process. BRIEF DESCRIPTION OF DRAWINGS

[0016] Figure 1 A flowchart of a map service access control method provided by an embodiment of the present application is shown.

[0017] Figure 2 An interception process diagram of an access interceptor provided by an embodiment of the present application is shown.

[0018] Figure 3 An interception process diagram of a permission interceptor provided by an embodiment of the present application is shown.

[0019] Figure 4 A structural block diagram of a map service access control system provided by an embodiment of the present application is shown.

[0020] Figure 5 A structural diagram of an electronic device provided by an embodiment of the present application is shown.

[0021] Element number explanation

[0022] Electronic device 1; map service access control system 11; memory 12; processor 13; acquisition unit 111; analysis unit 112; sorting unit 113; sending unit 114. DETAILED DESCRIPTION

[0023] The embodiments of the present application will be described in detail below with reference to specific examples. Those skilled in the art can easily understand other advantages and effects of the present application from the content disclosed in the specification. The present application can also be implemented or applied by different specific embodiments, and the details in the specification can be modified or changed based on different views and applications without departing from the spirit of the present application. It should be noted that the following embodiments and features in the embodiments can be combined with each other without conflict.

[0024] It is to be understood that the drawings shown in the following embodiments are only schematic and that the embodiments of the application are not necessarily drawn to scale. In the drawings, the cross-sectional views are schematic representations of the actual cross-sections taken along the lines indicated in the figures "as such". Identical or similar elements are denoted by the same reference numerals throughout the figures.

[0025] In the following description, numerous specific details are discussed in order to provide a thorough understanding of the embodiments of the application. However, various embodiments of the present application can be practiced without these specific details. In other instances, well-known structures and devices are not described in detail in order to avoid obscuring the embodiments of the present application.

[0026] Referring to Figure 1 The application provides a map service access control method. The map service request information is parsed before being sent to the permission interceptor, and the permission request to be diagnosed corresponding to the map service request information is parsed, so that the permission request can be accurately queried according to the map service request information, and the amount of permission diagnosis of the permission interceptor to the permission request can be adjusted, and the problem of slow response caused by the sequential diagnosis of the permission interceptor according to the set diagnosis mechanism can be reduced. Moreover, the obtained permission request is sorted before diagnosis by the permission regulator, so that a diagnosis priority list can be obtained, and the diagnosis result can be obtained by sequentially diagnosing according to the diagnosis priority list. The diagnosis can be performed according to the restriction strength of the permission request by using the diagnosis priority order, the permission request with large restriction strength can be diagnosed first, the permission request that fails to pass the diagnosis can be quickly found, and the invalid diagnosis of other permission requests with low restriction strength corresponding to the map service request information can be reduced, the blindness of the diagnosis process is reduced, and the diagnosis response efficiency is improved.

[0027] Figure 1 A flowchart of a map service access control method in an example embodiment of the application is shown, which is applied to a map service access control system. The map service access control system can be a client system, and of course, can be other application systems configured on the upper layer of the access interceptor. The access interceptor can include a permission interceptor and a service interceptor, and of course, can include other types of interceptors, including steps S10-S40. The technical solutions of the application will be described in detail below with reference to Figure 1

[0028] First, step S10 is performed, and the map service request information initiated by the client is obtained.

[0029] ​In the map service access control process, a user can send map service request information to an access interceptor through a client system to query a real map service address and initiate an access request to a map server, so as to realize sending of the map server to the client system. Before the client system sends the map service request information to the access interceptor, the map service request information is first acquired by the map service access control system for processing, and after the permission request is confirmed, the map service request information is further sent to the permission interceptor for diagnosis of the permission request corresponding to the map service request information.

[0030] Then, step S20 is performed to parse the map service request information to obtain the permission request.

[0031] After the map service request information is acquired, the map service access control system can generate a corresponding permission request according to the diagnosis interception demand of the permission interceptor, and then send the parsed permission request to the permission interceptor, so as to reduce the invalid diagnosis amount of the permission interceptor and improve the diagnosis efficiency.

[0032] In step S20, parsing the map service request information to obtain the permission request can further include:

[0033] Request type extraction is performed on the map service request information to obtain the request type.

[0034] According to the request type, a diagnosis whitelist corresponding to the permission interceptor is called.

[0035] Based on the diagnosis whitelist, each permission request is sequentially searched to obtain the permission request.

[0036] When the map service request information is parsed by the map service access control system, the request type extraction is first performed on the map service request information, so that after the request type is obtained, the diagnosis whitelist corresponding to the permission interceptor is automatically allocated for the parsing of the map service request information. For example, the request type can be a request for user role information, such as a developer, an auditor, a tourist, etc., and of course, other setting modes such as a membership level can also be used. The diagnosis whitelist can include a list of resources under the access permission corresponding to the current request type, access frequency limitation, and other permission request types (i.e., whitelist requests). Thus, according to the diagnosis whitelist, each permission request of the map service request information can be sequentially searched, and when each permission request in the map service request information meets the corresponding requirements of each permission request type of the diagnosis whitelist, the permission request is obtained for permission diagnosis of the permission interceptor, so that the filtering of invalid permission requests can be realized, and the permission diagnosis efficiency of the permission interceptor can be ensured.

[0037] The permission request is obtained by sequentially performing each permission request search based on the diagnostic whitelist, which can further include:

[0038] The coverage field in the map service request information is intercepted based on the corresponding whitelist request in the diagnostic whitelist;

[0039] The coverage field is compared with the demand field corresponding to the whitelist request, and a comparison result is obtained;

[0040] When the comparison result is a comparison pass, the whitelist request corresponding to the demand field is taken as the permission request;

[0041] When the comparison result is a comparison fail, the map service access is ended.

[0042] After the diagnostic whitelist is obtained through the map service access control system, the corresponding coverage field in the map service request information can be intercepted by using the corresponding whitelist request in the diagnostic whitelist, that is, the overall field length of the coverage field can be greater than that of the demand field corresponding to the whitelist request. Then, the intercepted coverage field is compared with the demand field corresponding to the whitelist request to determine whether the coverage field has the demand field corresponding to the whitelist request. When the comparison passes, the whitelist request corresponding to the demand field is taken as the permission request. When the comparison fails, it means that the coverage field does not have the demand field corresponding to the whitelist request, and therefore there is no corresponding permission request. At this time, the permission request corresponding to the whitelist request is needed for diagnosis, and if it does not exist, it is not necessary to send it to the permission interceptor for permission diagnosis, and the map service access corresponding to the map service request information can be directly ended.

[0043] The coverage field is compared with the demand field corresponding to the whitelist request, and a comparison result is obtained, which can further include:

[0044] According to the demand field corresponding to the whitelist request, a key field in the coverage field is extracted, and it is determined whether the key field satisfies the following conditions at the same time:

[0045] No field is missing in the key field;

[0046] The key field composition format sequence is consistent with the format sequence of the demand field;

[0047] The field length of the adjacent two key fields meets the demand field length requirement corresponding to the whitelist request;

[0048] The field content of the adjacent two key fields meets the address request requirement;

[0049] If yes, the comparison pass is taken as the comparison result;

[0050] If not, the comparison fails and is used as the comparison result.

[0051] The map service access control system, when comparing the coverage field with the demand field corresponding to the whitelist request in the diagnosis whitelist, obtains the demand field corresponding to the whitelist request in the diagnosis whitelist. Then, based on the demand field, key field extraction is implemented in the coverage field, so that it can be further determined whether the comparison between the coverage field and the demand field corresponding to the whitelist request passes or not, as the comparison result, by judging whether the key fields meet the relevant conditions. That is, when all the key fields meet the conditions that there is no missing field in the key fields, the format order of the key fields is consistent with the format order of the demand field, the field length of the two adjacent key fields meets the demand field length requirement of the demand field corresponding to the whitelist request, and the field content of the two adjacent key fields meets the address request requirement, it is indicated that the coverage field in the current map service request information matches the demand field corresponding to the whitelist request in the diagnosis whitelist, and the corresponding whitelist request can be used as the permission request, and further, the other whitelist requests in the diagnosis whitelist can be further searched for the permission request. Otherwise, it is indicated that the coverage field in the current map service request information does not match the demand field corresponding to the whitelist request in the diagnosis whitelist, and further, the map service access can be directly ended, of course, the other whitelist requests in the diagnosis whitelist can be further searched for the permission request.

[0052] Specifically, in the process of judging whether the demand field length corresponding to the two adjacent key fields meets the field length requirement of the whitelist request, two adjacent key fields A and B can be obtained first, and then the field length between the adjacent key fields A and B is queried to obtain the key field length . It is further judged whether the key field length corresponds to the demand field length requirement range corresponding to the whitelist request. If yes, it is indicated that the field length of the two adjacent key fields meets the demand field length requirement of the whitelist request; if not, it is indicated that the field length of the two adjacent key fields cannot meet the demand field length requirement of the whitelist request. The demand field length requirement range corresponding to the whitelist request is in a corresponding relationship with the corresponding adjacent key fields A and B, that is, there is a demand field length requirement range corresponding to each two adjacent key fields.

[0053] In addition, in the process of judging whether the field content of the two adjacent key fields meets the address request requirement, the process can further include:

[0054] the field content of the two adjacent key fields is sequentially subjected to semantic analysis to obtain an analysis result;

[0055] According to the semantic summary of the field content, obtain the summary words with different semantic strengths and the semantic deviation degree between each summary word and the field content;

[0056] Splice the summary words corresponding to each field content to obtain a splicing request;

[0057] Calculate the address request relevance between each summary word corresponding to each splicing request to obtain a request relevance degree;

[0058] Adjust the request relevance degree between each summary word corresponding to the splicing request according to the semantic deviation degree between each summary word and the field content to obtain a comprehensive relevance degree;

[0059] Determine whether the comprehensive relevance degree meets the set threshold requirement:

[0060] If yes, the field content of the adjacent two key fields meets the address request requirement;

[0061] If no, the field content of the adjacent two key fields does not meet the address request requirement.

[0062] When determining whether the field content of the adjacent two key fields meets the address request requirement through the map service access control system, further confirmation of the field content of the adjacent two key fields is also needed. Specifically, semantic analysis of the field content can be performed first, for example, based on the field content, content expansion or simplification and deletion of unnecessary content in the field content can be performed to obtain an analysis result that accurately expresses the field content. Then, after determining the semantic of the field content, further semantic summary is performed using the analysis result that accurately expresses the field content, so that a simple semantic word of the field content, i.e., a summary word, can be further defined. Moreover, the summary word can include various forms, such as multiple summary words with different semantic deviations, and each summary word is also generated with a corresponding semantic deviation degree between it and the field content when it is generated, so as to ensure semantic compensation when the summary word cannot completely coincide with the meaning to be expressed by the field content, and improve the accuracy of the field content when the semantic information is simplified.

[0063] Further, after obtaining the summary words with different semantic strengths and the semantic deviation degree between each summary word and the field content, the map service access control system is used to extract the summary words with different semantic strengths for word splicing corresponding to each field content, so that a splicing request can be obtained. In addition, based on the splicing request, further analysis of its relevance to the address request is performed, i.e., a request relevance degree is calculated, and then, based on the semantic deviation degree between each summary word and the field content, the request relevance degree between each summary word corresponding to the splicing request is adaptively adjusted, so that a comprehensive relevance degree reflecting the current splicing request can be obtained.

[0064] Then, after obtaining the overall relevance of the splicing request, it is further determined whether the overall relevance meets the set threshold requirements. If the requirements are met, it means that the content of the two adjacent key fields meets the address request requirements; if the requirements are not met, it means that the content of the two adjacent key fields does not meet the address request requirements, and therefore does not meet the requirements for generating a permission request.

[0065] By analyzing whether the content of two adjacent key fields meets the address request requirements, it can be achieved that after the permission interceptor performs diagnosis based on the permission request, when the service interceptor further queries the real map service address, the low correlation between the address components in the map service request information initiated by the client will increase the query load on the service interceptor for the real map service address. For example, if the map information between two adjacent key fields includes City A and County C, but the real map service address only contains County A and County B of City A, and has a low correlation with County C, then using this information to query the real map service address by the service interceptor will greatly increase the query burden on the service interceptor due to the invalidity of the query, thus reducing the efficiency of other map service requests.

[0066] Specifically, in the process of determining whether the content of two adjacent key fields meets the address request requirements, the content of the two adjacent key fields can be checked sequentially. Perform semantic analysis and obtain the analysis results. During semantic analysis, necessary parts are semantically expanded, and unnecessary parts are semantically simplified. Then, based on the analysis results... For field content Semantic summarization to obtain summary vocabulary with different semantic strengths. and each summary vocabulary With field content Semantic deviation between Then, convert the content of each field... Corresponding vocabulary summary Perform splicing to obtain splicing requests. Then, for each splicing request... Corresponding vocabulary summary Calculate the relevance of address requests between them to obtain the request relevance degree. Next, based on the summarized vocabulary... With field content Semantic deviation between For splicing requests Corresponding vocabulary summary Relevance of requests between Adjustment is made to obtain the comprehensive correlation degree wherein, represents the correlation degree of the adjustment value. Finally, it is determined whether the comprehensive correlation degree satisfies the set threshold requirement: when the set threshold requirement is satisfied, the field contents of the two adjacent key fields meet the address request requirement, and if the requirement is not satisfied, it means that the field contents of the two adjacent key fields do not meet the address request requirement, and thus do not meet the requirement of generating the authority request.

[0067] Next, step S30 is performed to prioritize the authority requests to obtain a diagnostic priority list.

[0068] Before the map service access control system sends the obtained authority requests to the authority interceptor, the authority requests need to be prioritized, and then the authority interceptor is configured based on the corresponding diagnostic priority list to perform authority diagnosis, so that the authority diagnosis efficiency of the authority interceptor can be effectively improved.

[0069] In step S30, the authority requests are prioritized to obtain a diagnostic priority list, including:

[0070] According to the request type corresponding to the map service request information, the diagnostic whitelist corresponding to the authority interceptor is called;

[0071] All authority requests are compared with the diagnostic whitelist for consistency;

[0072] When all authority requests are consistent with the diagnostic whitelist, the authority requests are analyzed according to the request type and the diagnostic whitelist to obtain the diagnostic priority of each authority request;

[0073] According to the diagnostic priority, a diagnostic priority list is obtained.

[0074] In prioritizing the permission requests, it is also necessary to check whether all the obtained permission requests are consistent with all the corresponding whitelist requests in the diagnostic whitelist. If not, it indicates that the permission diagnostic content is missing. In order to ensure the rigor of the permission interceptor, the permission diagnostic service for the map service request information can be directly ended, i.e. the map service request is directly ended. If all the permission requests are consistent with the whitelist requests in the diagnostic whitelist, the diagnostic priority of each permission request can be further obtained according to the request type and the diagnostic whitelist, so as to configure a diagnostic priority list to control the permission diagnostic order of the permission interceptor, so that the permission interceptor is more flexible in the permission diagnosis of the permission requests, and the diagnostic priority is sequentially diagnosed, which can quickly realize the permission diagnosis of each map service request information, quickly intercept when the permission requirement is not met, reduce the running load of the permission interceptor, and improve the response efficiency of each map service request information.

[0075] In the permission analysis of the permission requests according to the request type and the diagnostic whitelist, the diagnostic priority of each permission request can further include:

[0076] According to the request type, the restriction degree of each permission request corresponding to the diagnostic whitelist is found;

[0077] According to the restriction degree, the priority diagnostic weight corresponding to each permission request is generated;

[0078] According to the initial priority of the permission request and the priority diagnostic weight, the diagnostic priority corresponding to each permission request is obtained.

[0079] In the permission analysis of the permission requests according to the request type and the diagnostic whitelist by the map service access control system, the request type corresponding to the map service request information can be obtained first. Then, based on the request type, the restriction degree of each permission request corresponding to the diagnostic whitelist is obtained, i.e. the restriction degree of each whitelist request in the diagnostic whitelist. For example, if the user is a senior member of the map service, the opening degree of each permission request is higher than that of an ordinary member, i.e. the restriction degree is relatively small. The restriction degree of a developer is smaller than that of a senior member. Of course, other request type forms and restriction forms can also be included. After the restriction degree is obtained, the priority diagnostic weight corresponding to each permission request is further determined according to the restriction degree. For example, the more restricted the user is, the more he needs to be diagnosed. Because the direction of the right restriction is different, the priority diagnostic weight corresponding to the request type is also different. Then, based on the initial priority of the permission request and the priority diagnostic weight, the diagnostic priority corresponding to each permission request is further determined to ensure the ordered permission diagnosis of the permission interceptor.

[0080] Specifically, the calculation formula of the diagnostic priority corresponding to each permission request is: wherein, represents the initial priority corresponding to each permission request, and the initial priority corresponding to each permission request is a fixed value, represents the priority diagnostic weight corresponding to each permission request.

[0081] Then, step S40 is performed, and the diagnostic priority list is sent to the permission interceptor in sequence for sequential permission diagnosis to obtain a diagnostic result, so that the map service access is performed by the service interceptor according to the diagnostic result.

[0082] After the diagnostic priority list is obtained by the map service access control system, the diagnostic priority list is sent to the permission interceptor, and the permission interceptor performs sequential permission diagnosis according to the permission interceptor to obtain whether the permission request meets the requirements. Then, when the diagnostic result that meets the requirements is obtained, the map service request information is sent to the service interceptor to query the real map service address for the client to perform map service access.

[0083] Referring to Figure 2 , when the map service request information reaches the permission interceptor, the diagnostic audit of each permission request is performed in sequence according to the diagnostic priority list, so that the diagnostic results of passing and failing are determined. And when the diagnosis passes, it further enters the service interceptor, and if the diagnosis fails, it returns the status code 403 of refusing to execute and prompts the reason for prohibiting access. If the diagnosis passes, it further enters the service interceptor, further queries the real map service address corresponding to the map service request information through the service interceptor, and then based on the real map service address, initiates a request to the map server, and sends the information returned by the map server to the client system.

[0084] Referring to Figure 3 , in the specific execution process of the permission interceptor, the diagnostic priority list of whether the interface key is carried, whether the application is normally started, whether the resource list of the application contains the current service, whether the applicant of the application is a unit user or a personal user, whether the application is passed, whether the access times exceed the limit, and the like can be sequentially configured. Then, if it is judged that the interface key is not carried, it will further configure the secondary diagnostic priority list of whether the request is initiated from the online interface test address, whether the user information is obtained through the session and the user has the right to the map service, whether the user information is obtained through the parameter and the user has the right to the map service, whether the Token generation time is today and the user has the right to the map service, and the like. To obtain the diagnostic result. Then, based on the diagnostic result, the map service access is further performed by the service interceptor.

[0085] In addition, in the map service access control method, the method further comprises:

[0086] receiving a diagnosis result fed back by the permission interceptor;

[0087] when the diagnosis result is an abnormal permission request, obtaining an undiagnosed permission request corresponding to the permission interceptor according to the abnormal permission request and the diagnosis priority list;

[0088] sequentially simulating permission diagnosis on the undiagnosed permission request to obtain a simulation diagnosis result;

[0089] generating a corresponding access frequency limit according to a malicious access degree value corresponding to the simulation diagnosis result;

[0090] limiting sending of the diagnosis priority list to the permission interceptor according to the access frequency limit.

[0091] When permission diagnosis is performed by the permission interceptor, a corresponding diagnosis result is generated and then sent to the map service access control system. When the diagnosis result is abnormal, the map service access control system further outputs an abnormal permission request, and then obtains an undiagnosed permission request which is not diagnosed by the permission interceptor according to the diagnosis priority list and the position of the abnormal permission request in the diagnosis priority list. Then, the map service access control system sequentially simulates permission diagnosis on the undiagnosed permission request to evaluate a malicious access degree value of the current map service request information, so as to determine whether the current map service request information has malicious access. Then, based on the malicious access degree value, a corresponding access frequency limit is generated to limit the number of times of sending the diagnosis priority list to the permission interceptor, so as to further reduce the amount of invalid diagnosis of invalid map service access requests by the permission interceptor.

[0092] The generating of the corresponding access frequency limit according to the malicious access degree value corresponding to the simulation diagnosis result can further comprise:

[0093] obtaining a comprehensive malicious access degree value according to the malicious access degree initial value corresponding to the undiagnosed permission request and the abnormal permission request in the simulation diagnosis result, a malicious access combination weight, a permission request failure amount, a first penalty weight corresponding to the permission request failure amount, an accessed frequency, and a second penalty weight corresponding to the accessed frequency;

[0094] generating a corresponding access frequency limit according to the comprehensive malicious access degree value.

[0095] In the malicious access degree value evaluation, the corresponding malicious access degree initial value can be obtained by querying the abnormal permission request and the corresponding failed permission request in the simulation diagnosis, and then the comprehensive malicious access degree value of the current map service request information can be calculated based on the corresponding malicious access combination weight of each permission request, the first penalty weight corresponding to the failed permission request, and the second penalty weight corresponding to the accessed times, and then the access times limit of the current map service request information can be determined according to the comprehensive malicious access degree value to limit the number of times of sending the current map service request information to the permission interceptor, so as to realize the dynamic adjustment of the access times limit and reduce the diagnosis load of the permission interceptor.

[0096] Specifically, in the calculation of the malicious access degree value, the calculation formula of the malicious access degree value is as follows: , wherein, represents the failed permission corresponding to the malicious access degree initial value, represents the failed permission corresponding to the malicious access combination weight, represents the first penalty weight, represents the second penalty weight.

[0097] Referring to 4, the application further provides a map service access control system 11, comprising: an acquisition unit 111 configured to acquire map service request information initiated by a client; an analysis unit 112 configured to analyze the map service request information to acquire permission requests; a sorting unit 113 configured to sort the permission requests according to priority to acquire a diagnosis priority list; and a sending unit 114 configured to send the diagnosis priority list to the permission interceptor in sequence for sequential permission diagnosis to acquire a diagnosis result, and execute map service access through the service interceptor according to the diagnosis result.

[0098] It should be noted that the map service access control system 11 provided by the above embodiment and the map service access control method provided by the above embodiment belong to the same concept, wherein the specific operation of each module and unit has been described in detail in the method embodiment, which will not be repeated here. The map service access control system 11 provided by the above embodiment can be divided into different functional modules to complete the above described all or part of the functions according to the needs in the actual application, and the internal structure of the device is divided into different functional modules to complete the above described all or part of the functions, and this is not limited here.

[0099] Referring to Figure 5The electronic device 1 can include a memory 12, a processor 13 and a bus, and can further include a computer program, such as a map service access control program, stored in the memory 12 and executable on the processor 13.

[0100] The memory 12 includes at least one type of readable storage medium, such as a flash memory, a mobile hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a magnetic memory, a magnetic disk, an optical disk, etc. In some embodiments, the memory 12 can be an internal storage unit of the electronic device 1, such as a mobile hard disk of the electronic device 1. In other embodiments, the memory 12 can also be an external storage device of the electronic device 1, such as a plug-in mobile hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. Further, the memory 12 can include both an internal storage unit and an external storage device of the electronic device 1. The memory 12 can be used to store application software installed in the electronic device 1 and various data, such as the code of the map service access control, and can also be used to temporarily store data that has been output or will be output.

[0101] The processor 13 can be composed of an integrated circuit in some embodiments, such as a single packaged integrated circuit or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors and combinations of various control chips, etc. The processor 13 is the control unit of the electronic device 1, which connects various components of the entire electronic device 1 through various interfaces and lines, executes programs or modules stored in the memory 12 (such as the map service access control program, etc.), and calls data stored in the memory 12 to execute various functions of the electronic device 1 and process data.

[0102] The processor 13 executes the operating system and various application programs installed in the electronic device 1. The processor 13 executes the application programs to implement the steps in the above-described map service access control method.

[0103] The computer program can be divided into one or more modules, which are stored in the memory 12 and executed by the processor 13 to complete the present application. The one or more modules can be a series of computer program instruction segments capable of completing a specific function, which are used to describe the execution process of the computer program in the electronic device 1. For example, the computer program can be divided into units in the map service access control system.

[0104] The integrated units in the form of software function modules described above can be stored in a computer readable storage medium, which can be non-volatile or volatile. The software function modules described above are stored in a storage medium, including a plurality of instructions for causing a computer device (which can be a personal computer, a computer device, or a network device, etc.) or a processor to execute part of the functions of the map service access control method described in the embodiments of the present application.

[0105] In summary, the map service access control method and system disclosed by the present application can analyze the map service request information before it enters the access interceptor from the client system, to determine the legality of the permission request with respect to the permission interceptor and the service interceptor, so as to avoid invalid requests passing through the access interceptor, thereby reducing the diagnostic load of the access interceptor on the map service request information. Then, after the analysis of the permission request is completed, the diagnostic priority analysis of the permission request is performed before it is sent to the permission interceptor, so as to quickly complete the diagnosis through the permission interceptor, and effectively avoid invalid diagnosis of the permission request with low diagnostic priority when the permission request with high diagnostic priority is abnormal, thereby greatly improving the permission diagnosis efficiency of the permission interceptor, further improving the response efficiency of the map service request information when passing through the access interceptor, and reducing the blindness of the diagnosis process. Therefore, the present application effectively overcomes the shortcomings of the prior art and has high industrial utilization value.

[0106] The above embodiments only exemplarily illustrate the principles and effects of the present application, and are not used to limit the present application. Any person skilled in the art can modify or change the above embodiments without departing from the spirit and scope of the present application. Therefore, all equivalent modifications or changes made by those skilled in the art without departing from the spirit and technical idea disclosed by the present application should be covered by the claims of the present application.

Claims

1. A map service access control method, characterized in that, include: Obtain information about map service requests initiated by the client; The map service request information is parsed to obtain the permission request; The permission requests are prioritized to obtain a diagnostic priority list; The diagnostic priority list is sent to the permission interceptor in sequence for sequential permission diagnosis, and the diagnostic results are obtained. Based on the diagnostic results, map service access is executed through the service interceptor. Also includes: Receive the diagnostic results fed back by the permission interceptor; When the diagnostic result indicates the existence of an abnormal permission request, the undiagnosed permission request corresponding to the permission interceptor is obtained based on the abnormal permission request and the diagnostic priority list. Perform simulated permission diagnosis on the undiagnosed permission requests one by one to obtain simulated diagnosis results; Based on the malicious access level value corresponding to the simulated diagnostic results, a corresponding access limit is generated; Based on the access limit, the sending of the diagnostic priority list to the permission interceptor is restricted.

2. The map service access control method according to claim 1, characterized in that: The map service request information is parsed to obtain the permission request, including: The request type is extracted from the map service request information to obtain the request type; Based on the request type, retrieve the diagnostic whitelist corresponding to the permission interceptor; Based on the diagnostic whitelist, each permission request is searched sequentially to obtain the permission request.

3. The map service access control method according to claim 2, characterized in that: Based on the diagnostic whitelist, each of the aforementioned permission requests is searched sequentially to obtain the permission request, including: Based on the corresponding whitelist request in the diagnostic whitelist, the overlay field in the map service request information is extracted. The overridden fields are compared with the required fields corresponding to the whitelist request to obtain the comparison results; When the comparison result is a pass, the whitelist request corresponding to the requirement field is taken as the permission request; If the comparison result is that the comparison fails, the map service access will be terminated.

4. The map service access control method according to claim 3, characterized in that: The overlay field is compared with the required field corresponding to the whitelist request to obtain the comparison result, including: Based on the required fields corresponding to the whitelist request, extract the key fields from the coverage fields, and determine whether the key fields simultaneously meet the following conditions: No fields are missing from the specified key fields; The format order of the key fields is consistent with the format order of the required fields; The lengths of two adjacent key fields meet the required field length requirements of the whitelist request. The content of two adjacent key fields meets the address request requirements; If so, the comparison pass will be taken as the comparison result; If not, the comparison will fail as the comparison result.

5. The map service access control method according to claim 4, characterized in that: The process of determining whether the content of two adjacent key fields meets the address request requirements includes: Semantic analysis is performed on the content of two adjacent key fields in sequence to obtain the analysis results; Based on the analysis results, a semantic summary of the field content is obtained, and summary words with different semantic strengths and the semantic deviation between each summary word and the field content are obtained. Concatenate the summary terms corresponding to the content of each field to obtain a concatenation request; For each of the summaries corresponding to each splicing request, the address request correlation is calculated to obtain the request correlation degree. Based on the semantic deviation between each summary term and the content of the field, the request relevance between each summary term corresponding to the splicing request is adjusted to obtain the comprehensive relevance. Determine whether the overall correlation degree meets the set threshold requirement: If so, then the content of the two adjacent key fields meets the address request requirements; If not, the content of the two adjacent key fields does not meet the address request requirements.

6. The map service access control method according to claim 1, characterized in that: The permission requests are prioritized to obtain a diagnostic priority list, including: Based on the request type corresponding to the map service request information, retrieve the diagnostic whitelist corresponding to the permission interceptor; Compare the consistency of all the permission requests with the diagnostic whitelist; When all the permission requests match the diagnostic whitelist, permission analysis is performed on the permission requests based on the request type and the diagnostic whitelist to obtain the diagnostic priority corresponding to each permission request. Based on the diagnostic priorities, obtain a list of diagnostic priorities.

7. The map service access control method according to claim 6, characterized in that: Based on the request type and the diagnostic whitelist, permission analysis is performed on the permission requests to obtain the diagnostic priority corresponding to each permission request, including: Based on the request type, determine the restriction level of each permission request corresponding to the diagnostic whitelist; Based on the degree of restriction, a priority diagnostic weight is generated for each permission request; Based on the initial priority of the permission request and the priority diagnostic weight, obtain the diagnostic priority corresponding to each permission request.

8. The map service access control method according to claim 7, characterized in that: Based on the malicious access severity value corresponding to the simulated diagnostic results, a corresponding access limit is generated, including: Based on the initial value of malicious access degree corresponding to the failed permission requests and the abnormal permission requests in the simulation diagnosis results, the malicious access combination weight, the number of failed permission requests, the first penalty weight corresponding to the number of failed permission requests, the number of accesses, and the second penalty weight corresponding to the number of accesses, a comprehensive malicious access degree value is obtained. Based on the comprehensive malicious access level value, a corresponding access limit is generated.

9. A control system for the map service access control method according to any one of claims 1-8, characterized in that, include: The acquisition unit is used to acquire map service request information initiated by the client; The parsing unit is used to parse the map service request information to obtain the permission request; A sorting unit is used to prioritize the permission requests to obtain a diagnostic priority list. as well as The sending unit is used to send the diagnostic priority list to the permission interceptor in sequence for sequential permission diagnosis, obtain the diagnostic results, and then execute map service access through the service interceptor according to the diagnostic results.

Images