Geographic information system data management method and device and electronic equipment

Abstract

The invention provides a geographic information system data management method and device and electronic equipment, and relates to the technical field of geographic information system data management. The method comprises the following steps: encrypting a first uniform resource address of a service resource related to geographic space data according to a preset rule to obtain a second uniform resource address; when request information including a second uniform resource address from a client is received and the client accords with preset authorization information, determining a first uniform resource address corresponding to the second uniform resource address, and obtaining response data including service resources corresponding to the second uniform resource address according to the first uniform resource address, and returning the response data to the client. Through encryption processing, address decryption, conversion and the like, effective management and access of the geographic information system data are realized, the management difficulty of the geographic information system data is reduced, and the management efficiency of the geographic information system data is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of geographic information system data management, and more particularly, to a method, device, and electronic device for managing geographic information system data. Background Art

[0002] In the scenario of remote sensing data visualization, remote sensing data of geospatial data may be published as online services by different software and provided to users for access and use through the network.

[0003] However, due to the lack of a unified standard among different software, the service address rules generated by each software are not unified; moreover, even for the same software, in an actual production environment, it may have different host addresses, etc. due to being deployed in multiple different physical spaces. As a result, the following situations occur:

[0004] 1. The client used by the user to access the corresponding data needs to construct a Uniform Resource Locator (URL) for accessing the corresponding resource according to the different URL rules of different software.

[0005] 2. Since the authentication methods of different software are different, the client used by the user to access the corresponding data needs to submit corresponding authentication information according to different authentication methods.

[0006] 3. When publishing a service, the data owner needs to perform differential configuration according to the differences of the target software.

[0007] The above situations will lead to problems such as increased management difficulty and reduced management efficiency of the corresponding data. Summary of the Invention

[0008] The problem to be solved by the present invention is: how to reduce the data management difficulty and improve the data management efficiency.

[0009] To solve the above problems, the present invention provides a method for managing geographic information system data, including:

[0010] Encrypting a first uniform resource address of a service resource regarding geospatial data according to a preset rule to obtain a second uniform resource address;

[0011] When receiving a request message including the second uniform resource address from a client and the client meets the preset authorization information, determining the first uniform resource address corresponding to the second uniform resource address, obtaining response data including service resources corresponding to the second uniform resource address according to the first uniform resource address, and returning the response data to the client.

[0012] Optionally, the encrypting the first uniform resource locator of the service resource for geospatial data according to a preset rule to obtain a second uniform resource locator includes:

[0013] Representing the service resource for geospatial data by a uniform resource locator to obtain the first uniform resource locator corresponding to each service resource;

[0014] Encrypting the first uniform resource locator according to the preset rule to obtain the second uniform resource locator corresponding to the first uniform resource locator;

[0015] Disclosing the second uniform resource locator through the client.

[0016] Optionally, after obtaining the second uniform resource locator corresponding to the first uniform resource locator, the encrypting the first uniform resource locator of the service resource for geospatial data according to a preset rule to obtain a second uniform resource locator further includes:

[0017] Determining the corresponding relationship between the first uniform resource locator and the second uniform resource locator;

[0018] When receiving a request message including the second uniform resource locator from the client and the client meets the preset authorization information, determining the first uniform resource locator corresponding to the second uniform resource locator includes:

[0019] When receiving the request message including the second uniform resource locator from the client and the client meets the preset authorization information, determining the first uniform resource locator corresponding to the second uniform resource locator according to the corresponding relationship between the first uniform resource locator and the second uniform resource locator.

[0020] Optionally, the encrypting the first uniform resource locator according to the preset rule to obtain the second uniform resource locator corresponding to the first uniform resource locator includes:

[0021] Determining a domain name part including a port number, a public part including a resource path and query parameters to be disclosed, and a privacy part including a resource path and query parameters to be hidden in the first uniform resource locator;

[0022] Encrypting at least one of the domain name part and the privacy part to obtain the second uniform resource locator.

[0023] Optionally, the encrypting at least one of the domain name part and the privacy part to obtain the second uniform resource locator includes:

[0024] Perform hashing on the content of the domain name part to obtain a first hashing result. Take part or all of the first hashing result as the domain name identifier, and use the domain name identifier to replace the domain name part in the first uniform resource address to obtain the second uniform resource address;

[0025] And / or, perform hashing on the content of the privacy part to obtain a second hashing result. Take part or all of the second hashing result as the privacy identifier, and use the privacy identifier to replace the privacy part in the first uniform resource address to obtain the second uniform resource address.

[0026] Optionally, the encrypting at least one of the domain name part and the privacy part to obtain the second uniform resource address further includes:

[0027] Record the correspondence between the content of the domain name part and the domain name identifier, and / or record the correspondence between the content of the privacy part and the domain name identifier.

[0028] Optionally, after encrypting the first uniform resource address of the service resource regarding the geospatial data according to a preset rule to obtain the second uniform resource address, when receiving a request message including the second uniform resource address from a client and the client meets the preset authorization information, before determining the first uniform resource address corresponding to the second uniform resource address, obtaining response data including the service resource corresponding to the second uniform resource address according to the first uniform resource address, and returning the response data to the client, the geospatial information system data management method further includes:

[0029] Determine the first resource that needs to be managed among all the service resources, and the first uniform resource address and the second uniform resource address corresponding to the first resource;

[0030] Determine the ID information of the client or the user corresponding to the client authorized to access the first resource;

[0031] Construct an authorization permission table including the correspondence between the ID information and the first uniform resource address and the second uniform resource address corresponding to the first resource;

[0032] The when receiving a request message including the second uniform resource address from a client and the client meets the preset authorization information, determining the first uniform resource address corresponding to the second uniform resource address, obtaining response data including the service resource corresponding to the second uniform resource address according to the first uniform resource address, and returning the response data to the client includes:

[0033] When receiving first request information from the client, which includes a requested access address and ID information, if the requested access address is the public second uniform resource address, the ID information exists in the authorization permission table, and the ID information in the authorization permission table corresponds to the second uniform resource address, determine the first uniform resource address corresponding to the second uniform resource address, and obtain response data including service resources corresponding to the second uniform resource address according to the first uniform resource address, and return the response data to the client.

[0034] Optionally, the obtaining response data including service resources corresponding to the second uniform resource address according to the first uniform resource address and returning the response data to the client includes:

[0035] Obtain first response data including the service resources corresponding to the second uniform resource address according to the first uniform resource address, and perform response modification on the first response data to obtain second response data;

[0036] Return the second response data to the client.

[0037] To solve the above problems, the present invention also provides a geographic information system data management device, including:

[0038] A data encryption unit, configured to encrypt a first uniform resource address of service resources regarding geospatial data according to a preset rule to obtain a second uniform resource address;

[0039] An authentication and response unit, configured to, when receiving request information including the second uniform resource address from a client and the client meets preset authorization information, determine the first uniform resource address corresponding to the second uniform resource address, and obtain response data including service resources corresponding to the second uniform resource address according to the first uniform resource address, and return the response data to the client.

[0040] To solve the above problems, the present invention also provides an electronic device, including a memory and a processor;

[0041] The memory is used to store a computer program;

[0042] The processor is configured to, when executing the computer program, implement the above-mentioned geographic information system data management method.

[0043] Compared with the prior art, the present invention has the following beneficial effects: The present invention can be used to manage the data of a geographic information system. Specifically, by encrypting the first uniform resource locator of the service resources of the geospatial data using a preset rule, a second uniform resource locator is obtained. On the one hand, the security of the corresponding geographic information system and the corresponding service resources is improved, preventing unauthorized direct access, protecting the privacy and integrity of the service resources, and reducing the risk of resource abuse; on the other hand, the uniform resource locators encrypted according to the unified preset rule are also convenient for the unified management and control of the service resources; on the other hand, after the first uniform resource locator is encrypted according to the preset rule to obtain the second uniform resource locator, all the obtained second uniform resource locators can have a unified structure and form, and this unity helps to use a unified authentication logic for authentication (that is, to verify whether the client or the user corresponding to the client has the right to access the corresponding service resources), without the need to process each different type of service resource separately, thus simplifying the corresponding authentication process and improving the maintainability and user experience of the corresponding geographic information system; on the other hand, it is convenient for the service resource owner to uniformly publish the service to the corresponding client based on the second uniform resource locator with a unified structure and form, without the need for differential configuration, improving the management efficiency of the service resources, etc. When a request message containing the second uniform resource locator is received and the client meets the preset authorization information, the first uniform resource locator corresponding to the second uniform resource locator is determined, and the response data of the corresponding service resource is obtained and returned to the client, so that through address decryption and conversion, the authorized client can indirectly access the actual service resource, realizing the effective management and access of the geographic information system data while ensuring the security and data integrity of the corresponding geographic information system, reducing the management difficulty of the geographic information system data, and improving the management efficiency of the geographic information system data. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 It is a schematic flowchart of the method for managing geographic information system data in an embodiment of the present invention;

[0045] Figure 2 It is a schematic sub - flowchart of step 100 in an embodiment of the present invention;

[0046] Figure 3 It is a schematic sub - flowchart of step 120 in an embodiment of the present invention;

[0047] Figure 4 It is a structural block diagram of the device for managing geographic information system data in an embodiment of the present invention;

[0048] Figure 5 It is a schematic structural diagram of an electronic device in an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0049] To make the above objects, features, and advantages of the present invention more obvious and understandable, the following detailed description will be given of specific embodiments of the present invention with reference to the accompanying drawings.

[0050] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and do not necessarily need to describe a specific order or sequence. It should be understood that such used data can be interchanged under appropriate circumstances so that the embodiments of the present invention described here can be implemented in an order different from those illustrated or described here.

[0051] Combined with Figure 1 As shown, an embodiment of the present invention provides a method for managing geographic information system data, including the following steps:

[0052] Step 100: Encrypt the first uniform resource locator of the service resource regarding the geospatial data according to a preset rule to obtain a second uniform resource locator.

[0053] Specifically, for the geographic information system data provided to users, that is, the service resources regarding the geospatial data (such as map data, image data, geospatial analysis functions, map visualization, etc. services), in order to facilitate users to access online, a uniform resource locator (URL) is used to represent the access address of the service resources regarding the geospatial data, and the uniform resource locator corresponding to each service resource (denoted as the first uniform resource locator) is obtained. In step 100, according to the already determined URL of the service resource regarding the geospatial data, encryption processing is performed according to a preset rule. On the one hand, to hide the original service resource address, prevent unauthorized direct access, improve the security of the corresponding geographic information system using the method of this embodiment, and protect the privacy and integrity of the corresponding service resources, and reduce the risk of abuse of the corresponding service resources; on the other hand, by encrypting the first uniform resource locator according to a preset rule, that is to say, the encryption processing of the first uniform resource locator is carried out according to a unified standard (preset rule), so that a relatively unified form (or format) of the resource locator (denoted as the second uniform resource locator) can be obtained, thereby improving the convenience and efficiency of unified management and control of service resources.

[0054] Step 200: When receiving request information including the second uniform resource locator from the client and the client meets the preset authorization information, determine the first uniform resource locator corresponding to the second uniform resource locator, and obtain the response data including the service resource corresponding to the second uniform resource locator according to the first uniform resource locator, and return the response data to the client.

[0055] In step 200, when request information including a second uniform resource locator (URL) is received from a client that conforms to preset authorization information, it indicates that the corresponding authorized client is making an online access request for the corresponding service resource. At this time, the request can be responded to. Specifically, first, according to the second URL in the request information that the corresponding client needs to access the service resource, the original URL (i.e., the first URL) corresponding to the encrypted second URL is determined. After determining the corresponding first URL, the corresponding service resource can be accessed according to the first URL, and the response data obtained from the access (i.e., the reply data for this access) is returned to the client to implement the user's online access to the corresponding service resource on the client. Among them, the client conforming to the preset authorization information can be that the corresponding information of the application program (or software) corresponding to the client conforms to the preset authorization information, or the ID information (or account information, etc.) of the current user of the client conforms to the preset authorization information.

[0056] In this way, the method of this embodiment is used to implement the management of geographic information system data. Specifically, by encrypting the first URL of the service resource of the geospatial data using a preset rule to obtain a second URL, on the one hand, it improves the security of the corresponding geographic information system and the corresponding service resource using the method of this embodiment, prevents unauthorized direct access, protects the privacy and integrity of the service resource, and reduces the risk of resource abuse; on the other hand, the uniformly encrypted URL according to the preset rule is also convenient for the unified management and control of the service resource; on the other hand, after the first URL is encrypted according to the preset rule to obtain the second URL, all the obtained second URLs can have a unified structure and form, and this unity helps to use a unified authentication logic for authentication (i.e., verify whether the client or the user corresponding to the client has the right to access the corresponding service resource), without the need to process each different type of service resource separately, thus simplifying the corresponding authentication process and improving the maintainability and user experience of the corresponding geographic information system using the method of this embodiment; on the other hand, it is convenient for the service resource owner to uniformly publish the service to the corresponding client based on the second URL with a unified structure and form without the need for differential configuration, improving the management efficiency of the service resource, etc. When request information containing a second URL is received and the client conforms to the preset authorization information, the first URL corresponding to the second URL is determined, and the response data of the corresponding service resource is obtained and returned to the client, so that the authorized client can indirectly access the actual service resource through address decryption and conversion, realizing the effective management and access of the geographic information system data while ensuring the security and data integrity of the corresponding geographic information system, reducing the management difficulty of the geographic information system data, and improving the management efficiency of the geographic information system data.

[0057] Optionally, combine Figure 1 , Figure 2 As shown, step 100 includes:

[0058] Step 110, represent the service resources regarding geospatial data using a Uniform Resource Locator to obtain a first Uniform Resource Address corresponding to each service resource.

[0059] Specifically, represent the service resources of geospatial data using a Uniform Resource Locator, map each service resource to a unique first Uniform Resource Address, making the access to the service resources more intuitive and convenient, thus facilitating the management of these service resources and the access of corresponding clients to these resources (i.e., the client can access the required resources through a simple address); and making the service resources have corresponding readability, such as the corresponding public information of the corresponding service resources can be known according to the first Uniform Resource Address, for example, service type, version number, coordinate system, etc. Moreover, by adopting a consistent and standardized URI form, the client can construct a URI (Uniform Resource Identifier) or URL according to consistent rules when accessing different data.

[0060] Exemplarily, step 110 is resource definition, converting a certain service published by a certain software into a URL that conforms to the corresponding gateway rules. In this way, by redefining all the response resources for providing services according to certain rules, a unified access interface for the client is realized, further improving the convenience and efficiency of unified management and control of service resources. In some embodiments, by adopting a standard URL representation, it is beneficial to interoperate with other systems or platforms, thereby realizing data sharing and exchange.

[0061] Step 120, encrypt the first Uniform Resource Address according to a preset rule to obtain a second Uniform Resource Address corresponding to the first Uniform Resource Address.

[0062] Specifically, encrypt the first Uniform Resource Address according to a preset rule to encrypt all the first Uniform Resource Addresses using a unified standard to obtain the encrypted second Uniform Resource Address corresponding to the first Uniform Resource Address. In this way, while enhancing data security and privacy protection, etc., the convenience and efficiency of unified management and control of service resources and the corresponding second Uniform Resource Addresses are improved. Among them, through encryption processing, the original service resource address is hidden to prevent unauthorized direct access, reduce the risk of resource abuse, protect the privacy and integrity of service resources, and enable better control over the access to service resources, improving the security and controllability of the corresponding data and geographic information system.

[0063] Step 130: Publish the second uniform resource locator through the client.

[0064] Specifically, in step 130, publishing the second uniform resource locator through (or to) the client means making the second uniform resource locator publicly accessible to the client, so that the encrypted resource locator can be accessed by a legally authorized client, and at the same time enabling the user to directly make an access request for the corresponding service resource on the client according to the publicly available second uniform resource locator, improving the convenience of user operations, etc. Exemplarily, the second uniform resource locator and its corresponding service resource type are displayed on the corresponding display interface of the corresponding client. When the user has a corresponding need, the user can request access by selecting the corresponding second uniform resource locator. Moreover, by publishing the second uniform resource locator through the client, it is convenient for the service resource owner to uniformly publish services to the corresponding client based on the second uniform resource locator with a unified structure and form obtained after encryption processing according to a preset rule, without the need for differential configuration, improving the management efficiency of service resources, etc.

[0065] Optionally, after obtaining the second uniform resource locator, step 100 further includes:

[0066] Determine the correspondence between the first uniform resource locator and the second uniform resource locator;

[0067] Specifically, when encrypting the first uniform resource locator according to a preset rule to obtain the second uniform resource locator, the correspondence between the first uniform resource locator and the second uniform resource locator can be obtained simultaneously, so as to subsequently determine the corresponding first uniform resource locator according to the second uniform resource locator (i.e., address decryption and conversion), improving the efficiency of the user's access request through the corresponding client, etc.

[0068] When receiving a request message including the second uniform resource locator from the client and the client meets the preset authorization information, determining the first uniform resource locator corresponding to the second uniform resource locator includes:

[0069] When receiving a request message including the second uniform resource locator from the client and the client meets the preset authorization information, determine the first uniform resource locator corresponding to the second uniform resource locator according to the correspondence between the first uniform resource locator and the second uniform resource locator.

[0070] When receiving request information including a second uniform resource locator from a client and the client meets the preset authorization information, it indicates that the corresponding client has been authorized, and there is an online access request from the corresponding user for the corresponding service resource at this time. At this time, the request can be responded to. Specifically, based on the correspondence between the first uniform resource locator and the second uniform resource locator, determine the original uniform resource locator (i.e., the first uniform resource locator) corresponding to the second uniform resource locator of the service resource required by the corresponding client in the request information in this correspondence. After determining the corresponding first uniform resource locator, the corresponding service resource can be accessed according to the first uniform resource locator, and the response data obtained from the access (i.e., the reply data for responding to this access) is returned to the client to realize the user's online access to the corresponding service resource on the client.

[0071] Optionally, as shown in Figure 2 and Figure 3 , step 120 includes:

[0072] Step 121, determine the domain name part including the port number, the public part including the resource path and query parameters to be made public, and the privacy part including the resource path and query parameters to be hidden in the first uniform resource locator.

[0073] In step 121, considering privacy issues, in some scenarios, it may not be desired that some data information (such as service name, layer name, etc.) included in the first uniform resource locator be made public. These information can be encrypted to achieve public shielding to ensure the privacy of the first uniform resource locator. Specifically, the first uniform resource locator can be divided into three parts, namely the domain name part (including the host address and port number), the public part (including the resource path and query parameters that can be made public), and the privacy part (including the resource path and query parameters to be hidden), so as to clearly divide the resource address before encryption processing, rather than directly encrypting the entire first uniform resource locator, which can reduce the computational amount of subsequent encryption processing and improve the computational efficiency, etc.

[0074] Exemplarily, when using URL as the format for defining service resources, the basic URL format and the names of each part are as follows:

[0075] For the first uniform resource locator

[0076] "http: / / host:port / path1 / path2 / ... / endpoint?q1=a&q2=b", where "http" is called the scheme, which refers to the protocol adopted; "host" is called the domain name or hostname, which can be the IP address of the target machine, etc.; "port" is called the port number; "path1 / path2 / ... / endpoint" is the resource URL path; "q1=a&q2=b" are the query parameters.

[0077] Step 122: Encrypt at least one of the domain name part and the privacy part to obtain a second uniform resource locator.

[0078] Specifically, when there is a need to encrypt at least one of the domain name part and the privacy part in the first uniform resource locator, the corresponding part (i.e., the domain name part and / or the privacy part) is encrypted to obtain a second uniform resource locator. Exemplarily, after encrypting the response content in the first uniform resource locator, the obtained content replaces the original content in the first uniform resource locator to obtain a second uniform resource locator.

[0079] In this way, by encrypting the domain name part, the security of the data is enhanced, privacy protection is carried out, unauthorized visitors or attackers are prevented from obtaining sensitive information, and the security and credibility of network communication are improved. By encrypting the privacy part, the content such as the resource path and query parameters that need to be hidden can be effectively protected, and the security of the data is further enhanced.

[0080] Optionally, encrypting at least one of the domain name part and the privacy part to obtain a second uniform resource locator includes:

[0081] Perform a hash process on the content of the domain name part to obtain a first hash result, take part or all of the first hash result as the domain name identifier, and use the domain name identifier to replace the domain name part in the first uniform resource locator to obtain a second uniform resource locator;

[0082] And / or, perform a hash process on the content of the privacy part to obtain a second hash result, take part or all of the second hash result as the privacy identifier, and use the privacy identifier to replace the privacy part in the first uniform resource locator to obtain a second uniform resource locator.

[0083] Specifically, when it is necessary to perform hash processing on the content of the domain name part, the content of the domain name part in the first uniform resource locator is subjected to hash processing, and the obtained result is recorded as the first hash result. Part or all of the first hash result is taken as the domain name identifier, and the domain name part in the first uniform resource locator is replaced with the domain name identifier to obtain the second uniform resource locator. Exemplarily, the domain name part of the first uniform resource locator is subjected to hash processing to obtain the first hash result. Part or all of the hexadecimal string of the first hash result can be taken as the unique identifier of the domain name, so as to mask the original domain name information through this identifier. By replacing the domain name part in the first uniform resource locator with this identifier, the second uniform resource locator can be obtained. Moreover, by performing hash processing on the content of the domain name part, it is convenient to create a unified form of alternative name for different forms of domain names of different first uniform resource locators. For example, the domain names in the second uniform resource locators corresponding to different first uniform resource locators can have the same length (i.e., the same number of characters), which is convenient for the management of the first uniform resource locator and the second uniform resource locator, etc.

[0084] When it is necessary to perform hash processing on the content of the privacy part, the content of the privacy part in the first uniform resource locator is subjected to hash processing, and the obtained result is recorded as the second hash result. Part or all of the second hash result is taken as the privacy identifier, and the privacy part in the first uniform resource locator is replaced with the privacy identifier to obtain the second uniform resource locator. Exemplarily, the privacy part with privacy requirements is subjected to a hash operation. Part or all of the hexadecimal string of the hash result can be taken as the unique identifier of the privacy part URL, and the original content of the first uniform resource locator is replaced to obtain the second uniform resource locator.

[0085] For ease of understanding, the following uses hash processing as an example to illustrate the encryption processing. For the first uniform resource locator, the content of the domain name part in the first uniform resource locator is subjected to hash processing, and the obtained domain name identifier is recorded as A; the content of the privacy part in the first uniform resource locator is subjected to hash processing, and the obtained domain name identifier is recorded as B. At the same time, the public part URL in the first uniform resource locator is recorded as C. The second uniform resource locator corresponding to the first uniform resource locator can be generated according to the following formula:

[0086] URL = "http: / / " + host + " / " + A + " / " + B + " / " + C,

[0087] Among them, host is the address of the corresponding gateway service, which can be adjusted according to specific deployment scenarios. In the URL path part, the domain name hash is used as the first-level URL path, the privacy part hash is used as the second-level URL path, and the remaining part is supplemented to the third-level and subsequent URL paths. In some embodiments, the privacy part may exist in the corresponding path or query parameters of the first uniform resource address. The position of the URL path where the privacy part is located can be recorded as n to accurately generate the corresponding second uniform resource address.

[0088] In some embodiments, for the convenience of resource indexing, the uniqueness ID (denoted as rid) of the resource can be defined according to the following formula:

[0089] rid = H(A + B),

[0090] where H() is a hashing operation. In this way, the uniqueness of the corresponding service resource can be determined by the combination H(A + B) of the hash values A and B. For example, a certain layer under a certain service address (URL) is a service resource.

[0091] Optionally, encrypting at least one of the domain name part and the privacy part, obtaining the second uniform resource address further includes:

[0092] Recording the correspondence between the content of the domain name part and the domain name identifier, and / or recording the correspondence between the content of the privacy part and the domain name identifier.

[0093] Specifically, since the hashing operation is irreversible, to ensure that the first uniform resource address can be obtained based on the second uniform resource address, when hashing the content of the domain name part of the first uniform resource address, while obtaining the domain name identifier, the correspondence between the content of the domain name part and the domain name identifier needs to be recorded, so as to accurately obtain the first uniform resource address corresponding to the second uniform resource address according to the second uniform resource address and this correspondence in the future, improve the efficiency of address conversion and decryption, and ensure the user experience. Correspondingly, when hashing the content of the privacy part of the first uniform resource address, while obtaining the privacy identifier, the correspondence between the content of the privacy part and the privacy identifier needs to be recorded, so as to accurately obtain the first uniform resource address corresponding to the second uniform resource address according to the second uniform resource address and this correspondence in the future, improve the efficiency of address conversion and decryption, and ensure the user experience.

[0094] Optionally, after step 100 and before step 200, the method further includes:

[0095] Determining the first resources that need to be managed among all service resources, and the first uniform resource address and the second uniform resource address corresponding to the first resources.

[0096] Specifically, based on the differences in authorized permissions, the service resources that different clients or the users corresponding to the clients (i.e., the users who use the clients to make access requests for corresponding service resources) can access also vary, and the geographical information system data (or service resources) provided to the users may also differ. For example, some service resources do not require permissions, while some do. Therefore, all service resources need to be classified for management. Exemplarily, determine the first resources that need to be managed among all service resources, as well as the first unified resource address and the second unified resource address corresponding to the first resources; for other service resources that do not need to be managed, if any, they can be directly made public or processed otherwise.

[0097] Determine the ID information of the client or the user corresponding to the client that is authorized to access the first resource.

[0098] Considering that authorization can be for the client or for the user (it can be confirmed whether the user is authorized through the user account), therefore, based on the relevant authorization information, determine the ID information of the client that has been authorized to access the first resource or the ID information of the user corresponding to the client, so as to determine whether the corresponding client or the user corresponding to the client has obtained authorization to access the first resource through the corresponding ID information. Among them, for the client, the ID information can be information such as an API key, an access token, a device ID, etc. that are used to identify a specific application or system; for the user corresponding to the client, the ID information can be information such as a username, a user ID, an email address, etc. that are used to identify a specific user.

[0099] Construct an authorization permission table that includes the correspondence between the ID information and the first unified resource address and the second unified resource address corresponding to the first resource.

[0100] Based on the ID information of the client or the ID information of the user corresponding to the client, determine the specific content of the first resource that the client or the user corresponding to the client is allowed to access, and construct an authorization permission table that includes the correspondence between the ID information and the first unified resource address and the second unified resource address corresponding to the first resource. This authorization permission table includes the first unified resource address and the second unified resource address corresponding to the specific content of the first resource that the corresponding client or the user corresponding to the client is allowed to access, so as to perform authentication based on this authorization permission table later.

[0101] Step 200 includes:

[0102] When receiving the first request information from the client, which includes the requested access address and ID information, if the requested access address is the public second uniform resource address, the ID information exists in the permission table, and the ID information in the permission table corresponds to the second uniform resource address, determine the first uniform resource address corresponding to the second uniform resource address, and obtain the response data including service resources corresponding to the second uniform resource address according to the first uniform resource address, and return the response data to the client.

[0103] Specifically, in step 200, when receiving the first request information from the client, which includes the requested access address and the corresponding ID information, check whether the requested access address is the public second uniform resource address (if not, it may be an abnormal application that cannot be responded to), whether the corresponding ID information exists in the permission table, and whether the ID information in the permission table has a corresponding second uniform resource address. If all these conditions are met, that is, the requested access address is the public second uniform resource address, the ID information exists in the permission table, and the ID information in the permission table corresponds to the second uniform resource address, it indicates that the current request corresponding client or the user corresponding to the client has the corresponding permission to access the corresponding service resources, and subsequent processing can be carried out. Determine the first uniform resource address corresponding to the second uniform resource address, and obtain the response data of the service resources corresponding to the second uniform resource address, and finally return these response data to the client. In this way, it is ensured that only authorized clients can access the corresponding resources, thereby ensuring the security of data and the corresponding system and the reasonable utilization of resources, etc.

[0104] In this way, based on the authorization permission table including the correspondence between the ID information and the first and second uniform resource addresses corresponding to the first resource as a unified authentication logic for authentication, there is no need to process each different type of service resource separately, thus simplifying the corresponding authentication process and improving the maintainability and user experience of the corresponding geographic information system, etc.

[0105] Exemplarily, for the first resource to be managed, a unified resource table (or authorization permission table) is constructed, with rid as the unique identifier of the resource, storing information such as the original service domain name address, the privacy part path and location, and the public part path. To implement authentication, an associated database table of user-resource permissions needs to be established. Among them, the user table is defined according to the actual scenario requirements, but the uniqueness of the user (client or the user of the client) needs to be ensured. For example, authentication can be performed through unique information such as the user's IP address and account information, and the unique user ID is defined as eid. The many-to-many relationship between resources and users is defined using the authorization permission table, that is, the many-to-many mapping relationship between rid and eid. In some embodiments, each row of the corresponding authorization permission table includes three key attributes, namely rid, eid, and the unique identifier of this authorization content (denoted as pid), indicating that the resource rid allows the user eid to access. The operations of adding, deleting, and modifying permissions are ultimately mapped to the insert, delete, update, and query of this table. The reference formula for calculating the permission identifier pid is as follows:

[0106] pid = H(rid + eid),

[0107] In this way, subsequent authentication can be based on the authorization permission table. For authentication, exemplarily, after receiving the request information from the client, the legitimacy of the client needs to be verified, and only after passing can resource access be carried out. Specifically, after receiving the corresponding request from the client, two key pieces of data need to be parsed first, namely the second uniform resource locator URL and the user identity information in the request information. When the second uniform resource address is the corresponding public second uniform resource address URL, the first-level path of the URL is taken as A', and the second-level path is taken as B'. Substituting into the formula rid = H(A + B) can obtain the resource rid that the client or user expects to access (i.e., rid = H(A' + B')). The user identity is obtained according to the actual deployment scenario requirements. For example, for the scenario of authentication through IP, the user identity is the IP address of the requesting client, and then the eid of the user can be queried through the IP address. After obtaining the resource rid and the person eid that the user expects to access, the permission pid is calculated according to the formula pid = H(rid + eid), and then it is queried whether there is a pid field in the authorization permission table; calculating pid instead of directly querying rid and eid can obtain an effective improvement in query performance when the data scale is huge. If pid exists, it is considered that the resource has been authorized for this person to use, and the next step is carried out; if pid does not exist, an unauthorized error code is returned to the client, indicating that the resource is not authorized and cannot be accessed.

[0108] For obtaining first response data including service resources corresponding to a second uniform resource locator according to a first uniform resource locator. Exemplarily, if the service resources requested by the user are accessible (i.e., meet the corresponding permission requirements), if the resources are accessible, then the second uniform resource locator in the request information is further processed to obtain the first uniform resource locator of the original service for forwarding. Assume that the second uniform resource locator in the received request information is as follows:

[0109] http: / / gateway.com / path1 / path2 / rest?query,

[0110] Considering that the client used by the user to make the request is communicatively connected to the server with the corresponding service resources through a corresponding gateway. First, the gateway host address gateway.com in the second uniform resource locator needs to be removed, and path1 and path2 are extracted and denoted as A' and B' respectively. The original host address in the corresponding first uniform resource locator is queried by A' and replaced at the gateway host address position; the original path, layer name, service type, and path position n, etc. in the corresponding first uniform resource locator are queried by B', and path1 and path2 in the second uniform resource locator URL are replaced with the queried original path, and then the remaining rest?query is directly concatenated at the end. In some embodiments, since the privacy part information such as the layer name is removed during the generation of the resource URL, and depending on the service, the privacy part may exist in the URL path or in the query parameters, special processing needs to be performed according to the specific service. For services where the privacy part exists in the query parameters, the query parameters need to be restored. For example, during the generation of the second uniform resource locator, if the layer name to be hidden is in the query parameter "?layers=layer name", then during the process of determining the first uniform resource locator corresponding to the second uniform resource locator (the decryption and conversion process), "?layers=layer name" needs to be added to the query parameters to fully restore the original request, that is, to restore the original first uniform resource locator corresponding to the second uniform resource locator. After obtaining the first uniform resource locator, the request is forwarded to the server corresponding to the gateway backend based on the first uniform resource locator, and the response data from the server is received.

[0111] Optionally, obtaining response data including service resources corresponding to the second uniform resource locator and returning the response data to the client includes:

[0112] Obtaining first response data including service resources corresponding to the second uniform resource locator according to the first uniform resource locator, and performing response modification on the first response data to obtain second response data;

[0113] Returning the second response data to the client.

[0114] Specifically, after obtaining the first uniform resource locator corresponding to the second uniform resource locator and acquiring the response data (denoted as the first response data) including service resources corresponding to the first uniform resource locator, it is necessary to perform corresponding processing on the first response data and then return it to the client. Among them, the corresponding processing performed on the first response data includes response modification, which is used to remove sensitive information from the first response data, further transform the first response data, etc., so as to obtain the second response data that meets the requirements, and then return the second response data to the client.

[0115] Optionally, the client used by the user to make requests is communicatively connected to the server with corresponding service resources through a corresponding gateway. By adopting the corresponding gateway, it serves as a unified access point for a large number of service resources deployed in dispersed locations, and can implement unified authentication and authorization of access requests and dynamic configuration of permissions based on the gateway. Moreover, by using the gateway to implement unified authentication and authorization of access requests and dynamic configuration of permissions, no adaptive modification needs to be made to the client. It is only necessary to access the corresponding resources according to the URL address provided by the gateway, which reduces the corresponding requirements for the client and the difficulty of client development and maintenance. At the same time, the gateway can centrally manage and monitor all access requests, providing functions such as traffic limiting and load balancing, such as horizontally expanding or limiting the traffic of the gateway according to traffic changes, so as to meet the forwarding functions of different request quantity scales and ensure the stability and reliability of the service. In addition, the gateway can also record and analyze access logs to help the service resource owner understand the usage of resources and user behavior, so as to further optimize service quality and resource configuration.

[0116] Exemplarily, the server generates corresponding response data according to the forwarded first uniform resource locator and forwards it to the client through the gateway. During this period, according to the type of response, the gateway also needs to perform certain response modification. This is because in the Open Geospatial Consortium (OGC) specification, there is a type of GetCapabilities request, which is mainly used to return service-level metadata, such as the name of the current layer, coordinate range, tile information, etc., and the URL template of subsequent data requests. The client will form the URL of subsequent requests according to the received metadata to obtain actual data. These URLs also need to go through the unified authentication and authorization and forwarding of the gateway. Therefore, for the URL information included in the response data of the GetCapabilities type request, the gateway needs to perform response modification before returning it to the client to maintain the correctness of consecutive requests.

[0117] In some embodiments, if the response format is a text format such as XML or JSON, indicating that the response is a response to a GetCapabilities request, the gateway needs to traverse the response structure, process the URLs containing the URL fields in the response according to the corresponding process of the method in this embodiment, and replace the original field values with the generated new URLs.

[0118] For ease of understanding, the following is an exemplary description of the geographic information system data management method. Assume that a target service resource corresponds to a first uniform resource address:

[0119] http: / / arcgis.example.cn:9000 / example / rest / services / ServiceName / LayerName / MapServer / WMTS / 1.0.0 / WMTSCapabilities.xml,

[0120] Perform encryption processing on this first uniform resource address. For example, the target resource domain name is arcgis.example.cn:9000, and the SHA256 hash algorithm is used to obtain the domain name hash (for the convenience of description, only the first 8 bits of the hash value are taken): SHA256("arcgis.example.cn:9000") = 7dc3bb56; the service name and layer name need to be hidden from the target resource, and the private part is "ServiceName / LayerName", and its hash is: SHA256("ServiceName / LayerName") = 2f176977, and its path position is n = 3 (starting from 0). The final generated resource corresponds to the second uniform resource address URL:

[0121] http: / / gateway.cn / 7dc3bb56 / 2f176977 / example / rest / services / MapServer / WMTS / 1.0.0 / WMTSCapabilities.xml,

[0122] In this way, the resource unique ID (rid) can be obtained as: SHA256("7dc3bb56" + "2f176977") = 0c0c2c57, and the generated URL is made public to the client for user requests.

[0123] The corresponding authorization permission table is composed of the generated second uniform resource address and indexed by rid. Define the user table. Assuming that users are distinguished by client IP addresses, the user table is composed of user information and indexed by eid. Take user IP 192.168.1.2 as an example, its eid is 26702f5a. Assuming that resource 0c0c2c57 is authorized to use the user with IP 192.168.1.2, a record is inserted into the authorization permission table as follows:

[0124] Resource rid Personnel eid Permission pid 0c0c2c57 26702f5a a83ec6f0

[0125] Assume that user 192.168.1.2 initiates a resource access request GET as follows:

[0126] http: / / gateway.cn / 7dc3bb56 / 2f176977 / example / rest / services / MapServer / WM TS / 1.0.0 / WMTSCapabilities.xml, the gateway processing steps are as follows: extract the first two paths 7dc3bb56 and 2f176977 from the request URL, and calculate rid as 0c0c2c57. At the same time, extract the client IP address 192.168.1.2, and calculate eid as 26702f5a. Calculate pid from rid and eid as a83ec6f0, query the permission table, and find record a83ec6f0, then the authentication is passed.

[0127] The original host address arcgis.example.cn:9000 is obtained by querying 7dc3bb56, and the privacy part path ServiceName / LayerName and the position n=3 corresponding to the path are obtained by querying 2f176977. The gateway address is replaced by the original host address, and the privacy part path is added to the corresponding position according to the value of position n to restore the request URL of the original resource (i.e., the first uniform resource address):

[0128] http: / / arcgis.example.cn:9000 / example / rest / services / ServiceName / LayerNam e / MapServer / WMTS / 1.0.0 / WMTSCapabilities.xml,

[0129] The gateway forwards the request to the actual service host (server) according to the restored request URL and receives the host's response. If the request is a GetCapabilities request, the response URL needs to be replaced. The response format is XML text, and some fields need to be replaced by URLs. For example,

[0130] <ows:Get xlink:href="http: / / arcgis.example.cn:9000 / example / rest / services / ServiceName / LayerName / MapServer / WMTS / 1.0.0 / WMTSCapabilities.xml">

[0131] Replace with

[0132] <ows:Get xlink:href="http: / / gateway.cn / 7dc3bb56 / 2f176977 / example / rest / services / MapServer / WMTS / 1.0.0 / WMTSCapabilities.xml">, and

[0133] <ResourceURL format="image / png" resourceType="tile" template="http: / / arcgis.example.cn:9000 / example / rest / services / ServiceName / LayerName / MapServer / WMTS / tile / 1.0.0 / LayerName / {Style} / {TileMatrixSet} / {TileMatrix} / {TileRow} / {TileCol}.png" / >

[0134] Replace with

[0135] <ResourceURL format="image / png" resourceType="tile" template="http: / / gateway.cn / 7dc3bb56 / 2f176977 / example / rest / services / MapServer / WMTS / tile / 1.0.0 / LayerName / {Style} / {TileMatrixSet} / {TileMatrix} / {TileRow} / {TileCol}.png" / >.

[0136] After the modified response is returned to the client, the client can construct a new request URL through the template URL (which is a form of URL where some content is replaced by placeholders that will be replaced by specific parameter values during an actual request) provided in the ResourceURL (which is a URL used to locate and access a specific / specified resource), and send it to the gateway again. The gateway can complete the functions of authentication and request forwarding by repeating the above corresponding steps. In this way, the corresponding management of geographic information system data is realized.

[0137] Combined with Figure 4 As shown, another embodiment of the present invention provides a geographic information system data management device, including:

[0138] A data encryption unit, configured to encrypt the first uniform resource address of the service resource regarding the geospatial data according to a preset rule to obtain a second uniform resource address;

[0139] An authentication and response unit, configured to, when receiving request information including the second uniform resource address from the client and the client meets the preset authorization information, determine the first uniform resource address corresponding to the second uniform resource address, and obtain response data including the service resource corresponding to the second uniform resource address according to the first uniform resource address, and return the response data to the client.

[0140] The geographic information system data management device of this embodiment is used to implement the above-mentioned geographic information system data management method, and its advantages compared with the prior art are the same as those of the above-mentioned geographic information system data management method compared with the prior art, and will not be elaborated here.

[0141] Combined with Figure 5 As shown, another embodiment of the present invention provides an electronic device, including a memory 501 and a processor 502;

[0142] The memory 501 is used to store a computer program;

[0143] The processor 502 is configured to, when executing the computer program, implement the above-mentioned geographic information system data management method.

[0144] Or, an electronic device, including a memory 501 and a processor 502 coupled to the memory; the memory 501 is configured to store a computer program; the processor 502 is configured to, when executing the computer program, perform the following operations:

[0145] Encrypt the first uniform resource address of the service resource regarding the geospatial data according to a preset rule to obtain a second uniform resource address;

[0146] When receiving request information including a second uniform resource locator from a client and the client conforms to preset authorization information, determine a first uniform resource locator corresponding to the second uniform resource locator, obtain response data including service resources corresponding to the second uniform resource locator according to the first uniform resource locator, and return the response data to the client.

[0147] The electronic device in this embodiment can be used to implement the above-mentioned geographic information system data management method. Its advantages compared with the prior art are the same as those of the above-mentioned geographic information system data management method compared with the prior art, and will not be elaborated here.

[0148] Another embodiment of the present invention provides a computer-readable storage medium. The computer-readable storage medium stores a computer program. When the computer program is read and run by a processor, the above-mentioned geographic information system data management method is implemented.

[0149] Or, a non-volatile computer-readable storage medium stores a computer program. When the computer program is executed by a processor, the processor is caused to perform the following operations:

[0150] Encrypt a first uniform resource locator of service resources regarding geospatial data according to a preset rule to obtain a second uniform resource locator;

[0151] When receiving request information including a second uniform resource locator from a client and the client conforms to preset authorization information, determine a first uniform resource locator corresponding to the second uniform resource locator, obtain response data including service resources corresponding to the second uniform resource locator according to the first uniform resource locator, and return the response data to the client.

[0152] Essentially, or the part that contributes to the prior art, or all or part of the technical solution of the embodiments of the present invention can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor to execute all or part of the steps of the method of the embodiments of the present invention. The aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, ROM, RAM, magnetic disks, or optical discs that can store program codes.

[0153] The computer-readable storage medium in this embodiment can be used to implement the above-mentioned geographic information system data management method. Its advantages compared with the prior art are the same as those of the above-mentioned geographic information system data management method compared with the prior art, and will not be elaborated here.

[0154] Although the present invention is disclosed as above, the scope of protection of the present invention is not limited thereto. Those skilled in the art can make various changes and modifications without departing from the spirit and scope of the present invention, and these changes and modifications will all fall within the scope of protection of the present invention.

Claims

1. A geographic information system data management method, characterized in that: include: Encrypting a first uniform resource address of a service resource related to geographic spatial data according to a preset rule to obtain a second uniform resource address; When a request message including the second uniform resource address is received from a client and the client meets the preset authorization information, the first uniform resource address corresponding to the second uniform resource address is determined, and response data including service resources corresponding to the second uniform resource address is obtained based on the first uniform resource address, and the response data is returned to the client.

2. The geographic information system data management method according to claim 1, characterized in that: The step of encrypting the first uniform resource address of the service resource related to the geographic spatial data according to a preset rule to obtain the second uniform resource address comprises: Using a uniform resource locator to represent the service resources related to the geographic spatial data, and obtaining the first uniform resource address corresponding to each of the service resources; Encrypting the first uniform resource address according to the preset rule to obtain the second uniform resource address corresponding to the first uniform resource address; The second uniform resource address is made public through the client.

3. The geographic information system data management method according to claim 2, characterized in that: After obtaining the second uniform resource address corresponding to the first uniform resource address, encrypting the first uniform resource address of the service resource related to the geographic spatial data according to a preset rule to obtain the second uniform resource address further includes: Determine a correspondence between the first uniform resource address and the second uniform resource address; When receiving the request information including the second uniform resource address from the client and the client meets the preset authorization information, determining the first uniform resource address corresponding to the second uniform resource address includes: When the request information including the second uniform resource address is received from the client and the client meets the preset authorization information, the first uniform resource address corresponding to the second uniform resource address is determined according to the correspondence between the first uniform resource address and the second uniform resource address.

4. The method for managing geographic information system data according to claim 2, wherein: The encrypting the first uniform resource address according to the preset rule to obtain the second uniform resource address corresponding to the first uniform resource address includes: Determine the domain name part including the port number, the public part including the resource path and query parameters to be disclosed, and the private part including the resource path and query parameters to be hidden in the first uniform resource address; Encrypt at least one of the domain name part and the privacy part to obtain the second uniform resource address.

5. The method for managing geographic information system data according to claim 4, characterized in that: The encrypting at least one of the domain name part and the privacy part to obtain the second uniform resource address comprises: Performing hash processing on the content of the domain name part to obtain a first hash result, taking part or all of the first hash result as a domain name identifier, and using the domain name identifier to replace the domain name part in the first uniform resource address to obtain the second uniform resource address; And / or, hash the content of the private part to obtain a second hash result, take part or all of the second hash result as a privacy identifier, use the privacy identifier to replace the private part in the first uniform resource address, and obtain the second uniform resource address.

6. The method for managing geographic information system data according to claim 5, characterized in that: The step of encrypting at least one of the domain name part and the privacy part to obtain the second uniform resource address further comprises: The corresponding relationship between the content of the domain name part and the domain name identifier is recorded, and / or the corresponding relationship between the content of the privacy part and the domain name identifier is recorded.

7. The method for managing geographic information system data according to any one of claims 2 to 6, characterized in that: After encrypting the first uniform resource address of the service resource related to the geographic spatial data according to the preset rule to obtain the second uniform resource address, when receiving the request information including the second uniform resource address from the client and the client meets the preset authorization information, determining the first uniform resource address corresponding to the second uniform resource address, and obtaining the response data including the service resource corresponding to the second uniform resource address according to the first uniform resource address, before returning the response data to the client, the geographic information system data management method further includes: Determine a first resource that needs to be managed among all the service resources and the first unified resource address and the second unified resource address corresponding to the first resource; Determine the ID information of the client or the user corresponding to the client authorized to access the first resource; Constructing an authorization permission table including a correspondence between the ID information and the first uniform resource address corresponding to the first resource and the second uniform resource address; The step of, when receiving the request information including the second uniform resource address from the client and the client meets the preset authorization information, determining the first uniform resource address corresponding to the second uniform resource address, obtaining response data including service resources corresponding to the second uniform resource address according to the first uniform resource address, and returning the response data to the client comprises: When a first request information including a requested access address and ID information is received from the client, if the requested access address is the publicly disclosed second uniform resource address, the ID information exists in the authorization permission table, and the ID information in the authorization permission table corresponds to the second uniform resource address, determine the first uniform resource address corresponding to the second uniform resource address, and obtain response data including service resources corresponding to the second uniform resource address based on the first uniform resource address, and return the response data to the client.

8. The method for managing geographic information system data according to any one of claims 1 to 6, characterized in that: The acquiring, according to the first unified resource address, response data including service resources corresponding to the second unified resource address, and returning the response data to the client comprises: According to the first unified resource address, obtaining first response data including the service resource corresponding to the second unified resource address, and performing response modification on the first response data to obtain second response data; The second response data is returned to the client.

9. A geographic information system data management device, characterized in that: include: A data encryption unit, used for encrypting a first uniform resource address of a service resource related to geographic spatial data according to a preset rule to obtain a second uniform resource address; An authentication and response unit is used to determine the first unified resource address corresponding to the second unified resource address when receiving a request message including the second unified resource address from a client and the client meets the preset authorization information, and obtain response data including service resources corresponding to the second unified resource address based on the first unified resource address, and return the response data to the client.

10. An electronic device, characterized in that: including memory and processor; The memory is used to store computer programs; The processor is used to implement the geographic information system data management method according to any one of claims 1 to 8 when executing the computer program.

Images