Method for encrypted transmission of geographic data, recording medium and system

Abstract

The present application belongs to the technical field of geographic information science, and particularly relates to a geographic data encryption transmission method, which uses asymmetric encryption transmission for permission authentication data only and uses symmetric encryption transmission for geographic data to be sent, successfully wrapping the geographic data with a safe digital envelope, so that the quick demand of geographic data sharing service can be met, and the security thereof can be ensured, and the method is suitable for application in the scene of interactive geographic data sharing service. The present application also provides a non-transient readable recording medium storing a program of the method and a system containing the medium, and the program can be called by a processing circuit to execute the above method.

Description

Technical Field

[0001] This invention belongs to the field of geographic information science and technology, and discloses a method, recording medium and system for encrypted transmission of geographic data. Background Technology

[0002] Data services have become an important technological tool in geographic information science (GIS). By providing functions such as geographic data acquisition, processing, storage, and distribution, they offer strong support for GIS research and applications. The core idea of ​​data services is to view geographic data as an open and shareable service resource. The data service platform serves as the data infrastructure supporting the entire process of data aggregation, processing, circulation, application, operation, and security. Generally, the platform stipulates that geographic data conforming to the unified OGC (Open Geospatial Information Consortium) standard can be accessed and used by users via the internet or other communication networks. Different users can also upload and share data to the data service platform for others to use.

[0003] However, with the increasing development of network informatization, the contradiction between "sharing" and "security" in the use of data services in geographic information science projects has gradually become prominent, and some shortcomings in security have been exposed. Existing data services have very simplistic access control mechanisms. The management and control of data layers is often limited to using tokens to restrict the scope of access permissions; that is, a specific data layer corresponds to a specific token, and a specific token has a certain level of access. In the complex network environment, this method of managing data layers may lead to data leakage, data tampering, and theft (e.g., ...). Figure 4(As shown). In addition, due to their inherent sharing requirements, data services often spread data in a broadcast manner. For both the server and user sides of the data service platform, geographic data is bidirectionally open; that is, the server and user sides can transmit and share geographic data with each other. Both are both data providers and users. Geographic Information Systems (GIS) are typically systems that allow free data transfer; different users can freely share and access relevant geographic data. The data service platform does not know which specific user downloaded or uploaded a particular data layer. If it were to add an encryption layer to each access request, obtain the user's identity through login, and encrypt every subsequent transmission of geographic data to improve data security, this would contradict the framework standards of the Open Geospatial Information Consortium (OGC). In the OGC standard, each individual geographic data file has free transfer atomicity and its own unique availability. Furthermore, if data encryption slows down transmission speed, causing geographic data tile loading lag, it also does not meet the availability requirements of data sharing services. Since geographic data may involve national security and trade secrets, how to meet the demand for fast geographic data sharing services while ensuring its security is an urgent problem to be solved. Summary of the Invention

[0004] To address the above problems, this invention provides a method for encrypted transmission of geographic data, the specific scheme of which includes the following steps:

[0005] The sender uses a symmetric key to encrypt and send geographic data, and simultaneously uses an asymmetric key to encrypt and send authorization verification data. The authorization verification data includes the sender's identity information and symmetric key information. The sender and receiver authenticate each other, and the receiver uses the symmetric key to decrypt the geographic data, thus completing the geographic data transmission.

[0006] Preferably, the authentication includes the following steps: both the sender and receiver of geographic data use asymmetric encryption / decryption methods to authenticate their identities with a third-party authentication authority and submit their respective public keys, while retaining their respective private keys; when establishing a connection, one party encrypts its own identity information into a digital signature using its own private key, and sends it together with the symmetric key information encrypted with its own private key and its own identity information encrypted with the other party's public key; the other party decrypts the received digital signature using the other party's public key authenticated by the third-party authentication authority. If the digital signature matches the identity information decrypted with its own private key, the other party's identity is verified as legitimate, and the symmetric key information is decrypted using the other party's public key to complete the authentication.

[0007] Preferably, the identity information is the complete identity information or the digest information generated by a secure hash algorithm.

[0008] Another aspect of the present invention is to provide a non-transient readable recording medium for storing one or more programs containing multiple instructions, which, when executed, cause the processing circuitry to perform the aforementioned method for encrypted transmission of geographic data.

[0009] Another aspect of the present invention provides a geographic data encryption system, including a processing circuit and a memory electrically coupled thereto, the memory being configured to store at least one program, the program containing multiple instructions, the processing circuit running the program, and capable of executing the aforementioned geographic data encryption transmission method.

[0010] Compared with the prior art, the present invention has the following beneficial effects:

[0011] The method described in this patent allows geographic data to maintain the framework standards of the Open Geospatial Information Consortium (OGC). While enabling efficient dissemination and sharing, the security of the data during transmission is also effectively guaranteed. Both the server and user ends on the geographic data service platform can verify each other's identities, preventing the malicious uploading of illegal data or malware due to identity forgery. The platform can also effectively monitor users' data download records and assign appropriate permissions to different users and data layers. For example, a user can be restricted to accessing only certain data within certain layers, or read / write permissions for a specific geographic data layer can be modified and controlled. The identities of both the user and server ends cannot be tampered with, preventing data leakage to unauthorized third parties. This also ensures that data is not stolen by third parties during network transmission.

[0012] By comparing a model scene from a large-scale water conservancy digital twin project, adjusting the camera view to the same location, and scrolling and zooming the screen to the same level in the model scene, the loading time of the tiles displayed on the screen was compared. It was found that, under local operating conditions, after eliminating network latency factors, the loading time of the tiles obtained using the data service of this patent is only tens of milliseconds, compared with the loading time of most tile data obtained using the currently popular hash data services. This indicates that when users download large amounts of geographic data from the server, the time consumed by the method of this invention is on the same order of magnitude as the time consumed by querying using existing mainstream data services. The method of this invention ensures data security and the legitimacy of the identities of all parties, while also guaranteeing the efficiency and speed of data transmission. Attached Figure Description

[0013] Figure 1 This is a schematic diagram of a geographic data encryption transmission network in an embodiment of the present invention;

[0014] Figure 2 This is a schematic diagram of the encrypted transmission process of geographic data in an embodiment of the present invention;

[0015] Figure 3 This is a schematic diagram of the geographical data packet structure for a single transmission in an embodiment of the present invention;

[0016] Figure 4 This diagram illustrates potential leaks, forgeries, and tampering incidents that may occur during the transmission of existing geographic data.

[0017] Figure 5 This is a schematic diagram illustrating the structure of existing geographic tile data when stored and published in a computer system. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be described below with reference to the accompanying drawings. The described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without innovative effort are within the scope of protection of the present invention.

[0019] like Figures 1-3 As shown, an embodiment of the encrypted transmission method for geographic data provided by the present invention is as follows:

[0020] Geographic data often needs to be divided into levels based on different levels of precision, and into modules based on different latitude and longitude coordinates in geospatial coordinates (e.g., ...). Figure 5 (As shown). Therefore, when storing and publishing geographic data, it is also necessary to hierarchically classify the data according to its accuracy or its latitude and longitude coordinates in geographic space. For terrain and imagery data, the storage structure usually contains multiple layers of folders in the computer, each layer representing the terrain or imagery of the same area, but the files in different layers correspond to different levels of accuracy. Each level of folder represents the coordinate position on different axes in a geographic information coordinate system, and the last level stores the terrain and imagery data files. For model data, its storage structure often also contains multiple layers of folders, each folder containing all the sub-components of a model component. The last level stores the individual model files. This hierarchical and graded structure of geographic information system data can improve the efficiency of users using the data, because it makes a large amount of data appear as a tree structure, distributed from whole to part, which is very intuitive. Users can also perform business operations such as adding, deleting, modifying, and querying data quickly.

[0021] If data remains static, its use cases are secure. For example, a user using a standalone, offline geographic information application on their local machine will not pose a data security risk. The data security issues mentioned above arise because real-world geographic information projects often rely on networks to remotely transmit large amounts of data. Furthermore, ensuring that geographic information conforms to the Open Geospatial Information Consortium (OGC) framework standards and that applications function smoothly requires efficient data transmission, which presents additional challenges. Figure 4 As shown, during the transmission of geographic data, it is possible for third parties to intercept it, and the identities of the server and the user may also be impersonated by third parties, resulting in the transmission of forged and erroneous data.

[0022] To address these shortcomings, it is essential to ensure both the security of the transmitted geographic data itself and the legitimacy of the other party's identity when establishing a connection. In other words, the ultimate goal of ensuring security throughout the entire transmission lifecycle of a geographic information system (GIS) is to achieve secure transmission of both geographic data and authentication data (with complete and legitimate identity information for all parties involved in the authentication data).

[0023] This invention addresses these two objectives by employing different encryption methods (asymmetric and symmetric encryption) for geographic data and authorization verification data, as well as authentication methods for the entities involved. The specific process can be broadly summarized as follows: First, asymmetric encryption is used to authenticate the authorization verification data of both parties. Once both parties have confirmed each other's identities, the geographic data is decrypted. The authorization verification data contains not only the entity's identity information but also the symmetric key information used to decrypt the geographic data. After establishing a connection and packaging and transmitting the geographic data and authorization verification data, and completing the two-way authentication process, each party uses the symmetric key contained in the authorization verification data to decrypt the encrypted geographic data, ultimately obtaining the plaintext geographic data.

[0024] The reason for using different encryption technologies for authorization verification data and geographic data is that different encryption technologies have different characteristics. Files encrypted with asymmetric encryption are larger in size than those encrypted with symmetric encryption, thus consuming more bandwidth resources for transmission. As the number and size of geographic tile files increase, the time consumption of both symmetric and asymmetric encryption increases, but the increase in time consumption is more significant due to the higher algorithm complexity of asymmetric encryption, meaning that asymmetric encryption is slower than symmetric encryption. However, asymmetric encryption technology offers high security, while symmetric encryption technology offers relatively lower security. Therefore, the overall encryption and decryption strategy in this invention is to use asymmetric encryption to encrypt authorization verification data (which contains the symmetric encryption key) and symmetric encryption to encrypt geographic data. This ensures both the security of the data throughout its entire lifecycle and the efficiency of data transmission.

[0025] The details of this embodiment are as follows: First, before establishing an initial connection, both the user and the server need to authenticate their identities with a trusted third-party authentication authority. Both the user and the server generate their own public-private key pairs using an asymmetric encryption algorithm. They then authenticate with the authentication authority separately and submit their generated public keys to it. When a new user and server establish an initial connection, one end digitally signs a digest of its identity information using its private key and sends it. The other end decrypts the received digital signature using the public key of the other party, which has been authenticated by the third-party authentication authority. If the decrypted digest matches the digest obtained by decrypting the other party's identity information using the user's private key, it ensures that the symmetric key and geographic data sent by the other party are not forged, thus completing two-way authentication between the user and the server. The digest of the identity information is generated using the secure hash algorithm SHA-256. Sending the digest is more time-efficient and consumes less bandwidth than sending the entire identity information. At this point, both the user and the server have the same symmetric key. When transmitting geographic data, they first encrypt the geographic data using the symmetric key before transmitting the encrypted geographic data. Once each party receives the data from the other, they first decrypt the data using a symmetric key before proceeding with subsequent operations.

[0026] The table below compares the time results of obtaining model data services using the method of this invention and the unencrypted plaintext transmission method for a certain area in the same 3D scene:

[0027]

[0028]

[0029] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computers or available storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0030] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0031] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0032] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0033] The above methods and steps are compiled into a program and stored on a hard disk or other non-transitory storage medium, which constitutes the technical solution of "a non-transitory readable recording medium" of the present invention; and the storage medium is electrically connected to a computer processor, and the encrypted transmission of geographic data can be completed through data processing, which constitutes the technical solution of "a geographic data encrypted transmission system" of the present invention.

[0034] Finally, it should be noted that the above descriptions are merely preferred embodiments of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for encrypted transmission of geographic data, characterized in that... Includes the following steps: The sender uses a symmetric key to encrypt and send geographic data, and simultaneously uses an asymmetric key to encrypt and send authorization verification data. The authorization verification data includes the sender's identity information and symmetric key information. The sender and receiver authenticate each other, and the receiver uses the symmetric key to decrypt the geographic data, thus completing the geographic data transmission. Both the sender and receiver of geographic data use asymmetric encryption / decryption methods to authenticate their identities with a third-party certification authority and submit their respective public keys, while retaining their respective private keys. When establishing a connection, one party encrypts its own identity information into a digital signature using its private key, and sends it along with the symmetric key information encrypted with its own private key and its own identity information encrypted with the other party's public key. The other party decrypts the received digital signature using the other party's public key, which has been certified by the third-party certification authority. If the digital signature matches the identity information decrypted with its own private key, the other party's identity is verified as legitimate. Simultaneously, the other party decrypts the symmetric key information using the other party's public key to complete the authentication.

2. The method for encrypted transmission of geographic data according to claim 1, characterized in that, The identity information is either the complete identity information or a digest information generated by a secure hash algorithm.

3. A non-transitory readable recording medium for storing one or more programs containing multiple instructions, characterized in that, When the instruction is executed, the processing circuit will perform the encrypted transmission method for geographic data according to any one of claims 1-2.

4. A geographic data encrypted transmission system, comprising a processing circuit and a memory electrically coupled thereto, characterized in that, The memory is configured to store at least one program, the program containing multiple instructions, and the processing circuit runs the program to execute a method for encrypted transmission of geographic data according to any one of claims 1-2.

Images