A GIS-based comprehensive situation awareness and protection system and its construction method

Abstract

The present invention discloses a GIS-based comprehensive situational awareness protection system and a construction method thereof, and relates to the technical field of network security protection. The system includes a security verification unit and a situational awareness unit; the security verification unit is used to set different security verification strategies according to different access types; the situational awareness unit is used to ensure system security based on the result of security verification, and realize the protection of system data and the smooth progress of business processes; wherein the security verification unit includes a blacklist verification module, a verification code verification module, an RBAC verification module, a Token verification module, a compliance verification module, an authorization verification module and an identity verification module; the situational awareness unit includes an abnormality perception module, a statistical analysis module and a blacklist generation module. The present invention effectively avoids the security risks that may be caused by the traditional trust model based on network boundaries, and blocks the possibility of unauthorized access to geographic information spatial data.

Description

Technical Field

[0001] The present invention relates to the field of network security protection technology, and in particular to a GIS-based comprehensive situation awareness protection system and a construction method thereof. Background Art

[0002] With the advent of the big data era, geographic information system (GIS) data plays a vital role in various fields. As a new type of production factor, GIS spatial data is generating synergies with the digital economy and is widely used in industries such as precision agriculture, energy and electricity, and intelligent connected vehicles, as well as in daily life, such as express delivery, online shopping, food delivery, and housekeeping services. GIS data is highly accurate, easy to collect, and easy to transmit, providing powerful spatial analysis and decision-making support capabilities for all walks of life; however, these characteristics also make the protection of GIS data particularly important. If GIS data is improperly obtained or used without proper authorization, it may lead to the leakage of sensitive information such as key infrastructure and important resource distribution, thereby posing potential risks to economic development and public safety.

[0003] At present, most GIS tool research in the field of security focuses on single dimensions such as boundary security and fine-grained authority management. These traditional security protection measures usually adopt a trust model based on network boundaries to protect GIS systems and their data by setting up firewalls and configuring access control lists. At the same time, some studies have also begun to explore the application of role-based access control (RBAC) and token verification technologies to the security protection of GIS systems to improve the security and reliability of the system. These methods have improved the security protection capabilities of GIS systems to a certain extent and provided basic support for the security management of geographic spatial information.

[0004] However, with the explosive growth of data volume, the diversification of data types, and the increasing demand for data sharing, the traditional single-dimensional security protection method can no longer fully cope with the all-round challenges of GIS security protection in the big data era. The trust model based on network boundaries has potential security risks and cannot effectively prevent internal threats and complex external attacks; a single security technology cannot meet the diverse security needs of GIS systems in different scenarios, nor can it cope with increasingly complex network attack methods; in addition, existing security measures often lack comprehensive situational awareness capabilities, making it difficult to detect and respond to potential security threats in a timely manner; therefore, the security of GIS urgently needs to be expanded to a deeper level and a wider range of fields to build an all-round, multi-level comprehensive security protection system.

[0005] Currently, no effective solution has been proposed for the problems in the related technologies. Summary of the invention

[0006] In response to the problems in the related technology, the present invention proposes a comprehensive situational awareness and protection system based on GIS and a construction method thereof, which has the advantages of ensuring that system resources can be accessed and used legally and in compliance with regulations, eliminating potential security threats brought about by abnormal IP access and illegal operations, and blocking the possibility of unauthorized access to geographic information spatial data, thereby solving the problem that the single-dimensional security defense in the existing technology is one-sided and the traditional trust model based on network boundaries may cause security risks.

[0007] To this end, the specific technical solution adopted by the present invention is as follows:

[0008] According to one aspect of the present invention, a GIS-based integrated situational awareness and protection system is provided, the GIS-based integrated situational awareness and protection system comprising a security verification unit and a situational awareness unit;

[0009] The security verification unit is used to set different security verification strategies according to different access types;

[0010] The situation awareness unit is used to ensure system security based on the results of security verification, and to protect system data and ensure smooth business processes;

[0011] Among them, the security verification unit includes a blacklist verification module, a verification code verification module, a RBAC verification module, a token verification module, a compliance verification module, an authorization verification module, and an identity verification module;

[0012] The situation awareness unit includes an abnormality perception module, a statistical analysis module, and a blacklist generation module.

[0013] Furthermore, according to different access types, different security verification strategies are set, including:

[0014] According to the interface type, access requests are divided into identity authentication requests, resource service management requests and other general access requests;

[0015] Develop corresponding security verification strategies based on different access requests;

[0016] Among them, identity authentication requests include user registration requests and user login requests;

[0017] Resource service management requests include GIS service application requests, GIS service authorization requests, and GIS service use requests;

[0018] Other general access requests include all service access requests except non-specific requests;

[0019] The corresponding security verification strategies include user registration request verification strategy, user login request verification strategy, GIS service application request verification strategy, GIS service authorization request verification strategy, GIS service usage request verification strategy, and other general access request verification strategies.

[0020] Furthermore, the request body of the user registration request includes a user name, login name, password, verification code and timestamp;

[0021] User registration request verification strategies include:

[0022] Verify whether the requesting IP is in the blacklist. If so, return a request failure. Otherwise, proceed to the next step.

[0023] Verify the verification code. If the verification is successful, proceed to the next step. If the verification fails, the verification code error is returned.

[0024] Check whether the registration information exists and complies with the regulations. If the check passes, perform data persistence and return a successful operation prompt. Otherwise, prompt the user that the registration failed.

[0025] Based on the situation awareness unit, the statistical analysis module is used to record abnormal information, and the access without abnormality is entered into the operation log; the blacklist generation module is maintained according to the situation awareness anomaly table and the restriction method table, and the corresponding access restriction measures are implemented.

[0026] Furthermore, the request body of the user login request includes a login name, a password, a verification code, subsystem summary information, and a timestamp;

[0027] User login request verification strategies include:

[0028] Verify whether the requesting IP is in the blacklist. If so, return a request failure. Otherwise, proceed to the next step.

[0029] Verify the verification code. If the verification is successful, proceed to the next step. If the verification fails, the verification code error is returned.

[0030] Based on the database information, compare the password digest and user name passed in the login request. If they meet the verification requirements, proceed to the next step. Otherwise, it prompts that the user name and password are incorrect.

[0031] Verify RBAC permissions, including obtaining the subsystem code summary of the login request and comparing it with the database; if the permission verification is successful, a login Token is generated and returned to the front end, and the front end saves the login Token information; if the permission verification fails, a login failure is returned and a prompt indicating that no access rights are granted;

[0032] Based on the situation awareness unit, the statistical analysis module is used to record abnormal information, and the access without abnormality is entered into the operation log; the blacklist generation module is maintained according to the situation awareness anomaly table and the restriction method table, and the corresponding access restriction measures are implemented.

[0033] Furthermore, the request body of the GIS service application request includes a list of unique codes of the GIS resource services to be applied for, the application usage duration, the application start time, and the application description;

[0034] GIS service application request verification strategies include:

[0035] Verify whether the requesting IP is in the blacklist. If so, return a request failure. Otherwise, proceed to the next step.

[0036] Verify the token, including whether it has been tampered with, verify whether it has expired according to the validity period, parse the token to obtain user information, and compare it with the database; if the verification is successful, proceed to the next step, if the verification fails, return a prompt message;

[0037] Verify RBAC permissions, including obtaining a list of system resources, initiating a request based on the token, and comparing the permissions list; if the permission verification is successful, the application request information is recorded and submitted to the administrator for approval; if the permission verification fails, no access rights are returned;

[0038] Based on the situation awareness unit, the statistical analysis module is used to record abnormal information, and the access without abnormality is entered into the operation log; the blacklist generation module is maintained according to the situation awareness anomaly table and the restriction method table, and the corresponding access restriction measures are implemented.

[0039] Furthermore, the request body of the GIS service authorization request contains a list of GIS resource applications to be reviewed, the review status, the duration of resource use permitted after review, the start time of resource use, and review instructions;

[0040] GIS service authorization request verification strategies include:

[0041] Verify whether the requesting IP is in the blacklist. If so, return a request failure. Otherwise, proceed to the next step.

[0042] Verify the token, including whether it has been tampered with, verify whether it has expired according to the validity period, parse the token to obtain user information, and compare it with the database; if the verification is successful, proceed to the next step, if the verification fails, return a prompt message;

[0043] Verify RBAC permissions, including verifying whether the current operating user has the audit qualification; if the permission verification is successful, generate authorization information based on the application request information and save it to the database; if the permission verification fails, return no access permission;

[0044] Based on the situation awareness unit, the statistical analysis module is used to record abnormal information, and the access without abnormality is entered into the operation log; the blacklist generation module is maintained according to the situation awareness anomaly table and the restriction method table, and the corresponding access restriction measures are implemented.

[0045] Furthermore, GIS service usage request authentication strategies include:

[0046] Verify whether the requesting IP is in the blacklist. If so, return a request failure. Otherwise, proceed to the next step.

[0047] Verify the Token, including whether it has been tampered with, verify whether it has expired according to the validity period, parse the Token to obtain user information, and compare it with the database; if the verification is successful, obtain the GIS service authorization information and GIS service access address, and access the GIS service through the access address and authorization information; if the verification fails, return a prompt message;

[0048] Verify the authorization to use GIS services, including verifying whether the access rights to the current resources are authorized and whether the authorized access time has expired; if the verification of the authorization is successful, the corresponding GIS data of the proxy will be returned; if the verification of the authorization fails, the request will fail and a prompt will be given that access authorization is required;

[0049] Based on the situation awareness unit, the statistical analysis module is used to record abnormal information, and the access without abnormality is entered into the operation log; the blacklist generation module is maintained according to the situation awareness anomaly table and the restriction method table, and the corresponding access restriction measures are implemented.

[0050] Furthermore, other general access request validation strategies include:

[0051] Verify whether the requesting IP is in the blacklist. If so, return a request failure. Otherwise, proceed to the next step.

[0052] Verify the token, including whether it has been tampered with, verify whether it has expired according to the validity period, parse the token to obtain user information, and compare it with the database; if the verification is successful, proceed to the next step, if the verification fails, return a prompt message;

[0053] Verify RBAC permissions, including verifying whether the requesting user has the permission list required for the current request; if the permission verification succeeds, perform the operation required by the request and return the corresponding processing result; if the permission verification fails, return no access permission;

[0054] Based on the situation awareness unit, the statistical analysis module is used to record abnormal information, and the access without abnormality is entered into the operation log; the blacklist generation module is maintained according to the situation awareness anomaly table and the restriction method table, and the corresponding access restriction measures are implemented.

[0055] Furthermore, the anomaly perception module is used to dynamically monitor user access behaviors, focusing on user operations that fail verification in the security verification unit and common network attack methods;

[0056] The statistical analysis module is used to record IP addresses and users with frequent illegal access and to make illegal statistics;

[0057] The blacklist generation module is used to maintain the blacklist of the blacklist verification module in real time according to the situation awareness exception table and the restriction mode table.

[0058] According to another aspect of the present invention, a method for constructing a comprehensive situational awareness and protection system based on GIS is also provided, and the method comprises the following steps:

[0059] S1. Build the server based on the modern Web development framework and build the front end using the progressive programming framework;

[0060] S2. Use relational database to build underlying database and use GIS tools as the carrier of geographic information data;

[0061] S3. Set different security verification strategies according to different access types;

[0062] S4. Based on the results of security verification, ensure system security, protect system data and ensure smooth business processes.

[0063] The beneficial effects of the present invention are:

[0064] (1) The present invention combines the characteristics of geographic spatial information service management, integrates multiple network security technologies such as role-based access control model, token verification model, IP access permission management and blacklist management through a zero-trust framework, and constructs a protection system based on GIS comprehensive situational awareness; at the same time, from the perspective of comprehensive defense, the present invention solves the one-sidedness of single-dimensional security defense, ensures that system resources can be accessed and used legally and compliantly, effectively avoids the security risks that may be caused by the traditional trust model based on network boundaries, eliminates the potential security threats brought by abnormal IP access, illegal operations, etc., and blocks the possibility of unauthorized access to geographic information spatial data.

[0065] (2) The present invention adopts a zero-trust verification mode to ensure the security of GIS services and the entire system access. According to the pre-set user role, the access rules of system module access rights, system operation rights and GIS resource access rights corresponding to the access user are matched, thereby ensuring the authorized access to system resources. In addition, the present invention uses active sensing technology to dynamically analyze the compliance of user operations, and implement blacklist management and different restriction operations on detected abnormal IPs and users, thereby ensuring the safe and stable operation of GIS. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0067] Figure 1 It is a principle block diagram of a GIS-based comprehensive situation awareness and protection system according to an embodiment of the present invention;

[0068] Figure 2 It is a flowchart of a method for constructing a comprehensive situation awareness and protection system based on GIS according to an embodiment of the present invention;

[0069] Figure 3 It is a schematic diagram of a framework of a comprehensive situation awareness and protection system based on GIS according to an embodiment of the present invention;

[0070] Figure 4 It is a flow chart of a situation awareness unit in a comprehensive situation awareness and protection system based on GIS according to an embodiment of the present invention;

[0071] Figure 5 It is an operation flow chart of a user registration request verification strategy in a GIS-based comprehensive situational awareness and protection system according to an embodiment of the present invention;

[0072] Figure 6 It is an operation flow chart of a user login request verification strategy in a GIS-based comprehensive situational awareness and protection system according to an embodiment of the present invention;

[0073] Figure 7 It is an operation flow chart of a GIS service application request verification strategy in a GIS-based comprehensive situational awareness and protection system according to an embodiment of the present invention;

[0074] Figure 8 It is an operation flow chart of a GIS service authorization request verification strategy in a GIS-based comprehensive situational awareness and protection system according to an embodiment of the present invention;

[0075] Fig. 9 It is an operation flow chart of a GIS service usage request verification strategy in a GIS-based comprehensive situational awareness and protection system according to an embodiment of the present invention;

[0076] Fig.10 It is an operation flow chart of other general access request verification strategies in a GIS-based comprehensive situational awareness and protection system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0077] To further illustrate each embodiment, the present invention provides drawings, which are part of the disclosure of the present invention and are mainly used to illustrate the embodiments and can be used in conjunction with the relevant descriptions in the specification to explain the operating principles of the embodiments. With reference to these contents, ordinary technicians in the field should be able to understand other possible implementations and advantages of the present invention. The components in the figures are not drawn to scale, and similar component symbols are generally used to represent similar components.

[0078] According to an embodiment of the present invention, a GIS-based comprehensive situational awareness and protection system and system are provided.

[0079] The present invention is further described with reference to the accompanying drawings and specific embodiments. Figure 1 As shown, according to one embodiment of the present invention, a GIS-based comprehensive situation awareness and protection system is provided, and the GIS-based comprehensive situation awareness and protection system includes a security verification unit 1 and a situation awareness unit 2;

[0080] The security verification unit 1 is used to set different security verification strategies according to different access types;

[0081] The situation awareness unit 2 is used to ensure system security based on the results of security verification, and to achieve protection of system data and smooth business processes;

[0082] Among them, the security verification unit 1 includes a blacklist verification module, a verification code verification module, a RBAC verification module, a Token verification module, a compliance verification module, an authorization verification module and an identity verification module;

[0083] The situation awareness unit 2 includes an abnormality awareness module, a statistical analysis module, and a blacklist generation module.

[0084] Specifically, the comprehensive situational awareness and protection system constructed by the present invention sets the following seven types of security verification: blacklist verification, verification code verification, RBAC verification, Token verification, compliance verification, authorization verification, and identity verification; in addition, according to the front-end request interface type that requires security verification, it is divided into the following six request types: user registration request, user login request, GIS service application request, GIS service authorization request, GIS service use request and other general requests.

[0085] In one embodiment, according to different access types, setting different security verification strategies includes:

[0086] According to the interface type, access requests are divided into identity authentication requests, resource service management requests and other general access requests;

[0087] Develop corresponding security verification strategies based on different access requests;

[0088] Among them, identity authentication requests include user registration requests and user login requests;

[0089] Resource service management requests include GIS service application requests, GIS service authorization requests, and GIS service use requests;

[0090] Other general access requests include all service access requests except non-specific requests;

[0091] The corresponding security verification strategies include user registration request verification strategy, user login request verification strategy, GIS service application request verification strategy, GIS service authorization request verification strategy, GIS service usage request verification strategy, and other general access request verification strategies.

[0092] Specifically, the security verification unit 1 sets different security verification strategies according to different access types. First, according to the interface type, the access request is divided into identity authentication request, resource service management request and other general access requests. Among them, the identity authentication request includes user registration and login request; the resource service management request includes the application request, authorization request and use request of GIS service; other general access requests refer to all service access requests except the above specific requests; for different requests, the present invention formulates corresponding verification strategies:

[0093] 1) User registration request verification strategy: first perform blacklist verification, then verification code verification, and finally compliance verification;

[0094] 2) User login request verification strategy: first perform blacklist verification, then verification code verification, then user identity authentication, and finally RBAC verification;

[0095] 3) GIS service application request verification strategy: first perform blacklist verification, then token verification, and finally RBAC verification. The RBAC verification here mainly verifies whether the user has the authority to apply for the current resource. It should be noted that after successful verification, an application list should be generated, which records in detail the unique code of the resource applied, application time, application duration and other information;

[0096] 4) GIS service authorization request verification strategy: first perform blacklist verification, then perform token verification, and finally perform RBAC verification. The RBAC verification here mainly verifies whether the current user has the authority to audit operations. The audit operation can only be continued after successful verification, and when the audit is successful, a resource access authorization letter needs to be generated for the applicant user. The authorization letter contains the authorized time, authorized duration, and a list of authorized resources;

[0097] 5) GIS service use request verification strategy: first perform blacklist verification, then perform token verification, and finally verify whether the authorization letter and the requested service resource match. After successful verification, access the resource;

[0098] 6) Other general access request verification strategies: first perform blacklist verification, then perform token verification, and finally perform RBAC verification.

[0099] In one embodiment, the request body of the user registration request includes a user name, login name, password, verification code and timestamp;

[0100] User registration request verification strategies include:

[0101] Verify whether the requesting IP is in the blacklist. If so, return a request failure. Otherwise, proceed to the next step.

[0102] Verify the verification code. If the verification is successful, proceed to the next step. If the verification fails, the verification code error is returned.

[0103] Check whether the registration information exists and complies with the regulations. If the check passes, perform data persistence and return a successful operation prompt. Otherwise, prompt the user that the registration failed.

[0104] Based on the situation awareness unit 2, the statistical analysis module is used to record abnormal information, and the access without abnormality is entered into the operation log; the blacklist generation module is maintained according to the situation awareness abnormality table and the restriction method table, and the corresponding access restriction measures are implemented.

[0105] Specifically, in the present invention, the user registration request verification strategy first requires that the user registration request sent by the front end must be a standard HTTP POST request, and the request body of the request must contain the user name, login name, password, verification code and timestamp. After receiving the request, the server needs to perform blacklist verification, verification code verification and compliance verification. The specific operations are as follows: Figure 5 As shown:

[0106] A1. Verify whether the requesting IP is in the blacklist. If not, proceed to the next step; otherwise, return a request failure.

[0107] A2. Perform verification code verification to prevent robot attacks. If the verification is successful, proceed to the next step; otherwise, a verification code error is returned.

[0108] A3. After the above verification is passed, check whether the registration information already exists and whether it complies with legal regulations; if the test is passed, the data is persisted and a prompt of successful operation is returned; otherwise, the user is prompted that the registration failed.

[0109] A4. Obtain the abnormal parts in A1 to A3 above through situation awareness unit 2, enter the statistical analysis module, and maintain the blacklist generation module according to the situation awareness abnormality table (as shown in Table 1 below) and the restriction method table (as shown in Table 2 below), and finally implement the corresponding access restriction measures through the verification system. In addition, the access without abnormality will also be counted in the operation log to facilitate the expansion of situation awareness unit 2 later.

[0110] In one embodiment, the request body of the user login request includes a login name, a password, a verification code, subsystem summary information, and a timestamp;

[0111] User login request verification strategies include:

[0112] Verify whether the requesting IP is in the blacklist. If so, return a request failure. Otherwise, proceed to the next step.

[0113] Verify the verification code. If the verification is successful, proceed to the next step. If the verification fails, the verification code error is returned.

[0114] Based on the database information, compare the password digest and user name passed in the login request. If they meet the verification requirements, proceed to the next step. Otherwise, it prompts that the user name and password are incorrect.

[0115] Verify RBAC permissions, including obtaining the subsystem code summary of the login request and comparing it with the database; if the permission verification is successful, a login Token is generated and returned to the front end, and the front end saves the login Token information; if the permission verification fails, a login failure is returned and a prompt indicating that no access rights are granted;

[0116] Based on the situation awareness unit 2, the statistical analysis module is used to record abnormal information, and the access without abnormality is entered into the operation log; the blacklist generation module is maintained according to the situation awareness abnormality table and the restriction method table, and the corresponding access restriction measures are implemented.

[0117] Specifically, in the present invention, the user login request verification strategy first requires that the user login request sent by the front end must be a standard HTTP POST request, and the request body of the request must contain the login name, password, verification code, unique summary information of the login platform and a timestamp. After receiving the request, the server needs to perform blacklist verification, verification code verification, identity verification and RBAC permission verification. The specific operations are as follows: Figure 6 As shown:

[0118] B1, blacklist verification of A1 in the same user registration request verification strategy;

[0119] B2: Verify the verification code of A2 in the same user registration request verification strategy.

[0120] B3. After the above verification is passed, first, the password summary and user name passed in the login request are compared with the database information. If they meet the verification requirements, RBAC permission verification is performed; otherwise, a prompt "Username or password is incorrect" is displayed.

[0121] B4. Login RBAC verification: First, obtain the subsystem code summary of the login request, compare and verify it with the database, and check whether the role of the logged-in user contains the subsystem required by the request. If it contains the required subsystem, generate a login token based on user information, token validity period, and anti-tampering authentication information, and return it to the front end; otherwise, return login failure and prompt "no access rights".

[0122] B5. After the login RBAC verification is successful, the front end saves the login Token information, and the Token is required for verification in subsequent system operations.

[0123] B6. Obtain the abnormal parts in B1 to B4 above through situation awareness unit 2, enter the statistical analysis module, and maintain the blacklist generation module according to the situation awareness abnormality table (as shown in Table 1) and the restriction method table (as shown in Table 2), and finally implement the corresponding access restriction measures through the verification system. In addition, the access without abnormality will also be counted in the operation log to expand the situation awareness unit 2 later.

[0124] In one embodiment, the request body of the GIS service application request includes a list of GIS resource service unique codes to be applied for, application usage duration, application start time, and application description;

[0125] GIS service application request verification strategies include:

[0126] Verify whether the requesting IP is in the blacklist. If so, return a request failure. Otherwise, proceed to the next step.

[0127] Verify the token, including whether it has been tampered with, verify whether it has expired according to the validity period, parse the token to obtain user information, and compare it with the database; if the verification is successful, proceed to the next step, if the verification fails, return a prompt message;

[0128] Verify RBAC permissions, including obtaining a list of system resources, initiating a request based on the token, and comparing the permissions list; if the permission verification is successful, the application request information is recorded and submitted to the administrator for approval; if the permission verification fails, no access rights are returned;

[0129] Based on the situation awareness unit 2, the statistical analysis module is used to record abnormal information, and the access without abnormality is entered into the operation log; the blacklist generation module is maintained according to the situation awareness abnormality table and the restriction method table, and the corresponding access restriction measures are implemented.

[0130] Specifically, in the present invention, the GIS service application request verification strategy first requires that the GIS service application request sent by the front end must be a standard HTTP POST request. The request header must contain a field called "Authorization", whose value must start with "Bearer", and is followed by the parameter information of the Token. At the same time, the request body must clearly include the following information: a list of unique codes for the GIS resource services that need to be applied for, the duration of the application, the start time of the application, and the application description. After receiving the request, the server needs to perform blacklist verification, Token verification, and RBAC verification. The specific operations are as follows: Figure 7 As shown:

[0131] C1, blacklist verification of A1 in the same user registration request verification policy;

[0132] C2, Token verification: First, verify whether the Token has been tampered with according to the anti-tampering information added when the Token was generated, then verify whether the Token has expired according to the validity period, and finally parse the Token to obtain the user information and compare it with the database. If the comparison is successful, proceed to the next step. Otherwise, return to "Please log in first";

[0133] C3, RBAC permission verification: First, obtain the list of system resources accessed by the request, and obtain the user information that initiated the request based on the token carried in the request; then, compare the permission list of the role information owned by the user information with the permission list corresponding to the access system resource list; if the access permission list is fully included in the owned permission list, the verification is successful; otherwise, the verification fails and returns no access permission;

[0134] C4. The RBAC verification in the previous step mainly verifies whether the user has the authority to apply for the use of a certain resource;

[0135] C5. After verification, the application request information including the list of GIS service resources applied for, resource usage duration, and application time is recorded and approved and authorized by the administrator;

[0136] C6, through the situation awareness unit 2, obtain the abnormal part of the above C1 to C4, enter the statistical analysis module, and maintain the blacklist generation module according to the situation awareness abnormal table (as shown in Table 1) and the restriction method table (as shown in Table 2), and finally implement the corresponding access restriction measures through the verification system. In addition, the access without abnormality will also be counted in the operation log, so as to expand the situation awareness unit 2 later.

[0137] In one embodiment, the request body of the GIS service authorization request includes a list of GIS resource applications to be reviewed, review status, permitted resource usage duration after review, resource usage start time, and review instructions;

[0138] GIS service authorization request verification strategies include:

[0139] Verify whether the requesting IP is in the blacklist. If so, return a request failure. Otherwise, proceed to the next step.

[0140] Verify the token, including whether it has been tampered with, verify whether it has expired according to the validity period, parse the token to obtain user information, and compare it with the database; if the verification is successful, proceed to the next step, if the verification fails, return a prompt message;

[0141] Verify RBAC permissions, including verifying whether the current operating user has the audit qualification; if the permission verification is successful, generate authorization information based on the application request information and save it to the database; if the permission verification fails, return no access permission;

[0142] Based on the situation awareness unit 2, the statistical analysis module is used to record abnormal information, and the access without abnormality is entered into the operation log; the blacklist generation module is maintained according to the situation awareness abnormality table and the restriction method table, and the corresponding access restriction measures are implemented.

[0143] Specifically, in the present invention, the GIS service authorization request verification strategy first requires that the GIS service authorization request sent by the front end must be a standard HTTP POST request. The request header must contain a field called 'Authorization', whose value must start with 'Bearer', and is followed by the parameter information of the Token. At the same time, the request body must clearly include the following information: a list of GIS resource applications that need to be reviewed, the review status, the length of time allowed for resource use after review, the time when resource use starts, and the review instructions, where the review status includes: application approval (i.e., review passed) and application rejection (i.e., review failed). After receiving the request, the server needs to perform blacklist verification, Token verification, and RBAC verification. The specific operations are as follows: Figure 8 As shown:

[0144] D1, blacklist verification of A1 in the same user registration request verification policy;

[0145] D2, the same token verification as C2 in the GIS service application request verification strategy;

[0146] D3, the RBAC permission verification of C3 in the same GIS service application request verification strategy;

[0147] The RBAC permission verification in D4 and D3 mainly verifies whether the current operating user has the audit qualification, that is, whether he is an administrator role;

[0148] D5. After verification is completed, authorization information is generated based on the application information including the GIS service resource list, access duration, and operation time, and saved in the database;

[0149] D6. Through situation awareness unit 2, obtain the abnormal parts in D1 to D4 above, enter the statistical analysis module, and maintain the blacklist generation module according to the situation awareness abnormality table (as shown in Table 1) and the restriction method table (as shown in Table 2), and finally implement the corresponding access restriction measures through the verification system. In addition, the access without abnormality will also be counted in the operation log to expand the situation awareness unit 2 later.

[0150] In one embodiment, the GIS service usage request verification strategy includes:

[0151] Verify whether the requesting IP is in the blacklist. If so, return a request failure. Otherwise, proceed to the next step.

[0152] Verify the Token, including whether it has been tampered with, verify whether it has expired according to the validity period, parse the Token to obtain user information, and compare it with the database; if the verification is successful, obtain the GIS service authorization information and GIS service access address, and access the GIS service through the access address and authorization information; if the verification fails, return a prompt message;

[0153] Verify the authorization to use GIS services, including verifying whether the access rights to the current resources are authorized and whether the authorized access time has expired; if the verification of the authorization is successful, the corresponding GIS data of the proxy will be returned; if the verification of the authorization fails, the request will fail and a prompt will be given that access authorization is required;

[0154] Based on the situation awareness unit 2, the statistical analysis module is used to record abnormal information, and the access without abnormality is entered into the operation log; the blacklist generation module is maintained according to the situation awareness abnormality table and the restriction method table, and the corresponding access restriction measures are implemented.

[0155] Specifically, the GIS service use request verification strategy in this invention requires that the GIS service use request sent by the front end must be a standard HTTP POST request. The request header must contain a field called 'Authorization', whose value must start with 'Bearer' and is followed by the parameter information of the Token. After receiving the request, the server needs to perform blacklist verification, Token verification, and GIS service use authorization verification. The specific operations are as follows: Fig. 9 As shown:

[0156] E1, blacklist verification of A1 in the same user registration request verification policy;

[0157] E2, the same token verification as C2 in the GIS service application request verification strategy;

[0158] E3. After successful token verification, obtain the authorization information and GIS service access address for GIS service use, and access the GIS service through the address and authorization information;

[0159] E4. GIS service authorization verification: Verify the address and authorization information. First, verify whether the access rights to the current resource are authorized, and then verify whether the authorized access time has expired. If it passes, the corresponding GIS data of the proxy will be returned. If it fails, the request fails and prompts that access authorization is required.

[0160] E5. Through situation awareness unit 2, obtain the abnormal parts in E1, E2 and E4 above, enter the statistical analysis module, and maintain the blacklist generation module according to the restrictions in the situation awareness abnormality table (as shown in Table 1) and the restriction method table (as shown in Table 2). Finally, implement the corresponding access restriction measures through the verification system. In addition, the access without abnormalities will also be counted in the operation log to facilitate the expansion of situation awareness unit 2 in the future.

[0161] In one embodiment, other general access request verification strategies include:

[0162] Verify whether the requesting IP is in the blacklist. If so, return a request failure. Otherwise, proceed to the next step.

[0163] Verify the token, including whether it has been tampered with, verify whether it has expired according to the validity period, parse the token to obtain user information, and compare it with the database; if the verification is successful, proceed to the next step, if the verification fails, return a prompt message;

[0164] Verify RBAC permissions, including verifying whether the requesting user has the permission list required for the current request; if the permission verification succeeds, perform the operation required by the request and return the corresponding processing result; if the permission verification fails, return no access permission;

[0165] Based on the situation awareness unit 2, the statistical analysis module is used to record abnormal information, and the access without abnormality is entered into the operation log; the blacklist generation module is maintained according to the situation awareness abnormality table and the restriction method table, and the corresponding access restriction measures are implemented.

[0166] Specifically, other general access request verification strategies in the present invention require that the GIS service use request sent by the front end must be a standard HTTP POST request. The request header must contain a field called 'Authorization', whose value must start with 'Bearer', followed by the parameter information of the Token. In addition, if the request itself needs to carry certain parameters, the corresponding parameter information must be carried in the request body. After receiving the request, the server needs to perform blacklist verification, Token verification and RBAC verification. The specific operations are as follows: Fig.10 As shown:

[0167] F1, blacklist verification of A1 in the same user registration request verification policy;

[0168] F2, the same token verification as C2 in the GIS service application request verification strategy;

[0169] F3, the same as the RBAC permission verification of C4 in the GIS service application request verification strategy;

[0170] F4 and F3 mainly verify whether the requesting user has the permission list required for the current request;

[0171] F5. After successful verification, the requested operation is executed and the corresponding processing result is returned.

[0172] F6, through the situation awareness unit 2, obtain the abnormal part of F1 to F4 above, enter the statistical analysis module, and maintain the blacklist generation module according to the situation awareness abnormal table (as shown in Table 1) and the restriction method table (as shown in Table 2), and finally implement the corresponding access restriction measures through the verification system. In addition, the access without abnormality will also be counted in the operation log, so as to expand the situation awareness unit 2 later.

[0173] In one embodiment, the abnormality perception module is used to dynamically monitor user access behavior, focusing on user operations that fail verification in the security verification unit and common network attack methods;

[0174] The statistical analysis module is used to record IP addresses and users with frequent illegal access and to make illegal statistics;

[0175] The blacklist generation module is used to maintain the blacklist of the blacklist verification module in real time according to the situation awareness exception table and the restriction mode table.

[0176] Specifically, the purpose of the security verification by the situation awareness defense unit 2 is not only to defend the system security, but also to make full use of its results, which is an important part of ensuring the system security, system data protection and smooth business processes. Figure 4Among them, the abnormal perception module is responsible for dynamically monitoring user access behavior, focusing on user operations that fail verification in the verification system and common network attack methods, such as DDoS attacks and SQL injection attacks; in the statistical analysis module, for IP addresses and users who frequently violate the rules, violation statistics are collected, and the blacklist generation module is maintained according to the restrictions in the situational awareness abnormality table (as shown in Table 1) and the restriction method table (as shown in Table 2), and finally the corresponding access restriction measures are implemented through the verification system.

[0177] Table 1 Situational awareness anomaly table

[0178] coding name Classification Frequency ERR001 Blacklist detection General inspection 5 ERR002 DDoS Detection General inspection 3000 / min ERR003 SQL injection detection General inspection 1 ERR004 Verification code detection General inspection 5 ERR005 RBAC Authentication General inspection 5 ERR006 Token Validation General inspection 5 ERR007 Compliance Check Registration detection 5 ERR008 Username and password verification Login detection 5 ERR009 Authorization Verification GIS Service Validation 5 ERR010 Other business exceptions Sub-business 5

[0179] Table 2 Restriction method table

[0180] coding name Classification RES001 Limit 1 minute Login restrictions RES002 5 minute limit Login restrictions RES003 30 hours limit Login restrictions RES004 Limit 1 hour Login restrictions RES005 Login prohibited Login restrictions RES006 Force quit Permission restrictions RES007 Access Denied IP Restriction

[0181] like Figure 2 As shown, according to another embodiment of the present invention, a method for constructing a comprehensive situation awareness and protection system based on GIS is also provided, and the method for constructing the system comprises the following steps:

[0182] S1. Build the server based on the modern Web development framework and build the front end using the progressive programming framework;

[0183] S2. Use relational database to build underlying database and use GIS tools as the carrier of geographic information data;

[0184] S3. Set different security verification strategies according to different access types;

[0185] S4. Based on the results of security verification, ensure system security, protect system data and ensure smooth business processes.

[0186] Specifically, Figure 3 As shown, the present invention adopts a front-end and back-end separation solution, uses the Dotnet6.0 framework to build the server, uses the Vue3.0 framework to build the front-end, uses the Postgre13.0 relational database to build the underlying database, and uses GIS tools such as ArcGIS Server as the carrier of geographic information data. The comprehensive situational awareness defense framework is composed of a security verification unit and a situational awareness defense unit.

[0187] In order to facilitate understanding of the above technical solution of the present invention, the comprehensive situation awareness and protection system based on GIS and its construction method in the present invention are tested with X Province Y City as the pilot area, and the test results are as follows:

[0188] The test of the present invention took half a year and released 226 basic spatiotemporal data. The average daily visits in the test exceeded 2 million times. The access restrictions and processing methods for some IPs are shown in Table 3, the login restrictions and processing methods for some users are shown in Table 4, and some logs of normal user access are shown in Table 5.

[0189] Table 3 IP access restriction table

[0190] IP Access content Blacklist time Reasons for restriction Processing 114.219.12.241 Vector Map August 21, 2024 DDoS attacks Blacklisted 222.64.222.230 Vector Map July 30, 2024 DDoS attacks Released 117.80.13.188 Vector Map April 17, 2024 DDoS attacks Released 58.211.58.58 Vector Notes April 8, 2024 DDoS attacks Blacklisted 58.211.58.58 Vector Map April 8, 2024 DDoS attacks Blacklisted 114.220.146.166 Vector Map March 27, 2024 DDoS attacks Blacklisted 114.220.146.166 Vector Map March 26, 2024 DDoS attacks Blacklisted 58.211.58.57 Vector Map March 19, 2024 DDoS attacks Blacklisted 58.211.58.59 Vector Map March 19, 2024 DDoS attacks Blacklisted 180.103.199.179 Vector Map March 14, 2024 DDoS attacks Blacklisted 218.4.157.94 Vector Map March 8, 2024 DDoS attacks Blacklisted 114.219.98.155 Vector Map February 27, 2024 DDoS attacks Blacklisted 58.210.34.82 Vector Map February 22, 2024 DDoS attacks Whitelist

[0191] Table 4 User login restriction table

[0192] Log in to your account Access content Blacklist time Reasons for restriction Processing Log in to your account gx Log in to the Resource Center June 30, 2024 Login detection anomaly Reset Password gx Tcsfzszd Log in to the Resource Center April 17, 2024 Verification code detection anomaly Unbanned Tcsfzszd zw Login management system March 15, 2024 RBAC detection exception Unbanned zw CXGTZYF Vector Map March 10, 2024 RBAC detection exception Re-apply CXGTZYF

[0193] Table 5 User normal access record table

[0194] Access Account Access Account Access Account Operation time administrator Portal screen Get GIS service usage statistics August 22, 2024 xzzf GIS service system Visit Vector Maps February 5, 2024 administrator Management System Review user resource applications February 1, 2024 administrator Management System Get a list of auditable resources February 1, 2024 f Resource Center Apply for GIS access service February 1, 2024 f Resource Center Get a list of available GIS resources February 1, 2024 f Resource Center Get a list of accessible submodules February 1, 2024

[0195] It can be seen that the system constructed by this application effectively eliminates potential security threats brought by abnormal IP access, illegal operations, etc., and blocks the possibility of unauthorized access to geographic information spatial data.

[0196] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A GIS-based comprehensive situational awareness and protection system, characterized in that: The GIS-based integrated situational awareness and protection system includes a security verification unit and a situational awareness unit; The security verification unit is used to set different security verification strategies according to different access types; The situation awareness unit is used to ensure system security based on the results of security verification, and to protect system data and smoothly carry out business processes; The security verification unit includes a blacklist verification module, a verification code verification module, an RBAC verification module, a token verification module, a compliance verification module, an authorization verification module and an identity verification module; The situation awareness unit includes an abnormality awareness module, a statistical analysis module, and a blacklist generation module; The different security verification strategies are set according to different access types, including: According to the interface type, access requests are divided into identity authentication requests, resource service management requests and other general access requests; the identity authentication requests include user registration requests and user login requests; the resource service management requests include GIS service application requests, GIS service authorization requests and GIS service use requests; the other general access requests include all service access requests except non-specific requests; Based on different access requests, formulate corresponding security verification strategies; the corresponding security verification strategies include user registration request verification strategy, user login request verification strategy, GIS service application request verification strategy, GIS service authorization request verification strategy, GIS service use request verification strategy, and other general access request verification strategies; Among them, the user registration request verification strategy includes first performing blacklist verification, then performing verification code verification, and finally performing compliance verification; the user login request verification strategy includes first performing blacklist verification, then performing verification code verification, then performing user identity authentication, and finally performing RBAC verification; the GIS service application request verification strategy includes first performing blacklist verification, then performing Token verification, and finally performing RBAC verification, and generating an application list after successful verification; the GIS service authorization request verification strategy includes first performing blacklist verification, then performing Token verification, and finally performing RBAC verification, and performing an audit after successful verification, and if the audit is successful, generating a resource access authorization letter for the applicant user; the GIS service use request verification strategy includes first performing blacklist verification, then performing Token verification, and finally verifying whether the authorization letter and the requested service resources are consistent, and if they are consistent, performing resource access; the other general access request verification strategies include first performing blacklist verification, then performing Token verification, and finally performing RBAC verification.

2. The GIS-based comprehensive situational awareness and protection system according to claim 1, characterized in that: The request body of the user registration request includes a user name, login name, password, verification code and timestamp; The user registration request verification strategy includes: Verify whether the requesting IP is in the blacklist. If so, return a request failure. Otherwise, proceed to the next step. Verify the verification code. If the verification is successful, proceed to the next step. If the verification fails, the verification code error is returned. Check whether the registration information exists and complies with the regulations. If the check passes, perform data persistence and return a successful operation prompt. Otherwise, prompt the user that the registration failed. Based on the situation awareness unit, the statistical analysis module is used to record abnormal information, and the access without abnormality is entered into the operation log; the blacklist generation module is maintained according to the situation awareness anomaly table and the restriction method table, and the corresponding access restriction measures are implemented.

3. The GIS-based comprehensive situational awareness and protection system according to claim 2, characterized in that: The request body of the user login request includes login name, password, verification code, subsystem summary information and timestamp; The user login request verification strategy includes: Verify whether the requesting IP is in the blacklist. If so, return a request failure. Otherwise, proceed to the next step. Verify the verification code. If the verification is successful, proceed to the next step. If the verification fails, the verification code error is returned. Based on the database information, compare the password digest and user name passed in the login request. If they meet the verification requirements, proceed to the next step. Otherwise, it prompts that the user name and password are incorrect. Verify RBAC permissions, including obtaining the subsystem code summary of the login request and comparing it with the database; if the permission verification is successful, a login Token is generated and returned to the front end, and the front end saves the login Token information; if the permission verification fails, a login failure is returned and a prompt indicating that no access rights are granted; Based on the situation awareness unit, the statistical analysis module is used to record abnormal information, and the access without abnormality is entered into the operation log; the blacklist generation module is maintained according to the situation awareness anomaly table and the restriction method table, and the corresponding access restriction measures are implemented.

4. The GIS-based comprehensive situational awareness and protection system according to claim 2, characterized in that: The request body of the GIS service application request includes a list of GIS resource service unique codes to be applied for, application usage duration, application start time and application description; The GIS service application request verification strategy includes: Verify whether the requesting IP is in the blacklist. If so, return a request failure. Otherwise, proceed to the next step. Verify the token, including whether it has been tampered with, verify whether it has expired according to the validity period, parse the token to obtain user information, and compare it with the database; if the verification is successful, proceed to the next step, if the verification fails, return a prompt message; Verify RBAC permissions, including obtaining a list of system resources, initiating a request based on the token, and comparing the permissions list; if the permission verification is successful, the application request information is recorded and submitted to the administrator for approval; if the permission verification fails, no access rights are returned; Based on the situation awareness unit, the statistical analysis module is used to record abnormal information, and the access without abnormality is entered into the operation log; the blacklist generation module is maintained according to the situation awareness anomaly table and the restriction method table, and the corresponding access restriction measures are implemented.

5. The GIS-based comprehensive situational awareness and protection system according to claim 2, characterized in that: The request body of the GIS service authorization request includes a list of GIS resource applications to be reviewed, review status, permitted resource usage duration after review, resource usage start time, and review instructions; The GIS service authorization request verification strategy includes: Verify whether the requesting IP is in the blacklist. If so, return a request failure. Otherwise, proceed to the next step. Verify the token, including whether it has been tampered with, verify whether it has expired according to the validity period, parse the token to obtain user information, and compare it with the database; if the verification is successful, proceed to the next step, if the verification fails, return a prompt message; Verify RBAC permissions, including verifying whether the current operating user has the audit qualification; if the permission verification is successful, generate authorization information based on the application request information and save it to the database; if the permission verification fails, return no access permission; Based on the situation awareness unit, the statistical analysis module is used to record abnormal information, and the access without abnormality is entered into the operation log; the blacklist generation module is maintained according to the situation awareness anomaly table and the restriction method table, and the corresponding access restriction measures are implemented.

6. The GIS-based comprehensive situational awareness and protection system according to claim 2, characterized in that: The GIS service use request verification strategy includes: Verify whether the requesting IP is in the blacklist. If so, return a request failure. Otherwise, proceed to the next step. Verify the Token, including whether it has been tampered with, verify whether it has expired according to the validity period, parse the Token to obtain user information, and compare it with the database; if the verification is successful, obtain the GIS service authorization information and GIS service access address, and access the GIS service through the access address and authorization information; if the verification fails, return a prompt message; Verify the authorization to use GIS services, including verifying whether the access rights to the current resources are authorized and whether the authorized access time has expired; if the verification of the authorization is successful, the corresponding GIS data of the proxy will be returned; if the verification of the authorization fails, the request will fail and a prompt will be given that access authorization is required; Based on the situation awareness unit, the statistical analysis module is used to record abnormal information, and the access without abnormality is entered into the operation log; the blacklist generation module is maintained according to the situation awareness anomaly table and the restriction method table, and the corresponding access restriction measures are implemented.

7. The GIS-based comprehensive situational awareness and protection system according to claim 2 is characterized in that: Other general access request validation strategies include: Verify whether the requesting IP is in the blacklist. If so, return a request failure. Otherwise, proceed to the next step. Verify the token, including whether it has been tampered with, verify whether it has expired according to the validity period, parse the token to obtain user information, and compare it with the database; if the verification is successful, proceed to the next step, if the verification fails, return a prompt message; Verify RBAC permissions, including verifying whether the requesting user has the permission list required for the current request; if the permission verification succeeds, perform the operation required by the request and return the corresponding processing result; if the permission verification fails, return no access permission; Based on the situation awareness unit, the statistical analysis module is used to record abnormal information, and the access without abnormality is entered into the operation log; the blacklist generation module is maintained according to the situation awareness anomaly table and the restriction method table, and the corresponding access restriction measures are implemented.

8. The GIS-based comprehensive situational awareness and protection system according to claim 1, characterized in that: The abnormality perception module is used to dynamically monitor user access behavior, focusing on user operations that fail verification in the security verification unit and common network attack methods; The statistical analysis module is used to record IP addresses and users who frequently violate the regulations and to make statistics on violations; The blacklist generation module is used to maintain the blacklist of the blacklist verification module in real time according to the situation awareness exception table and the restriction mode table.

9. A method for constructing a GIS-based integrated situational awareness and protection system, used to construct the GIS-based integrated situational awareness and protection system according to any one of claims 1 to 8, characterized in that: The construction method includes the following steps: S1. Build the server based on the modern Web development framework and build the front end using the progressive programming framework; S2. Use relational database to build underlying database and use GIS tools as the carrier of geographic information data; S3. Set different security verification strategies according to different access types; S4. Based on the results of security verification, ensure system security, protect system data and ensure smooth business processes.

Images