A Geographic Data Processing System Based on Cryptography

Abstract

The present application discloses a geographic data processing system based on cryptographic technology, which relates to the field of data security technology. The system includes: a server and a client. The server includes a hardware device with a binary unit and a binary unit message authentication code burned in it. The binary unit is generated by the joint compilation of the source code of the spatial coordinate conversion processing algorithm and the source code of at least one cryptographic algorithm. The binary unit includes a spatial coordinate conversion interface and an encryption interface. The client includes an identity authentication, integrity verification and decryption interface. Based on the spatial coordinate conversion interface, encryption interface, identity authentication, integrity verification and decryption interface, the server and the client jointly complete the security protection of input and output geographic data based on cryptographic technology: the geographic data completes spatial coordinate conversion and encryption processing on the server, and returns the processing result to the client for decryption processing. The present application improves the security of data in the geographic processing process.

Description

Technical Field

[0001] The present application relates to the field of data security technology, and in particular to a geographic data processing system based on cryptographic technology. Background Art

[0002] Geospatial data has high application value for people's production and life, so the security of geospatial data is very important. Software encryption refers to the encryption method implemented with the help of computer software. Compared with hardware encryption, this encryption has lower cost and is more convenient to maintain and upgrade. However, since key information such as keys are usually stored in computer systems, they are easily stolen by hackers, which affects security. At the same time, software encryption has a great impact on the performance of the system. Hardware encryption refers to the use of dedicated hardware chips to implement encryption and decryption functions. The main advantage of this encryption method is high security, because key information such as keys is stored inside the dedicated chip and is not easily stolen by attackers. At the same time, the speed of hardware encryption is also very fast and will not have a great impact on system performance. However, hardware encryption requires additional hardware support, is costly, and is more troublesome to upgrade and maintain.

[0003] Due to its important role, geographic information data makes software in this field easily become the target of hacker attacks. Once the data is illegally obtained, the threat to social security is difficult to estimate. At present, the protection method of the graded protection system is used to focus on protecting software. The standard of network security graded protection has put forward the application requirements of passwords in multiple aspects such as identity authentication and communication transmission, that is, the network security of geographic information data needs to be improved. Summary of the invention

[0004] The purpose of this application is to provide a geographic data processing system based on cryptographic technology to improve the security of the geographic data processing process.

[0005] To achieve the above-mentioned purpose, the present application provides the following scheme: a geographic data processing system based on cryptographic technology, comprising: a server and a client; the server comprises a hardware device burned with a binary unit and a message authentication code of the binary unit; the binary unit is generated by jointly compiling a source code processed by a spatial coordinate conversion algorithm and a source code of at least one cryptographic algorithm, and the binary unit comprises a spatial coordinate conversion interface and an encryption interface; the client comprises an identity authentication interface, an integrity verification interface and a decryption interface; based on the spatial coordinate conversion interface, the encryption interface, the identity authentication interface, the integrity verification interface and the decryption interface, the server and the client jointly complete the security protection of the input and output geographic data based on cryptographic technology, the geographic data completes the spatial coordinate conversion and encryption processing on the server, and returns the encryption processing result to the client for decryption processing.

[0006] According to the specific embodiments provided by the present application, the present application discloses the following technical effects: the present application generates a binary unit by jointly compiling the source code of the spatial coordinate conversion algorithm and the source code of multiple cryptographic algorithms, and burns the binary unit into the hardware device on the server side; the security of the spatial coordinate conversion algorithm is improved through joint compilation and hardware burning, thereby improving the security of the geographic data processing process. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0008] Figure 1 A schematic diagram of the structure of a geographic data processing system based on cryptographic technology provided in an embodiment of the present application.

[0009] Figure 2 A block diagram of a geographic data processing system based on cryptographic technology provided in an embodiment of the present application. DETAILED DESCRIPTION

[0010] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0011] The purpose of this application is to provide a geographic data processing system based on cryptographic technology to improve the security of the geographic data processing process.

[0012] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods.

[0013] like Figure 1 As shown, a geographic data processing system based on cryptographic technology in this embodiment includes: a server and a client.

[0014] The server side includes a hardware device burned with a binary unit and a message authentication code of the binary unit; the binary unit is generated by jointly compiling source code processed by a spatial coordinate conversion algorithm and source code of at least one cryptographic algorithm, and the binary unit includes a spatial coordinate conversion interface and an encryption interface; the client side includes an identity authentication interface, an integrity verification interface and a decryption interface.

[0015] Based on the spatial coordinate conversion interface, encryption interface, identity authentication interface, integrity verification interface and decryption interface, the server and the client jointly complete the security protection of input and output geographic data based on cryptographic technology. The geographic data completes spatial coordinate conversion and encryption processing on the server side, and returns the encryption processing result to the client for decryption processing.

[0016] More specifically, the spatial coordinate conversion interface is used to perform spatial coordinate conversion on the input data requested by the client using a cryptographic algorithm, and the encryption interface is used to encrypt to obtain the encryption processing result and its message authentication code; the integrity check interface is used to perform integrity check on the returned output data using a cryptographic algorithm, and the decryption interface is used to decrypt the data that passes the integrity check to obtain the decrypted data; the cryptographic algorithm is specifically a plurality of cryptographic algorithms.

[0017] The input and output geographic data include the input geographic data and output geographic data of the server and the client in both directions. The security protection is provided by encrypting and decrypting the geographic data in both directions of the server and the client during the data transmission process.

[0018] The message authentication code (MAC) of the binary unit is used to verify the integrity of the binary unit burned in the device hardware; the message authentication code of the encrypted data is used to verify the integrity of the output encrypted data.

[0019] The client is used to process and encrypt geographic data by calling the spatial coordinate conversion interface and encryption interface in the server; and to decrypt geographic data by calling the integrity verification interface and decryption interface in the client.

[0020] The geographic data output by the server is encrypted geographic data. After receiving it, the client calls the integrity verification interface and the decryption interface to decrypt it. The geographic data output by the server is encrypted geographic data. After receiving it, the client uses the decryption interface to decrypt it, thereby realizing the security protection of geographic data transmission between the server and the client.

[0021] When the space conversion algorithm is used, it is strictly managed according to the controlled object. This embodiment limits the space conversion algorithm to be used after being compiled with the cryptographic algorithm in a safe and trusted environment. Security protection is carried out from five levels, including module security, code security, interface security, user security, and application security, to ensure security, controllability, and traceability. Figure 2 shown.

[0022] The various cryptographic algorithms in this application include SM2 algorithm, SM3 algorithm and SM4 algorithm. Among them, SM4 algorithm is a symmetric algorithm, SM2 algorithm is an asymmetric algorithm, and SM3 algorithm is a hash algorithm. The encryption interface uses a compliant and effective domestic commercial cryptographic algorithm. Only clients that have passed identity authentication and requests that have passed integrity verification can correctly decrypt the processing results.

[0023] The SM2 algorithm is mainly used for terminal and user identity authentication, secure communication link establishment, SM4 symmetric key exchange and key negotiation, digital envelope and digital signature and verification of sensitive data, etc.

[0024] The SM3 algorithm is mainly used for integrity verification, digital signature and verification of sensitive data, authorization information, audit data and other key data.

[0025] The SM4 algorithm is mainly used for confidentiality in the transmission and storage of sensitive data, including high-precision surveying and mapping geographic information data, identity authentication information, etc. The encryption algorithm used by the server-side encryption interface and the client-side decryption interface are both the SM4 algorithm.

[0026] The server side includes an encryption interface for adopting a format-preserving encryption method of the SM4 algorithm to encrypt the geographic data after spatial coordinate conversion and output the encrypted spatial coordinates.

[0027] The server side also includes a message authentication code encryption unit, which is used to encrypt the binary unit or the encryption processing result using the HMAC-SM3 algorithm to obtain a message authentication code for the binary unit or the encryption processing result to protect the security of the binary unit.

[0028] The server end is also used to perform consistency check on the message authentication code of the binary unit and the message authentication code built into the binary unit when powered on. If the consistency check fails, a reminder is given that the consistency check has failed, and the startup program is stopped to protect the security of the binary unit.

[0029] The server also includes a space coordinate conversion unit; the space coordinate conversion unit is used to provide the space coordinate conversion interface.

[0030] The spatial coordinate conversion unit is used to complete the conversion from the original spatial coordinates to the deflected coordinates, obtain the processing result after the coordinate conversion, and call the SM4 algorithm through the encryption interface to symmetrically encrypt the processing result after the coordinate conversion to obtain the encrypted processing result, and calculate the message authentication code of the encrypted processing result by calling the HMAC-SM3 algorithm in the message authentication code encryption unit.

[0031] The server also includes a range verification unit, which is used to determine whether the received requested geographic data is within a pre-entered range. If so, the requested geographic data is subjected to coordinate conversion processing, and an encryption processing result and a corresponding message authentication code are returned. Otherwise, an error code is returned.

[0032] The client comprises a data integrity verification unit; the data integrity verification unit is used to provide the integrity verification interface.

[0033] The data integrity verification unit is used to receive the encryption processing result and the message authentication code of the encryption processing result transmitted by the server when calling the encryption interface, and use the HMAC-SM3 algorithm to encrypt the received encryption processing result to obtain the summary value of the client.

[0034] Determine whether the message authentication code calculated by the client is equal to the digest value returned by the server-side encryption interface. If so, the data is complete; otherwise, the data is incomplete.

[0035] 1) Code security: In a secure and trusted environment, the spatial coordinate conversion algorithm source code is jointly compiled with the cryptographic algorithm source code (SM2 algorithm, SM3 algorithm and SM4 algorithm) in the cryptographic machine that has passed the cryptographic product certification to ensure that the spatial coordinate conversion algorithm source code itself is not exposed. It mainly includes the following contents.

[0036] (1) In a trusted security environment, information encryption of plug-ins refers to the use of cryptographic methods to encrypt confidential plug-ins so that attackers cannot read the content of the data, thereby achieving the purpose of protecting the content in the plug-in; while information hiding refers to hiding geospatial data in other information through steganography (cryptographic algorithm) so that attackers cannot discover the existence of geospatial data, which not only achieves the confidentiality of geospatial data, but also protects the communication behavior of secret distribution of geospatial data. Among them, information encryption is the most basic means to ensure information security.

[0037] (2) Integrity protection mechanism: The integrity protection mechanism uses cryptographic integrity protection to combat illegal tampering and prevent spatial coordinate conversion algorithms and geospatial data from being modified by unauthorized parties during the distribution process. In addition, the mechanism can also provide non-repudiation services, that is, to ensure the authenticity of the source of geospatial data, so that the receiver can confirm the sender of the information.

[0038] (3) Authentication mechanism: In the process of accessing the spatial coordinate conversion algorithm through the network, according to the basic mechanism of network security, the sender and receiver network devices need to be able to confirm each other's identity to ensure that legitimate users can perform correct operations. This mechanism is mainly used for access control and dynamic security protection of the spatial coordinate conversion interface.

[0039] (4) Audit mechanism: By recording important events that occur when a trusted user accesses the plug-in interface, when the system encounters an error or is attacked, the error can be accurately located and the cause of the attack can be found, thereby investigating and collecting evidence for the accident and preventing internal crimes. This mechanism is mainly used for static security protection of plug-in access.

[0040] (5) Range authority control mechanism: This mechanism is a necessary security measure for spatial coordinate conversion interface management. Before processing geospatial data, different users must be granted different processing scope authorities and the authorities must be properly authenticated to prevent unauthorized operations.

[0041] 2) Module security: For the binary unit compiled together, the message authentication code is calculated using the HMAC-SM3 algorithm and burned together with the binary unit into a commercial cryptographic hardware device that has passed product certification to ensure that the binary unit cannot be modified.

[0042] Data integrity protection means that if a data packet is modified by an illegal user during storage or network transmission, the data receiver can discover it in time. The HMAC-SM3 algorithm is used to calculate the message authentication code of the data on the server side, and the message authentication code is sent to the client in the form of a digital envelope; when the client receives the data, it uses the same HMAC-SM3 algorithm and the same key to calculate its message authentication code; by comparing the message authentication code transmitted by the server side with the message authentication code calculated in real time by the client side, it can be verified whether the model data is complete and whether the data is sent from the authenticated server side.

[0043] 3) Interface security: The coordinates after confidentiality processing are encrypted by the national secret algorithm and output in ciphertext to ensure the output security of data; to achieve confidentiality protection of the confidentiality processing results, the format-preserving encryption method based on the SM4 algorithm is called for the processed result coordinates, and the encrypted spatial coordinates are output. Only applications with the SM4 algorithm key can correctly identify them. The main technical process is as follows.

[0044] (1) The SM4 algorithm uses an unbalanced Feistel structure, and its block data length and key length are both 128 bits. When encrypting data, the plaintext data to be encrypted must first be divided to ensure that the size of each block is consistent; then each block of data is iteratively encrypted; and finally the ciphertext block is output. The SM4 algorithm is used to encrypt and decrypt geographic data, which improves the security of encryption methods.

[0045] (2) The volume of geographic coordinate data is large, and the full-text encryption method seriously restricts the efficiency of geographic data processing. In order to ensure the security of classified geographic data, all data need to create independent keys. In order to improve the security of the key, an identity-based public key cryptographic algorithm is adopted to complete the encryption of key information. The key consists of a 1-byte encryption algorithm (SM4 algorithm) serial number and a 16-byte encryption algorithm key. The SM4 algorithm key length is 128 bits. When a user encrypts geographic information data for the first time, the key is randomly generated. Usually, the precision of the spatial coordinates of geographic objects is double-precision floating point data (double) type. Combined with the value range of the double type and the value attributes of the vector data coordinate point, the coordinate value is expanded to store the encrypted key in the encryption model.

[0046] Therefore, the geographic data coordinate data segments are encrypted and decrypted based on the SM4 algorithm to form a geographic data encryption process.

[0047] The client includes a personal computer (PC) terminal. The PC terminal is used for identity authentication.

[0048] 4) User security: The identity authentication technology based on commercial encryption is used to identify and verify the identity of the terminal user, and only legal users are allowed to have the right to decrypt and use. Users who have passed the identity authentication call the service and enter the original spatial coordinates. After verification and processing, the encrypted output result is returned to the user. After the user uses the symmetric key to decrypt, a secure call of the service is completed. The main technical process is as follows.

[0049] Access the interface in a secure manner and adopt a variety of secure access methods.

[0050] When the PC terminal uses USBKey and digital certificate, the digital certificate is generated by the digital certificate authentication system, and the digital certificate is stored in the USBKey; the digital certificate is used to verify the user identity of the geographic data processing system requesting the client. For desktop PC terminals that have already used or are preparing to use USBKey+digital certificates, according to the principle of basic co-construction and centralized and intensive construction, the existing USBKey+digital certificate method is reused, and the digital certificate authentication system is used to provide digital certificate generation and management services. The USBKey that has passed the test is used as a secure storage medium for user private keys and digital certificates. Deploy password security access components on desktop PC terminals, combined with a secure authentication gateway, to implement password-based multi-factor security access authentication to meet password application compliance requirements.

[0051] When the PC terminal does not use USBKey and digital certificate, the QR code generated by the PC terminal is scanned through the mobile terminal. The collaborative signature technology is used between the mobile terminal and the PC terminal, and the user identity of the requesting client is verified in combination with the security authentication gateway and collaborative signature system deployed by the server. For desktop PC terminals that do not use USBKey+signature private key, the mobile collaborative signature + PC QR code scanning method is adopted. The QR code (user identity information) generated by the desktop PC terminal is scanned through the APP on the mobile terminal. In combination with the deployed security authentication gateway and collaborative signature system, the physical smart password key (USBKey) is replaced by the mobile terminal. Under the premise of meeting the compliance requirements of password applications, identity authentication and secure access based on cryptographic technology are realized when the terminal has no dedicated hardware. The mobile terminal is specifically a mobile phone.

[0052] In terms of verifying the user identity of the requesting client, the PC terminal is specifically used to verify the user identity of the requesting client by adopting a challenge-response authentication mechanism.

[0053] The security of authentication in this embodiment is mainly based on the challenge / response security protocol, which uses a key to authenticate the identity of the logged-in user. This protocol is mainly used to improve the security of the username / password authentication method. The username / password-based authentication method is extremely vulnerable to attacks such as Trojans and password dictionaries. The challenge / response authentication method based on a public-private key pair is extremely secure and can resist the above attacks.

[0054] This embodiment uses challenge / response technology to authenticate the business system and users, and realizes security authentication based on commercial cryptographic technology (national secret algorithm technology).

[0055] The challenge-response authentication protocol verifies the identity of the client through three interactive processes.

[0056] (1) When a visitor needs to identify himself to the authenticator, the authenticator (provided by the server) sends a random challenge message to the visitor (client).

[0057] (2) After receiving the challenge message, the visitor uses the signature challenge value of his own private key to generate a response value.

[0058] (3) The authenticator verifies the visitor's identity based on the visitor's signature information on the challenge value in the response value. If the signature verification is correct, the identity is confirmed; otherwise, the visit request should be terminated.

[0059] The basic process of key exchange in this embodiment is that the client initiates an authenticated key exchange protocol, and the server responds accordingly to the request. After successfully completing an authenticated key exchange protocol, the relevant algorithms required by the recording protocol are determined and relevant secret information is generated.

[0060] In this process, the client assumes that the server can support the cryptographic algorithm (symmetric algorithm, digest algorithm and data encapsulation method) and key exchange authentication protocol selected by the client. The client initiates an authenticated key exchange protocol, specifies the symmetric algorithm, digest algorithm, data encapsulation mechanism, key exchange authentication protocol in the client request (client_request) message, and carries the relevant protocol data of the initiator required in the selected key exchange authentication protocol in the message.

[0061] After receiving the client_request message, the server determines that it can support the relevant algorithms and protocols specified by the client, and returns the relevant protocol data of the responder according to the key exchange authentication protocol. The server generates the negotiated secret information. If the protocol allows and the recipient requires, the server response (server_response) can carry the server's explicit authentication information.

[0062] The types of data in geographic data are diverse and complex, including structured and unstructured types. Many data are cross-basin and cross-provincial. The more concentrated the high-value data is, the more likely it is to face security risks. In the entire life cycle of data collection, transmission, storage, management, analysis, publication, use, and destruction, the protection of the data itself is insufficient. There is a problem of insufficient data security defense-in-depth capability and failure to fully meet the requirements of laws and regulations. Therefore, it is necessary to further strengthen the spatial scope verification.

[0063] The specified spatial range is pre-entered (information that has been written into the system before co-compilation). When the input coordinates to be processed are not within the range after verification, the input data is judged as invalid input. The main technical process is as follows:

[0064] (1) Before executing the spatial coordinate conversion operation, the system will determine in advance whether the currently input coordinates to be processed are within the pre-entered range. If they are within the range, the system will continue to execute and return the encrypted result. If they are not within the pre-set range, the system will terminate the decryption operation and return an error code.

[0065] (2) By verifying the scope, the scope and objects used for matching processing can be effectively controlled, malicious attacks through data matching can be prevented, and the security of the geographic data processing system can be effectively protected.

[0066] This embodiment also includes traffic verification. Traffic verification analysis refers to the process of collecting and analyzing system data packets (coordinate data to be processed submitted by the client) to obtain various information about the system. Traffic verification plays an important role in the management, network security, and network optimization of the system. Abnormal detection and early warning in traffic verification analysis are an indispensable part of the analysis. The main technical process is as follows:

[0067] (1) By analyzing the amount of data transmitted over the network over a period of time, we can understand network usage, the number of network connections, and the network end communication mode. By monitoring the network end traffic in real time, we can detect abnormal situations in the network, such as malicious attacks, network congestion, etc., and predict the future development trend of the network.

[0068] In traffic verification and analysis, anomaly detection is very important. Anomaly detection refers to finding network traffic behaviors that are inconsistent with normal conditions through statistical analysis and pattern recognition of network traffic data. It can help discover abnormal behaviors in the network, including malicious attack virus propagation, DDoS attacks, etc. By detecting abnormal behaviors, corresponding measures can be taken in time to protect the security of the network. Anomaly detection is achieved by judging the frequency and location of input data. For example, if the frequency of input data is higher than the set frequency, it is abnormal behavior.

[0069] (2) In traffic verification and analysis, early warning is a mechanism that sends alarms in a timely manner to remind administrators or relevant personnel to pay attention to abnormal network behavior. The early warning system can detect abnormal network behavior by analyzing and judging traffic data, and issue an alarm when abnormal behavior is found. The early warning system can help administrators take timely measures to avoid network security incidents. For example, when a large number of requests from different addresses are found, it may be an attack by a computer virus. The early warning system can issue an alarm and the administrator can troubleshoot the problem in a timely manner.

[0070] (3) The number of spatial coordinate conversions to be performed per unit time is pre-set. When the number of request processing times exceeds the specified frequency, it is judged as a malicious call and no response is given.

[0071] (4) The system traffic verification module calculates the number of confidentiality processing operations performed per unit time in real time based on the parameters pre-set in the system, and calculates the request frequency. If the number of processing operations performed per unit time exceeds the pre-set number, the current data processing operation is terminated and a warning message is returned, and subsequent data processing requests are not executed.

[0072] The spatial coordinate conversion algorithm is an independent program; the server cryptographic machine is an independent hardware and software integrated device based on the cryptographic algorithm, which has been tested and certified. The present application discloses a geographic data processing system based on cryptographic technology, which integrates the spatial coordinate conversion algorithm and the cryptographic machine into a hardware and software whole, and the coordinate conversion algorithm is protected by the server cryptographic machine as a whole.

[0073] The security of the geographic data processing system based on cryptographic technology in this application is embodied in three aspects: 1. static program security; 2. dynamic operation process security; 3. access security of client program calling spatial coordinate conversion algorithm.

[0074] The first aspect: the spatial coordinate conversion algorithm is combined with the underlying software of the cryptographic machine to form a new executable program (operating system + cryptographic business software + spatial coordinate conversion algorithm software), which is deployed on the cryptographic machine hardware.

[0075] Linking is an external software processing process, and the final result is deployed to the server cryptographic machine (server side) and becomes a function on the server cryptographic machine. Linking only needs to be done once, and the result is deployed to the server cryptographic machine to provide secure access support for the client.

[0076] The second aspect: security protection based on password servers.

[0077] 1) Anti-tampering: Hardware encryption uses a dedicated encryption chip or hardware module for encryption, which is difficult to tamper with or replace. In contrast, software encryption is vulnerable to attack and tampering because they rely on computer systems and application software, which hackers can attack through vulnerabilities and malware.

[0078] 2) Protecting keys: Hardware encryption stores keys inside a secure chip, which is difficult to steal or attack. However, software encryption keys are usually stored in computer systems and are easily stolen by hackers.

[0079] 3) High encryption strength: Hardware encryption usually uses advanced encryption algorithms and key management mechanisms to provide stronger encryption strength and security. Although software encryption can also implement advanced encryption algorithms, it is more susceptible to various attacks and vulnerabilities than hardware encryption:

[0080] 4) Real-time: Hardware encryption can provide real-time data encryption and decryption functions, which is suitable for application scenarios that require real-time response. Software encryption may take a certain amount of time to process encryption and decryption requests.

[0081] 5) Reliability: The reliability and stability of hardware encryption are usually higher than those of software encryption. Since hardware encryption uses a dedicated hardware module for encryption, it is not easily affected by computer system failures or viruses. Software encryption may be affected by computer system failures or viruses, reducing its reliability and stability.

[0082] The third aspect: client access security.

[0083] First of all, the server password machine can verify the identity of the server access user, ensuring that only authorized users can access the server and protect the security of the server. With the help of the server password machine, the administrator can limit the intrusion and attack of outsiders or malicious hackers by setting security measures such as usernames and passwords.

[0084] Secondly, the server password machine can perform security control and management on user login to ensure the security of user login. When the user logs in, the server password machine can encrypt the password entered by the user to prevent the password from being maliciously stolen or cracked. At the same time, the server password machine can also record the user login status and operation behavior to facilitate auditing and log management.

[0085] In addition, the server cipher can also be used to encrypt sensitive data stored on the server to ensure the confidentiality of the data. By encrypting the data, even if the server is attacked or the data is leaked, hackers cannot directly obtain the true content of the data, thereby better protecting the security of the data.

[0086] To sum up, server cryptographic machines play an important role in maintaining server security, managing user logins, protecting confidential data, etc., and can improve network security performance and ensure network security.

[0087] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0088] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A geographic data processing system based on cryptographic technology, characterized in that: include: Server and client side; The server end includes a hardware device burned with a binary unit and a message authentication code of the binary unit; The binary unit is generated by jointly compiling the source code processed by the spatial coordinate conversion algorithm and the source code of at least one cryptographic algorithm, and the binary unit includes a spatial coordinate conversion interface and an encryption interface; the message authentication code of the binary unit formed by the joint compilation is calculated by the HMAC-SM3 algorithm and burned into the hardware device together with the binary unit; the client includes an identity authentication interface, an integrity verification interface and a decryption interface; Based on the spatial coordinate conversion interface, encryption interface, identity authentication interface, integrity verification interface and decryption interface, the server and the client jointly complete the security protection of input and output geographic data based on cryptographic technology. The geographic data completes spatial coordinate conversion and encryption processing on the server, and returns the encryption processing result to the client for decryption processing; The server side also includes a space coordinate conversion unit; the space coordinate conversion unit is used to provide the space coordinate conversion interface; the space coordinate conversion unit is used to complete the conversion from the original space coordinate to the deflected coordinate, obtain the processing result after the coordinate conversion, and call the SM4 algorithm through the encryption interface to symmetrically encrypt the processing result after the coordinate conversion to obtain the encrypted processing result; the space coordinate conversion unit is also used to calculate the message authentication code of the encrypted processing result by calling the HMAC-SM3 algorithm in the message authentication code encryption unit; The server side also includes a message authentication code encryption unit, which is used to encrypt the binary unit or the encryption processing result using the HMAC-SM3 algorithm to obtain a message authentication code for the binary unit or the encryption processing result; The server is also used to perform consistency detection between the message authentication code of the binary unit and the message authentication code built into the binary unit when powered on and started. If the consistency detection fails, a reminder is given that the consistency detection fails, and the startup program is stopped; The server side also includes a range verification unit, which is used to determine whether the received requested geographic data is within a pre-entered range, and if so, perform coordinate conversion processing on the requested geographic data, return the encryption processing result and the corresponding message authentication code, and if not, return an error code; The number of spatial coordinate conversions to be performed per unit time is pre-set. When the number of request processing times exceeds the specified frequency, it is judged as a malicious call and no response is given. The client includes a PC terminal, and the PC terminal is used for identity authentication; When the PC terminal uses USBKey and digital certificate, the digital certificate is generated by a digital certificate authentication system, and the digital certificate is stored in the USBKey; The digital certificate is used to verify the user identity of the requesting client; When the PC terminal does not use USBKey and digital certificate, the QR code generated by the PC terminal is scanned by the mobile terminal, and the collaborative signature technology is adopted between the mobile terminal and the PC terminal. The user identity of the requesting client is verified according to the security authentication gateway and collaborative signature system deployed on the server side; the QR code is used to represent the user identity information.

2. The cryptographic-based geographic data processing system according to claim 1, characterized in that: The cryptographic algorithms include SM3 algorithm and SM4 algorithm.

3. The cryptographic-based geographic data processing system according to claim 1, characterized in that: The client comprises a data integrity verification unit; the data integrity verification unit is used to provide the integrity verification interface; The data integrity verification unit is used to receive the encryption processing result and the message authentication code of the encryption processing result transmitted by the server when calling the encryption interface, and encrypt the received encryption processing result using the HMAC-SM3 algorithm to obtain the message authentication code of the client; Determine whether the message authentication code calculated by the client is equal to the message authentication code returned by the server-side encryption interface. If so, the data is complete; otherwise, the data is incomplete.

4. The cryptographic-based geographic data processing system according to claim 1, characterized in that: In terms of verifying the user identity of the requesting client, the PC terminal is specifically used to verify the user identity of the requesting client using a challenge response authentication mechanism.

Images